From 5eb163bc0370016873b7f629068eed7ec12dee9b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Oct 2004 20:21:14 +0000
Subject: [PATCH 002/549] Initial revision

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@2 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban         | 151 +++++++++++++++++
 log-test/current |   4 +
 log-test/test    | 431 +++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 586 insertions(+)
 create mode 100755 fail2ban
 create mode 100644 log-test/current
 create mode 100644 log-test/test

diff --git a/fail2ban b/fail2ban
new file mode 100755
index 00000000..2936021a
--- /dev/null
+++ b/fail2ban
@@ -0,0 +1,151 @@
+#!/usr/bin/env python
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+import posix,sys,os
+import string,re,time
+
+def checkForRoot():
+	""" Check for root user.
+	"""
+	uid = `posix.getuid()`
+	if uid == '0':
+		return True
+	else:
+		return False
+
+def executeCmd(cmd):
+	return #os.system(cmd)
+
+def unBanIP(ip):
+	iptables = 'iptables -D INPUT -i eth0 -s '+ip+' -j DROP'
+	executeCmd(iptables)
+	print iptables
+
+def banIP(ip):
+	iptables = 'iptables -I INPUT 1 -i eth0 -s '+ip+' -j DROP'
+	executeCmd(iptables)
+	print iptables
+
+def checkForUnBan(banList, currentTime, banTime):
+	""" Check for user to remove from ban list.
+	"""
+	iterBanList = banList.iteritems()
+	for i in range(len(banList)):
+		element = iterBanList.next()
+		ip = element[0]
+		btime = element[1]
+		if btime < currentTime-banTime:
+			del banList[ip]
+			unBanIP(ip)
+			print '`->', currentTime
+	return banList
+
+def checkForBan(retryList, banList, currentTime):
+	iterRetry = retryList.iteritems()
+	for i in range(len(retryList)):
+		element = iterRetry.next()
+		retry = element[1][0]
+		ip = element[0]
+		if element[1][0] > 2 and not banList.has_key(ip):
+			banList[ip] = currentTime
+			banIP(ip)
+			print '`->', currentTime
+	return banList
+
+def flushBanList(banList):
+	iterBanList = banList.iteritems()
+	for i in range(len(banList)):
+		element = iterBanList.next()
+		ip = element[0]
+		unBanIP(ip)
+
+def parseLogLine(line):
+	""" Match sshd failed password log
+	"""
+	if re.search("Failed password", line):
+		matchIP = re.search("(?:\d{1,3}\.){3}\d{1,3}", line)
+		return matchIP
+
+if __name__ == "__main__":
+	
+	if not checkForRoot():
+		print "You must be root."
+		#sys.exit(-1)
+	
+	logPath = './log/temp'
+	banTime = 60
+	ignoreIPs = '127.0.0.1'
+	
+	lastModTime = 0
+	banList = dict()
+	while True:
+		try:
+			currentTime = time.time()
+			
+			banList = checkForUnBan(banList, currentTime, banTime)
+			
+			try:
+				pwdFailStats = os.stat(logPath)
+			except OSError:
+				print "Unable to get stat on", logPath
+				sys.exit(-1)
+			
+			if lastModTime == pwdFailStats.st_mtime:
+				time.sleep(1)
+				continue
+			
+			print logPath, 'has been modified'
+			lastModTime = pwdFailStats.st_mtime
+			
+			try:
+				pwdfail = open(logPath)
+			except OSError:
+				print "Unable to open", logPath
+				sys.exit(-1)
+			
+			retryList = dict()
+			for line in pwdfail.readlines():
+				match = parseLogLine(line)
+				if match:
+					ip = match.group()
+					date = list(time.strptime(line[0:15], "%b %d %H:%M:%S"))
+					date[0] = time.gmtime()[0]
+					unixTime = time.mktime(date)
+					if unixTime < currentTime-banTime:
+						continue
+					if re.search(ip, ignoreIPs):
+						print 'Ignore ', ip
+						continue
+					print 'Found', ip, 'at', unixTime
+					if retryList.has_key(`ip`):
+						retryList[`ip`] = (retryList[`ip`][0]+1,unixTime)
+					else:
+						retryList[`ip`] = (1,unixTime)
+		
+			pwdfail.close()
+		
+			banList = checkForBan(retryList, banList, currentTime)
+		except KeyboardInterrupt:
+			print 'Restoring iptables...'
+			flushBanList(banList)
+			print 'Exiting...'
+			sys.exit(0)
diff --git a/log-test/current b/log-test/current
new file mode 100644
index 00000000..6537a6aa
--- /dev/null
+++ b/log-test/current
@@ -0,0 +1,4 @@
+                - Last output repeated 2 times -
+Oct  7 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
+Oct  7 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
+Oct  7 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
diff --git a/log-test/test b/log-test/test
new file mode 100644
index 00000000..81e0e87f
--- /dev/null
+++ b/log-test/test
@@ -0,0 +1,431 @@
+Sep 28 13:18:43 [sshd] Failed password for illegal user test from 211.112.229.69 port 59506 ssh2
+Sep 28 13:18:45 [sshd] Failed password for illegal user guest from 211.112.229.69 port 59584 ssh2
+Sep 28 13:18:48 [sshd] Failed password for illegal user admin from 211.112.229.69 port 59668 ssh2
+Sep 28 13:18:51 [sshd] Failed password for illegal user admin from 211.112.229.69 port 59746 ssh2
+Sep 28 13:18:54 [sshd] Failed password for illegal user user from 211.112.229.69 port 59809 ssh2
+Sep 28 13:18:57 [sshd] Failed password for illegal user root from 211.112.229.69 port 59881 ssh2
+Sep 28 13:19:00 [sshd] Failed password for illegal user root from 211.112.229.69 port 59944 ssh2
+Sep 28 13:19:03 [sshd] Failed password for illegal user root from 211.112.229.69 port 59999 ssh2
+Sep 28 13:19:06 [sshd] Failed password for illegal user test from 211.112.229.69 port 60055 ssh2
+Sep 28 21:05:25 [sshd(pam_unix)] authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.128.local.home  user=cyril
+Sep 28 21:05:27 [sshd] error: PAM: Authentication failure for cyril from 192.168.0.128.local.home
+Sep 29 03:45:18 [sshd] Failed password for illegal user nobody from 203.198.168.66 port 55927 ssh2
+Sep 29 03:45:21 [sshd] Failed password for illegal user patrick from 203.198.168.66 port 55973 ssh2
+Sep 29 03:45:23 [sshd] Failed password for illegal user patrick from 203.198.168.66 port 56010 ssh2
+Sep 29 03:45:26 [sshd] Failed password for illegal user root from 203.198.168.66 port 56060 ssh2
+Sep 29 03:45:29 [sshd] Failed password for illegal user root from 203.198.168.66 port 56107 ssh2
+Sep 29 03:45:32 [sshd] Failed password for illegal user root from 203.198.168.66 port 56152 ssh2
+Sep 29 03:45:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 56200 ssh2
+Sep 29 03:45:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 56243 ssh2
+Sep 29 03:45:40 [sshd] Failed password for illegal user rolo from 203.198.168.66 port 56288 ssh2
+Sep 29 03:45:43 [sshd] Failed password for illegal user iceuser from 203.198.168.66 port 56333 ssh2
+Sep 29 03:45:46 [sshd] Failed password for illegal user horde from 203.198.168.66 port 56379 ssh2
+Sep 29 03:45:48 [sshd] Failed password for illegal user cyrus from 203.198.168.66 port 56425 ssh2
+Sep 29 03:45:52 [sshd] Failed password for illegal user www from 203.198.168.66 port 56470 ssh2
+Sep 29 03:45:55 [sshd] Failed password for illegal user wwwrun from 203.198.168.66 port 56534 ssh2
+Sep 29 03:45:58 [sshd] Failed password for illegal user matt from 203.198.168.66 port 56572 ssh2
+Sep 29 03:46:01 [sshd] Failed password for illegal user test from 203.198.168.66 port 56616 ssh2
+Sep 29 03:46:03 [sshd] Failed password for illegal user test from 203.198.168.66 port 56660 ssh2
+Sep 29 03:46:06 [sshd] Failed password for illegal user test from 203.198.168.66 port 56704 ssh2
+Sep 29 03:46:09 [sshd] Failed password for illegal user test from 203.198.168.66 port 56752 ssh2
+Sep 29 03:46:12 [sshd] Failed password for illegal user www-data from 203.198.168.66 port 56795 ssh2
+Sep 29 03:46:15 [sshd] Failed password for illegal user mysql from 203.198.168.66 port 56839 ssh2
+Sep 29 03:46:17 [sshd] Failed password for illegal user operator from 203.198.168.66 port 56882 ssh2
+Sep 29 03:46:20 [sshd] Failed password for illegal user adm from 203.198.168.66 port 56929 ssh2
+Sep 29 03:46:23 [sshd] Failed password for illegal user apache from 203.198.168.66 port 56971 ssh2
+Sep 29 03:46:26 [sshd] Failed password for illegal user irc from 203.198.168.66 port 57011 ssh2
+Sep 29 03:46:29 [sshd] Failed password for illegal user irc from 203.198.168.66 port 57060 ssh2
+Sep 29 03:46:31 [sshd] Failed password for illegal user adm from 203.198.168.66 port 57100 ssh2
+Sep 29 03:46:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 57148 ssh2
+Sep 29 03:46:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 57194 ssh2
+Sep 29 03:46:40 [sshd] Failed password for illegal user root from 203.198.168.66 port 57236 ssh2
+Sep 29 03:46:43 [sshd] Failed password for illegal user jane from 203.198.168.66 port 57281 ssh2
+Sep 29 03:46:45 [sshd] Failed password for illegal user pamela from 203.198.168.66 port 57328 ssh2
+Sep 29 03:46:48 [sshd] Failed password for illegal user root from 203.198.168.66 port 57372 ssh2
+Sep 29 03:46:51 [sshd] Failed password for illegal user root from 203.198.168.66 port 57418 ssh2
+Sep 29 03:46:54 [sshd] Failed password for illegal user root from 203.198.168.66 port 57463 ssh2
+Sep 29 03:46:57 [sshd] Failed password for illegal user root from 203.198.168.66 port 57506 ssh2
+Sep 29 03:46:59 [sshd] Failed password for illegal user root from 203.198.168.66 port 57549 ssh2
+Sep 29 03:47:02 [sshd] Failed password for illegal user cosmin from 203.198.168.66 port 57594 ssh2
+Sep 29 03:47:05 [sshd] Failed password for illegal user root from 203.198.168.66 port 57637 ssh2
+Sep 29 03:47:08 [sshd] Failed password for illegal user root from 203.198.168.66 port 57689 ssh2
+Sep 29 03:47:11 [sshd] Failed password for illegal user root from 203.198.168.66 port 57730 ssh2
+Sep 29 03:47:13 [sshd] Failed password for illegal user root from 203.198.168.66 port 57774 ssh2
+Sep 29 03:47:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 57820 ssh2
+Sep 29 03:47:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 57866 ssh2
+Sep 29 03:47:22 [sshd] Failed password for illegal user root from 203.198.168.66 port 57901 ssh2
+Sep 29 03:47:25 [sshd] Failed password for illegal user root from 203.198.168.66 port 57944 ssh2
+Sep 29 03:47:27 [sshd] Failed password for illegal user root from 203.198.168.66 port 57990 ssh2
+Sep 29 03:47:31 [sshd] Failed password for illegal user root from 203.198.168.66 port 58031 ssh2
+Sep 29 03:47:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 58098 ssh2
+Sep 29 03:47:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 58137 ssh2
+Sep 29 03:47:40 [sshd] Failed password for illegal user root from 203.198.168.66 port 58183 ssh2
+Sep 29 03:47:42 [sshd] Failed password for illegal user root from 203.198.168.66 port 58228 ssh2
+Sep 29 03:47:45 [sshd] Failed password for illegal user root from 203.198.168.66 port 58273 ssh2
+Sep 29 03:47:48 [sshd] Failed password for illegal user root from 203.198.168.66 port 58314 ssh2
+Sep 29 03:47:51 [sshd] Failed password for illegal user root from 203.198.168.66 port 58358 ssh2
+Sep 29 03:47:54 [sshd] Failed password for illegal user root from 203.198.168.66 port 58401 ssh2
+Sep 29 03:47:56 [sshd] Failed password for illegal user root from 203.198.168.66 port 58443 ssh2
+Sep 29 03:47:59 [sshd] Failed password for illegal user root from 203.198.168.66 port 58484 ssh2
+Sep 29 03:48:02 [sshd] Failed password for illegal user root from 203.198.168.66 port 58528 ssh2
+Sep 29 03:48:05 [sshd] Failed password for illegal user root from 203.198.168.66 port 58574 ssh2
+Sep 29 03:48:07 [sshd] Failed password for illegal user root from 203.198.168.66 port 58613 ssh2
+Sep 29 03:48:10 [sshd] Failed password for illegal user root from 203.198.168.66 port 58662 ssh2
+Sep 29 03:48:13 [sshd] Failed password for illegal user root from 203.198.168.66 port 58703 ssh2
+Sep 29 03:48:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 58748 ssh2
+Sep 29 03:48:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 58792 ssh2
+Sep 29 03:48:21 [sshd] Failed password for illegal user root from 203.198.168.66 port 58839 ssh2
+Sep 29 03:48:24 [sshd] Failed password for illegal user root from 203.198.168.66 port 58880 ssh2
+Sep 29 03:48:27 [sshd] Failed password for illegal user root from 203.198.168.66 port 58926 ssh2
+Sep 29 03:48:30 [sshd] Failed password for illegal user root from 203.198.168.66 port 58967 ssh2
+Sep 29 03:48:33 [sshd] Failed password for illegal user root from 203.198.168.66 port 59012 ssh2
+Sep 29 03:48:35 [sshd] Failed password for illegal user root from 203.198.168.66 port 59052 ssh2
+Sep 29 03:48:38 [sshd] Failed password for illegal user root from 203.198.168.66 port 59095 ssh2
+Sep 29 03:48:41 [sshd] Failed password for illegal user root from 203.198.168.66 port 59140 ssh2
+Sep 29 03:48:44 [sshd] Failed password for illegal user root from 203.198.168.66 port 59182 ssh2
+Sep 29 03:48:47 [sshd] Failed password for illegal user cip52 from 203.198.168.66 port 59222 ssh2
+Sep 29 03:48:49 [sshd] Failed password for illegal user cip51 from 203.198.168.66 port 59264 ssh2
+Sep 29 03:48:52 [sshd] Failed password for illegal user root from 203.198.168.66 port 59309 ssh2
+Sep 29 03:48:55 [sshd] Failed password for illegal user noc from 203.198.168.66 port 59351 ssh2
+Sep 29 03:48:58 [sshd] Failed password for illegal user root from 203.198.168.66 port 59395 ssh2
+Sep 29 03:49:01 [sshd] Failed password for illegal user root from 203.198.168.66 port 59432 ssh2
+Sep 29 03:49:04 [sshd] Failed password for illegal user root from 203.198.168.66 port 59479 ssh2
+Sep 29 03:49:07 [sshd] Failed password for illegal user root from 203.198.168.66 port 59951 ssh2
+Sep 29 03:49:11 [sshd] Failed password for illegal user webmaster from 203.198.168.66 port 60006 ssh2
+Sep 29 03:49:14 [sshd] Failed password for illegal user data from 203.198.168.66 port 60463 ssh2
+Sep 29 03:49:17 [sshd] Failed password for illegal user user from 203.198.168.66 port 60880 ssh2
+Sep 29 03:49:20 [sshd] Failed password for illegal user user from 203.198.168.66 port 60947 ssh2
+Sep 29 03:49:23 [sshd] Failed password for illegal user user from 203.198.168.66 port 33137 ssh2
+Sep 29 03:49:26 [sshd] Failed password for illegal user web from 203.198.168.66 port 33572 ssh2
+Sep 29 03:49:31 [sshd] Failed password for illegal user web from 203.198.168.66 port 33630 ssh2
+Sep 29 03:49:34 [sshd] Failed password for illegal user oracle from 203.198.168.66 port 34129 ssh2
+Sep 29 03:49:39 [sshd] Failed password for illegal user sybase from 203.198.168.66 port 34558 ssh2
+Sep 29 03:49:42 [sshd] Failed password for illegal user master from 203.198.168.66 port 35018 ssh2
+Sep 29 03:49:45 [sshd] Failed password for illegal user account from 203.198.168.66 port 35095 ssh2
+Sep 29 03:49:48 [sshd] Failed password for illegal user backup from 203.198.168.66 port 35506 ssh2
+Sep 29 03:49:51 [sshd] Failed password for illegal user server from 203.198.168.66 port 35935 ssh2
+Sep 29 03:49:54 [sshd] Failed password for illegal user adam from 203.198.168.66 port 36016 ssh2
+Sep 29 03:49:57 [sshd] Failed password for illegal user alan from 203.198.168.66 port 36399 ssh2
+Sep 29 03:49:59 [sshd] Failed password for illegal user frank from 203.198.168.66 port 36488 ssh2
+Sep 29 03:50:04 [sshd] Failed password for illegal user george from 203.198.168.66 port 36876 ssh2
+Sep 29 03:50:07 [sshd] Failed password for illegal user henry from 203.198.168.66 port 37333 ssh2
+Sep 29 03:50:11 [sshd] Failed password for illegal user john from 203.198.168.66 port 37423 ssh2
+Sep 29 03:50:14 [sshd] Failed password for illegal user root from 203.198.168.66 port 37837 ssh2
+Sep 29 03:50:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 38210 ssh2
+Sep 29 03:50:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 38286 ssh2
+Sep 29 03:50:22 [sshd] Failed password for illegal user root from 203.198.168.66 port 38653 ssh2
+Sep 29 03:50:26 [sshd] Failed password for illegal user root from 203.198.168.66 port 38749 ssh2
+Sep 29 03:50:29 [sshd] Failed password for illegal user test from 203.198.168.66 port 39162 ssh2
+Sep 29 10:19:26 [sshd] Failed password for illegal user test from 24.19.0.105 port 3765 ssh2
+Sep 29 10:19:32 [sshd] Failed password for illegal user guest from 24.19.0.105 port 3846 ssh2
+Sep 29 10:19:39 [sshd] Failed password for illegal user admin from 24.19.0.105 port 3929 ssh2
+Sep 29 10:19:45 [sshd] Failed password for illegal user admin from 24.19.0.105 port 3992 ssh2
+Sep 29 10:19:49 [sshd] Failed password for illegal user user from 24.19.0.105 port 4057 ssh2
+Sep 29 10:19:54 [sshd] Failed password for illegal user root from 24.19.0.105 port 4115 ssh2
+Sep 29 10:19:58 [sshd] Failed password for illegal user root from 24.19.0.105 port 4170 ssh2
+Sep 29 10:20:01 [sshd] Failed password for illegal user root from 24.19.0.105 port 4202 ssh2
+Sep 29 10:20:04 [sshd] Failed password for illegal user test from 24.19.0.105 port 4242 ssh2
+Oct  1 15:53:46 [sshd] Failed password for illegal user test from 210.51.173.75 port 40940 ssh2
+Oct  1 15:53:53 [sshd] Failed password for illegal user guest from 210.51.173.75 port 41196 ssh2
+Oct  1 15:53:59 [sshd] Failed password for illegal user admin from 210.51.173.75 port 41480 ssh2
+Oct  1 15:54:05 [sshd] Failed password for illegal user admin from 210.51.173.75 port 41738 ssh2
+Oct  1 15:54:12 [sshd] Failed password for illegal user user from 210.51.173.75 port 42036 ssh2
+Oct  1 15:54:18 [sshd] Failed password for illegal user root from 210.51.173.75 port 42393 ssh2
+Oct  1 15:54:24 [sshd] Failed password for illegal user root from 210.51.173.75 port 42721 ssh2
+Oct  1 15:54:30 [sshd] Failed password for illegal user root from 210.51.173.75 port 42984 ssh2
+Oct  1 15:54:36 [sshd] Failed password for illegal user test from 210.51.173.75 port 43299 ssh2
+Oct  2 20:24:36 [sshd] Failed password for illegal user test from 220.64.223.249 port 2460 ssh2
+Oct  2 20:24:39 [sshd] Failed password for illegal user guest from 220.64.223.249 port 2527 ssh2
+Oct  2 20:24:42 [sshd] Failed password for illegal user admin from 220.64.223.249 port 2584 ssh2
+Oct  2 20:24:45 [sshd] Failed password for illegal user admin from 220.64.223.249 port 2645 ssh2
+Oct  2 20:24:48 [sshd] Failed password for illegal user user from 220.64.223.249 port 2708 ssh2
+Oct  2 20:24:51 [sshd] Failed password for illegal user root from 220.64.223.249 port 2794 ssh2
+Oct  2 20:24:54 [sshd] Failed password for illegal user root from 220.64.223.249 port 2868 ssh2
+Oct  2 20:24:58 [sshd] Failed password for illegal user root from 220.64.223.249 port 2931 ssh2
+Oct  2 20:25:01 [sshd] Failed password for illegal user test from 220.64.223.249 port 2994 ssh2
+Oct  3 02:17:47 [sshd] Failed password for illegal user nobody from 216.65.197.170 port 54324 ssh2
+Oct  3 02:17:48 [sshd] Failed password for illegal user patrick from 216.65.197.170 port 54491 ssh2
+Oct  3 02:17:50 [sshd] Failed password for illegal user patrick from 216.65.197.170 port 54669 ssh2
+Oct  3 02:17:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 54845 ssh2
+Oct  3 02:17:53 [sshd] Failed password for illegal user root from 216.65.197.170 port 55021 ssh2
+Oct  3 02:17:55 [sshd] Failed password for illegal user root from 216.65.197.170 port 55201 ssh2
+Oct  3 02:17:57 [sshd] Failed password for illegal user root from 216.65.197.170 port 55381 ssh2
+Oct  3 02:17:59 [sshd] Failed password for illegal user root from 216.65.197.170 port 55553 ssh2
+Oct  3 02:18:00 [sshd] Failed password for illegal user rolo from 216.65.197.170 port 55730 ssh2
+Oct  3 02:18:02 [sshd] Failed password for illegal user iceuser from 216.65.197.170 port 55892 ssh2
+Oct  3 02:18:04 [sshd] Failed password for illegal user horde from 216.65.197.170 port 56054 ssh2
+Oct  3 02:18:05 [sshd] Failed password for illegal user cyrus from 216.65.197.170 port 56231 ssh2
+Oct  3 02:18:07 [sshd] Failed password for illegal user www from 216.65.197.170 port 56412 ssh2
+Oct  3 02:18:09 [sshd] Failed password for illegal user wwwrun from 216.65.197.170 port 56594 ssh2
+Oct  3 02:18:11 [sshd] Failed password for illegal user matt from 216.65.197.170 port 56755 ssh2
+Oct  3 02:18:12 [sshd] Failed password for illegal user test from 216.65.197.170 port 56928 ssh2
+Oct  3 02:18:14 [sshd] Failed password for illegal user test from 216.65.197.170 port 57112 ssh2
+Oct  3 02:18:16 [sshd] Failed password for illegal user test from 216.65.197.170 port 57292 ssh2
+Oct  3 02:18:17 [sshd] Failed password for illegal user test from 216.65.197.170 port 57465 ssh2
+Oct  3 02:18:19 [sshd] Failed password for illegal user www-data from 216.65.197.170 port 57631 ssh2
+Oct  3 02:18:21 [sshd] Failed password for illegal user mysql from 216.65.197.170 port 57802 ssh2
+Oct  3 02:18:22 [sshd] Failed password for illegal user operator from 216.65.197.170 port 57989 ssh2
+Oct  3 02:18:24 [sshd] Failed password for illegal user adm from 216.65.197.170 port 58151 ssh2
+Oct  3 02:18:26 [sshd] Failed password for illegal user apache from 216.65.197.170 port 58319 ssh2
+Oct  3 02:18:28 [sshd] Failed password for illegal user irc from 216.65.197.170 port 58492 ssh2
+Oct  3 02:18:29 [sshd] Failed password for illegal user irc from 216.65.197.170 port 58662 ssh2
+Oct  3 02:18:31 [sshd] Failed password for illegal user adm from 216.65.197.170 port 58818 ssh2
+Oct  3 02:18:33 [sshd] Failed password for illegal user root from 216.65.197.170 port 58976 ssh2
+Oct  3 02:18:34 [sshd] Failed password for illegal user root from 216.65.197.170 port 59147 ssh2
+Oct  3 02:18:36 [sshd] Failed password for illegal user root from 216.65.197.170 port 59306 ssh2
+Oct  3 02:18:38 [sshd] Failed password for illegal user jane from 216.65.197.170 port 59474 ssh2
+Oct  3 02:18:40 [sshd] Failed password for illegal user pamela from 216.65.197.170 port 59644 ssh2
+Oct  3 02:18:41 [sshd] Failed password for illegal user root from 216.65.197.170 port 59797 ssh2
+Oct  3 02:18:43 [sshd] Failed password for illegal user root from 216.65.197.170 port 59963 ssh2
+Oct  3 02:18:45 [sshd] Failed password for illegal user root from 216.65.197.170 port 60139 ssh2
+Oct  3 02:18:47 [sshd] Failed password for illegal user root from 216.65.197.170 port 60308 ssh2
+Oct  3 02:18:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 60479 ssh2
+Oct  3 02:18:50 [sshd] Failed password for illegal user cosmin from 216.65.197.170 port 60654 ssh2
+Oct  3 02:18:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 60830 ssh2
+Oct  3 02:18:54 [sshd] Failed password for illegal user root from 216.65.197.170 port 60992 ssh2
+Oct  3 02:18:55 [sshd] Failed password for illegal user root from 216.65.197.170 port 32945 ssh2
+Oct  3 02:18:58 [sshd] Failed password for illegal user root from 216.65.197.170 port 33101 ssh2
+Oct  3 02:18:59 [sshd] Failed password for illegal user root from 216.65.197.170 port 33343 ssh2
+Oct  3 02:19:02 [sshd] Failed password for illegal user root from 216.65.197.170 port 33501 ssh2
+Oct  3 02:19:03 [sshd] Failed password for illegal user root from 216.65.197.170 port 33733 ssh2
+Oct  3 02:19:05 [sshd] Failed password for illegal user root from 216.65.197.170 port 33892 ssh2
+Oct  3 02:19:07 [sshd] Failed password for illegal user root from 216.65.197.170 port 34066 ssh2
+Oct  3 02:19:08 [sshd] Failed password for illegal user root from 216.65.197.170 port 34212 ssh2
+Oct  3 02:19:10 [sshd] Failed password for illegal user root from 216.65.197.170 port 34376 ssh2
+Oct  3 02:19:12 [sshd] Failed password for illegal user root from 216.65.197.170 port 34535 ssh2
+Oct  3 02:19:14 [sshd] Failed password for illegal user root from 216.65.197.170 port 34704 ssh2
+Oct  3 02:19:16 [sshd] Failed password for illegal user root from 216.65.197.170 port 34853 ssh2
+Oct  3 02:19:18 [sshd] Failed password for illegal user root from 216.65.197.170 port 35092 ssh2
+Oct  3 02:19:19 [sshd] Failed password for illegal user root from 216.65.197.170 port 35261 ssh2
+Oct  3 02:19:21 [sshd] Failed password for illegal user root from 216.65.197.170 port 35425 ssh2
+Oct  3 02:19:23 [sshd] Failed password for illegal user root from 216.65.197.170 port 35583 ssh2
+Oct  3 02:19:24 [sshd] Failed password for illegal user root from 216.65.197.170 port 35753 ssh2
+Oct  3 02:19:26 [sshd] Failed password for illegal user root from 216.65.197.170 port 35901 ssh2
+Oct  3 02:19:28 [sshd] Failed password for illegal user root from 216.65.197.170 port 36068 ssh2
+Oct  3 02:19:30 [sshd] Failed password for illegal user root from 216.65.197.170 port 36227 ssh2
+Oct  3 02:19:33 [sshd] Failed password for illegal user root from 216.65.197.170 port 36453 ssh2
+Oct  3 02:19:34 [sshd] Failed password for illegal user root from 216.65.197.170 port 36673 ssh2
+Oct  3 02:19:36 [sshd] Failed password for illegal user root from 216.65.197.170 port 36823 ssh2
+Oct  3 02:19:38 [sshd] Failed password for illegal user root from 216.65.197.170 port 36981 ssh2
+Oct  3 02:19:39 [sshd] Failed password for illegal user root from 216.65.197.170 port 37152 ssh2
+Oct  3 02:19:41 [sshd] Failed password for illegal user root from 216.65.197.170 port 37310 ssh2
+Oct  3 02:19:43 [sshd] Failed password for illegal user root from 216.65.197.170 port 37484 ssh2
+Oct  3 02:19:45 [sshd] Failed password for illegal user root from 216.65.197.170 port 37644 ssh2
+Oct  3 02:19:46 [sshd] Failed password for illegal user root from 216.65.197.170 port 37827 ssh2
+Oct  3 02:19:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 37989 ssh2
+Oct  3 02:19:50 [sshd] Failed password for illegal user root from 216.65.197.170 port 38163 ssh2
+Oct  3 02:19:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 38329 ssh2
+Oct  3 02:19:54 [sshd] Failed password for illegal user root from 216.65.197.170 port 38559 ssh2
+Oct  3 02:19:56 [sshd] Failed password for illegal user root from 216.65.197.170 port 38735 ssh2
+Oct  3 02:19:58 [sshd] Failed password for illegal user cip52 from 216.65.197.170 port 38893 ssh2
+Oct  3 02:20:00 [sshd] Failed password for illegal user cip51 from 216.65.197.170 port 39109 ssh2
+Oct  3 02:20:01 [sshd] Failed password for illegal user root from 216.65.197.170 port 39282 ssh2
+Oct  3 02:20:03 [sshd] Failed password for illegal user noc from 216.65.197.170 port 39448 ssh2
+Oct  3 02:20:05 [sshd] Failed password for illegal user root from 216.65.197.170 port 39621 ssh2
+Oct  3 02:20:06 [sshd] Failed password for illegal user root from 216.65.197.170 port 39781 ssh2
+Oct  3 02:20:08 [sshd] Failed password for illegal user root from 216.65.197.170 port 39958 ssh2
+Oct  3 02:20:10 [sshd] Failed password for illegal user root from 216.65.197.170 port 40125 ssh2
+Oct  3 02:20:12 [sshd] Failed password for illegal user webmaster from 216.65.197.170 port 40316 ssh2
+Oct  3 02:20:13 [sshd] Failed password for illegal user data from 216.65.197.170 port 40473 ssh2
+Oct  3 02:20:15 [sshd] Failed password for illegal user user from 216.65.197.170 port 40645 ssh2
+Oct  3 02:20:17 [sshd] Failed password for illegal user user from 216.65.197.170 port 40800 ssh2
+Oct  3 02:20:19 [sshd] Failed password for illegal user user from 216.65.197.170 port 40965 ssh2
+Oct  3 02:20:20 [sshd] Failed password for illegal user web from 216.65.197.170 port 41120 ssh2
+Oct  3 02:20:22 [sshd] Failed password for illegal user web from 216.65.197.170 port 41300 ssh2
+Oct  3 02:20:24 [sshd] Failed password for illegal user oracle from 216.65.197.170 port 41468 ssh2
+Oct  3 02:20:25 [sshd] Failed password for illegal user sybase from 216.65.197.170 port 41642 ssh2
+Oct  3 02:20:27 [sshd] Failed password for illegal user master from 216.65.197.170 port 41809 ssh2
+Oct  3 02:20:29 [sshd] Failed password for illegal user account from 216.65.197.170 port 41987 ssh2
+Oct  3 02:20:31 [sshd] Failed password for illegal user backup from 216.65.197.170 port 42143 ssh2
+Oct  3 02:20:32 [sshd] Failed password for illegal user server from 216.65.197.170 port 42316 ssh2
+Oct  3 02:20:34 [sshd] Failed password for illegal user adam from 216.65.197.170 port 42481 ssh2
+Oct  3 02:20:36 [sshd] Failed password for illegal user alan from 216.65.197.170 port 42647 ssh2
+Oct  3 02:20:37 [sshd] Failed password for illegal user frank from 216.65.197.170 port 42817 ssh2
+Oct  3 02:20:39 [sshd] Failed password for illegal user george from 216.65.197.170 port 42993 ssh2
+Oct  3 02:20:41 [sshd] Failed password for illegal user henry from 216.65.197.170 port 43170 ssh2
+Oct  3 02:20:43 [sshd] Failed password for illegal user john from 216.65.197.170 port 43319 ssh2
+Oct  3 02:20:44 [sshd] Failed password for illegal user root from 216.65.197.170 port 43504 ssh2
+Oct  3 02:20:46 [sshd] Failed password for illegal user root from 216.65.197.170 port 43664 ssh2
+Oct  3 02:20:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 43844 ssh2
+Oct  3 02:20:49 [sshd] Failed password for illegal user root from 216.65.197.170 port 44008 ssh2
+Oct  3 02:20:51 [sshd] Failed password for illegal user root from 216.65.197.170 port 44182 ssh2
+Oct  3 02:20:53 [sshd] Failed password for illegal user test from 216.65.197.170 port 44338 ssh2
+Oct  3 06:37:34 [sshd] Failed password for illegal user nobody from 217.56.33.194 port 1969 ssh2
+Oct  3 06:37:36 [sshd] Failed password for illegal user patrick from 217.56.33.194 port 2002 ssh2
+Oct  3 06:37:37 [sshd] Failed password for illegal user patrick from 217.56.33.194 port 2039 ssh2
+Oct  3 06:37:38 [sshd] Failed password for illegal user root from 217.56.33.194 port 2070 ssh2
+Oct  3 06:37:40 [sshd] Failed password for illegal user root from 217.56.33.194 port 2109 ssh2
+Oct  3 06:37:41 [sshd] Failed password for illegal user root from 217.56.33.194 port 2142 ssh2
+Oct  3 06:37:42 [sshd] Failed password for illegal user root from 217.56.33.194 port 2173 ssh2
+Oct  3 06:37:44 [sshd] Failed password for illegal user root from 217.56.33.194 port 2211 ssh2
+Oct  3 06:37:45 [sshd] Failed password for illegal user rolo from 217.56.33.194 port 2244 ssh2
+Oct  3 06:37:46 [sshd] Failed password for illegal user iceuser from 217.56.33.194 port 2272 ssh2
+Oct  3 06:37:48 [sshd] Failed password for illegal user horde from 217.56.33.194 port 2305 ssh2
+Oct  3 06:37:49 [sshd] Failed password for illegal user cyrus from 217.56.33.194 port 2337 ssh2
+Oct  3 06:37:50 [sshd] Failed password for illegal user www from 217.56.33.194 port 2373 ssh2
+Oct  3 06:37:52 [sshd] Failed password for illegal user wwwrun from 217.56.33.194 port 2407 ssh2
+Oct  3 06:37:53 [sshd] Failed password for illegal user matt from 217.56.33.194 port 2439 ssh2
+Oct  3 06:37:55 [sshd] Failed password for illegal user test from 217.56.33.194 port 2466 ssh2
+Oct  3 06:37:56 [sshd] Failed password for illegal user test from 217.56.33.194 port 2501 ssh2
+Oct  3 06:37:57 [sshd] Failed password for illegal user test from 217.56.33.194 port 2533 ssh2
+Oct  3 06:37:59 [sshd] Failed password for illegal user test from 217.56.33.194 port 2567 ssh2
+Oct  3 06:38:00 [sshd] Failed password for illegal user www-data from 217.56.33.194 port 2605 ssh2
+Oct  3 06:38:01 [sshd] Failed password for illegal user mysql from 217.56.33.194 port 2635 ssh2
+Oct  3 06:38:03 [sshd] Failed password for illegal user operator from 217.56.33.194 port 2667 ssh2
+Oct  3 06:38:04 [sshd] Failed password for illegal user adm from 217.56.33.194 port 2697 ssh2
+Oct  3 06:38:05 [sshd] Failed password for illegal user apache from 217.56.33.194 port 2733 ssh2
+Oct  3 06:38:07 [sshd] Failed password for illegal user irc from 217.56.33.194 port 2768 ssh2
+Oct  3 06:38:08 [sshd] Failed password for illegal user irc from 217.56.33.194 port 2804 ssh2
+Oct  3 06:38:09 [sshd] Failed password for illegal user adm from 217.56.33.194 port 2837 ssh2
+Oct  3 06:38:11 [sshd] Failed password for illegal user root from 217.56.33.194 port 2872 ssh2
+Oct  3 06:38:13 [sshd] Failed password for illegal user root from 217.56.33.194 port 2907 ssh2
+Oct  3 06:38:14 [sshd] Failed password for illegal user root from 217.56.33.194 port 2950 ssh2
+Oct  3 06:38:16 [sshd] Failed password for illegal user jane from 217.56.33.194 port 2986 ssh2
+Oct  3 06:38:17 [sshd] Failed password for illegal user pamela from 217.56.33.194 port 3019 ssh2
+Oct  3 06:38:18 [sshd] Failed password for illegal user root from 217.56.33.194 port 3053 ssh2
+Oct  3 06:38:20 [sshd] Failed password for illegal user root from 217.56.33.194 port 3085 ssh2
+Oct  3 06:38:21 [sshd] Failed password for illegal user root from 217.56.33.194 port 3115 ssh2
+Oct  3 06:38:22 [sshd] Failed password for illegal user root from 217.56.33.194 port 3147 ssh2
+Oct  3 06:38:24 [sshd] Failed password for illegal user root from 217.56.33.194 port 3177 ssh2
+Oct  3 06:38:25 [sshd] Failed password for illegal user cosmin from 217.56.33.194 port 3208 ssh2
+Oct  3 06:38:26 [sshd] Failed password for illegal user root from 217.56.33.194 port 3239 ssh2
+Oct  3 06:38:28 [sshd] Failed password for illegal user root from 217.56.33.194 port 3272 ssh2
+Oct  3 06:38:29 [sshd] Failed password for illegal user root from 217.56.33.194 port 3302 ssh2
+Oct  3 06:38:30 [sshd] Failed password for illegal user root from 217.56.33.194 port 3336 ssh2
+Oct  3 06:38:32 [sshd] Failed password for illegal user root from 217.56.33.194 port 3367 ssh2
+Oct  3 06:38:33 [sshd] Failed password for illegal user root from 217.56.33.194 port 3403 ssh2
+Oct  3 06:38:34 [sshd] Failed password for illegal user root from 217.56.33.194 port 3432 ssh2
+Oct  3 06:38:36 [sshd] Failed password for illegal user root from 217.56.33.194 port 3458 ssh2
+Oct  3 06:38:37 [sshd] Failed password for illegal user root from 217.56.33.194 port 3494 ssh2
+Oct  3 06:38:38 [sshd] Failed password for illegal user root from 217.56.33.194 port 3525 ssh2
+Oct  3 06:38:40 [sshd] Failed password for illegal user root from 217.56.33.194 port 3554 ssh2
+Oct  3 06:38:41 [sshd] Failed password for illegal user root from 217.56.33.194 port 3590 ssh2
+Oct  3 06:38:42 [sshd] Failed password for illegal user root from 217.56.33.194 port 3623 ssh2
+Oct  3 06:38:44 [sshd] Failed password for illegal user root from 217.56.33.194 port 3654 ssh2
+Oct  3 06:38:45 [sshd] Failed password for illegal user root from 217.56.33.194 port 3690 ssh2
+Oct  3 06:38:46 [sshd] Failed password for illegal user root from 217.56.33.194 port 3720 ssh2
+Oct  3 06:38:48 [sshd] Failed password for illegal user root from 217.56.33.194 port 3752 ssh2
+Oct  3 06:38:49 [sshd] Failed password for illegal user root from 217.56.33.194 port 3785 ssh2
+Oct  3 06:38:51 [sshd] Failed password for illegal user root from 217.56.33.194 port 3817 ssh2
+Oct  3 06:38:52 [sshd] Failed password for illegal user root from 217.56.33.194 port 3853 ssh2
+Oct  3 06:38:53 [sshd] Failed password for illegal user root from 217.56.33.194 port 3886 ssh2
+Oct  3 06:38:55 [sshd] Failed password for illegal user root from 217.56.33.194 port 3923 ssh2
+Oct  3 06:38:56 [sshd] Failed password for illegal user root from 217.56.33.194 port 3955 ssh2
+Oct  3 06:38:57 [sshd] Failed password for illegal user root from 217.56.33.194 port 3983 ssh2
+Oct  3 06:38:59 [sshd] Failed password for illegal user root from 217.56.33.194 port 4016 ssh2
+Oct  3 06:39:00 [sshd] Failed password for illegal user root from 217.56.33.194 port 4045 ssh2
+Oct  3 06:39:01 [sshd] Failed password for illegal user root from 217.56.33.194 port 4073 ssh2
+Oct  3 06:39:03 [sshd] Failed password for illegal user root from 217.56.33.194 port 4110 ssh2
+Oct  3 06:39:04 [sshd] Failed password for illegal user root from 217.56.33.194 port 4140 ssh2
+Oct  3 06:39:05 [sshd] Failed password for illegal user root from 217.56.33.194 port 4171 ssh2
+Oct  3 06:39:07 [sshd] Failed password for illegal user root from 217.56.33.194 port 4201 ssh2
+Oct  3 06:39:08 [sshd] Failed password for illegal user root from 217.56.33.194 port 4235 ssh2
+Oct  3 06:39:09 [sshd] Failed password for illegal user root from 217.56.33.194 port 4267 ssh2
+Oct  3 06:39:11 [sshd] Failed password for illegal user root from 217.56.33.194 port 4300 ssh2
+Oct  3 06:39:12 [sshd] Failed password for illegal user root from 217.56.33.194 port 4326 ssh2
+Oct  3 06:39:13 [sshd] Failed password for illegal user root from 217.56.33.194 port 4358 ssh2
+Oct  3 06:39:15 [sshd] Failed password for illegal user cip52 from 217.56.33.194 port 4390 ssh2
+Oct  3 06:39:16 [sshd] Failed password for illegal user cip51 from 217.56.33.194 port 4427 ssh2
+Oct  3 06:39:18 [sshd] Failed password for illegal user root from 217.56.33.194 port 4459 ssh2
+Oct  3 06:39:19 [sshd] Failed password for illegal user noc from 217.56.33.194 port 4492 ssh2
+Oct  3 06:39:20 [sshd] Failed password for illegal user root from 217.56.33.194 port 4526 ssh2
+Oct  3 06:39:22 [sshd] Failed password for illegal user root from 217.56.33.194 port 4557 ssh2
+Oct  3 06:39:23 [sshd] Failed password for illegal user root from 217.56.33.194 port 4588 ssh2
+Oct  3 06:39:24 [sshd] Failed password for illegal user root from 217.56.33.194 port 4618 ssh2
+Oct  3 06:39:26 [sshd] Failed password for illegal user webmaster from 217.56.33.194 port 4652 ssh2
+Oct  3 06:39:27 [sshd] Failed password for illegal user data from 217.56.33.194 port 4679 ssh2
+Oct  3 06:39:28 [sshd] Failed password for illegal user user from 217.56.33.194 port 4716 ssh2
+Oct  3 06:39:30 [sshd] Failed password for illegal user user from 217.56.33.194 port 4744 ssh2
+Oct  3 06:39:31 [sshd] Failed password for illegal user user from 217.56.33.194 port 4777 ssh2
+Oct  3 06:39:32 [sshd] Failed password for illegal user web from 217.56.33.194 port 4808 ssh2
+Oct  3 06:39:34 [sshd] Failed password for illegal user web from 217.56.33.194 port 4842 ssh2
+Oct  3 06:39:35 [sshd] Failed password for illegal user oracle from 217.56.33.194 port 4869 ssh2
+Oct  3 06:39:36 [sshd] Failed password for illegal user sybase from 217.56.33.194 port 4899 ssh2
+Oct  3 06:39:38 [sshd] Failed password for illegal user master from 217.56.33.194 port 4933 ssh2
+Oct  3 06:39:39 [sshd] Failed password for illegal user account from 217.56.33.194 port 4969 ssh2
+Oct  3 06:39:40 [sshd] Failed password for illegal user backup from 217.56.33.194 port 4999 ssh2
+Oct  3 06:39:42 [sshd] Failed password for illegal user server from 217.56.33.194 port 1051 ssh2
+Oct  3 06:39:43 [sshd] Failed password for illegal user adam from 217.56.33.194 port 1082 ssh2
+Oct  3 06:39:44 [sshd] Failed password for illegal user alan from 217.56.33.194 port 1114 ssh2
+Oct  3 06:39:46 [sshd] Failed password for illegal user frank from 217.56.33.194 port 1141 ssh2
+Oct  3 06:39:47 [sshd] Failed password for illegal user george from 217.56.33.194 port 1174 ssh2
+Oct  3 06:39:49 [sshd] Failed password for illegal user henry from 217.56.33.194 port 1205 ssh2
+Oct  3 06:39:50 [sshd] Failed password for illegal user john from 217.56.33.194 port 1236 ssh2
+Oct  3 06:39:51 [sshd] Failed password for illegal user root from 217.56.33.194 port 1271 ssh2
+Oct  3 06:39:53 [sshd] Failed password for illegal user root from 217.56.33.194 port 1300 ssh2
+Oct  3 06:39:55 [sshd] Failed password for illegal user root from 217.56.33.194 port 1332 ssh2
+Oct  3 06:39:56 [sshd] Failed password for illegal user root from 217.56.33.194 port 1380 ssh2
+Oct  3 06:39:57 [sshd] Failed password for illegal user root from 217.56.33.194 port 1412 ssh2
+Oct  3 06:39:59 [sshd] Failed password for illegal user test from 217.56.33.194 port 1449 ssh2
+Oct  4 04:43:59 [sshd] Failed password for illegal user test from 212.204.226.21 port 60349 ssh2
+Oct  4 04:44:03 [sshd] Failed password for illegal user guest from 212.204.226.21 port 60394 ssh2
+Oct  4 04:44:06 [sshd] Failed password for illegal user admin from 212.204.226.21 port 60540 ssh2
+Oct  4 04:44:08 [sshd] Failed password for illegal user admin from 212.204.226.21 port 60620 ssh2
+Oct  4 04:44:11 [sshd] Failed password for illegal user user from 212.204.226.21 port 60679 ssh2
+Oct  4 04:44:14 [sshd] Failed password for illegal user root from 212.204.226.21 port 60773 ssh2
+Oct  4 04:44:15 [sshd] Failed password for illegal user root from 212.204.226.21 port 60828 ssh2
+Oct  4 04:44:18 [sshd] Failed password for illegal user root from 212.204.226.21 port 60880 ssh2
+Oct  4 04:44:21 [sshd] Failed password for illegal user test from 212.204.226.21 port 60957 ssh2
+Oct  4 09:32:21 [sshd] Failed password for illegal user test from 62.141.56.70 port 45600 ssh2
+Oct  4 09:32:27 [sshd] Failed password for illegal user guest from 62.141.56.70 port 47635 ssh2
+Oct  4 09:32:32 [sshd] Failed password for illegal user admin from 62.141.56.70 port 49967 ssh2
+Oct  4 09:32:37 [sshd] Failed password for illegal user admin from 62.141.56.70 port 52093 ssh2
+Oct  4 09:32:42 [sshd] Failed password for illegal user user from 62.141.56.70 port 53840 ssh2
+Oct  4 09:32:47 [sshd] Failed password for illegal user root from 62.141.56.70 port 55568 ssh2
+Oct  4 09:32:51 [sshd] Failed password for illegal user root from 62.141.56.70 port 57526 ssh2
+Oct  4 09:32:51 [sshd] Failed password for illegal user root from 62.141.56.70 port 58454 ssh2
+Oct  4 09:32:52 [sshd] Failed password for illegal user test from 62.141.56.70 port 58819 ssh2
+Oct  4 14:09:11 [sshd] Failed password for illegal user test from 211.234.125.100 port 46642 ssh2
+Oct  4 14:09:18 [sshd] Failed password for illegal user guest from 211.234.125.100 port 46788 ssh2
+Oct  4 14:09:23 [sshd] Failed password for illegal user admin from 211.234.125.100 port 46886 ssh2
+Oct  4 14:09:30 [sshd] Failed password for illegal user admin from 211.234.125.100 port 46960 ssh2
+Oct  4 14:09:43 [sshd] Failed password for illegal user user from 211.234.125.100 port 47025 ssh2
+Oct  6 04:13:11 [sshd] Failed password for illegal user test from 64.246.30.17 port 58277 ssh2
+Oct  6 04:13:13 [sshd] Failed password for illegal user guest from 64.246.30.17 port 58360 ssh2
+Oct  6 04:13:15 [sshd] Failed password for illegal user admin from 64.246.30.17 port 58428 ssh2
+Oct  6 04:13:17 [sshd] Failed password for illegal user admin from 64.246.30.17 port 58514 ssh2
+Oct  6 22:13:56 [sshd] Failed password for illegal user test from 61.11.98.217 port 45434 ssh2
+Oct  6 22:14:00 [sshd] Failed password for illegal user guest from 61.11.98.217 port 45586 ssh2
+Oct  6 22:14:05 [sshd] Failed password for illegal user admin from 61.11.98.217 port 45672 ssh2
+Oct  6 22:14:10 [sshd] Failed password for illegal user admin from 61.11.98.217 port 45748 ssh2
+Oct  6 22:14:18 [sshd] Failed password for illegal user user from 61.11.98.217 port 45833 ssh2
+Oct  7 00:25:34 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37086 ssh2
+Oct  7 00:25:34 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37086 ssh2
+                - Last output repeated twice -
+Oct  7 00:26:27 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37089 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:26:37 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37092 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:27:21 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37095 ssh2
+                - Last output repeated twice -
+Oct  7 00:51:31 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37130 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:51:48 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37138 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:52:02 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37141 ssh2
+Oct  7 00:56:10 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37153 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:56:41 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37156 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:57:00 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37159 ssh2
+Oct  7 00:58:17 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37162 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:58:29 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37165 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:58:39 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37168 ssh2
+Oct  7 01:00:32 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37171 ssh2
+                - Last output repeated 2 times -
+Oct  7 01:00:44 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37175 ssh2
+                - Last output repeated 2 times -
+Oct  7 01:01:23 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37178 ssh2
+                - Last output repeated 2 times -
+Oct  7 01:03:01 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37181 ssh2
+                - Last output repeated 2 times -
+Oct  7 01:03:12 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37184 ssh2
+                - Last output repeated 2 times -
+Oct  7 01:03:20 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37187 ssh2
+                - Last output repeated 2 times -
+Oct  8 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
+Oct  8 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
+Oct  8 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
+Oct  9 21:54:11 yellow sshd[16069]: Failed password for cyril from 212.41.79.210 port 29404 ssh2

From f9430284498529454a935c71fa9c103a62d95fdd Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 9 Oct 2004 15:33:33 +0000
Subject: [PATCH 003/549] - Some object-oriented code testing

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@6 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban             | 22 ++++++++++++++++++-
 firewall/__init__.py | 25 +++++++++++++++++++++
 firewall/firewall.py | 52 ++++++++++++++++++++++++++++++++++++++++++++
 firewall/iptables.py | 41 ++++++++++++++++++++++++++++++++++
 4 files changed, 139 insertions(+), 1 deletion(-)
 create mode 100644 firewall/__init__.py
 create mode 100644 firewall/firewall.py
 create mode 100644 firewall/iptables.py

diff --git a/fail2ban b/fail2ban
index 2936021a..278a118f 100755
--- a/fail2ban
+++ b/fail2ban
@@ -20,9 +20,17 @@
 # 
 # $Revision$
 
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
 import posix,sys,os
 import string,re,time
 
+from firewall.iptables import Iptables
+
 def checkForRoot():
 	""" Check for root user.
 	"""
@@ -32,6 +40,7 @@ def checkForRoot():
 	else:
 		return False
 
+# start: To be removed
 def executeCmd(cmd):
 	return #os.system(cmd)
 
@@ -44,6 +53,7 @@ def banIP(ip):
 	iptables = 'iptables -I INPUT 1 -i eth0 -s '+ip+' -j DROP'
 	executeCmd(iptables)
 	print iptables
+# end:
 
 def checkForUnBan(banList, currentTime, banTime):
 	""" Check for user to remove from ban list.
@@ -87,11 +97,21 @@ def parseLogLine(line):
 
 if __name__ == "__main__":
 	
+	# start: For object oriented testing
+	f = Iptables()
+	f.banIP('11', 1231)
+	f.banIP('13', 1232)
+	f.banIP('13', 1233)
+	f.unBanIP('11')
+	f.viewBanList()
+	f.flushBanList()
+	# end:
+	
 	if not checkForRoot():
 		print "You must be root."
 		#sys.exit(-1)
 	
-	logPath = './log/temp'
+	logPath = './log-test/test'
 	banTime = 60
 	ignoreIPs = '127.0.0.1'
 	
diff --git a/firewall/__init__.py b/firewall/__init__.py
new file mode 100644
index 00000000..76dba873
--- /dev/null
+++ b/firewall/__init__.py
@@ -0,0 +1,25 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
\ No newline at end of file
diff --git a/firewall/firewall.py b/firewall/firewall.py
new file mode 100644
index 00000000..0a937d77
--- /dev/null
+++ b/firewall/firewall.py
@@ -0,0 +1,52 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+class Firewall:
+	
+	banList = dict()
+	
+	def addBanIP(self, ip, time):
+		self.banList[ip] = time
+	
+	def delBanIP(self, ip):
+		del self.banList[ip]
+	
+	def flushBanList(self):
+		iterBanList = self.banList.iteritems()
+		for i in range(len(self.banList)):
+			element = iterBanList.next()
+			ip = element[0]
+			self.unBanIP(ip)
+	
+	def executeCmd(self, cmd):
+		return #os.system(cmd)
+		
+	def viewBanList(self):
+		iterBanList = self.banList.iteritems()
+		for i in range(len(self.banList)):
+			element = iterBanList.next()
+			print element
+		
diff --git a/firewall/iptables.py b/firewall/iptables.py
new file mode 100644
index 00000000..fcee9652
--- /dev/null
+++ b/firewall/iptables.py
@@ -0,0 +1,41 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from firewall import Firewall
+
+class Iptables(Firewall):
+	
+	def banIP(self, ip, time):
+		query = 'iptables -I INPUT 1 -i eth0 -s '+str(ip)+' -j DROP'
+		self.addBanIP(ip, time)
+		self.executeCmd(query)
+		print query
+	
+	def unBanIP(self, ip):
+		query = 'iptables -D INPUT -i eth0 -s '+str(ip)+' -j DROP'
+		self.delBanIP(ip)
+		self.executeCmd(query)
+		print query

From 7e00b03a9382ee08fad8d9f40b9d60cc70f144f4 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Oct 2004 13:33:40 +0000
Subject: [PATCH 004/549] - add log reader classes. Currently support metalog
 and sshd but should handle others services and syslog yet

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@7 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/__init__.py  | 25 ++++++++++++++++
 logreader/logreader.py | 67 ++++++++++++++++++++++++++++++++++++++++++
 logreader/metalog.py   | 65 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 157 insertions(+)
 create mode 100644 logreader/__init__.py
 create mode 100644 logreader/logreader.py
 create mode 100644 logreader/metalog.py

diff --git a/logreader/__init__.py b/logreader/__init__.py
new file mode 100644
index 00000000..76dba873
--- /dev/null
+++ b/logreader/__init__.py
@@ -0,0 +1,25 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
\ No newline at end of file
diff --git a/logreader/logreader.py b/logreader/logreader.py
new file mode 100644
index 00000000..492ed76d
--- /dev/null
+++ b/logreader/logreader.py
@@ -0,0 +1,67 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os, sys
+
+class LogReader:
+	
+	def __init__(self, logPath, findTime = 3600):
+		self.logPath = logPath
+		self.findTime = findTime
+		self.ignoreIpList = []
+		self.lastModTime = 0
+	
+	def addIgnoreIP(self, ip):
+		self.ignoreIpList.append(ip)
+		
+	def inIgnoreIPList(self, ip):
+		return ip in self.ignoreIpList
+	
+	def openLogFile(self):
+		try:
+			fileHandler = open(self.logPath)
+		except OSError:
+			print "Unable to open", self.logPath
+			sys.exit(-1)
+		return fileHandler
+		
+	def isModified(self):
+		try:
+			logStats = os.stat(self.logPath)
+		except OSError:
+			print "Unable to get stat on", logPath
+			sys.exit(-1)
+		
+		if self.lastModTime == logStats.st_mtime:
+			return False
+		else:
+			print self.logPath, 'has been modified'
+			self.lastModTime = logStats.st_mtime
+			return True
+	
+	def getPwdFailure(self):
+		failList = self.getFailInfo(self.findTime)
+		return failList
diff --git a/logreader/metalog.py b/logreader/metalog.py
new file mode 100644
index 00000000..20a64766
--- /dev/null
+++ b/logreader/metalog.py
@@ -0,0 +1,65 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import re, time
+
+from logreader import LogReader
+
+class Metalog(LogReader):
+	
+	def getFailInfo(self, findTime):
+		ipList = dict()
+		logFile = self.openLogFile()
+		for line in logFile.readlines():
+			match = self.parseLogLine(line)
+			if match:
+				ip = match[0]
+				unixTime = match[1]
+				if unixTime < time.time()-self.findTime:
+					continue
+				if self.inIgnoreIPList(ip):
+					print 'Ignore', ip
+					continue
+				print 'Found', ip, 'at', unixTime
+				if ipList.has_key(ip):
+					ipList[ip] = (ipList[ip][0]+1, unixTime)
+				else:
+					ipList[ip] = (1, unixTime)
+		logFile.close()
+		return ipList
+	
+	def parseLogLine(self, line):
+		""" Match sshd failed password log
+		"""
+		if re.search("Failed password", line):
+			matchIP = re.search("(?:\d{1,3}\.){3}\d{1,3}", line)
+			if matchIP:
+				date = list(time.strptime(line[0:15], "%b %d %H:%M:%S"))
+				date[0] = time.gmtime()[0]
+				unixTime = time.mktime(date)
+				return [matchIP.group(), unixTime]
+			else:
+				return False

From 0de46864a1ba5443e719043d718e7d3c1e523996 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Oct 2004 13:34:02 +0000
Subject: [PATCH 005/549] - update some dates

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@8 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 log-test/test | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/log-test/test b/log-test/test
index 81e0e87f..30fc4868 100644
--- a/log-test/test
+++ b/log-test/test
@@ -425,7 +425,7 @@ Oct  7 01:03:12 [sshd] Failed password for illegal user tata from 128.178.164.52
                 - Last output repeated 2 times -
 Oct  7 01:03:20 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37187 ssh2
                 - Last output repeated 2 times -
-Oct  8 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
-Oct  8 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
-Oct  8 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
-Oct  9 21:54:11 yellow sshd[16069]: Failed password for cyril from 212.41.79.210 port 29404 ssh2
+Oct 11 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
+Oct 11 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
+Oct 11 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
+Oct 12 21:54:11 yellow sshd[16069]: Failed password for cyril from 212.41.79.210 port 29404 ssh2

From 68ab4b0b26cee2c96ff8751e94b396692b0ecce4 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Oct 2004 13:35:11 +0000
Subject: [PATCH 006/549] - a few changes and corrections

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@9 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/firewall.py | 38 ++++++++++++++++++++++++++++++++++----
 firewall/iptables.py | 14 +++++---------
 2 files changed, 39 insertions(+), 13 deletions(-)

diff --git a/firewall/firewall.py b/firewall/firewall.py
index 0a937d77..76632a75 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -24,24 +24,54 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
+import time
+
 class Firewall:
 	
 	banList = dict()
 	
-	def addBanIP(self, ip, time):
-		self.banList[ip] = time
+	def __init__(self, banTime):
+		self.banTime = banTime
+	
+	def addBanIP(self, ip):
+		if not self.inBanList(ip):
+			self.banList[ip] = time.time()
+			self.executeCmd(self.banIP(ip))
+		else:
+			print ip, "already in ban list"
 	
 	def delBanIP(self, ip):
-		del self.banList[ip]
+		if self.inBanList(ip):
+			del self.banList[ip]
+			self.executeCmd(self.unBanIP(ip))
+		else:
+			print ip, "not in ban list"
+	
+	def inBanList(self, ip):
+		return self.banList.has_key(ip)
+	
+	def checkForUnBan(self):
+		""" Check for user to remove from ban list.
+		"""
+		banListTemp = self.banList.copy()
+		iterBanList = banListTemp.iteritems()
+		for i in range(len(self.banList)):
+			element = iterBanList.next()
+			ip = element[0]
+			btime = element[1]
+			if btime < time.time()-self.banTime:
+				self.delBanIP(ip)
+				print '`->', time.time()
 	
 	def flushBanList(self):
 		iterBanList = self.banList.iteritems()
 		for i in range(len(self.banList)):
 			element = iterBanList.next()
 			ip = element[0]
-			self.unBanIP(ip)
+			self.delBanIP(ip)
 	
 	def executeCmd(self, cmd):
+		print cmd
 		return #os.system(cmd)
 		
 	def viewBanList(self):
diff --git a/firewall/iptables.py b/firewall/iptables.py
index fcee9652..8206e631 100644
--- a/firewall/iptables.py
+++ b/firewall/iptables.py
@@ -28,14 +28,10 @@ from firewall import Firewall
 
 class Iptables(Firewall):
 	
-	def banIP(self, ip, time):
-		query = 'iptables -I INPUT 1 -i eth0 -s '+str(ip)+' -j DROP'
-		self.addBanIP(ip, time)
-		self.executeCmd(query)
-		print query
+	def banIP(self, ip):
+		query = 'iptables -I INPUT 1 -i eth0 -s '+ip+' -j DROP'
+		return query
 	
 	def unBanIP(self, ip):
-		query = 'iptables -D INPUT -i eth0 -s '+str(ip)+' -j DROP'
-		self.delBanIP(ip)
-		self.executeCmd(query)
-		print query
+		query = 'iptables -D INPUT -i eth0 -s '+ip+' -j DROP'
+		return query

From 012301b64411850e449bbc7d0aa42b68553350fa Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Oct 2004 13:35:52 +0000
Subject: [PATCH 007/549] - Complete rewrite to use the log-reader and firewall
 classes

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@10 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban | 127 +++++++------------------------------------------------
 1 file changed, 15 insertions(+), 112 deletions(-)

diff --git a/fail2ban b/fail2ban
index 278a118f..c2cae5df 100755
--- a/fail2ban
+++ b/fail2ban
@@ -26,10 +26,10 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import posix,sys,os
-import string,re,time
+import posix, time, sys
 
 from firewall.iptables import Iptables
+from logreader.metalog import Metalog
 
 def checkForRoot():
 	""" Check for root user.
@@ -40,132 +40,35 @@ def checkForRoot():
 	else:
 		return False
 
-# start: To be removed
-def executeCmd(cmd):
-	return #os.system(cmd)
-
-def unBanIP(ip):
-	iptables = 'iptables -D INPUT -i eth0 -s '+ip+' -j DROP'
-	executeCmd(iptables)
-	print iptables
-
-def banIP(ip):
-	iptables = 'iptables -I INPUT 1 -i eth0 -s '+ip+' -j DROP'
-	executeCmd(iptables)
-	print iptables
-# end:
-
-def checkForUnBan(banList, currentTime, banTime):
-	""" Check for user to remove from ban list.
-	"""
-	iterBanList = banList.iteritems()
-	for i in range(len(banList)):
-		element = iterBanList.next()
-		ip = element[0]
-		btime = element[1]
-		if btime < currentTime-banTime:
-			del banList[ip]
-			unBanIP(ip)
-			print '`->', currentTime
-	return banList
-
-def checkForBan(retryList, banList, currentTime):
-	iterRetry = retryList.iteritems()
-	for i in range(len(retryList)):
-		element = iterRetry.next()
-		retry = element[1][0]
-		ip = element[0]
-		if element[1][0] > 2 and not banList.has_key(ip):
-			banList[ip] = currentTime
-			banIP(ip)
-			print '`->', currentTime
-	return banList
-
-def flushBanList(banList):
-	iterBanList = banList.iteritems()
-	for i in range(len(banList)):
-		element = iterBanList.next()
-		ip = element[0]
-		unBanIP(ip)
-
-def parseLogLine(line):
-	""" Match sshd failed password log
-	"""
-	if re.search("Failed password", line):
-		matchIP = re.search("(?:\d{1,3}\.){3}\d{1,3}", line)
-		return matchIP
-
 if __name__ == "__main__":
 	
-	# start: For object oriented testing
-	f = Iptables()
-	f.banIP('11', 1231)
-	f.banIP('13', 1232)
-	f.banIP('13', 1233)
-	f.unBanIP('11')
-	f.viewBanList()
-	f.flushBanList()
-	# end:
+	fireWall = Iptables(600)
+	logFile = Metalog("./log-test/test", 600)
 	
 	if not checkForRoot():
 		print "You must be root."
 		#sys.exit(-1)
 	
-	logPath = './log-test/test'
-	banTime = 60
-	ignoreIPs = '127.0.0.1'
+	logFile.addIgnoreIP("127.0.0.1")
 	
-	lastModTime = 0
-	banList = dict()
 	while True:
-		try:
-			currentTime = time.time()
+		try:			
+			fireWall.checkForUnBan()
 			
-			banList = checkForUnBan(banList, currentTime, banTime)
-			
-			try:
-				pwdFailStats = os.stat(logPath)
-			except OSError:
-				print "Unable to get stat on", logPath
-				sys.exit(-1)
-			
-			if lastModTime == pwdFailStats.st_mtime:
+			if not logFile.isModified():
 				time.sleep(1)
 				continue
 			
-			print logPath, 'has been modified'
-			lastModTime = pwdFailStats.st_mtime
+			failList = logFile.getPwdFailure()
 			
-			try:
-				pwdfail = open(logPath)
-			except OSError:
-				print "Unable to open", logPath
-				sys.exit(-1)
+			iterFailList = failList.iteritems()
+			for i in range(len(failList)):
+				element = iterFailList.next()
+				if element[1][0] > 2:
+					fireWall.addBanIP(element[0])
 			
-			retryList = dict()
-			for line in pwdfail.readlines():
-				match = parseLogLine(line)
-				if match:
-					ip = match.group()
-					date = list(time.strptime(line[0:15], "%b %d %H:%M:%S"))
-					date[0] = time.gmtime()[0]
-					unixTime = time.mktime(date)
-					if unixTime < currentTime-banTime:
-						continue
-					if re.search(ip, ignoreIPs):
-						print 'Ignore ', ip
-						continue
-					print 'Found', ip, 'at', unixTime
-					if retryList.has_key(`ip`):
-						retryList[`ip`] = (retryList[`ip`][0]+1,unixTime)
-					else:
-						retryList[`ip`] = (1,unixTime)
-		
-			pwdfail.close()
-		
-			banList = checkForBan(retryList, banList, currentTime)
 		except KeyboardInterrupt:
 			print 'Restoring iptables...'
-			flushBanList(banList)
+			fireWall.flushBanList()
 			print 'Exiting...'
 			sys.exit(0)

From 5fc0a651635377fe1faa5bdcdb56aa0835382636 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Oct 2004 23:41:07 +0000
Subject: [PATCH 008/549] - removing this file. Replaced by fail2ban.py

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@11 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban | 74 --------------------------------------------------------
 1 file changed, 74 deletions(-)
 delete mode 100755 fail2ban

diff --git a/fail2ban b/fail2ban
deleted file mode 100755
index c2cae5df..00000000
--- a/fail2ban
+++ /dev/null
@@ -1,74 +0,0 @@
-#!/usr/bin/env python
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import posix, time, sys
-
-from firewall.iptables import Iptables
-from logreader.metalog import Metalog
-
-def checkForRoot():
-	""" Check for root user.
-	"""
-	uid = `posix.getuid()`
-	if uid == '0':
-		return True
-	else:
-		return False
-
-if __name__ == "__main__":
-	
-	fireWall = Iptables(600)
-	logFile = Metalog("./log-test/test", 600)
-	
-	if not checkForRoot():
-		print "You must be root."
-		#sys.exit(-1)
-	
-	logFile.addIgnoreIP("127.0.0.1")
-	
-	while True:
-		try:			
-			fireWall.checkForUnBan()
-			
-			if not logFile.isModified():
-				time.sleep(1)
-				continue
-			
-			failList = logFile.getPwdFailure()
-			
-			iterFailList = failList.iteritems()
-			for i in range(len(failList)):
-				element = iterFailList.next()
-				if element[1][0] > 2:
-					fireWall.addBanIP(element[0])
-			
-		except KeyboardInterrupt:
-			print 'Restoring iptables...'
-			fireWall.flushBanList()
-			print 'Exiting...'
-			sys.exit(0)

From 5c9c6e82cf976968e89ad4fba99458b13ed32bb5 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Oct 2004 23:41:08 +0000
Subject: [PATCH 009/549] This commit was manufactured by cvs2svn to create
 branch 'FAIL2BAN-0_5'.

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@12 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban               | 171 ----------------
 firewall/firewall.py   |  52 -----
 firewall/iptables.py   |  41 ----
 log-test/current       |   4 -
 log-test/test          | 431 -----------------------------------------
 logreader/logreader.py |  67 -------
 logreader/metalog.py   |  65 -------
 7 files changed, 831 deletions(-)
 delete mode 100755 fail2ban
 delete mode 100644 firewall/firewall.py
 delete mode 100644 firewall/iptables.py
 delete mode 100644 log-test/current
 delete mode 100644 log-test/test
 delete mode 100644 logreader/logreader.py
 delete mode 100644 logreader/metalog.py

diff --git a/fail2ban b/fail2ban
deleted file mode 100755
index 278a118f..00000000
--- a/fail2ban
+++ /dev/null
@@ -1,171 +0,0 @@
-#!/usr/bin/env python
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import posix,sys,os
-import string,re,time
-
-from firewall.iptables import Iptables
-
-def checkForRoot():
-	""" Check for root user.
-	"""
-	uid = `posix.getuid()`
-	if uid == '0':
-		return True
-	else:
-		return False
-
-# start: To be removed
-def executeCmd(cmd):
-	return #os.system(cmd)
-
-def unBanIP(ip):
-	iptables = 'iptables -D INPUT -i eth0 -s '+ip+' -j DROP'
-	executeCmd(iptables)
-	print iptables
-
-def banIP(ip):
-	iptables = 'iptables -I INPUT 1 -i eth0 -s '+ip+' -j DROP'
-	executeCmd(iptables)
-	print iptables
-# end:
-
-def checkForUnBan(banList, currentTime, banTime):
-	""" Check for user to remove from ban list.
-	"""
-	iterBanList = banList.iteritems()
-	for i in range(len(banList)):
-		element = iterBanList.next()
-		ip = element[0]
-		btime = element[1]
-		if btime < currentTime-banTime:
-			del banList[ip]
-			unBanIP(ip)
-			print '`->', currentTime
-	return banList
-
-def checkForBan(retryList, banList, currentTime):
-	iterRetry = retryList.iteritems()
-	for i in range(len(retryList)):
-		element = iterRetry.next()
-		retry = element[1][0]
-		ip = element[0]
-		if element[1][0] > 2 and not banList.has_key(ip):
-			banList[ip] = currentTime
-			banIP(ip)
-			print '`->', currentTime
-	return banList
-
-def flushBanList(banList):
-	iterBanList = banList.iteritems()
-	for i in range(len(banList)):
-		element = iterBanList.next()
-		ip = element[0]
-		unBanIP(ip)
-
-def parseLogLine(line):
-	""" Match sshd failed password log
-	"""
-	if re.search("Failed password", line):
-		matchIP = re.search("(?:\d{1,3}\.){3}\d{1,3}", line)
-		return matchIP
-
-if __name__ == "__main__":
-	
-	# start: For object oriented testing
-	f = Iptables()
-	f.banIP('11', 1231)
-	f.banIP('13', 1232)
-	f.banIP('13', 1233)
-	f.unBanIP('11')
-	f.viewBanList()
-	f.flushBanList()
-	# end:
-	
-	if not checkForRoot():
-		print "You must be root."
-		#sys.exit(-1)
-	
-	logPath = './log-test/test'
-	banTime = 60
-	ignoreIPs = '127.0.0.1'
-	
-	lastModTime = 0
-	banList = dict()
-	while True:
-		try:
-			currentTime = time.time()
-			
-			banList = checkForUnBan(banList, currentTime, banTime)
-			
-			try:
-				pwdFailStats = os.stat(logPath)
-			except OSError:
-				print "Unable to get stat on", logPath
-				sys.exit(-1)
-			
-			if lastModTime == pwdFailStats.st_mtime:
-				time.sleep(1)
-				continue
-			
-			print logPath, 'has been modified'
-			lastModTime = pwdFailStats.st_mtime
-			
-			try:
-				pwdfail = open(logPath)
-			except OSError:
-				print "Unable to open", logPath
-				sys.exit(-1)
-			
-			retryList = dict()
-			for line in pwdfail.readlines():
-				match = parseLogLine(line)
-				if match:
-					ip = match.group()
-					date = list(time.strptime(line[0:15], "%b %d %H:%M:%S"))
-					date[0] = time.gmtime()[0]
-					unixTime = time.mktime(date)
-					if unixTime < currentTime-banTime:
-						continue
-					if re.search(ip, ignoreIPs):
-						print 'Ignore ', ip
-						continue
-					print 'Found', ip, 'at', unixTime
-					if retryList.has_key(`ip`):
-						retryList[`ip`] = (retryList[`ip`][0]+1,unixTime)
-					else:
-						retryList[`ip`] = (1,unixTime)
-		
-			pwdfail.close()
-		
-			banList = checkForBan(retryList, banList, currentTime)
-		except KeyboardInterrupt:
-			print 'Restoring iptables...'
-			flushBanList(banList)
-			print 'Exiting...'
-			sys.exit(0)
diff --git a/firewall/firewall.py b/firewall/firewall.py
deleted file mode 100644
index 0a937d77..00000000
--- a/firewall/firewall.py
+++ /dev/null
@@ -1,52 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-class Firewall:
-	
-	banList = dict()
-	
-	def addBanIP(self, ip, time):
-		self.banList[ip] = time
-	
-	def delBanIP(self, ip):
-		del self.banList[ip]
-	
-	def flushBanList(self):
-		iterBanList = self.banList.iteritems()
-		for i in range(len(self.banList)):
-			element = iterBanList.next()
-			ip = element[0]
-			self.unBanIP(ip)
-	
-	def executeCmd(self, cmd):
-		return #os.system(cmd)
-		
-	def viewBanList(self):
-		iterBanList = self.banList.iteritems()
-		for i in range(len(self.banList)):
-			element = iterBanList.next()
-			print element
-		
diff --git a/firewall/iptables.py b/firewall/iptables.py
deleted file mode 100644
index fcee9652..00000000
--- a/firewall/iptables.py
+++ /dev/null
@@ -1,41 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-from firewall import Firewall
-
-class Iptables(Firewall):
-	
-	def banIP(self, ip, time):
-		query = 'iptables -I INPUT 1 -i eth0 -s '+str(ip)+' -j DROP'
-		self.addBanIP(ip, time)
-		self.executeCmd(query)
-		print query
-	
-	def unBanIP(self, ip):
-		query = 'iptables -D INPUT -i eth0 -s '+str(ip)+' -j DROP'
-		self.delBanIP(ip)
-		self.executeCmd(query)
-		print query
diff --git a/log-test/current b/log-test/current
deleted file mode 100644
index 6537a6aa..00000000
--- a/log-test/current
+++ /dev/null
@@ -1,4 +0,0 @@
-                - Last output repeated 2 times -
-Oct  7 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
-Oct  7 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
-Oct  7 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
diff --git a/log-test/test b/log-test/test
deleted file mode 100644
index 81e0e87f..00000000
--- a/log-test/test
+++ /dev/null
@@ -1,431 +0,0 @@
-Sep 28 13:18:43 [sshd] Failed password for illegal user test from 211.112.229.69 port 59506 ssh2
-Sep 28 13:18:45 [sshd] Failed password for illegal user guest from 211.112.229.69 port 59584 ssh2
-Sep 28 13:18:48 [sshd] Failed password for illegal user admin from 211.112.229.69 port 59668 ssh2
-Sep 28 13:18:51 [sshd] Failed password for illegal user admin from 211.112.229.69 port 59746 ssh2
-Sep 28 13:18:54 [sshd] Failed password for illegal user user from 211.112.229.69 port 59809 ssh2
-Sep 28 13:18:57 [sshd] Failed password for illegal user root from 211.112.229.69 port 59881 ssh2
-Sep 28 13:19:00 [sshd] Failed password for illegal user root from 211.112.229.69 port 59944 ssh2
-Sep 28 13:19:03 [sshd] Failed password for illegal user root from 211.112.229.69 port 59999 ssh2
-Sep 28 13:19:06 [sshd] Failed password for illegal user test from 211.112.229.69 port 60055 ssh2
-Sep 28 21:05:25 [sshd(pam_unix)] authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.128.local.home  user=cyril
-Sep 28 21:05:27 [sshd] error: PAM: Authentication failure for cyril from 192.168.0.128.local.home
-Sep 29 03:45:18 [sshd] Failed password for illegal user nobody from 203.198.168.66 port 55927 ssh2
-Sep 29 03:45:21 [sshd] Failed password for illegal user patrick from 203.198.168.66 port 55973 ssh2
-Sep 29 03:45:23 [sshd] Failed password for illegal user patrick from 203.198.168.66 port 56010 ssh2
-Sep 29 03:45:26 [sshd] Failed password for illegal user root from 203.198.168.66 port 56060 ssh2
-Sep 29 03:45:29 [sshd] Failed password for illegal user root from 203.198.168.66 port 56107 ssh2
-Sep 29 03:45:32 [sshd] Failed password for illegal user root from 203.198.168.66 port 56152 ssh2
-Sep 29 03:45:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 56200 ssh2
-Sep 29 03:45:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 56243 ssh2
-Sep 29 03:45:40 [sshd] Failed password for illegal user rolo from 203.198.168.66 port 56288 ssh2
-Sep 29 03:45:43 [sshd] Failed password for illegal user iceuser from 203.198.168.66 port 56333 ssh2
-Sep 29 03:45:46 [sshd] Failed password for illegal user horde from 203.198.168.66 port 56379 ssh2
-Sep 29 03:45:48 [sshd] Failed password for illegal user cyrus from 203.198.168.66 port 56425 ssh2
-Sep 29 03:45:52 [sshd] Failed password for illegal user www from 203.198.168.66 port 56470 ssh2
-Sep 29 03:45:55 [sshd] Failed password for illegal user wwwrun from 203.198.168.66 port 56534 ssh2
-Sep 29 03:45:58 [sshd] Failed password for illegal user matt from 203.198.168.66 port 56572 ssh2
-Sep 29 03:46:01 [sshd] Failed password for illegal user test from 203.198.168.66 port 56616 ssh2
-Sep 29 03:46:03 [sshd] Failed password for illegal user test from 203.198.168.66 port 56660 ssh2
-Sep 29 03:46:06 [sshd] Failed password for illegal user test from 203.198.168.66 port 56704 ssh2
-Sep 29 03:46:09 [sshd] Failed password for illegal user test from 203.198.168.66 port 56752 ssh2
-Sep 29 03:46:12 [sshd] Failed password for illegal user www-data from 203.198.168.66 port 56795 ssh2
-Sep 29 03:46:15 [sshd] Failed password for illegal user mysql from 203.198.168.66 port 56839 ssh2
-Sep 29 03:46:17 [sshd] Failed password for illegal user operator from 203.198.168.66 port 56882 ssh2
-Sep 29 03:46:20 [sshd] Failed password for illegal user adm from 203.198.168.66 port 56929 ssh2
-Sep 29 03:46:23 [sshd] Failed password for illegal user apache from 203.198.168.66 port 56971 ssh2
-Sep 29 03:46:26 [sshd] Failed password for illegal user irc from 203.198.168.66 port 57011 ssh2
-Sep 29 03:46:29 [sshd] Failed password for illegal user irc from 203.198.168.66 port 57060 ssh2
-Sep 29 03:46:31 [sshd] Failed password for illegal user adm from 203.198.168.66 port 57100 ssh2
-Sep 29 03:46:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 57148 ssh2
-Sep 29 03:46:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 57194 ssh2
-Sep 29 03:46:40 [sshd] Failed password for illegal user root from 203.198.168.66 port 57236 ssh2
-Sep 29 03:46:43 [sshd] Failed password for illegal user jane from 203.198.168.66 port 57281 ssh2
-Sep 29 03:46:45 [sshd] Failed password for illegal user pamela from 203.198.168.66 port 57328 ssh2
-Sep 29 03:46:48 [sshd] Failed password for illegal user root from 203.198.168.66 port 57372 ssh2
-Sep 29 03:46:51 [sshd] Failed password for illegal user root from 203.198.168.66 port 57418 ssh2
-Sep 29 03:46:54 [sshd] Failed password for illegal user root from 203.198.168.66 port 57463 ssh2
-Sep 29 03:46:57 [sshd] Failed password for illegal user root from 203.198.168.66 port 57506 ssh2
-Sep 29 03:46:59 [sshd] Failed password for illegal user root from 203.198.168.66 port 57549 ssh2
-Sep 29 03:47:02 [sshd] Failed password for illegal user cosmin from 203.198.168.66 port 57594 ssh2
-Sep 29 03:47:05 [sshd] Failed password for illegal user root from 203.198.168.66 port 57637 ssh2
-Sep 29 03:47:08 [sshd] Failed password for illegal user root from 203.198.168.66 port 57689 ssh2
-Sep 29 03:47:11 [sshd] Failed password for illegal user root from 203.198.168.66 port 57730 ssh2
-Sep 29 03:47:13 [sshd] Failed password for illegal user root from 203.198.168.66 port 57774 ssh2
-Sep 29 03:47:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 57820 ssh2
-Sep 29 03:47:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 57866 ssh2
-Sep 29 03:47:22 [sshd] Failed password for illegal user root from 203.198.168.66 port 57901 ssh2
-Sep 29 03:47:25 [sshd] Failed password for illegal user root from 203.198.168.66 port 57944 ssh2
-Sep 29 03:47:27 [sshd] Failed password for illegal user root from 203.198.168.66 port 57990 ssh2
-Sep 29 03:47:31 [sshd] Failed password for illegal user root from 203.198.168.66 port 58031 ssh2
-Sep 29 03:47:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 58098 ssh2
-Sep 29 03:47:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 58137 ssh2
-Sep 29 03:47:40 [sshd] Failed password for illegal user root from 203.198.168.66 port 58183 ssh2
-Sep 29 03:47:42 [sshd] Failed password for illegal user root from 203.198.168.66 port 58228 ssh2
-Sep 29 03:47:45 [sshd] Failed password for illegal user root from 203.198.168.66 port 58273 ssh2
-Sep 29 03:47:48 [sshd] Failed password for illegal user root from 203.198.168.66 port 58314 ssh2
-Sep 29 03:47:51 [sshd] Failed password for illegal user root from 203.198.168.66 port 58358 ssh2
-Sep 29 03:47:54 [sshd] Failed password for illegal user root from 203.198.168.66 port 58401 ssh2
-Sep 29 03:47:56 [sshd] Failed password for illegal user root from 203.198.168.66 port 58443 ssh2
-Sep 29 03:47:59 [sshd] Failed password for illegal user root from 203.198.168.66 port 58484 ssh2
-Sep 29 03:48:02 [sshd] Failed password for illegal user root from 203.198.168.66 port 58528 ssh2
-Sep 29 03:48:05 [sshd] Failed password for illegal user root from 203.198.168.66 port 58574 ssh2
-Sep 29 03:48:07 [sshd] Failed password for illegal user root from 203.198.168.66 port 58613 ssh2
-Sep 29 03:48:10 [sshd] Failed password for illegal user root from 203.198.168.66 port 58662 ssh2
-Sep 29 03:48:13 [sshd] Failed password for illegal user root from 203.198.168.66 port 58703 ssh2
-Sep 29 03:48:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 58748 ssh2
-Sep 29 03:48:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 58792 ssh2
-Sep 29 03:48:21 [sshd] Failed password for illegal user root from 203.198.168.66 port 58839 ssh2
-Sep 29 03:48:24 [sshd] Failed password for illegal user root from 203.198.168.66 port 58880 ssh2
-Sep 29 03:48:27 [sshd] Failed password for illegal user root from 203.198.168.66 port 58926 ssh2
-Sep 29 03:48:30 [sshd] Failed password for illegal user root from 203.198.168.66 port 58967 ssh2
-Sep 29 03:48:33 [sshd] Failed password for illegal user root from 203.198.168.66 port 59012 ssh2
-Sep 29 03:48:35 [sshd] Failed password for illegal user root from 203.198.168.66 port 59052 ssh2
-Sep 29 03:48:38 [sshd] Failed password for illegal user root from 203.198.168.66 port 59095 ssh2
-Sep 29 03:48:41 [sshd] Failed password for illegal user root from 203.198.168.66 port 59140 ssh2
-Sep 29 03:48:44 [sshd] Failed password for illegal user root from 203.198.168.66 port 59182 ssh2
-Sep 29 03:48:47 [sshd] Failed password for illegal user cip52 from 203.198.168.66 port 59222 ssh2
-Sep 29 03:48:49 [sshd] Failed password for illegal user cip51 from 203.198.168.66 port 59264 ssh2
-Sep 29 03:48:52 [sshd] Failed password for illegal user root from 203.198.168.66 port 59309 ssh2
-Sep 29 03:48:55 [sshd] Failed password for illegal user noc from 203.198.168.66 port 59351 ssh2
-Sep 29 03:48:58 [sshd] Failed password for illegal user root from 203.198.168.66 port 59395 ssh2
-Sep 29 03:49:01 [sshd] Failed password for illegal user root from 203.198.168.66 port 59432 ssh2
-Sep 29 03:49:04 [sshd] Failed password for illegal user root from 203.198.168.66 port 59479 ssh2
-Sep 29 03:49:07 [sshd] Failed password for illegal user root from 203.198.168.66 port 59951 ssh2
-Sep 29 03:49:11 [sshd] Failed password for illegal user webmaster from 203.198.168.66 port 60006 ssh2
-Sep 29 03:49:14 [sshd] Failed password for illegal user data from 203.198.168.66 port 60463 ssh2
-Sep 29 03:49:17 [sshd] Failed password for illegal user user from 203.198.168.66 port 60880 ssh2
-Sep 29 03:49:20 [sshd] Failed password for illegal user user from 203.198.168.66 port 60947 ssh2
-Sep 29 03:49:23 [sshd] Failed password for illegal user user from 203.198.168.66 port 33137 ssh2
-Sep 29 03:49:26 [sshd] Failed password for illegal user web from 203.198.168.66 port 33572 ssh2
-Sep 29 03:49:31 [sshd] Failed password for illegal user web from 203.198.168.66 port 33630 ssh2
-Sep 29 03:49:34 [sshd] Failed password for illegal user oracle from 203.198.168.66 port 34129 ssh2
-Sep 29 03:49:39 [sshd] Failed password for illegal user sybase from 203.198.168.66 port 34558 ssh2
-Sep 29 03:49:42 [sshd] Failed password for illegal user master from 203.198.168.66 port 35018 ssh2
-Sep 29 03:49:45 [sshd] Failed password for illegal user account from 203.198.168.66 port 35095 ssh2
-Sep 29 03:49:48 [sshd] Failed password for illegal user backup from 203.198.168.66 port 35506 ssh2
-Sep 29 03:49:51 [sshd] Failed password for illegal user server from 203.198.168.66 port 35935 ssh2
-Sep 29 03:49:54 [sshd] Failed password for illegal user adam from 203.198.168.66 port 36016 ssh2
-Sep 29 03:49:57 [sshd] Failed password for illegal user alan from 203.198.168.66 port 36399 ssh2
-Sep 29 03:49:59 [sshd] Failed password for illegal user frank from 203.198.168.66 port 36488 ssh2
-Sep 29 03:50:04 [sshd] Failed password for illegal user george from 203.198.168.66 port 36876 ssh2
-Sep 29 03:50:07 [sshd] Failed password for illegal user henry from 203.198.168.66 port 37333 ssh2
-Sep 29 03:50:11 [sshd] Failed password for illegal user john from 203.198.168.66 port 37423 ssh2
-Sep 29 03:50:14 [sshd] Failed password for illegal user root from 203.198.168.66 port 37837 ssh2
-Sep 29 03:50:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 38210 ssh2
-Sep 29 03:50:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 38286 ssh2
-Sep 29 03:50:22 [sshd] Failed password for illegal user root from 203.198.168.66 port 38653 ssh2
-Sep 29 03:50:26 [sshd] Failed password for illegal user root from 203.198.168.66 port 38749 ssh2
-Sep 29 03:50:29 [sshd] Failed password for illegal user test from 203.198.168.66 port 39162 ssh2
-Sep 29 10:19:26 [sshd] Failed password for illegal user test from 24.19.0.105 port 3765 ssh2
-Sep 29 10:19:32 [sshd] Failed password for illegal user guest from 24.19.0.105 port 3846 ssh2
-Sep 29 10:19:39 [sshd] Failed password for illegal user admin from 24.19.0.105 port 3929 ssh2
-Sep 29 10:19:45 [sshd] Failed password for illegal user admin from 24.19.0.105 port 3992 ssh2
-Sep 29 10:19:49 [sshd] Failed password for illegal user user from 24.19.0.105 port 4057 ssh2
-Sep 29 10:19:54 [sshd] Failed password for illegal user root from 24.19.0.105 port 4115 ssh2
-Sep 29 10:19:58 [sshd] Failed password for illegal user root from 24.19.0.105 port 4170 ssh2
-Sep 29 10:20:01 [sshd] Failed password for illegal user root from 24.19.0.105 port 4202 ssh2
-Sep 29 10:20:04 [sshd] Failed password for illegal user test from 24.19.0.105 port 4242 ssh2
-Oct  1 15:53:46 [sshd] Failed password for illegal user test from 210.51.173.75 port 40940 ssh2
-Oct  1 15:53:53 [sshd] Failed password for illegal user guest from 210.51.173.75 port 41196 ssh2
-Oct  1 15:53:59 [sshd] Failed password for illegal user admin from 210.51.173.75 port 41480 ssh2
-Oct  1 15:54:05 [sshd] Failed password for illegal user admin from 210.51.173.75 port 41738 ssh2
-Oct  1 15:54:12 [sshd] Failed password for illegal user user from 210.51.173.75 port 42036 ssh2
-Oct  1 15:54:18 [sshd] Failed password for illegal user root from 210.51.173.75 port 42393 ssh2
-Oct  1 15:54:24 [sshd] Failed password for illegal user root from 210.51.173.75 port 42721 ssh2
-Oct  1 15:54:30 [sshd] Failed password for illegal user root from 210.51.173.75 port 42984 ssh2
-Oct  1 15:54:36 [sshd] Failed password for illegal user test from 210.51.173.75 port 43299 ssh2
-Oct  2 20:24:36 [sshd] Failed password for illegal user test from 220.64.223.249 port 2460 ssh2
-Oct  2 20:24:39 [sshd] Failed password for illegal user guest from 220.64.223.249 port 2527 ssh2
-Oct  2 20:24:42 [sshd] Failed password for illegal user admin from 220.64.223.249 port 2584 ssh2
-Oct  2 20:24:45 [sshd] Failed password for illegal user admin from 220.64.223.249 port 2645 ssh2
-Oct  2 20:24:48 [sshd] Failed password for illegal user user from 220.64.223.249 port 2708 ssh2
-Oct  2 20:24:51 [sshd] Failed password for illegal user root from 220.64.223.249 port 2794 ssh2
-Oct  2 20:24:54 [sshd] Failed password for illegal user root from 220.64.223.249 port 2868 ssh2
-Oct  2 20:24:58 [sshd] Failed password for illegal user root from 220.64.223.249 port 2931 ssh2
-Oct  2 20:25:01 [sshd] Failed password for illegal user test from 220.64.223.249 port 2994 ssh2
-Oct  3 02:17:47 [sshd] Failed password for illegal user nobody from 216.65.197.170 port 54324 ssh2
-Oct  3 02:17:48 [sshd] Failed password for illegal user patrick from 216.65.197.170 port 54491 ssh2
-Oct  3 02:17:50 [sshd] Failed password for illegal user patrick from 216.65.197.170 port 54669 ssh2
-Oct  3 02:17:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 54845 ssh2
-Oct  3 02:17:53 [sshd] Failed password for illegal user root from 216.65.197.170 port 55021 ssh2
-Oct  3 02:17:55 [sshd] Failed password for illegal user root from 216.65.197.170 port 55201 ssh2
-Oct  3 02:17:57 [sshd] Failed password for illegal user root from 216.65.197.170 port 55381 ssh2
-Oct  3 02:17:59 [sshd] Failed password for illegal user root from 216.65.197.170 port 55553 ssh2
-Oct  3 02:18:00 [sshd] Failed password for illegal user rolo from 216.65.197.170 port 55730 ssh2
-Oct  3 02:18:02 [sshd] Failed password for illegal user iceuser from 216.65.197.170 port 55892 ssh2
-Oct  3 02:18:04 [sshd] Failed password for illegal user horde from 216.65.197.170 port 56054 ssh2
-Oct  3 02:18:05 [sshd] Failed password for illegal user cyrus from 216.65.197.170 port 56231 ssh2
-Oct  3 02:18:07 [sshd] Failed password for illegal user www from 216.65.197.170 port 56412 ssh2
-Oct  3 02:18:09 [sshd] Failed password for illegal user wwwrun from 216.65.197.170 port 56594 ssh2
-Oct  3 02:18:11 [sshd] Failed password for illegal user matt from 216.65.197.170 port 56755 ssh2
-Oct  3 02:18:12 [sshd] Failed password for illegal user test from 216.65.197.170 port 56928 ssh2
-Oct  3 02:18:14 [sshd] Failed password for illegal user test from 216.65.197.170 port 57112 ssh2
-Oct  3 02:18:16 [sshd] Failed password for illegal user test from 216.65.197.170 port 57292 ssh2
-Oct  3 02:18:17 [sshd] Failed password for illegal user test from 216.65.197.170 port 57465 ssh2
-Oct  3 02:18:19 [sshd] Failed password for illegal user www-data from 216.65.197.170 port 57631 ssh2
-Oct  3 02:18:21 [sshd] Failed password for illegal user mysql from 216.65.197.170 port 57802 ssh2
-Oct  3 02:18:22 [sshd] Failed password for illegal user operator from 216.65.197.170 port 57989 ssh2
-Oct  3 02:18:24 [sshd] Failed password for illegal user adm from 216.65.197.170 port 58151 ssh2
-Oct  3 02:18:26 [sshd] Failed password for illegal user apache from 216.65.197.170 port 58319 ssh2
-Oct  3 02:18:28 [sshd] Failed password for illegal user irc from 216.65.197.170 port 58492 ssh2
-Oct  3 02:18:29 [sshd] Failed password for illegal user irc from 216.65.197.170 port 58662 ssh2
-Oct  3 02:18:31 [sshd] Failed password for illegal user adm from 216.65.197.170 port 58818 ssh2
-Oct  3 02:18:33 [sshd] Failed password for illegal user root from 216.65.197.170 port 58976 ssh2
-Oct  3 02:18:34 [sshd] Failed password for illegal user root from 216.65.197.170 port 59147 ssh2
-Oct  3 02:18:36 [sshd] Failed password for illegal user root from 216.65.197.170 port 59306 ssh2
-Oct  3 02:18:38 [sshd] Failed password for illegal user jane from 216.65.197.170 port 59474 ssh2
-Oct  3 02:18:40 [sshd] Failed password for illegal user pamela from 216.65.197.170 port 59644 ssh2
-Oct  3 02:18:41 [sshd] Failed password for illegal user root from 216.65.197.170 port 59797 ssh2
-Oct  3 02:18:43 [sshd] Failed password for illegal user root from 216.65.197.170 port 59963 ssh2
-Oct  3 02:18:45 [sshd] Failed password for illegal user root from 216.65.197.170 port 60139 ssh2
-Oct  3 02:18:47 [sshd] Failed password for illegal user root from 216.65.197.170 port 60308 ssh2
-Oct  3 02:18:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 60479 ssh2
-Oct  3 02:18:50 [sshd] Failed password for illegal user cosmin from 216.65.197.170 port 60654 ssh2
-Oct  3 02:18:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 60830 ssh2
-Oct  3 02:18:54 [sshd] Failed password for illegal user root from 216.65.197.170 port 60992 ssh2
-Oct  3 02:18:55 [sshd] Failed password for illegal user root from 216.65.197.170 port 32945 ssh2
-Oct  3 02:18:58 [sshd] Failed password for illegal user root from 216.65.197.170 port 33101 ssh2
-Oct  3 02:18:59 [sshd] Failed password for illegal user root from 216.65.197.170 port 33343 ssh2
-Oct  3 02:19:02 [sshd] Failed password for illegal user root from 216.65.197.170 port 33501 ssh2
-Oct  3 02:19:03 [sshd] Failed password for illegal user root from 216.65.197.170 port 33733 ssh2
-Oct  3 02:19:05 [sshd] Failed password for illegal user root from 216.65.197.170 port 33892 ssh2
-Oct  3 02:19:07 [sshd] Failed password for illegal user root from 216.65.197.170 port 34066 ssh2
-Oct  3 02:19:08 [sshd] Failed password for illegal user root from 216.65.197.170 port 34212 ssh2
-Oct  3 02:19:10 [sshd] Failed password for illegal user root from 216.65.197.170 port 34376 ssh2
-Oct  3 02:19:12 [sshd] Failed password for illegal user root from 216.65.197.170 port 34535 ssh2
-Oct  3 02:19:14 [sshd] Failed password for illegal user root from 216.65.197.170 port 34704 ssh2
-Oct  3 02:19:16 [sshd] Failed password for illegal user root from 216.65.197.170 port 34853 ssh2
-Oct  3 02:19:18 [sshd] Failed password for illegal user root from 216.65.197.170 port 35092 ssh2
-Oct  3 02:19:19 [sshd] Failed password for illegal user root from 216.65.197.170 port 35261 ssh2
-Oct  3 02:19:21 [sshd] Failed password for illegal user root from 216.65.197.170 port 35425 ssh2
-Oct  3 02:19:23 [sshd] Failed password for illegal user root from 216.65.197.170 port 35583 ssh2
-Oct  3 02:19:24 [sshd] Failed password for illegal user root from 216.65.197.170 port 35753 ssh2
-Oct  3 02:19:26 [sshd] Failed password for illegal user root from 216.65.197.170 port 35901 ssh2
-Oct  3 02:19:28 [sshd] Failed password for illegal user root from 216.65.197.170 port 36068 ssh2
-Oct  3 02:19:30 [sshd] Failed password for illegal user root from 216.65.197.170 port 36227 ssh2
-Oct  3 02:19:33 [sshd] Failed password for illegal user root from 216.65.197.170 port 36453 ssh2
-Oct  3 02:19:34 [sshd] Failed password for illegal user root from 216.65.197.170 port 36673 ssh2
-Oct  3 02:19:36 [sshd] Failed password for illegal user root from 216.65.197.170 port 36823 ssh2
-Oct  3 02:19:38 [sshd] Failed password for illegal user root from 216.65.197.170 port 36981 ssh2
-Oct  3 02:19:39 [sshd] Failed password for illegal user root from 216.65.197.170 port 37152 ssh2
-Oct  3 02:19:41 [sshd] Failed password for illegal user root from 216.65.197.170 port 37310 ssh2
-Oct  3 02:19:43 [sshd] Failed password for illegal user root from 216.65.197.170 port 37484 ssh2
-Oct  3 02:19:45 [sshd] Failed password for illegal user root from 216.65.197.170 port 37644 ssh2
-Oct  3 02:19:46 [sshd] Failed password for illegal user root from 216.65.197.170 port 37827 ssh2
-Oct  3 02:19:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 37989 ssh2
-Oct  3 02:19:50 [sshd] Failed password for illegal user root from 216.65.197.170 port 38163 ssh2
-Oct  3 02:19:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 38329 ssh2
-Oct  3 02:19:54 [sshd] Failed password for illegal user root from 216.65.197.170 port 38559 ssh2
-Oct  3 02:19:56 [sshd] Failed password for illegal user root from 216.65.197.170 port 38735 ssh2
-Oct  3 02:19:58 [sshd] Failed password for illegal user cip52 from 216.65.197.170 port 38893 ssh2
-Oct  3 02:20:00 [sshd] Failed password for illegal user cip51 from 216.65.197.170 port 39109 ssh2
-Oct  3 02:20:01 [sshd] Failed password for illegal user root from 216.65.197.170 port 39282 ssh2
-Oct  3 02:20:03 [sshd] Failed password for illegal user noc from 216.65.197.170 port 39448 ssh2
-Oct  3 02:20:05 [sshd] Failed password for illegal user root from 216.65.197.170 port 39621 ssh2
-Oct  3 02:20:06 [sshd] Failed password for illegal user root from 216.65.197.170 port 39781 ssh2
-Oct  3 02:20:08 [sshd] Failed password for illegal user root from 216.65.197.170 port 39958 ssh2
-Oct  3 02:20:10 [sshd] Failed password for illegal user root from 216.65.197.170 port 40125 ssh2
-Oct  3 02:20:12 [sshd] Failed password for illegal user webmaster from 216.65.197.170 port 40316 ssh2
-Oct  3 02:20:13 [sshd] Failed password for illegal user data from 216.65.197.170 port 40473 ssh2
-Oct  3 02:20:15 [sshd] Failed password for illegal user user from 216.65.197.170 port 40645 ssh2
-Oct  3 02:20:17 [sshd] Failed password for illegal user user from 216.65.197.170 port 40800 ssh2
-Oct  3 02:20:19 [sshd] Failed password for illegal user user from 216.65.197.170 port 40965 ssh2
-Oct  3 02:20:20 [sshd] Failed password for illegal user web from 216.65.197.170 port 41120 ssh2
-Oct  3 02:20:22 [sshd] Failed password for illegal user web from 216.65.197.170 port 41300 ssh2
-Oct  3 02:20:24 [sshd] Failed password for illegal user oracle from 216.65.197.170 port 41468 ssh2
-Oct  3 02:20:25 [sshd] Failed password for illegal user sybase from 216.65.197.170 port 41642 ssh2
-Oct  3 02:20:27 [sshd] Failed password for illegal user master from 216.65.197.170 port 41809 ssh2
-Oct  3 02:20:29 [sshd] Failed password for illegal user account from 216.65.197.170 port 41987 ssh2
-Oct  3 02:20:31 [sshd] Failed password for illegal user backup from 216.65.197.170 port 42143 ssh2
-Oct  3 02:20:32 [sshd] Failed password for illegal user server from 216.65.197.170 port 42316 ssh2
-Oct  3 02:20:34 [sshd] Failed password for illegal user adam from 216.65.197.170 port 42481 ssh2
-Oct  3 02:20:36 [sshd] Failed password for illegal user alan from 216.65.197.170 port 42647 ssh2
-Oct  3 02:20:37 [sshd] Failed password for illegal user frank from 216.65.197.170 port 42817 ssh2
-Oct  3 02:20:39 [sshd] Failed password for illegal user george from 216.65.197.170 port 42993 ssh2
-Oct  3 02:20:41 [sshd] Failed password for illegal user henry from 216.65.197.170 port 43170 ssh2
-Oct  3 02:20:43 [sshd] Failed password for illegal user john from 216.65.197.170 port 43319 ssh2
-Oct  3 02:20:44 [sshd] Failed password for illegal user root from 216.65.197.170 port 43504 ssh2
-Oct  3 02:20:46 [sshd] Failed password for illegal user root from 216.65.197.170 port 43664 ssh2
-Oct  3 02:20:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 43844 ssh2
-Oct  3 02:20:49 [sshd] Failed password for illegal user root from 216.65.197.170 port 44008 ssh2
-Oct  3 02:20:51 [sshd] Failed password for illegal user root from 216.65.197.170 port 44182 ssh2
-Oct  3 02:20:53 [sshd] Failed password for illegal user test from 216.65.197.170 port 44338 ssh2
-Oct  3 06:37:34 [sshd] Failed password for illegal user nobody from 217.56.33.194 port 1969 ssh2
-Oct  3 06:37:36 [sshd] Failed password for illegal user patrick from 217.56.33.194 port 2002 ssh2
-Oct  3 06:37:37 [sshd] Failed password for illegal user patrick from 217.56.33.194 port 2039 ssh2
-Oct  3 06:37:38 [sshd] Failed password for illegal user root from 217.56.33.194 port 2070 ssh2
-Oct  3 06:37:40 [sshd] Failed password for illegal user root from 217.56.33.194 port 2109 ssh2
-Oct  3 06:37:41 [sshd] Failed password for illegal user root from 217.56.33.194 port 2142 ssh2
-Oct  3 06:37:42 [sshd] Failed password for illegal user root from 217.56.33.194 port 2173 ssh2
-Oct  3 06:37:44 [sshd] Failed password for illegal user root from 217.56.33.194 port 2211 ssh2
-Oct  3 06:37:45 [sshd] Failed password for illegal user rolo from 217.56.33.194 port 2244 ssh2
-Oct  3 06:37:46 [sshd] Failed password for illegal user iceuser from 217.56.33.194 port 2272 ssh2
-Oct  3 06:37:48 [sshd] Failed password for illegal user horde from 217.56.33.194 port 2305 ssh2
-Oct  3 06:37:49 [sshd] Failed password for illegal user cyrus from 217.56.33.194 port 2337 ssh2
-Oct  3 06:37:50 [sshd] Failed password for illegal user www from 217.56.33.194 port 2373 ssh2
-Oct  3 06:37:52 [sshd] Failed password for illegal user wwwrun from 217.56.33.194 port 2407 ssh2
-Oct  3 06:37:53 [sshd] Failed password for illegal user matt from 217.56.33.194 port 2439 ssh2
-Oct  3 06:37:55 [sshd] Failed password for illegal user test from 217.56.33.194 port 2466 ssh2
-Oct  3 06:37:56 [sshd] Failed password for illegal user test from 217.56.33.194 port 2501 ssh2
-Oct  3 06:37:57 [sshd] Failed password for illegal user test from 217.56.33.194 port 2533 ssh2
-Oct  3 06:37:59 [sshd] Failed password for illegal user test from 217.56.33.194 port 2567 ssh2
-Oct  3 06:38:00 [sshd] Failed password for illegal user www-data from 217.56.33.194 port 2605 ssh2
-Oct  3 06:38:01 [sshd] Failed password for illegal user mysql from 217.56.33.194 port 2635 ssh2
-Oct  3 06:38:03 [sshd] Failed password for illegal user operator from 217.56.33.194 port 2667 ssh2
-Oct  3 06:38:04 [sshd] Failed password for illegal user adm from 217.56.33.194 port 2697 ssh2
-Oct  3 06:38:05 [sshd] Failed password for illegal user apache from 217.56.33.194 port 2733 ssh2
-Oct  3 06:38:07 [sshd] Failed password for illegal user irc from 217.56.33.194 port 2768 ssh2
-Oct  3 06:38:08 [sshd] Failed password for illegal user irc from 217.56.33.194 port 2804 ssh2
-Oct  3 06:38:09 [sshd] Failed password for illegal user adm from 217.56.33.194 port 2837 ssh2
-Oct  3 06:38:11 [sshd] Failed password for illegal user root from 217.56.33.194 port 2872 ssh2
-Oct  3 06:38:13 [sshd] Failed password for illegal user root from 217.56.33.194 port 2907 ssh2
-Oct  3 06:38:14 [sshd] Failed password for illegal user root from 217.56.33.194 port 2950 ssh2
-Oct  3 06:38:16 [sshd] Failed password for illegal user jane from 217.56.33.194 port 2986 ssh2
-Oct  3 06:38:17 [sshd] Failed password for illegal user pamela from 217.56.33.194 port 3019 ssh2
-Oct  3 06:38:18 [sshd] Failed password for illegal user root from 217.56.33.194 port 3053 ssh2
-Oct  3 06:38:20 [sshd] Failed password for illegal user root from 217.56.33.194 port 3085 ssh2
-Oct  3 06:38:21 [sshd] Failed password for illegal user root from 217.56.33.194 port 3115 ssh2
-Oct  3 06:38:22 [sshd] Failed password for illegal user root from 217.56.33.194 port 3147 ssh2
-Oct  3 06:38:24 [sshd] Failed password for illegal user root from 217.56.33.194 port 3177 ssh2
-Oct  3 06:38:25 [sshd] Failed password for illegal user cosmin from 217.56.33.194 port 3208 ssh2
-Oct  3 06:38:26 [sshd] Failed password for illegal user root from 217.56.33.194 port 3239 ssh2
-Oct  3 06:38:28 [sshd] Failed password for illegal user root from 217.56.33.194 port 3272 ssh2
-Oct  3 06:38:29 [sshd] Failed password for illegal user root from 217.56.33.194 port 3302 ssh2
-Oct  3 06:38:30 [sshd] Failed password for illegal user root from 217.56.33.194 port 3336 ssh2
-Oct  3 06:38:32 [sshd] Failed password for illegal user root from 217.56.33.194 port 3367 ssh2
-Oct  3 06:38:33 [sshd] Failed password for illegal user root from 217.56.33.194 port 3403 ssh2
-Oct  3 06:38:34 [sshd] Failed password for illegal user root from 217.56.33.194 port 3432 ssh2
-Oct  3 06:38:36 [sshd] Failed password for illegal user root from 217.56.33.194 port 3458 ssh2
-Oct  3 06:38:37 [sshd] Failed password for illegal user root from 217.56.33.194 port 3494 ssh2
-Oct  3 06:38:38 [sshd] Failed password for illegal user root from 217.56.33.194 port 3525 ssh2
-Oct  3 06:38:40 [sshd] Failed password for illegal user root from 217.56.33.194 port 3554 ssh2
-Oct  3 06:38:41 [sshd] Failed password for illegal user root from 217.56.33.194 port 3590 ssh2
-Oct  3 06:38:42 [sshd] Failed password for illegal user root from 217.56.33.194 port 3623 ssh2
-Oct  3 06:38:44 [sshd] Failed password for illegal user root from 217.56.33.194 port 3654 ssh2
-Oct  3 06:38:45 [sshd] Failed password for illegal user root from 217.56.33.194 port 3690 ssh2
-Oct  3 06:38:46 [sshd] Failed password for illegal user root from 217.56.33.194 port 3720 ssh2
-Oct  3 06:38:48 [sshd] Failed password for illegal user root from 217.56.33.194 port 3752 ssh2
-Oct  3 06:38:49 [sshd] Failed password for illegal user root from 217.56.33.194 port 3785 ssh2
-Oct  3 06:38:51 [sshd] Failed password for illegal user root from 217.56.33.194 port 3817 ssh2
-Oct  3 06:38:52 [sshd] Failed password for illegal user root from 217.56.33.194 port 3853 ssh2
-Oct  3 06:38:53 [sshd] Failed password for illegal user root from 217.56.33.194 port 3886 ssh2
-Oct  3 06:38:55 [sshd] Failed password for illegal user root from 217.56.33.194 port 3923 ssh2
-Oct  3 06:38:56 [sshd] Failed password for illegal user root from 217.56.33.194 port 3955 ssh2
-Oct  3 06:38:57 [sshd] Failed password for illegal user root from 217.56.33.194 port 3983 ssh2
-Oct  3 06:38:59 [sshd] Failed password for illegal user root from 217.56.33.194 port 4016 ssh2
-Oct  3 06:39:00 [sshd] Failed password for illegal user root from 217.56.33.194 port 4045 ssh2
-Oct  3 06:39:01 [sshd] Failed password for illegal user root from 217.56.33.194 port 4073 ssh2
-Oct  3 06:39:03 [sshd] Failed password for illegal user root from 217.56.33.194 port 4110 ssh2
-Oct  3 06:39:04 [sshd] Failed password for illegal user root from 217.56.33.194 port 4140 ssh2
-Oct  3 06:39:05 [sshd] Failed password for illegal user root from 217.56.33.194 port 4171 ssh2
-Oct  3 06:39:07 [sshd] Failed password for illegal user root from 217.56.33.194 port 4201 ssh2
-Oct  3 06:39:08 [sshd] Failed password for illegal user root from 217.56.33.194 port 4235 ssh2
-Oct  3 06:39:09 [sshd] Failed password for illegal user root from 217.56.33.194 port 4267 ssh2
-Oct  3 06:39:11 [sshd] Failed password for illegal user root from 217.56.33.194 port 4300 ssh2
-Oct  3 06:39:12 [sshd] Failed password for illegal user root from 217.56.33.194 port 4326 ssh2
-Oct  3 06:39:13 [sshd] Failed password for illegal user root from 217.56.33.194 port 4358 ssh2
-Oct  3 06:39:15 [sshd] Failed password for illegal user cip52 from 217.56.33.194 port 4390 ssh2
-Oct  3 06:39:16 [sshd] Failed password for illegal user cip51 from 217.56.33.194 port 4427 ssh2
-Oct  3 06:39:18 [sshd] Failed password for illegal user root from 217.56.33.194 port 4459 ssh2
-Oct  3 06:39:19 [sshd] Failed password for illegal user noc from 217.56.33.194 port 4492 ssh2
-Oct  3 06:39:20 [sshd] Failed password for illegal user root from 217.56.33.194 port 4526 ssh2
-Oct  3 06:39:22 [sshd] Failed password for illegal user root from 217.56.33.194 port 4557 ssh2
-Oct  3 06:39:23 [sshd] Failed password for illegal user root from 217.56.33.194 port 4588 ssh2
-Oct  3 06:39:24 [sshd] Failed password for illegal user root from 217.56.33.194 port 4618 ssh2
-Oct  3 06:39:26 [sshd] Failed password for illegal user webmaster from 217.56.33.194 port 4652 ssh2
-Oct  3 06:39:27 [sshd] Failed password for illegal user data from 217.56.33.194 port 4679 ssh2
-Oct  3 06:39:28 [sshd] Failed password for illegal user user from 217.56.33.194 port 4716 ssh2
-Oct  3 06:39:30 [sshd] Failed password for illegal user user from 217.56.33.194 port 4744 ssh2
-Oct  3 06:39:31 [sshd] Failed password for illegal user user from 217.56.33.194 port 4777 ssh2
-Oct  3 06:39:32 [sshd] Failed password for illegal user web from 217.56.33.194 port 4808 ssh2
-Oct  3 06:39:34 [sshd] Failed password for illegal user web from 217.56.33.194 port 4842 ssh2
-Oct  3 06:39:35 [sshd] Failed password for illegal user oracle from 217.56.33.194 port 4869 ssh2
-Oct  3 06:39:36 [sshd] Failed password for illegal user sybase from 217.56.33.194 port 4899 ssh2
-Oct  3 06:39:38 [sshd] Failed password for illegal user master from 217.56.33.194 port 4933 ssh2
-Oct  3 06:39:39 [sshd] Failed password for illegal user account from 217.56.33.194 port 4969 ssh2
-Oct  3 06:39:40 [sshd] Failed password for illegal user backup from 217.56.33.194 port 4999 ssh2
-Oct  3 06:39:42 [sshd] Failed password for illegal user server from 217.56.33.194 port 1051 ssh2
-Oct  3 06:39:43 [sshd] Failed password for illegal user adam from 217.56.33.194 port 1082 ssh2
-Oct  3 06:39:44 [sshd] Failed password for illegal user alan from 217.56.33.194 port 1114 ssh2
-Oct  3 06:39:46 [sshd] Failed password for illegal user frank from 217.56.33.194 port 1141 ssh2
-Oct  3 06:39:47 [sshd] Failed password for illegal user george from 217.56.33.194 port 1174 ssh2
-Oct  3 06:39:49 [sshd] Failed password for illegal user henry from 217.56.33.194 port 1205 ssh2
-Oct  3 06:39:50 [sshd] Failed password for illegal user john from 217.56.33.194 port 1236 ssh2
-Oct  3 06:39:51 [sshd] Failed password for illegal user root from 217.56.33.194 port 1271 ssh2
-Oct  3 06:39:53 [sshd] Failed password for illegal user root from 217.56.33.194 port 1300 ssh2
-Oct  3 06:39:55 [sshd] Failed password for illegal user root from 217.56.33.194 port 1332 ssh2
-Oct  3 06:39:56 [sshd] Failed password for illegal user root from 217.56.33.194 port 1380 ssh2
-Oct  3 06:39:57 [sshd] Failed password for illegal user root from 217.56.33.194 port 1412 ssh2
-Oct  3 06:39:59 [sshd] Failed password for illegal user test from 217.56.33.194 port 1449 ssh2
-Oct  4 04:43:59 [sshd] Failed password for illegal user test from 212.204.226.21 port 60349 ssh2
-Oct  4 04:44:03 [sshd] Failed password for illegal user guest from 212.204.226.21 port 60394 ssh2
-Oct  4 04:44:06 [sshd] Failed password for illegal user admin from 212.204.226.21 port 60540 ssh2
-Oct  4 04:44:08 [sshd] Failed password for illegal user admin from 212.204.226.21 port 60620 ssh2
-Oct  4 04:44:11 [sshd] Failed password for illegal user user from 212.204.226.21 port 60679 ssh2
-Oct  4 04:44:14 [sshd] Failed password for illegal user root from 212.204.226.21 port 60773 ssh2
-Oct  4 04:44:15 [sshd] Failed password for illegal user root from 212.204.226.21 port 60828 ssh2
-Oct  4 04:44:18 [sshd] Failed password for illegal user root from 212.204.226.21 port 60880 ssh2
-Oct  4 04:44:21 [sshd] Failed password for illegal user test from 212.204.226.21 port 60957 ssh2
-Oct  4 09:32:21 [sshd] Failed password for illegal user test from 62.141.56.70 port 45600 ssh2
-Oct  4 09:32:27 [sshd] Failed password for illegal user guest from 62.141.56.70 port 47635 ssh2
-Oct  4 09:32:32 [sshd] Failed password for illegal user admin from 62.141.56.70 port 49967 ssh2
-Oct  4 09:32:37 [sshd] Failed password for illegal user admin from 62.141.56.70 port 52093 ssh2
-Oct  4 09:32:42 [sshd] Failed password for illegal user user from 62.141.56.70 port 53840 ssh2
-Oct  4 09:32:47 [sshd] Failed password for illegal user root from 62.141.56.70 port 55568 ssh2
-Oct  4 09:32:51 [sshd] Failed password for illegal user root from 62.141.56.70 port 57526 ssh2
-Oct  4 09:32:51 [sshd] Failed password for illegal user root from 62.141.56.70 port 58454 ssh2
-Oct  4 09:32:52 [sshd] Failed password for illegal user test from 62.141.56.70 port 58819 ssh2
-Oct  4 14:09:11 [sshd] Failed password for illegal user test from 211.234.125.100 port 46642 ssh2
-Oct  4 14:09:18 [sshd] Failed password for illegal user guest from 211.234.125.100 port 46788 ssh2
-Oct  4 14:09:23 [sshd] Failed password for illegal user admin from 211.234.125.100 port 46886 ssh2
-Oct  4 14:09:30 [sshd] Failed password for illegal user admin from 211.234.125.100 port 46960 ssh2
-Oct  4 14:09:43 [sshd] Failed password for illegal user user from 211.234.125.100 port 47025 ssh2
-Oct  6 04:13:11 [sshd] Failed password for illegal user test from 64.246.30.17 port 58277 ssh2
-Oct  6 04:13:13 [sshd] Failed password for illegal user guest from 64.246.30.17 port 58360 ssh2
-Oct  6 04:13:15 [sshd] Failed password for illegal user admin from 64.246.30.17 port 58428 ssh2
-Oct  6 04:13:17 [sshd] Failed password for illegal user admin from 64.246.30.17 port 58514 ssh2
-Oct  6 22:13:56 [sshd] Failed password for illegal user test from 61.11.98.217 port 45434 ssh2
-Oct  6 22:14:00 [sshd] Failed password for illegal user guest from 61.11.98.217 port 45586 ssh2
-Oct  6 22:14:05 [sshd] Failed password for illegal user admin from 61.11.98.217 port 45672 ssh2
-Oct  6 22:14:10 [sshd] Failed password for illegal user admin from 61.11.98.217 port 45748 ssh2
-Oct  6 22:14:18 [sshd] Failed password for illegal user user from 61.11.98.217 port 45833 ssh2
-Oct  7 00:25:34 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37086 ssh2
-Oct  7 00:25:34 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37086 ssh2
-                - Last output repeated twice -
-Oct  7 00:26:27 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37089 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:26:37 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37092 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:27:21 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37095 ssh2
-                - Last output repeated twice -
-Oct  7 00:51:31 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37130 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:51:48 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37138 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:52:02 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37141 ssh2
-Oct  7 00:56:10 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37153 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:56:41 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37156 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:57:00 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37159 ssh2
-Oct  7 00:58:17 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37162 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:58:29 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37165 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:58:39 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37168 ssh2
-Oct  7 01:00:32 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37171 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:00:44 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37175 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:01:23 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37178 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:03:01 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37181 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:03:12 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37184 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:03:20 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37187 ssh2
-                - Last output repeated 2 times -
-Oct  8 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
-Oct  8 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
-Oct  8 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
-Oct  9 21:54:11 yellow sshd[16069]: Failed password for cyril from 212.41.79.210 port 29404 ssh2
diff --git a/logreader/logreader.py b/logreader/logreader.py
deleted file mode 100644
index 492ed76d..00000000
--- a/logreader/logreader.py
+++ /dev/null
@@ -1,67 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import os, sys
-
-class LogReader:
-	
-	def __init__(self, logPath, findTime = 3600):
-		self.logPath = logPath
-		self.findTime = findTime
-		self.ignoreIpList = []
-		self.lastModTime = 0
-	
-	def addIgnoreIP(self, ip):
-		self.ignoreIpList.append(ip)
-		
-	def inIgnoreIPList(self, ip):
-		return ip in self.ignoreIpList
-	
-	def openLogFile(self):
-		try:
-			fileHandler = open(self.logPath)
-		except OSError:
-			print "Unable to open", self.logPath
-			sys.exit(-1)
-		return fileHandler
-		
-	def isModified(self):
-		try:
-			logStats = os.stat(self.logPath)
-		except OSError:
-			print "Unable to get stat on", logPath
-			sys.exit(-1)
-		
-		if self.lastModTime == logStats.st_mtime:
-			return False
-		else:
-			print self.logPath, 'has been modified'
-			self.lastModTime = logStats.st_mtime
-			return True
-	
-	def getPwdFailure(self):
-		failList = self.getFailInfo(self.findTime)
-		return failList
diff --git a/logreader/metalog.py b/logreader/metalog.py
deleted file mode 100644
index 20a64766..00000000
--- a/logreader/metalog.py
+++ /dev/null
@@ -1,65 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import re, time
-
-from logreader import LogReader
-
-class Metalog(LogReader):
-	
-	def getFailInfo(self, findTime):
-		ipList = dict()
-		logFile = self.openLogFile()
-		for line in logFile.readlines():
-			match = self.parseLogLine(line)
-			if match:
-				ip = match[0]
-				unixTime = match[1]
-				if unixTime < time.time()-self.findTime:
-					continue
-				if self.inIgnoreIPList(ip):
-					print 'Ignore', ip
-					continue
-				print 'Found', ip, 'at', unixTime
-				if ipList.has_key(ip):
-					ipList[ip] = (ipList[ip][0]+1, unixTime)
-				else:
-					ipList[ip] = (1, unixTime)
-		logFile.close()
-		return ipList
-	
-	def parseLogLine(self, line):
-		""" Match sshd failed password log
-		"""
-		if re.search("Failed password", line):
-			matchIP = re.search("(?:\d{1,3}\.){3}\d{1,3}", line)
-			if matchIP:
-				date = list(time.strptime(line[0:15], "%b %d %H:%M:%S"))
-				date[0] = time.gmtime()[0]
-				unixTime = time.mktime(date)
-				return [matchIP.group(), unixTime]
-			else:
-				return False

From 4602bb1bfc8ce9f63aaaa323e1b1b9ecd293cf30 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Oct 2004 23:44:24 +0000
Subject: [PATCH 010/549] - Add this file with .py extension in order to by
 recognize as Python source file with pydev (Eclipse plugin) - Add command
 line options: -v (verbose mode), -h (help), -b (background) - Add daemon
 function found on aspn.activestate.com

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@14 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 176 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 176 insertions(+)
 create mode 100755 fail2ban.py

diff --git a/fail2ban.py b/fail2ban.py
new file mode 100755
index 00000000..4acae8e3
--- /dev/null
+++ b/fail2ban.py
@@ -0,0 +1,176 @@
+#!/usr/bin/env python
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import posix, time, sys, getopt, os, signal
+
+from firewall.iptables import Iptables
+from logreader.metalog import Metalog
+
+def usage():
+	print "fail2ban [-h][-v][-b]"
+	sys.exit(0)
+
+def checkForRoot():
+	""" Check for root user.
+	"""
+	uid = `posix.getuid()`
+	if uid == '0':
+		return True
+	else:
+		return False
+
+def createDaemon():
+	"""Detach a process from the controlling terminal and run it in the
+	background as a daemon.
+	
+	http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
+	"""
+
+	try:
+		# Fork a child process so the parent can exit.  This will return control
+		# to the command line or shell.  This is required so that the new process
+		# is guaranteed not to be a process group leader.  We have this guarantee
+		# because the process GID of the parent is inherited by the child, but
+		# the child gets a new PID, making it impossible for its PID to equal its
+		# PGID.
+		pid = os.fork()
+	except OSError, e:
+		return((e.errno, e.strerror))	 # ERROR (return a tuple)
+
+	if (pid == 0):	   # The first child.
+
+		# Next we call os.setsid() to become the session leader of this new
+		# session.  The process also becomes the process group leader of the
+		# new process group.  Since a controlling terminal is associated with a
+		# session, and this new session has not yet acquired a controlling
+		# terminal our process now has no controlling terminal.  This shouldn't
+		# fail, since we're guaranteed that the child is not a process group
+		# leader.
+		os.setsid()
+	
+		# When the first child terminates, all processes in the second child
+		# are sent a SIGHUP, so it's ignored.
+		signal.signal(signal.SIGHUP, signal.SIG_IGN)
+	
+		try:
+			# Fork a second child to prevent zombies.  Since the first child is
+			# a session leader without a controlling terminal, it's possible for
+			# it to acquire one by opening a terminal in the future.  This second
+			# fork guarantees that the child is no longer a session leader, thus
+			# preventing the daemon from ever acquiring a controlling terminal.
+			pid = os.fork()		# Fork a second child.
+		except OSError, e:
+			return((e.errno, e.strerror))  # ERROR (return a tuple)
+	
+		if (pid == 0):	  # The second child.
+			# Ensure that the daemon doesn't keep any directory in use.  Failure
+			# to do this could make a filesystem unmountable.
+			#os.chdir("/")
+			# Give the child complete control over permissions.
+			os.umask(0)
+		else:
+			os._exit(0)	  # Exit parent (the first child) of the second child.
+	else:
+		os._exit(0)		 # Exit parent of the first child.
+
+	# Close all open files.  Try the system configuration variable, SC_OPEN_MAX,
+	# for the maximum number of open files to close.  If it doesn't exist, use
+	# the default value (configurable).
+	try:
+		maxfd = os.sysconf("SC_OPEN_MAX")
+	except (AttributeError, ValueError):
+		maxfd = 256	   # default maximum
+
+	for fd in range(0, maxfd):
+		try:
+			os.close(fd)
+		except OSError:   # ERROR (ignore)
+			pass
+
+	# Redirect the standard file descriptors to /dev/null.
+   	os.open("/dev/null", os.O_RDONLY)	# standard input (0)
+	#os.open("/dev/null", os.O_RDWR)	   # standard output (1)
+	os.open("/tmp/fail2ban.log", os.O_CREAT|os.O_APPEND|os.O_RDWR)	   # standard output (1)
+	#os.open("/dev/null", os.O_RDWR)	   # standard error (2)
+	os.open("/tmp/fail2ban.log", os.O_CREAT|os.O_APPEND|os.O_RDWR)	   # standard error (2)
+
+	return(0)
+
+
+if __name__ == "__main__":
+	
+	try:
+		optList, args = getopt.getopt(sys.argv[1:], 'hvb')
+	except getopt.GetoptError:
+		usage()
+
+	verbose = False
+	for opt in optList:
+		if opt[0] == "-h":
+			usage()
+		if opt[0] == "-v":
+			verbose = True
+		if opt[0] == "-b":
+			retCode = createDaemon()
+			if retCode != 0:
+				print "Unable to start daemon"
+				sys.exit(-1)
+	
+	if not checkForRoot():
+		print "You must be root."
+		#sys.exit(-1)
+	
+	fireWall = Iptables(600, verbose = verbose)
+	logFile = Metalog("./log-test/test", 600, verbose = verbose)
+	
+	logFile.addIgnoreIP("127.0.0.1")
+	
+	while True:
+		try:
+			sys.stdout.flush()
+			sys.stderr.flush()
+			
+			fireWall.checkForUnBan()
+			
+			if not logFile.isModified():
+				time.sleep(1)
+				continue
+			
+			failList = logFile.getPwdFailure()
+						
+			iterFailList = failList.iteritems()
+			for i in range(len(failList)):
+				element = iterFailList.next()
+				if element[1][0] > 2:
+					fireWall.addBanIP(element[0])
+			
+		except KeyboardInterrupt:
+			print 'Restoring iptables...'
+			fireWall.flushBanList()
+			print 'Exiting...'
+			sys.exit(0)

From e561e39583ad4b866dbd2153e001b6dbf8201264 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Oct 2004 23:46:58 +0000
Subject: [PATCH 011/549] - Add verbose option

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@15 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/firewall.py   | 15 ++++++++++-----
 logreader/logreader.py |  6 ++++--
 logreader/metalog.py   |  6 ++++--
 3 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/firewall/firewall.py b/firewall/firewall.py
index 76632a75..09e9ccae 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -30,22 +30,25 @@ class Firewall:
 	
 	banList = dict()
 	
-	def __init__(self, banTime):
+	def __init__(self, banTime, verbose = False):
 		self.banTime = banTime
+		self.verbose = verbose
 	
 	def addBanIP(self, ip):
 		if not self.inBanList(ip):
 			self.banList[ip] = time.time()
 			self.executeCmd(self.banIP(ip))
 		else:
-			print ip, "already in ban list"
+			if self.verbose:
+				print ip, "already in ban list"
 	
 	def delBanIP(self, ip):
 		if self.inBanList(ip):
 			del self.banList[ip]
 			self.executeCmd(self.unBanIP(ip))
 		else:
-			print ip, "not in ban list"
+			if self.verbose:
+				print ip, "not in ban list"
 	
 	def inBanList(self, ip):
 		return self.banList.has_key(ip)
@@ -61,7 +64,8 @@ class Firewall:
 			btime = element[1]
 			if btime < time.time()-self.banTime:
 				self.delBanIP(ip)
-				print '`->', time.time()
+				if self.verbose:
+					print '`->', time.time()
 	
 	def flushBanList(self):
 		iterBanList = self.banList.iteritems()
@@ -71,7 +75,8 @@ class Firewall:
 			self.delBanIP(ip)
 	
 	def executeCmd(self, cmd):
-		print cmd
+		if self.verbose:
+			print cmd
 		return #os.system(cmd)
 		
 	def viewBanList(self):
diff --git a/logreader/logreader.py b/logreader/logreader.py
index 492ed76d..f17711f8 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -28,11 +28,12 @@ import os, sys
 
 class LogReader:
 	
-	def __init__(self, logPath, findTime = 3600):
+	def __init__(self, logPath, findTime = 3600, verbose = False):
 		self.logPath = logPath
 		self.findTime = findTime
 		self.ignoreIpList = []
 		self.lastModTime = 0
+		self.verbose = verbose
 	
 	def addIgnoreIP(self, ip):
 		self.ignoreIpList.append(ip)
@@ -58,7 +59,8 @@ class LogReader:
 		if self.lastModTime == logStats.st_mtime:
 			return False
 		else:
-			print self.logPath, 'has been modified'
+			if self.verbose:
+				print self.logPath, 'has been modified'
 			self.lastModTime = logStats.st_mtime
 			return True
 	
diff --git a/logreader/metalog.py b/logreader/metalog.py
index 20a64766..c8e3db12 100644
--- a/logreader/metalog.py
+++ b/logreader/metalog.py
@@ -41,9 +41,11 @@ class Metalog(LogReader):
 				if unixTime < time.time()-self.findTime:
 					continue
 				if self.inIgnoreIPList(ip):
-					print 'Ignore', ip
+					if self.verbose:
+						print 'Ignore', ip
 					continue
-				print 'Found', ip, 'at', unixTime
+				if self.verbose:
+					print 'Found', ip, 'at', unixTime
 				if ipList.has_key(ip):
 					ipList[ip] = (ipList[ip][0]+1, unixTime)
 				else:

From be1755cac12afb93d9c74ce9c5e0295c8ba1a090 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 11 Oct 2004 10:21:56 +0000
Subject: [PATCH 012/549] - Change quoting style

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@16 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/iptables.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/firewall/iptables.py b/firewall/iptables.py
index 8206e631..c06a2dd3 100644
--- a/firewall/iptables.py
+++ b/firewall/iptables.py
@@ -29,9 +29,9 @@ from firewall import Firewall
 class Iptables(Firewall):
 	
 	def banIP(self, ip):
-		query = 'iptables -I INPUT 1 -i eth0 -s '+ip+' -j DROP'
+		query = "iptables -I INPUT 1 -i eth0 -s "+ip+" -j DROP"
 		return query
 	
 	def unBanIP(self, ip):
-		query = 'iptables -D INPUT -i eth0 -s '+ip+' -j DROP'
+		query = "iptables -D INPUT -i eth0 -s "+ip+" -j DROP"
 		return query

From c286d568555896e33cade457d870630e35ea16c4 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 11 Oct 2004 10:22:41 +0000
Subject: [PATCH 013/549] - Add log4py support - Remove old verbose mode - Add
 debug feature

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@17 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/firewall.py | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/firewall/firewall.py b/firewall/firewall.py
index 09e9ccae..72ecc7cd 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -24,36 +24,36 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time
+import time, os
 
 class Firewall:
 	
 	banList = dict()
 	
-	def __init__(self, banTime, verbose = False):
+	def __init__(self, banTime, logSys):
 		self.banTime = banTime
-		self.verbose = verbose
+		self.logSys = logSys
 	
-	def addBanIP(self, ip):
+	def addBanIP(self, ip, debug):
 		if not self.inBanList(ip):
+			self.logSys.info("Ban "+ip)
 			self.banList[ip] = time.time()
-			self.executeCmd(self.banIP(ip))
+			self.executeCmd(self.banIP(ip), debug)
 		else:
-			if self.verbose:
-				print ip, "already in ban list"
+			self.logSys.info(ip+" already in ban list")
 	
-	def delBanIP(self, ip):
+	def delBanIP(self, ip, debug):
 		if self.inBanList(ip):
+			self.logSys.info("Unban "+ip)
 			del self.banList[ip]
-			self.executeCmd(self.unBanIP(ip))
+			self.executeCmd(self.unBanIP(ip), debug)
 		else:
-			if self.verbose:
-				print ip, "not in ban list"
+			self.logSys.info(ip+" not in ban list")
 	
 	def inBanList(self, ip):
 		return self.banList.has_key(ip)
 	
-	def checkForUnBan(self):
+	def checkForUnBan(self, debug):
 		""" Check for user to remove from ban list.
 		"""
 		banListTemp = self.banList.copy()
@@ -63,21 +63,21 @@ class Firewall:
 			ip = element[0]
 			btime = element[1]
 			if btime < time.time()-self.banTime:
-				self.delBanIP(ip)
-				if self.verbose:
-					print '`->', time.time()
+				self.delBanIP(ip, debug)
 	
-	def flushBanList(self):
+	def flushBanList(self, debug):
 		iterBanList = self.banList.iteritems()
 		for i in range(len(self.banList)):
 			element = iterBanList.next()
 			ip = element[0]
-			self.delBanIP(ip)
+			self.delBanIP(ip, debug)
 	
-	def executeCmd(self, cmd):
-		if self.verbose:
-			print cmd
-		return #os.system(cmd)
+	def executeCmd(self, cmd, debug):
+		self.logSys.debug(cmd)
+		if not debug:
+			return os.system(cmd)
+		else:
+			return None
 		
 	def viewBanList(self):
 		iterBanList = self.banList.iteritems()

From a2ea1164b3ed987c8ef9e30874a1c7e4adf079bc Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 11 Oct 2004 10:23:53 +0000
Subject: [PATCH 014/549] - Add log4py support - Remove old verbose mode

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@18 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 11 +++++------
 logreader/metalog.py   |  6 ++----
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index f17711f8..9c134307 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -28,12 +28,12 @@ import os, sys
 
 class LogReader:
 	
-	def __init__(self, logPath, findTime = 3600, verbose = False):
+	def __init__(self, logPath, logSys, findTime = 3600):
 		self.logPath = logPath
 		self.findTime = findTime
 		self.ignoreIpList = []
 		self.lastModTime = 0
-		self.verbose = verbose
+		self.logSys = logSys
 	
 	def addIgnoreIP(self, ip):
 		self.ignoreIpList.append(ip)
@@ -45,7 +45,7 @@ class LogReader:
 		try:
 			fileHandler = open(self.logPath)
 		except OSError:
-			print "Unable to open", self.logPath
+			self.logSys.error("Unable to open "+self.logPath)
 			sys.exit(-1)
 		return fileHandler
 		
@@ -53,14 +53,13 @@ class LogReader:
 		try:
 			logStats = os.stat(self.logPath)
 		except OSError:
-			print "Unable to get stat on", logPath
+			self.logSys.error("Unable to get stat on "+self.logPath)
 			sys.exit(-1)
 		
 		if self.lastModTime == logStats.st_mtime:
 			return False
 		else:
-			if self.verbose:
-				print self.logPath, 'has been modified'
+			self.logSys.debug(self.logPath+" has been modified")
 			self.lastModTime = logStats.st_mtime
 			return True
 	
diff --git a/logreader/metalog.py b/logreader/metalog.py
index c8e3db12..31b4d564 100644
--- a/logreader/metalog.py
+++ b/logreader/metalog.py
@@ -41,11 +41,9 @@ class Metalog(LogReader):
 				if unixTime < time.time()-self.findTime:
 					continue
 				if self.inIgnoreIPList(ip):
-					if self.verbose:
-						print 'Ignore', ip
+					self.logSys.debug("Ignore "+ip)
 					continue
-				if self.verbose:
-					print 'Found', ip, 'at', unixTime
+				self.logSys.debug("Found "+ip)
 				if ipList.has_key(ip):
 					ipList[ip] = (ipList[ip][0]+1, unixTime)
 				else:

From 8eb470019c3884af2f9196a149974f0fd91270e1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 11 Oct 2004 10:26:39 +0000
Subject: [PATCH 015/549] - Add log4py support - Remove old verbose mode - Add
 debug feature - Add option -f <pwdfail file>. This is the log file to read
 from - Add option -l <log file>. This is the file to log fail2ban messages -
 Add option -d. Allow fail2ban to run without root permissions. Do not execute
 OS command

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@19 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 57 +++++++++++++++++++++++++++++++++++------------------
 1 file changed, 38 insertions(+), 19 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index 4acae8e3..895d2092 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -27,12 +27,13 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 import posix, time, sys, getopt, os, signal
+import log4py
 
 from firewall.iptables import Iptables
 from logreader.metalog import Metalog
 
 def usage():
-	print "fail2ban [-h][-v][-b]"
+	print "fail2ban [-h][-v][-b][-d][-f <pwdfail file>][-l <log file>]"
 	sys.exit(0)
 
 def checkForRoot():
@@ -90,7 +91,7 @@ def createDaemon():
 		if (pid == 0):	  # The second child.
 			# Ensure that the daemon doesn't keep any directory in use.  Failure
 			# to do this could make a filesystem unmountable.
-			#os.chdir("/")
+			os.chdir("/")
 			# Give the child complete control over permissions.
 			os.umask(0)
 		else:
@@ -114,39 +115,57 @@ def createDaemon():
 
 	# Redirect the standard file descriptors to /dev/null.
    	os.open("/dev/null", os.O_RDONLY)	# standard input (0)
-	#os.open("/dev/null", os.O_RDWR)	   # standard output (1)
-	os.open("/tmp/fail2ban.log", os.O_CREAT|os.O_APPEND|os.O_RDWR)	   # standard output (1)
-	#os.open("/dev/null", os.O_RDWR)	   # standard error (2)
-	os.open("/tmp/fail2ban.log", os.O_CREAT|os.O_APPEND|os.O_RDWR)	   # standard error (2)
+	os.open("/dev/null", os.O_RDWR)		# standard output (1)
+	os.open("/dev/null", os.O_RDWR)		# standard error (2)
 
 	return(0)
 
 
 if __name__ == "__main__":
 	
+	logSys = log4py.Logger().get_instance()
+	logSys.set_formatstring("%T %L %M")
+	
 	try:
-		optList, args = getopt.getopt(sys.argv[1:], 'hvb')
+		optList, args = getopt.getopt(sys.argv[1:], 'hvbdf:l:')
 	except getopt.GetoptError:
 		usage()
 
-	verbose = False
+	debug = False
+	logFilePath = "/var/log/pwdfail/current"
+	
 	for opt in optList:
 		if opt[0] == "-h":
 			usage()
 		if opt[0] == "-v":
-			verbose = True
+			logSys.set_loglevel(log4py.LOGLEVEL_VERBOSE)
 		if opt[0] == "-b":
 			retCode = createDaemon()
+			logSys.set_target("/tmp/fail2ban.log")
 			if retCode != 0:
-				print "Unable to start daemon"
+				logSys.error("Unable to start daemon")
 				sys.exit(-1)
+		if opt[0] == "-d":
+			debug = True
+			logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
+			logSys.set_formatstring(log4py.FMT_DEBUG)
+		if opt[0] == "-f":
+			logFilePath = opt[1]
+		if opt[0] == "-l":
+			try:
+				open(opt[1], "a")
+				logSys.set_target(opt[1])
+			except IOError:
+				logSys.error("Unable to log to "+opt[1])
+				logSys.error("Use default output for logging")
 	
 	if not checkForRoot():
-		print "You must be root."
-		#sys.exit(-1)
+		logSys.error("You must be root")
+		if not debug:
+			sys.exit(-1)
 	
-	fireWall = Iptables(600, verbose = verbose)
-	logFile = Metalog("./log-test/test", 600, verbose = verbose)
+	fireWall = Iptables(600, logSys)
+	logFile = Metalog(logFilePath, logSys, 600)
 	
 	logFile.addIgnoreIP("127.0.0.1")
 	
@@ -155,7 +174,7 @@ if __name__ == "__main__":
 			sys.stdout.flush()
 			sys.stderr.flush()
 			
-			fireWall.checkForUnBan()
+			fireWall.checkForUnBan(debug)
 			
 			if not logFile.isModified():
 				time.sleep(1)
@@ -167,10 +186,10 @@ if __name__ == "__main__":
 			for i in range(len(failList)):
 				element = iterFailList.next()
 				if element[1][0] > 2:
-					fireWall.addBanIP(element[0])
+					fireWall.addBanIP(element[0], debug)
 			
 		except KeyboardInterrupt:
-			print 'Restoring iptables...'
-			fireWall.flushBanList()
-			print 'Exiting...'
+			logSys.info("Restoring iptables...")
+			fireWall.flushBanList(debug)
+			logSys.info("Exiting...")
 			sys.exit(0)

From bb896fb391ed6fcb63d256eb4c87702b3b323442 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Oct 2004 21:40:50 +0000
Subject: [PATCH 016/549] - Add a debug message when adding ip to ignore list

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@20 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index 9c134307..1e52ace2 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -36,6 +36,7 @@ class LogReader:
 		self.logSys = logSys
 	
 	def addIgnoreIP(self, ip):
+		self.logSys.debug("Add "+ip+" to ignore list")
 		self.ignoreIpList.append(ip)
 		
 	def inIgnoreIPList(self, ip):

From 4eeb61c0e163a429ffeccfa10fb1270e6af98bd4 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Oct 2004 21:44:09 +0000
Subject: [PATCH 017/549] - Update help message - Add -i option: ignore ip
 list. Space separated ip list - Add -t option: ban time in seconds. 600 to
 ban ip for 10 minutes - Add a info message saying that fail2ban is running

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@21 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 44 +++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 39 insertions(+), 5 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index 895d2092..5b813a3a 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -29,11 +29,28 @@ __license__ = "GPL"
 import posix, time, sys, getopt, os, signal
 import log4py
 
+# Appends our own modules path
+sys.path.append('/usr/lib/fail2ban')
+
 from firewall.iptables import Iptables
 from logreader.metalog import Metalog
+from version import version
 
 def usage():
-	print "fail2ban [-h][-v][-b][-d][-f <pwdfail file>][-l <log file>]"
+	print "Usage: fail2ban.py [OPTIONS]"
+	print
+	print "Fail2Ban v"+version+" reads log file that contains password failure report"
+	print "and bans the corresponding IP address using iptables."
+	print
+	print "  -b         start fail2ban in background"
+	print "  -d         start fail2ban in debug mode"
+	print "  -f <FILE>  read password failure from FILE"
+	print "  -h         display this help message"
+	print "  -l <FILE>  log message in FILE"
+	print "  -t <TIME>  ban IP for TIME seconds"
+	print "  -v         verbose"
+	print
+	print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	sys.exit(0)
 
 def checkForRoot():
@@ -127,12 +144,14 @@ if __name__ == "__main__":
 	logSys.set_formatstring("%T %L %M")
 	
 	try:
-		optList, args = getopt.getopt(sys.argv[1:], 'hvbdf:l:')
+		optList, args = getopt.getopt(sys.argv[1:], 'hvbdf:l:t:i:')
 	except getopt.GetoptError:
 		usage()
 
 	debug = False
 	logFilePath = "/var/log/pwdfail/current"
+	banTime = 600
+	ignoreIPList = {}
 	
 	for opt in optList:
 		if opt[0] == "-h":
@@ -157,18 +176,33 @@ if __name__ == "__main__":
 				logSys.set_target(opt[1])
 			except IOError:
 				logSys.error("Unable to log to "+opt[1])
-				logSys.error("Use default output for logging")
+				logSys.error("Using default output for logging")
+		if opt[0] == "-t":
+			try:
+				banTime = int(opt[1])
+			except ValueError:
+				logSys.error("banTime must be an integer")
+				logSys.error("Using default value")
+		if opt[0] == "-i":
+			ignoreIPList = opt[1].split(' ')
 	
 	if not checkForRoot():
 		logSys.error("You must be root")
 		if not debug:
 			sys.exit(-1)
 	
-	fireWall = Iptables(600, logSys)
-	logFile = Metalog(logFilePath, logSys, 600)
+	logSys.debug("logFilePath is "+logFilePath)
+	logSys.debug("BanTime is "+`banTime`)
+	
+	fireWall = Iptables(banTime, logSys)
+	logFile = Metalog(logFilePath, logSys, banTime)
 	
 	logFile.addIgnoreIP("127.0.0.1")
+	while len(ignoreIPList) > 0:
+		ip = ignoreIPList.pop()
+		logFile.addIgnoreIP(ip)
 	
+	logSys.info("Fail2Ban v"+version+" is running")
 	while True:
 		try:
 			sys.stdout.flush()

From 03d73b78f84f717c1c221315f2ed53a4f59b6629 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Oct 2004 21:45:41 +0000
Subject: [PATCH 018/549] - Setup and dist files

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@22 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  |  12 ++++++
 MANIFEST   |  12 ++++++
 README     | 116 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 setup.cfg  |   5 +++
 setup.py   |  42 +++++++++++++++++++
 version.py |  27 +++++++++++++
 6 files changed, 214 insertions(+)
 create mode 100644 CHANGELOG
 create mode 100644 MANIFEST
 create mode 100644 README
 create mode 100644 setup.cfg
 create mode 100755 setup.py
 create mode 100644 version.py

diff --git a/CHANGELOG b/CHANGELOG
new file mode 100644
index 00000000..23a93525
--- /dev/null
+++ b/CHANGELOG
@@ -0,0 +1,12 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+Fail2Ban (version 0.1.0)                           10/12/2004
+=============================================================
+
+ver. 0.1.0 (10/12/2004) - alpha
+----------
+- Initial release
diff --git a/MANIFEST b/MANIFEST
new file mode 100644
index 00000000..233eed8b
--- /dev/null
+++ b/MANIFEST
@@ -0,0 +1,12 @@
+README
+CHANGELOG
+setup.cfg
+setup.py
+version.py
+fail2ban.py
+firewall/__init__.py
+firewall/firewall.py
+firewall/iptables.py
+logreader/__init__.py
+logreader/logreader.py
+logreader/metalog.py
diff --git a/README b/README
new file mode 100644
index 00000000..60c077ef
--- /dev/null
+++ b/README
@@ -0,0 +1,116 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+Fail2Ban (version 0.1.0)                           10/12/2004
+=============================================================
+
+Fail2Ban scans log files like /var/log/pwdfail and bans IP
+that makes too much password failures. It updates firewall
+rules to reject the IP address. Currently metalog and
+iptables are supported but it should work with other syslog
+daemons. It needs log4py.
+
+This is my first Python program. I began learning Python for
+less than one week so please be understanding ;-) English is
+not either my mother tongue...
+
+
+More details:
+-------------
+
+Fail2Ban is rather simple. I have a home server connected to
+the Internet which runs apache, samba, sshd, ... I see in my
+logs that people are trying to log into my box using "manual"
+brute force or scripts. They try 10, 20 and sometimes more
+user/password (without success anyway). In order to
+discourage these script kiddies, I wanted that sshd refuse
+login from a specific ip after 3 password failures. After
+some google searches, I found that sshd was not able of that.
+So I search for a script or program that do it. Found
+nothing :-( So I decide to write mine and to learn Python :-)
+
+I read the log file (/var/log/pwdfail/current on metalog) and
+search for line with "Failed password". Then get the ip and
+if it has already done 3 or more password failure in the last
+banTime, I ban the ip for banTime using a iptable rule. After
+banTime, the rule is deleted.
+
+Runs on my server and does its job rather well :-) The idea
+is to make fail2ban usable with most syslog daemons and
+services that require a login (sshd, telnetd, ...). It should
+also support others firewalls than iptables.
+
+
+Installation:
+-------------
+
+Require: python-2.? (http://www.python.org)
+         log4py-1.1 (http://sourceforge.net/projects/log4py)
+
+To install, just do:
+
+> tar xvfj fail2ban-0.1.0.tar.bz2
+> cd fail2ban-0.1.0
+> python setup.py install
+
+Fail2Ban should now be correctly installed. Just type:
+
+> fail2ban.py -h
+
+to see if everything is alright.
+
+
+Configuration:
+--------------
+
+For the time, there is no configuration file. You must use
+commande line options instead. Here are the options:
+
+  -b         start fail2ban in background
+  -d         start fail2ban in debug mode
+  -f <FILE>  read password failure from FILE
+  -h         display this help message
+  -l <FILE>  log message in FILE
+  -t <TIME>  ban IP for TIME seconds
+  -v         verbose
+
+
+Contact:
+--------
+
+You need some new features, you found bugs or you just
+appreciate this program, you can contact me at :
+
+Website: http://www.sourceforge.net/projects/fail2ban
+
+Cyril Jaquier: <lostcontrol@users.sourceforge.net>
+
+
+Thanks:
+-------
+
+Kévin Drapel, Marvin Rouge
+
+
+License:
+--------
+
+Fail2Ban is free software; you can redistribute it
+and/or modify it under the terms of the GNU General Public
+License as published by the Free Software Foundation; either
+version 2 of the License, or (at your option) any later
+version.
+
+Fail2Ban is distributed in the hope that it will be
+useful, but WITHOUT ANY WARRANTY; without even the implied
+warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public
+License along with Fail2Ban; if not, write to the Free
+Software Foundation, Inc., 59 Temple Place, Suite 330,
+Boston, MA  02111-1307  USA
diff --git a/setup.cfg b/setup.cfg
new file mode 100644
index 00000000..fba97f88
--- /dev/null
+++ b/setup.cfg
@@ -0,0 +1,5 @@
+[install]
+install-purelib=/usr/lib/fail2ban
+
+[sdist]
+formats=bztar
diff --git a/setup.py b/setup.py
new file mode 100755
index 00000000..b1eafeda
--- /dev/null
+++ b/setup.py
@@ -0,0 +1,42 @@
+#!/usr/bin/env python
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from distutils.core import setup
+from version import version
+
+setup(
+        name = "fail2ban",
+        version = version,
+        description = "Ban IPs that make too much password failure",
+        author = "Cyril Jaquier",
+        author_email = "lostcontrol@users.sourceforge.net",
+        url = "http://www.sourceforge.net/projects/fail2ban",
+        scripts = ['fail2ban.py'],
+        py_modules = ['version'],
+        packages = ['firewall', 'logreader']
+)
\ No newline at end of file
diff --git a/version.py b/version.py
new file mode 100644
index 00000000..41ddf79c
--- /dev/null
+++ b/version.py
@@ -0,0 +1,27 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+version = "0.1.0"
\ No newline at end of file

From 28c1d658a4ae6509efc728381babaa833f0d27bd Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 14 Oct 2004 10:26:17 +0000
Subject: [PATCH 019/549] - Change to CVS version

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@24 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.py b/version.py
index 41ddf79c..70ccfc7b 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.1.0"
\ No newline at end of file
+version = "0.1.0-CVS"
\ No newline at end of file

From 1786004c3d67a0426e97b47066e43839c2594afe Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 14 Oct 2004 10:27:27 +0000
Subject: [PATCH 020/549] - Add logreader/parser.py and logreader/sshd.py -
 Remove logreader/metalog.py

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@25 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/MANIFEST b/MANIFEST
index 233eed8b..a29e9fd1 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -9,4 +9,5 @@ firewall/firewall.py
 firewall/iptables.py
 logreader/__init__.py
 logreader/logreader.py
-logreader/metalog.py
+logreader/parser.py
+logreader/sshd.py

From 3fa88d60a63c80c5ad5a346c28b72210418bb326 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 14 Oct 2004 10:28:04 +0000
Subject: [PATCH 021/549] - Some small update about current work

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@26 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 11 +++++++++++
 README    | 11 +++++++----
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 23a93525..76de70c3 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,17 @@
 Fail2Ban (version 0.1.0)                           10/12/2004
 =============================================================
 
+ver. 0.1.1 (??/??/????) - alpha
+----------
+- Add -r option which allows to set the maximum number of
+  login failures
+- Remove the Metalog class as the log file are not so syslog
+  daemon specific
+- Rewrite log reader to be service centered. Sshd support
+  added. Match "Failed password" and "Illegal user"
+- Code documentation
+
+
 ver. 0.1.0 (10/12/2004) - alpha
 ----------
 - Initial release
diff --git a/README b/README
index 60c077ef..317b34e7 100644
--- a/README
+++ b/README
@@ -9,9 +9,8 @@ Fail2Ban (version 0.1.0)                           10/12/2004
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
 that makes too much password failures. It updates firewall
-rules to reject the IP address. Currently metalog and
-iptables are supported but it should work with other syslog
-daemons. It needs log4py.
+rules to reject the IP address. Currently sshd and iptables
+are supported. It needs log4py.
 
 This is my first Python program. I began learning Python for
 less than one week so please be understanding ;-) English is
@@ -47,7 +46,7 @@ also support others firewalls than iptables.
 Installation:
 -------------
 
-Require: python-2.? (http://www.python.org)
+Require: python-2.2 (http://www.python.org)
          log4py-1.1 (http://sourceforge.net/projects/log4py)
 
 To install, just do:
@@ -56,6 +55,9 @@ To install, just do:
 > cd fail2ban-0.1.0
 > python setup.py install
 
+This will install Fail2Ban into /usr/lib/fail2ban. The
+fail2ban.py executable is placed into /usr/bin.
+
 Fail2Ban should now be correctly installed. Just type:
 
 > fail2ban.py -h
@@ -74,6 +76,7 @@ commande line options instead. Here are the options:
   -f <FILE>  read password failure from FILE
   -h         display this help message
   -l <FILE>  log message in FILE
+  -r <VALUE> allow a max of VALUE password failure
   -t <TIME>  ban IP for TIME seconds
   -v         verbose
 

From 18029d4426dfc2d7818cbd6b48d2bde5efebc533 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 14 Oct 2004 10:30:25 +0000
Subject: [PATCH 022/549] - Add log4py import exception handling - Remove
 metalog class. Now use LogReader - Add -r option: you can specifie the
 maximum number of login failure before ban - Code comments

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@27 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 54 +++++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 44 insertions(+), 10 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index 5b813a3a..5e498085 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -27,13 +27,19 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 import posix, time, sys, getopt, os, signal
-import log4py
+
+# Checks if log4py is present.
+try:
+	import log4py
+except:
+	print "log4py is needed (see README)"
+	sys.exit(-1)
 
 # Appends our own modules path
 sys.path.append('/usr/lib/fail2ban')
 
 from firewall.iptables import Iptables
-from logreader.metalog import Metalog
+from logreader.logreader import LogReader
 from version import version
 
 def usage():
@@ -47,6 +53,7 @@ def usage():
 	print "  -f <FILE>  read password failure from FILE"
 	print "  -h         display this help message"
 	print "  -l <FILE>  log message in FILE"
+	print "  -r <VALUE> allow a max of VALUE password failure"
 	print "  -t <TIME>  ban IP for TIME seconds"
 	print "  -v         verbose"
 	print
@@ -140,18 +147,22 @@ def createDaemon():
 
 if __name__ == "__main__":
 	
+	# Gets an instance of log4py.
 	logSys = log4py.Logger().get_instance()
 	logSys.set_formatstring("%T %L %M")
 	
-	try:
-		optList, args = getopt.getopt(sys.argv[1:], 'hvbdf:l:t:i:')
-	except getopt.GetoptError:
-		usage()
-
+	# Initializes some variables.
 	debug = False
 	logFilePath = "/var/log/pwdfail/current"
 	banTime = 600
 	ignoreIPList = {}
+	retryAllowed = 3
+	
+	# Reads the command line options.
+	try:
+		optList, args = getopt.getopt(sys.argv[1:], 'hvbdf:l:t:i:r:')
+	except getopt.GetoptError:
+		usage()
 	
 	for opt in optList:
 		if opt[0] == "-h":
@@ -185,7 +196,15 @@ if __name__ == "__main__":
 				logSys.error("Using default value")
 		if opt[0] == "-i":
 			ignoreIPList = opt[1].split(' ')
+		if opt[0] == "-r":
+			try:
+				retryAllowed = int(opt[1])
+			except ValueError:
+				logSys.error("retryAllowed must be an integer")
+				logSys.error("Using default value")
 	
+	# Checks for root user. This is necessary because log files
+	# are owned by root and firewall needs root access.
 	if not checkForRoot():
 		logSys.error("You must be root")
 		if not debug:
@@ -193,36 +212,51 @@ if __name__ == "__main__":
 	
 	logSys.debug("logFilePath is "+logFilePath)
 	logSys.debug("BanTime is "+`banTime`)
+	logSys.debug("retryAllowed is "+`retryAllowed`)
 	
+	# Creates one instance of Iptables and one of LogReader.
 	fireWall = Iptables(banTime, logSys)
-	logFile = Metalog(logFilePath, logSys, banTime)
+	logFile = LogReader(logFilePath, logSys, banTime)
 	
+	# We add 127.0.0.1 to the ignore list has we do not want
+	# to be ban ourself.
 	logFile.addIgnoreIP("127.0.0.1")
 	while len(ignoreIPList) > 0:
 		ip = ignoreIPList.pop()
 		logFile.addIgnoreIP(ip)
 	
 	logSys.info("Fail2Ban v"+version+" is running")
+	# Main loop
 	while True:
 		try:
 			sys.stdout.flush()
 			sys.stderr.flush()
 			
+			# Checks if some IP have to be remove from ban
+			# list.
 			fireWall.checkForUnBan(debug)
 			
+			# If the log file has not been modified since the
+			# last time, we sleep for 1 second. This is active
+			# polling so not very effective.
 			if not logFile.isModified():
 				time.sleep(1)
 				continue
 			
+			# Gets the failure list from the log file.
 			failList = logFile.getPwdFailure()
-						
+			
+			# We iterate the failure list and ban IP that make
+			# *retryAllowed* login failures.
 			iterFailList = failList.iteritems()
 			for i in range(len(failList)):
 				element = iterFailList.next()
-				if element[1][0] > 2:
+				if element[1][0] >= retryAllowed:
 					fireWall.addBanIP(element[0], debug)
 			
 		except KeyboardInterrupt:
+			# When the user press <ctrl>+<c> we flush the ban list
+			# and exit nicely.
 			logSys.info("Restoring iptables...")
 			fireWall.flushBanList(debug)
 			logSys.info("Exiting...")

From 3331c9dccbeb6a5b95e8f3a8e2e84e8af5cbda14 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 14 Oct 2004 10:31:32 +0000
Subject: [PATCH 023/549] - Change executeCmd to private - Code comments

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@28 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/firewall.py | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/firewall/firewall.py b/firewall/firewall.py
index 72ecc7cd..c65fe57c 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -27,6 +27,9 @@ __license__ = "GPL"
 import time, os
 
 class Firewall:
+	""" Manages the ban list and executes the command that ban
+		the IP.
+	"""
 	
 	banList = dict()
 	
@@ -35,26 +38,32 @@ class Firewall:
 		self.logSys = logSys
 	
 	def addBanIP(self, ip, debug):
+		""" Bans an IP.
+		"""
 		if not self.inBanList(ip):
 			self.logSys.info("Ban "+ip)
 			self.banList[ip] = time.time()
-			self.executeCmd(self.banIP(ip), debug)
+			self.__executeCmd(self.banIP(ip), debug)
 		else:
 			self.logSys.info(ip+" already in ban list")
 	
 	def delBanIP(self, ip, debug):
+		""" Unban an IP.
+		"""
 		if self.inBanList(ip):
 			self.logSys.info("Unban "+ip)
 			del self.banList[ip]
-			self.executeCmd(self.unBanIP(ip), debug)
+			self.__executeCmd(self.unBanIP(ip), debug)
 		else:
 			self.logSys.info(ip+" not in ban list")
 	
 	def inBanList(self, ip):
+		""" Checks if IP is in ban list.
+		"""
 		return self.banList.has_key(ip)
 	
 	def checkForUnBan(self, debug):
-		""" Check for user to remove from ban list.
+		""" Check for IP to remove from ban list.
 		"""
 		banListTemp = self.banList.copy()
 		iterBanList = banListTemp.iteritems()
@@ -66,13 +75,18 @@ class Firewall:
 				self.delBanIP(ip, debug)
 	
 	def flushBanList(self, debug):
+		""" Flushes the ban list and of course the firewall rules.
+			Called when fail2ban exits.
+		"""
 		iterBanList = self.banList.iteritems()
 		for i in range(len(self.banList)):
 			element = iterBanList.next()
 			ip = element[0]
 			self.delBanIP(ip, debug)
 	
-	def executeCmd(self, cmd, debug):
+	def __executeCmd(self, cmd, debug):
+		""" Executes an OS command.
+		"""
 		self.logSys.debug(cmd)
 		if not debug:
 			return os.system(cmd)
@@ -80,6 +94,8 @@ class Firewall:
 			return None
 		
 	def viewBanList(self):
+		""" Prints the ban list on screen. Usefull for debugging.
+		"""
 		iterBanList = self.banList.iteritems()
 		for i in range(len(self.banList)):
 			element = iterBanList.next()

From 1070273151dd700dd776fa31e186adaf9f199be1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 14 Oct 2004 10:31:53 +0000
Subject: [PATCH 024/549] - Code comments

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@29 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/iptables.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/firewall/iptables.py b/firewall/iptables.py
index c06a2dd3..9983c27a 100644
--- a/firewall/iptables.py
+++ b/firewall/iptables.py
@@ -27,11 +27,22 @@ __license__ = "GPL"
 from firewall import Firewall
 
 class Iptables(Firewall):
+	""" This class contains specific methods and variables for the
+		iptables firewall. Must implements the 'abstracts' methods
+		banIP(ip) and unBanIP(ip).
+		
+		Must adds abstract methods definition:
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
+	"""
 	
 	def banIP(self, ip):
+		""" Returns query to ban IP.
+		"""
 		query = "iptables -I INPUT 1 -i eth0 -s "+ip+" -j DROP"
 		return query
 	
 	def unBanIP(self, ip):
+		""" Returns query to unban IP.
+		"""
 		query = "iptables -D INPUT -i eth0 -s "+ip+" -j DROP"
 		return query

From ded1b1492b358dd040f93aeaa6019cb2704913cf Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 14 Oct 2004 10:34:25 +0000
Subject: [PATCH 025/549] - Remove metalog class. Use now the "service" classes
 (Sshd for the moment) - Code comments

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@30 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 56 +++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 55 insertions(+), 1 deletion(-)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index 1e52ace2..12a24d85 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -24,9 +24,15 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import os, sys
+import os, sys, time
+
+from sshd import Sshd
 
 class LogReader:
+	""" Reads a log file and reports information about IP that make password
+		failure, bad user or anything else that is considered as doubtful login
+		attempt.	
+	"""
 	
 	def __init__(self, logPath, logSys, findTime = 3600):
 		self.logPath = logPath
@@ -34,15 +40,22 @@ class LogReader:
 		self.ignoreIpList = []
 		self.lastModTime = 0
 		self.logSys = logSys
+		self.parserList = ["Sshd"]
 	
 	def addIgnoreIP(self, ip):
+		""" Adds an IP to the ignore list.
+		"""
 		self.logSys.debug("Add "+ip+" to ignore list")
 		self.ignoreIpList.append(ip)
 		
 	def inIgnoreIPList(self, ip):
+		""" Checks if IP is in the ignore list.
+		"""
 		return ip in self.ignoreIpList
 	
 	def openLogFile(self):
+		""" Opens the log file specified on init.
+		"""
 		try:
 			fileHandler = open(self.logPath)
 		except OSError:
@@ -51,6 +64,8 @@ class LogReader:
 		return fileHandler
 		
 	def isModified(self):
+		""" Checks if the log file has been modified using os.stat().
+		"""
 		try:
 			logStats = os.stat(self.logPath)
 		except OSError:
@@ -64,6 +79,45 @@ class LogReader:
 			self.lastModTime = logStats.st_mtime
 			return True
 	
+	def matchLine(self, line):
+		""" Checks if the line contains a pattern. It does this for all
+			classes specified in *parserList*. We use a singleton to avoid
+			creating/destroying objects too much.
+			
+			Return a dict with the IP and number of retries.
+		"""
+		for i in self.parserList:
+			match = eval(i).getInstance().parseLogLine(line)
+			if match:
+				return match
+		return None
+	
+	def getFailInfo(self, findTime):
+		""" Gets the failed login attempt. Returns a dict() which contains
+			IP and the number of retries.
+		"""
+		ipList = dict()
+		logFile = self.openLogFile()
+		for line in logFile.readlines():
+			match = self.matchLine(line)
+			if match:
+				ip = match[0]
+				unixTime = match[1]
+				if unixTime < time.time()-self.findTime:
+					continue
+				if self.inIgnoreIPList(ip):
+					self.logSys.debug("Ignore "+ip)
+					continue
+				self.logSys.debug("Found "+ip)
+				if ipList.has_key(ip):
+					ipList[ip] = (ipList[ip][0]+1, unixTime)
+				else:
+					ipList[ip] = (1, unixTime)
+		logFile.close()
+		return ipList
+	
 	def getPwdFailure(self):
+		""" Executes the getFailInfo method. Not very usefull...
+		"""
 		failList = self.getFailInfo(self.findTime)
 		return failList

From 052f35eccb2b5294b2f8312dc3f94d55f347a1e1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 14 Oct 2004 10:38:22 +0000
Subject: [PATCH 026/549] - Initial import

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@31 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/parser.py | 67 +++++++++++++++++++++++++++++++++++++++++++++
 logreader/sshd.py   | 55 +++++++++++++++++++++++++++++++++++++
 2 files changed, 122 insertions(+)
 create mode 100644 logreader/parser.py
 create mode 100644 logreader/sshd.py

diff --git a/logreader/parser.py b/logreader/parser.py
new file mode 100644
index 00000000..d3067543
--- /dev/null
+++ b/logreader/parser.py
@@ -0,0 +1,67 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time, re
+
+class Parser:
+    """ This class is the main log parser class. It should be inherited
+        by all the service specific classes.
+    """
+    
+    def getLogMatch(self, pattern, line):
+        """ Returns a match if pattern is found in line.
+        """
+        return re.search(pattern, line)
+        
+    def getLogIPv4(self, line):
+        """ Returns IP if one is found in line. Match IPv4 string.
+        """
+        matchIP = re.search("(?:\d{1,3}\.){3}\d{1,3}", line)
+        if matchIP:
+            return matchIP.group()
+        else:
+            return None
+        
+    def getLogIP(self, line):
+        """ Returns IP if one is found in line.
+        """
+        return self.getLogIPv4(line)
+    
+    def getLogTimeStandard(self, line):
+        """ Returns the log time of line using a standard log format.
+            
+            Format: Oct 14 11:47:08
+        """
+        date = list(time.strptime(line[0:15], "%b %d %H:%M:%S"))
+        date[0] = time.gmtime()[0]
+        unixTime = time.mktime(date)
+        return unixTime
+        
+    def getLogTime(self, line):
+        """ Returns the log time of line.
+        """
+        return self.getLogTimeStandard(line)
+    
\ No newline at end of file
diff --git a/logreader/sshd.py b/logreader/sshd.py
new file mode 100644
index 00000000..2adc87f3
--- /dev/null
+++ b/logreader/sshd.py
@@ -0,0 +1,55 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from parser import Parser
+
+class Sshd(Parser):
+    """ OpenSSH daemon log parser. Contains specific code for sshd.
+    """
+    
+    _instance = None
+    # This is the pattern to look for.
+    pattern = "Failed password|Illegal user"
+    
+    def getInstance():
+        """ We use a singleton.
+        """
+        if not Sshd._instance:
+            Sshd._instance = Sshd()
+        return Sshd._instance
+                   
+    getInstance = staticmethod(getInstance)
+    
+    def parseLogLine(self, line):
+        """ Matches sshd bad login attempt. Returns the IP and the
+            log time.
+        """
+        if self.getLogMatch(self.pattern, line):
+            matchIP = self.getLogIP(line)
+            if matchIP:
+                return [matchIP, self.getLogTime(line)]
+            else:
+                return False

From d50f1cd0f74eac88b643ad0bda5ced01b71500d9 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 14 Oct 2004 10:39:43 +0000
Subject: [PATCH 027/549] - Remove this file has it is no more necessary.
 Fail2Ban seems to be more services dependant than syslog daemons

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@32 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/metalog.py | 65 --------------------------------------------
 1 file changed, 65 deletions(-)
 delete mode 100644 logreader/metalog.py

diff --git a/logreader/metalog.py b/logreader/metalog.py
deleted file mode 100644
index 31b4d564..00000000
--- a/logreader/metalog.py
+++ /dev/null
@@ -1,65 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import re, time
-
-from logreader import LogReader
-
-class Metalog(LogReader):
-	
-	def getFailInfo(self, findTime):
-		ipList = dict()
-		logFile = self.openLogFile()
-		for line in logFile.readlines():
-			match = self.parseLogLine(line)
-			if match:
-				ip = match[0]
-				unixTime = match[1]
-				if unixTime < time.time()-self.findTime:
-					continue
-				if self.inIgnoreIPList(ip):
-					self.logSys.debug("Ignore "+ip)
-					continue
-				self.logSys.debug("Found "+ip)
-				if ipList.has_key(ip):
-					ipList[ip] = (ipList[ip][0]+1, unixTime)
-				else:
-					ipList[ip] = (1, unixTime)
-		logFile.close()
-		return ipList
-	
-	def parseLogLine(self, line):
-		""" Match sshd failed password log
-		"""
-		if re.search("Failed password", line):
-			matchIP = re.search("(?:\d{1,3}\.){3}\d{1,3}", line)
-			if matchIP:
-				date = list(time.strptime(line[0:15], "%b %d %H:%M:%S"))
-				date[0] = time.gmtime()[0]
-				unixTime = time.mktime(date)
-				return [matchIP.group(), unixTime]
-			else:
-				return False

From aee13b03ee5d2d106aa3212bbaa35c63880d185f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 16 Oct 2004 22:16:14 +0000
Subject: [PATCH 028/549] - Default config file

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@33 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 38 ++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 config/fail2ban.conf.default

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
new file mode 100644
index 00000000..d31c76c4
--- /dev/null
+++ b/config/fail2ban.conf.default
@@ -0,0 +1,38 @@
+# Fail2Ban configuration file
+#
+# $Revision$
+
+[DEFAULT]
+
+# background: true to start fail2ban as a daemon. Output
+# is redirect to logfile.
+background = false
+
+# debug: true to enable debug mode. More verbose output
+# and bypass root user test.
+debug = false
+
+# pwdfailfile: the path of the file which contains the
+# password failure log.
+pwdfailfile = /var/log/pwdfail/current
+
+# logfile: the path of the file for logging messages of
+# fail2ban.
+logfile = /var/log/fail2ban.log
+
+# maxretry: the number of retry before IP gets ban.
+maxretry = 3
+
+# bantime: the number of seconds an IP will be ban.
+bantime = 600
+
+# ignoreip: a space separated list that contains IP which
+# will be ignore by fail2ban. Example:
+# ignoreip = 192.168.0.1 123.45.235.65
+ignoreip = 
+
+# polltime: the number of seconds that fail2ban sleeps
+# between two iteration (check for IP to unban - parse
+# log file). 1 is a good value.
+polltime = 1
+

From f1d7157caedff35d7dee5960f586097e8afd8be8 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 16 Oct 2004 22:17:35 +0000
Subject: [PATCH 029/549] - Add config/fail2ban.conf.default

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@34 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MANIFEST b/MANIFEST
index a29e9fd1..8f0a2b6c 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -11,3 +11,4 @@ logreader/__init__.py
 logreader/logreader.py
 logreader/parser.py
 logreader/sshd.py
+config/fail2ban.conf.default

From 3b7f952cd27417e44c4beda758bd6f474f16f51c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 16 Oct 2004 22:17:58 +0000
Subject: [PATCH 030/549] - Update installation + configuration instructions

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@35 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 README | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/README b/README
index 317b34e7..4967b25b 100644
--- a/README
+++ b/README
@@ -46,7 +46,7 @@ also support others firewalls than iptables.
 Installation:
 -------------
 
-Require: python-2.2 (http://www.python.org)
+Require: python-2.3 (http://www.python.org)
          log4py-1.1 (http://sourceforge.net/projects/log4py)
 
 To install, just do:
@@ -62,19 +62,24 @@ Fail2Ban should now be correctly installed. Just type:
 
 > fail2ban.py -h
 
-to see if everything is alright.
+to see if everything is alright. You can configure fail2ban
+with a config file. Copy config/fail2ban.conf.default to
+/etc/fail2ban.conf.
 
 
 Configuration:
 --------------
 
-For the time, there is no configuration file. You must use
-commande line options instead. Here are the options:
+You can configure fail2ban using the file /etc/fail2ban.conf
+or using command line options. Command line options override
+the value stored in fail2ban.conf. Here are the command line
+options:
 
   -b         start fail2ban in background
   -d         start fail2ban in debug mode
   -f <FILE>  read password failure from FILE
   -h         display this help message
+  -i <IP(s)> IP(s) to ignore
   -l <FILE>  log message in FILE
   -r <VALUE> allow a max of VALUE password failure
   -t <TIME>  ban IP for TIME seconds

From b9349fd45e97ea1c2724bdc3c2966c784e935c2e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 16 Oct 2004 22:18:25 +0000
Subject: [PATCH 031/549] - Configuration using /etc/fail2ban.conf

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@36 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG   |   1 +
 fail2ban.py | 186 ++++++++++++++++++++++++++++++++++++++++------------
 2 files changed, 144 insertions(+), 43 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 76de70c3..fb26c30f 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -15,6 +15,7 @@ ver. 0.1.1 (??/??/????) - alpha
   daemon specific
 - Rewrite log reader to be service centered. Sshd support
   added. Match "Failed password" and "Illegal user"
+- Add /etc/fail2ban.conf configuration support
 - Code documentation
 
 
diff --git a/fail2ban.py b/fail2ban.py
index 5e498085..9e640895 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -27,6 +27,7 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 import posix, time, sys, getopt, os, signal
+from ConfigParser import *
 
 # Checks if log4py is present.
 try:
@@ -52,6 +53,7 @@ def usage():
 	print "  -d         start fail2ban in debug mode"
 	print "  -f <FILE>  read password failure from FILE"
 	print "  -h         display this help message"
+	print "  -i <IP(s)> IP(s) to ignore"
 	print "  -l <FILE>  log message in FILE"
 	print "  -r <VALUE> allow a max of VALUE password failure"
 	print "  -t <TIME>  ban IP for TIME seconds"
@@ -151,12 +153,101 @@ if __name__ == "__main__":
 	logSys = log4py.Logger().get_instance()
 	logSys.set_formatstring("%T %L %M")
 	
-	# Initializes some variables.
-	debug = False
-	logFilePath = "/var/log/pwdfail/current"
-	banTime = 600
-	ignoreIPList = {}
-	retryAllowed = 3
+	# Config file
+	configParser = SafeConfigParser()
+	configParser.read("/etc/fail2ban.conf")
+	
+	conf = dict()
+	conf["verbose"] = False
+	conf["background"] = False
+	conf["debug"] = False
+	conf["pwdfailfile"] = "/var/log/pwdfail/current"
+	conf["logging"] = False
+	conf["logfile"] = "/var/log/fail2ban.log"
+	conf["maxretry"] = 3
+	conf["bantime"] = 600
+	conf["ignoreip"] = ''
+	conf["polltime"] = 1
+	
+	# background
+	try:
+		conf["background"] = configParser.getboolean("DEFAULT", "background")
+	except ValueError:
+		logSys.warn("background option should be a boolean")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("background option not in config file")
+		logSys.warn("Using default value")
+
+	# debug
+	try:
+		conf["debug"] = configParser.getboolean("DEFAULT", "debug")
+	except ValueError:
+		logSys.warn("debug option should be a boolean")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("debug option not in config file")
+		logSys.warn("Using default value")
+	
+	# pwdfailfile
+	try:
+		conf["pwdfailfile"] = configParser.get("DEFAULT", "pwdfailfile")
+	except ValueError:
+		logSys.warn("pwdfailfile option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("pwdfailfile option not in config file")
+		logSys.warn("Using default value")
+
+	# logfile
+	try:
+		conf["logfile"] = configParser.get("DEFAULT", "logfile")
+	except ValueError:
+		logSys.warn("logfile option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("logfile option not in config file")
+		logSys.warn("Using default value")
+		
+	# maxretry
+	try:
+		conf["maxretry"] = configParser.getint("DEFAULT", "maxretry")
+	except ValueError:
+		logSys.warn("maxretry option should be an integer")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("maxretry option not in config file")
+		logSys.warn("Using default value")
+
+	# bantime
+	try:
+		conf["bantime"] = configParser.getint("DEFAULT", "bantime")
+	except ValueError:
+		logSys.warn("bantime option should be an integer")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("bantime option not in config file")
+		logSys.warn("Using default value")
+
+	# ignoreip
+	try:
+		conf["ignoreip"] = configParser.get("DEFAULT", "ignoreip")
+	except ValueError:
+		logSys.warn("ignoreip option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("ignoreip option not in config file")
+		logSys.warn("Using default value")
+		
+	# polltime
+	try:
+		conf["polltime"] = configParser.getint("DEFAULT", "polltime")
+	except ValueError:
+		logSys.warn("polltime option should be an integer")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("polltime option not in config file")
+		logSys.warn("Using default value")
 	
 	# Reads the command line options.
 	try:
@@ -168,55 +259,64 @@ if __name__ == "__main__":
 		if opt[0] == "-h":
 			usage()
 		if opt[0] == "-v":
-			logSys.set_loglevel(log4py.LOGLEVEL_VERBOSE)
+			conf["verbose"] = True
 		if opt[0] == "-b":
+			conf["background"] = True
+		if opt[0] == "-d":
+			conf["debug"] = True
+		if opt[0] == "-f":
+			conf["pwdfailfile"] = opt[1]
+		if opt[0] == "-l":
+			conf["logging"] = True
+			conf["logfile"] = opt[1]
+		if opt[0] == "-t":
+			try:
+				conf["bantime"] = int(opt[1])
+			except ValueError:
+				logSys.warn("banTime must be an integer")
+				logSys.warn("Using default value")
+		if opt[0] == "-i":
+			conf["ignoreip"] = opt[1]
+		if opt[0] == "-r":
+			conf["retrymax"] = int(opt[1])
+
+	# Process some options
+	for c in conf:
+		if c == "verbose" and conf[c]:
+			logSys.set_loglevel(log4py.LOGLEVEL_VERBOSE)
+		elif c == "debug" and conf[c]:
+			logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
+			logSys.set_formatstring(log4py.FMT_DEBUG)
+		elif c == "background" and conf[c]:
 			retCode = createDaemon()
-			logSys.set_target("/tmp/fail2ban.log")
+			logSys.set_target(conf["logfile"])
 			if retCode != 0:
 				logSys.error("Unable to start daemon")
 				sys.exit(-1)
-		if opt[0] == "-d":
-			debug = True
-			logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
-			logSys.set_formatstring(log4py.FMT_DEBUG)
-		if opt[0] == "-f":
-			logFilePath = opt[1]
-		if opt[0] == "-l":
+		elif c == "logging" and conf[c]:
 			try:
-				open(opt[1], "a")
-				logSys.set_target(opt[1])
+				open(conf["logfile"], "a")
+				logSys.set_target(conf["logfile"])
 			except IOError:
-				logSys.error("Unable to log to "+opt[1])
-				logSys.error("Using default output for logging")
-		if opt[0] == "-t":
-			try:
-				banTime = int(opt[1])
-			except ValueError:
-				logSys.error("banTime must be an integer")
-				logSys.error("Using default value")
-		if opt[0] == "-i":
-			ignoreIPList = opt[1].split(' ')
-		if opt[0] == "-r":
-			try:
-				retryAllowed = int(opt[1])
-			except ValueError:
-				logSys.error("retryAllowed must be an integer")
-				logSys.error("Using default value")
+				logSys.warn("Unable to log to "+conf["logfile"])
+				logSys.warn("Using default output for logging")
+		elif c == "ignoreip":
+			ignoreIPList = conf[c].split(' ')
 	
 	# Checks for root user. This is necessary because log files
 	# are owned by root and firewall needs root access.
 	if not checkForRoot():
 		logSys.error("You must be root")
-		if not debug:
+		if not conf["debug"]:
 			sys.exit(-1)
 	
-	logSys.debug("logFilePath is "+logFilePath)
-	logSys.debug("BanTime is "+`banTime`)
-	logSys.debug("retryAllowed is "+`retryAllowed`)
+	logSys.debug("logFilePath is "+conf["pwdfailfile"])
+	logSys.debug("BanTime is "+`conf["bantime"]`)
+	logSys.debug("retryAllowed is "+`conf["maxretry"]`)
 	
 	# Creates one instance of Iptables and one of LogReader.
-	fireWall = Iptables(banTime, logSys)
-	logFile = LogReader(logFilePath, logSys, banTime)
+	fireWall = Iptables(conf["bantime"], logSys)
+	logFile = LogReader(conf["pwdfailfile"], logSys, conf["bantime"])
 	
 	# We add 127.0.0.1 to the ignore list has we do not want
 	# to be ban ourself.
@@ -234,13 +334,13 @@ if __name__ == "__main__":
 			
 			# Checks if some IP have to be remove from ban
 			# list.
-			fireWall.checkForUnBan(debug)
+			fireWall.checkForUnBan(conf["debug"])
 			
 			# If the log file has not been modified since the
 			# last time, we sleep for 1 second. This is active
 			# polling so not very effective.
 			if not logFile.isModified():
-				time.sleep(1)
+				time.sleep(conf["polltime"])
 				continue
 			
 			# Gets the failure list from the log file.
@@ -252,12 +352,12 @@ if __name__ == "__main__":
 			for i in range(len(failList)):
 				element = iterFailList.next()
 				if element[1][0] >= retryAllowed:
-					fireWall.addBanIP(element[0], debug)
+					fireWall.addBanIP(element[0], conf["debug"])
 			
 		except KeyboardInterrupt:
 			# When the user press <ctrl>+<c> we flush the ban list
 			# and exit nicely.
 			logSys.info("Restoring iptables...")
-			fireWall.flushBanList(debug)
+			fireWall.flushBanList(conf["debug"])
 			logSys.info("Exiting...")
 			sys.exit(0)

From c7513aba776e81737efbadc07e1f086ace07332e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 18 Oct 2004 20:50:56 +0000
Subject: [PATCH 032/549] - Fix retryAllowed. It is now conf["maxretry"] - Add
 SIGTERM handler in order to exit properly when in daemon mode

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@37 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/fail2ban.py b/fail2ban.py
index 9e640895..f445b584 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -146,6 +146,15 @@ def createDaemon():
 
 	return(0)
 
+def sigTERMhandler(signum, frame):
+	""" Handles the TERM signal when in daemon mode in order to
+		exit properly.
+	"""
+	logSys.debug("Signal handler called with sig "+`signum`)
+	logSys.info("Restoring iptables...")
+	fireWall.flushBanList(conf["debug"])
+	logSys.info("Exiting...")
+	sys.exit(0)
 
 if __name__ == "__main__":
 	
@@ -289,6 +298,7 @@ if __name__ == "__main__":
 			logSys.set_formatstring(log4py.FMT_DEBUG)
 		elif c == "background" and conf[c]:
 			retCode = createDaemon()
+			signal.signal(signal.SIGTERM, sigTERMhandler)
 			logSys.set_target(conf["logfile"])
 			if retCode != 0:
 				logSys.error("Unable to start daemon")
@@ -351,7 +361,7 @@ if __name__ == "__main__":
 			iterFailList = failList.iteritems()
 			for i in range(len(failList)):
 				element = iterFailList.next()
-				if element[1][0] >= retryAllowed:
+				if element[1][0] >= conf["maxretry"]:
 					fireWall.addBanIP(element[0], conf["debug"])
 			
 		except KeyboardInterrupt:

From f3dd99da0c9c49f775f29b1f2b91074d7571d599 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 18 Oct 2004 20:54:29 +0000
Subject: [PATCH 033/549] - Add SIGTERM handler

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@38 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index fb26c30f..448f24c6 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,6 +9,8 @@ Fail2Ban (version 0.1.0)                           10/12/2004
 
 ver. 0.1.1 (??/??/????) - alpha
 ----------
+- Add SIGTERM handler in order to exit nicely when in daemon
+  mode
 - Add -r option which allows to set the maximum number of
   login failures
 - Remove the Metalog class as the log file are not so syslog

From 6930f5c0c3ae309b41f3e6958601cc1082b38b5c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 23 Oct 2004 08:42:53 +0000
Subject: [PATCH 034/549] - Version 0.1.1. This is the first beta release

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@39 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  | 4 ++--
 README     | 6 +++---
 version.py | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 448f24c6..ce24c846 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.1.0)                           10/12/2004
+Fail2Ban (version 0.1.1)                           10/23/2004
 =============================================================
 
-ver. 0.1.1 (??/??/????) - alpha
+ver. 0.1.1 (10/23/2004) - beta
 ----------
 - Add SIGTERM handler in order to exit nicely when in daemon
   mode
diff --git a/README b/README
index 4967b25b..cd32f9a1 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.1.0)                           10/12/2004
+Fail2Ban (version 0.1.1)                           10/23/2004
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -51,8 +51,8 @@ Require: python-2.3 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.1.0.tar.bz2
-> cd fail2ban-0.1.0
+> tar xvfj fail2ban-0.1.1.tar.bz2
+> cd fail2ban-0.1.1
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The
diff --git a/version.py b/version.py
index 70ccfc7b..d83fb7b4 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.1.0-CVS"
\ No newline at end of file
+version = "0.1.1"

From 01a53b045b783fa9f0c2bf398e90764c62e6e9ac Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 6 Nov 2004 14:02:07 +0000
Subject: [PATCH 035/549] - Add interface parameter

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@41 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/firewall.py | 3 ++-
 firewall/iptables.py | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/firewall/firewall.py b/firewall/firewall.py
index c65fe57c..38782bde 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -33,9 +33,10 @@ class Firewall:
 	
 	banList = dict()
 	
-	def __init__(self, banTime, logSys):
+	def __init__(self, banTime, logSys, interface):
 		self.banTime = banTime
 		self.logSys = logSys
+		self.interface = interface
 	
 	def addBanIP(self, ip, debug):
 		""" Bans an IP.
diff --git a/firewall/iptables.py b/firewall/iptables.py
index 9983c27a..7b78c69c 100644
--- a/firewall/iptables.py
+++ b/firewall/iptables.py
@@ -38,11 +38,11 @@ class Iptables(Firewall):
 	def banIP(self, ip):
 		""" Returns query to ban IP.
 		"""
-		query = "iptables -I INPUT 1 -i eth0 -s "+ip+" -j DROP"
+		query = "iptables -I INPUT 1 -i "+self.interface+" -s "+ip+" -j DROP"
 		return query
 	
 	def unBanIP(self, ip):
 		""" Returns query to unban IP.
 		"""
-		query = "iptables -D INPUT -i eth0 -s "+ip+" -j DROP"
+		query = "iptables -D INPUT -i "+self.interface+" -s "+ip+" -j DROP"
 		return query

From 4d098fbd7a3b445c44a61e8feef953207773a3e7 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 6 Nov 2004 14:02:27 +0000
Subject: [PATCH 036/549] - Initial import

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@42 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/ipfw.py    | 59 +++++++++++++++++++++++++++++++++++++++++++++
 firewall/ipfwadm.py | 48 ++++++++++++++++++++++++++++++++++++
 2 files changed, 107 insertions(+)
 create mode 100644 firewall/ipfw.py
 create mode 100644 firewall/ipfwadm.py

diff --git a/firewall/ipfw.py b/firewall/ipfw.py
new file mode 100644
index 00000000..c8cd3cba
--- /dev/null
+++ b/firewall/ipfw.py
@@ -0,0 +1,59 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os
+
+from firewall import Firewall
+
+class Ipfw(Firewall):
+	""" This class contains specific methods and variables for the
+		iptables firewall. Must implements the 'abstracts' methods
+		banIP(ip) and unBanIP(ip).
+		
+		Must adds abstract methods definition:
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
+	"""
+	
+	def banIP(self, ip):
+		""" Returns query to ban IP.
+		"""
+		query = "ipfw -q add deny ip from "+ip+" to any"
+		return query
+	
+	def unBanIP(self, ip):
+		""" Returns query to unban IP.
+		"""
+		ruleNbr = str(self.__findRuleNumber(ip))
+		query = "ipfw -q delete "+ruleNbr
+		return query
+		
+	def __findRuleNumber(self, ip):
+		""" Uses shell commands in order to find the rule
+			number we want to delete.
+		"""
+		output = os.popen("ipfw list|grep \"from "+ip+" to\"|awk '{print $1}'",
+						  "r");
+		return output.read()
diff --git a/firewall/ipfwadm.py b/firewall/ipfwadm.py
new file mode 100644
index 00000000..cfdccbd8
--- /dev/null
+++ b/firewall/ipfwadm.py
@@ -0,0 +1,48 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from firewall import Firewall
+
+class Ipfwadm(Firewall):
+	""" This class contains specific methods and variables for the
+		iptables firewall. Must implements the 'abstracts' methods
+		banIP(ip) and unBanIP(ip).
+		
+		Must adds abstract methods definition:
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
+	"""
+	
+	def banIP(self, ip):
+		""" Returns query to ban IP.
+		"""
+		query = "ipfwadm -I -a deny -W "+self.interface+" -S "+ip
+		return query
+	
+	def unBanIP(self, ip):
+		""" Returns query to unban IP.
+		"""
+		query = "ipfwadm -I -d deny -W "+self.interface+" -S "+ip
+		return query

From fabe6e59b4addad1ca214844cee52c46a6942aab Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 6 Nov 2004 14:03:17 +0000
Subject: [PATCH 037/549] - Add firewall and interface options

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@43 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index d31c76c4..c1bb16f7 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -4,6 +4,10 @@
 
 [DEFAULT]
 
+# firewall: select the firewall system to use. Actually,
+# the available options are: iptables, ipfwadm, ipfw
+firewall = iptables
+
 # background: true to start fail2ban as a daemon. Output
 # is redirect to logfile.
 background = false
@@ -31,6 +35,10 @@ bantime = 600
 # ignoreip = 192.168.0.1 123.45.235.65
 ignoreip = 
 
+# interface: the interface name on which the IP will be
+# banned.
+interface = eth0
+
 # polltime: the number of seconds that fail2ban sleeps
 # between two iteration (check for IP to unban - parse
 # log file). 1 is a good value.

From 8598ff231516722637a42ecb5d6ebff2896c32ca Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 6 Nov 2004 14:03:43 +0000
Subject: [PATCH 038/549] - Change to CVS version

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@44 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.py b/version.py
index d83fb7b4..cc87ea49 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.1.1"
+version = "0.1.1-CVS"

From 88313ea6118da7f75b03d52d89ae2b7ba718c3d7 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 6 Nov 2004 14:04:34 +0000
Subject: [PATCH 039/549] - Add firewall/ipfw.py and firewall/ipfwadm.py

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@45 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MANIFEST b/MANIFEST
index 8f0a2b6c..f52e1848 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -7,6 +7,8 @@ fail2ban.py
 firewall/__init__.py
 firewall/firewall.py
 firewall/iptables.py
+firewall/ipfw.py
+firewall/ipfwadm.py
 logreader/__init__.py
 logreader/logreader.py
 logreader/parser.py

From f1770f937b1d090d894f6980a79dc1494aaff583 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 6 Nov 2004 14:05:09 +0000
Subject: [PATCH 040/549] - Update current changes

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@46 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index ce24c846..eabe886a 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,14 @@
 Fail2Ban (version 0.1.1)                           10/23/2004
 =============================================================
 
+ver. 0.?.? (??/??/2004) - ???
+----------
+- Add ipfw and ipfwadm support. The rules are taken from
+  BlockIt. Thanks to Robert Edeker
+- Add -e option which allows to set the interface. Thanks to
+  Robert Edeker who reminded me this
+- Small code cleaning
+
 ver. 0.1.1 (10/23/2004) - beta
 ----------
 - Add SIGTERM handler in order to exit nicely when in daemon

From 11330ff944ca27350bf944f99f4abc745d5a5656 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 6 Nov 2004 14:06:06 +0000
Subject: [PATCH 041/549] - Fail2ban now support ipfw and ipfwadm - New options

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@47 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 README | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/README b/README
index cd32f9a1..03303a35 100644
--- a/README
+++ b/README
@@ -9,8 +9,8 @@ Fail2Ban (version 0.1.1)                           10/23/2004
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
 that makes too much password failures. It updates firewall
-rules to reject the IP address. Currently sshd and iptables
-are supported. It needs log4py.
+rules to reject the IP address. Currently sshd, iptables,
+ipfw and ipfwadm are supported. It needs log4py.
 
 This is my first Python program. I began learning Python for
 less than one week so please be understanding ;-) English is
@@ -32,10 +32,11 @@ So I search for a script or program that do it. Found
 nothing :-( So I decide to write mine and to learn Python :-)
 
 I read the log file (/var/log/pwdfail/current on metalog) and
-search for line with "Failed password". Then get the ip and
-if it has already done 3 or more password failure in the last
-banTime, I ban the ip for banTime using a iptable rule. After
-banTime, the rule is deleted.
+search for a given pattern which indicates a login attempt.
+Then I get the ip and if it has already done 3 or more
+password failure in the last banTime, I ban the ip for
+banTime using a iptable rule. After banTime, the rule is
+deleted.
 
 Runs on my server and does its job rather well :-) The idea
 is to make fail2ban usable with most syslog daemons and
@@ -77,6 +78,7 @@ options:
 
   -b         start fail2ban in background
   -d         start fail2ban in debug mode
+  -e <INTF>  ban IP on the INTF interface
   -f <FILE>  read password failure from FILE
   -h         display this help message
   -i <IP(s)> IP(s) to ignore
@@ -84,7 +86,8 @@ options:
   -r <VALUE> allow a max of VALUE password failure
   -t <TIME>  ban IP for TIME seconds
   -v         verbose
-
+  -w <FIWA>  select the firewall to use. Can be iptables,
+             ipfwadm or ipfw
 
 Contact:
 --------
@@ -100,7 +103,7 @@ Cyril Jaquier: <lostcontrol@users.sourceforge.net>
 Thanks:
 -------
 
-Kévin Drapel, Marvin Rouge
+Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker
 
 
 License:

From a562542523889073f037e76aa174c3105611a10b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 6 Nov 2004 14:08:04 +0000
Subject: [PATCH 042/549] - Remove posix from import - Update help message -
 Add support for multiple firewall class. It is now really simple to add new
 ones - Add support for interface selection

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@48 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 51 ++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 46 insertions(+), 5 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index f445b584..9ed5738a 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -26,7 +26,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import posix, time, sys, getopt, os, signal
+import time, sys, getopt, os, signal, string
 from ConfigParser import *
 
 # Checks if log4py is present.
@@ -40,6 +40,8 @@ except:
 sys.path.append('/usr/lib/fail2ban')
 
 from firewall.iptables import Iptables
+from firewall.ipfw import Ipfw
+from firewall.ipfwadm import Ipfwadm
 from logreader.logreader import LogReader
 from version import version
 
@@ -51,6 +53,7 @@ def usage():
 	print
 	print "  -b         start fail2ban in background"
 	print "  -d         start fail2ban in debug mode"
+	print "  -e <INTF>  ban IP on the INTF interface"
 	print "  -f <FILE>  read password failure from FILE"
 	print "  -h         display this help message"
 	print "  -i <IP(s)> IP(s) to ignore"
@@ -58,6 +61,8 @@ def usage():
 	print "  -r <VALUE> allow a max of VALUE password failure"
 	print "  -t <TIME>  ban IP for TIME seconds"
 	print "  -v         verbose"
+	print "  -w <FIWA>  select the firewall to use. Can be iptables,"
+	print "             ipfwadm or ipfw"
 	print
 	print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	sys.exit(0)
@@ -65,7 +70,7 @@ def usage():
 def checkForRoot():
 	""" Check for root user.
 	"""
-	uid = `posix.getuid()`
+	uid = `os.getuid()`
 	if uid == '0':
 		return True
 	else:
@@ -176,6 +181,8 @@ if __name__ == "__main__":
 	conf["maxretry"] = 3
 	conf["bantime"] = 600
 	conf["ignoreip"] = ''
+	conf["interface"] = "eth0"
+	conf["firewall"] = "iptables"
 	conf["polltime"] = 1
 	
 	# background
@@ -248,6 +255,26 @@ if __name__ == "__main__":
 		logSys.warn("ignoreip option not in config file")
 		logSys.warn("Using default value")
 		
+	# interface
+	try:
+		conf["interface"] = configParser.get("DEFAULT", "interface")
+	except ValueError:
+		logSys.warn("interface option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("interface option not in config file")
+		logSys.warn("Using default value")
+		
+	# interface
+	try:
+		conf["firewall"] = configParser.get("DEFAULT", "firewall")
+	except ValueError:
+		logSys.warn("firewall option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("firewall option not in config file")
+		logSys.warn("Using default value")
+
 	# polltime
 	try:
 		conf["polltime"] = configParser.getint("DEFAULT", "polltime")
@@ -260,7 +287,7 @@ if __name__ == "__main__":
 	
 	# Reads the command line options.
 	try:
-		optList, args = getopt.getopt(sys.argv[1:], 'hvbdf:l:t:i:r:')
+		optList, args = getopt.getopt(sys.argv[1:], 'hvbdf:l:t:i:r:e:w:')
 	except getopt.GetoptError:
 		usage()
 	
@@ -273,6 +300,8 @@ if __name__ == "__main__":
 			conf["background"] = True
 		if opt[0] == "-d":
 			conf["debug"] = True
+		if opt[0] == "-e":
+			conf["interface"] = opt[1]
 		if opt[0] == "-f":
 			conf["pwdfailfile"] = opt[1]
 		if opt[0] == "-l":
@@ -288,6 +317,8 @@ if __name__ == "__main__":
 			conf["ignoreip"] = opt[1]
 		if opt[0] == "-r":
 			conf["retrymax"] = int(opt[1])
+		if opt[0] == "-w":
+			conf["firewall"] = opt[1]
 
 	# Process some options
 	for c in conf:
@@ -312,6 +343,14 @@ if __name__ == "__main__":
 				logSys.warn("Using default output for logging")
 		elif c == "ignoreip":
 			ignoreIPList = conf[c].split(' ')
+		elif c == "firewall":
+			conf[c] = string.lower(conf[c])
+			if conf[c] == "ipfw":
+				fireWallName = "Ipfw"
+			elif conf[c] == "ipfwadm":
+				fireWallName = "Ipfwadm"
+			else:
+				fireWallName = "Iptables"
 	
 	# Checks for root user. This is necessary because log files
 	# are owned by root and firewall needs root access.
@@ -324,8 +363,10 @@ if __name__ == "__main__":
 	logSys.debug("BanTime is "+`conf["bantime"]`)
 	logSys.debug("retryAllowed is "+`conf["maxretry"]`)
 	
-	# Creates one instance of Iptables and one of LogReader.
-	fireWall = Iptables(conf["bantime"], logSys)
+	# Creates one instance of Iptables (thanks to Pyhton dynamic
+	# features) and one of LogReader.
+	fireWallObj = eval(fireWallName)
+	fireWall = fireWallObj(conf["bantime"], logSys, conf["interface"])
 	logFile = LogReader(conf["pwdfailfile"], logSys, conf["bantime"])
 	
 	# We add 127.0.0.1 to the ignore list has we do not want

From 2c778a9b76bd0f7e69c9366fc52e4b2fd9ec6676 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 21 Nov 2004 09:29:11 +0000
Subject: [PATCH 043/549] - Version 0.1.2. Second beta version

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@49 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  | 4 ++--
 README     | 4 ++--
 version.py | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index eabe886a..c71f9a0e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.1.1)                           10/23/2004
+Fail2Ban (version 0.1.2)                           11/21/2004
 =============================================================
 
-ver. 0.?.? (??/??/2004) - ???
+ver. 0.1.2 (11/21/2004) - beta
 ----------
 - Add ipfw and ipfwadm support. The rules are taken from
   BlockIt. Thanks to Robert Edeker
diff --git a/README b/README
index 03303a35..14a23b02 100644
--- a/README
+++ b/README
@@ -52,8 +52,8 @@ Require: python-2.3 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.1.1.tar.bz2
-> cd fail2ban-0.1.1
+> tar xvfj fail2ban-0.1.2.tar.bz2
+> cd fail2ban-0.1.2
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The
diff --git a/version.py b/version.py
index cc87ea49..cbfd96b8 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.1.1-CVS"
+version = "0.1.2"

From 2e5bfe5bb640c3aaefe7310f68c9144baf935b97 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 18 Feb 2005 13:30:54 +0000
Subject: [PATCH 044/549] - Changed Fail2Ban in order to handle several log
 files

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@50 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                                     |   8 +-
 MANIFEST                                      |   3 +-
 README                                        |   2 +-
 config/fail2ban.conf.default                  |  41 ++++++-
 confreader/__init__.py                        |  25 +++++
 .../sshd.py => confreader/configreader.py     |  50 ++++-----
 fail2ban.py                                   |  77 +++++++------
 log-test/apache                               | 102 ++++++++++++++++++
 log-test/current                              |   9 +-
 log-test/test                                 |   9 +-
 logreader/logreader.py                        |  70 ++++++------
 logreader/parser.py                           |  67 ------------
 setup.py                                      |   2 +-
 version.py                                    |   2 +-
 14 files changed, 298 insertions(+), 169 deletions(-)
 create mode 100644 confreader/__init__.py
 rename logreader/sshd.py => confreader/configreader.py (53%)
 create mode 100644 log-test/apache
 delete mode 100644 logreader/parser.py

diff --git a/CHANGELOG b/CHANGELOG
index c71f9a0e..d954dec9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,15 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.1.2)                           11/21/2004
+Fail2Ban (version 0.3.0)                           02/??/2005
 =============================================================
 
+ver. 0.3.0 (02/??/2005) - alpha
+----------
+- Re-writting of parts of the code in order to handle several
+  log files with different rules
+- Removed sshd.py because it is no more needed
+
 ver. 0.1.2 (11/21/2004) - beta
 ----------
 - Add ipfw and ipfwadm support. The rules are taken from
diff --git a/MANIFEST b/MANIFEST
index f52e1848..d31f45f5 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -12,5 +12,6 @@ firewall/ipfwadm.py
 logreader/__init__.py
 logreader/logreader.py
 logreader/parser.py
-logreader/sshd.py
+confreader/__init__.py
+confreader/configreader.py
 config/fail2ban.conf.default
diff --git a/README b/README
index 14a23b02..30b27060 100644
--- a/README
+++ b/README
@@ -79,7 +79,7 @@ options:
   -b         start fail2ban in background
   -d         start fail2ban in debug mode
   -e <INTF>  ban IP on the INTF interface
-  -f <FILE>  read password failure from FILE
+  -c <FILE>  read configuration file FILE
   -h         display this help message
   -i <IP(s)> IP(s) to ignore
   -l <FILE>  log message in FILE
diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index c1bb16f7..3a4e79cc 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -16,10 +16,6 @@ background = false
 # and bypass root user test.
 debug = false
 
-# pwdfailfile: the path of the file which contains the
-# password failure log.
-pwdfailfile = /var/log/pwdfail/current
-
 # logfile: the path of the file for logging messages of
 # fail2ban.
 logfile = /var/log/fail2ban.log
@@ -44,3 +40,40 @@ interface = eth0
 # log file). 1 is a good value.
 polltime = 1
 
+# You can define a new section for each log file to check for
+# password failure.
+
+[Apache]
+# logfile: file to monitor.
+logfile = log-test/apache
+
+# timeregex: regular expression which have to match the
+# timestamp of an Apache log event.
+# [Wed Jan 05 15:08:01 2005]
+timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+
+# timepattern: indicates the "timeregex" fields signification.
+# See syntax here: http://rgruet.free.fr/PQR2.3.html#timeModule
+timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
+
+# failregex: regular expression which have to match the
+# message written in the log file in case of password failure.
+failregex = authentication failure
+
+[SSH]
+# logfile: file to monitor.
+logfile = log-test/current
+
+# timeregex: regular expression which have to match the
+# timestamp of an Apache log event.
+# Mar  7 17:53:28
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# timepattern: indicates the "timeregex" fields signification.
+# See syntax here: http://rgruet.free.fr/PQR2.3.html#timeModule
+timepattern = %%b %%d %%H:%%M:%%S
+
+# failregex: regular expression which have to match the
+# message written in the log file in case of password failure.
+failregex = Authentication failure
+
diff --git a/confreader/__init__.py b/confreader/__init__.py
new file mode 100644
index 00000000..76dba873
--- /dev/null
+++ b/confreader/__init__.py
@@ -0,0 +1,25 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
\ No newline at end of file
diff --git a/logreader/sshd.py b/confreader/configreader.py
similarity index 53%
rename from logreader/sshd.py
rename to confreader/configreader.py
index 2adc87f3..5f8679dd 100644
--- a/logreader/sshd.py
+++ b/confreader/configreader.py
@@ -24,32 +24,34 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from parser import Parser
+import os, sys, time
 
-class Sshd(Parser):
-    """ OpenSSH daemon log parser. Contains specific code for sshd.
+from ConfigParser import *
+
+class ConfigReader:
+    """ Reads a log file and reports information about IP that make password
+        failure, bad user or anything else that is considered as doubtful login
+        attempt.    
     """
     
-    _instance = None
-    # This is the pattern to look for.
-    pattern = "Failed password|Illegal user"
+    optionValues = ("logfile", "timeregex", "timepattern", "failregex")
+    
+    def __init__(self, confPath):
+        self.confPath = confPath
+        self.configParser = SafeConfigParser()
+        
+    def openConf(self):
+        self.configParser.read(self.confPath)
+    
+    def getSections(self):
+        return self.configParser.sections()
+        
+    def getLogOptions(self, sec):
+        values = dict()
+        for option in self.optionValues:
+            v = self.configParser.get(sec, option)
+            values[option] = v
+        return values
+        
     
-    def getInstance():
-        """ We use a singleton.
-        """
-        if not Sshd._instance:
-            Sshd._instance = Sshd()
-        return Sshd._instance
-                   
-    getInstance = staticmethod(getInstance)
     
-    def parseLogLine(self, line):
-        """ Matches sshd bad login attempt. Returns the IP and the
-            log time.
-        """
-        if self.getLogMatch(self.pattern, line):
-            matchIP = self.getLogIP(line)
-            if matchIP:
-                return [matchIP, self.getLogTime(line)]
-            else:
-                return False
diff --git a/fail2ban.py b/fail2ban.py
index 9ed5738a..a7adfd2d 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -44,6 +44,7 @@ from firewall.ipfw import Ipfw
 from firewall.ipfwadm import Ipfwadm
 from logreader.logreader import LogReader
 from version import version
+from confreader.configreader import ConfigReader
 
 def usage():
 	print "Usage: fail2ban.py [OPTIONS]"
@@ -54,7 +55,7 @@ def usage():
 	print "  -b         start fail2ban in background"
 	print "  -d         start fail2ban in debug mode"
 	print "  -e <INTF>  ban IP on the INTF interface"
-	print "  -f <FILE>  read password failure from FILE"
+	print "  -c <FILE>  read configuration file FILE"
 	print "  -h         display this help message"
 	print "  -i <IP(s)> IP(s) to ignore"
 	print "  -l <FILE>  log message in FILE"
@@ -167,15 +168,12 @@ if __name__ == "__main__":
 	logSys = log4py.Logger().get_instance()
 	logSys.set_formatstring("%T %L %M")
 	
-	# Config file
-	configParser = SafeConfigParser()
-	configParser.read("/etc/fail2ban.conf")
-	
 	conf = dict()
 	conf["verbose"] = False
 	conf["background"] = False
 	conf["debug"] = False
-	conf["pwdfailfile"] = "/var/log/pwdfail/current"
+	conf["conffile"] = "/etc/fail2ban.conf"
+	conf["apachefile"] = "log-test/current"
 	conf["logging"] = False
 	conf["logfile"] = "/var/log/fail2ban.log"
 	conf["maxretry"] = 3
@@ -185,6 +183,21 @@ if __name__ == "__main__":
 	conf["firewall"] = "iptables"
 	conf["polltime"] = 1
 	
+	# Reads the command line options.
+	try:
+		optList, args = getopt.getopt(sys.argv[1:], 'hvbdc:l:t:i:r:e:w:')
+	except getopt.GetoptError:
+		usage()
+	
+	# Pre-parsing of command line options for the -c option
+	for opt in optList:
+		if opt[0] == "-c":
+			conf["conffile"] = opt[1]
+	
+	# Config file
+	configParser = SafeConfigParser()
+	configParser.read(conf["conffile"])
+	
 	# background
 	try:
 		conf["background"] = configParser.getboolean("DEFAULT", "background")
@@ -204,16 +217,6 @@ if __name__ == "__main__":
 	except NoOptionError:
 		logSys.warn("debug option not in config file")
 		logSys.warn("Using default value")
-	
-	# pwdfailfile
-	try:
-		conf["pwdfailfile"] = configParser.get("DEFAULT", "pwdfailfile")
-	except ValueError:
-		logSys.warn("pwdfailfile option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("pwdfailfile option not in config file")
-		logSys.warn("Using default value")
 
 	# logfile
 	try:
@@ -265,7 +268,7 @@ if __name__ == "__main__":
 		logSys.warn("interface option not in config file")
 		logSys.warn("Using default value")
 		
-	# interface
+	# firewall
 	try:
 		conf["firewall"] = configParser.get("DEFAULT", "firewall")
 	except ValueError:
@@ -285,12 +288,6 @@ if __name__ == "__main__":
 		logSys.warn("polltime option not in config file")
 		logSys.warn("Using default value")
 	
-	# Reads the command line options.
-	try:
-		optList, args = getopt.getopt(sys.argv[1:], 'hvbdf:l:t:i:r:e:w:')
-	except getopt.GetoptError:
-		usage()
-	
 	for opt in optList:
 		if opt[0] == "-h":
 			usage()
@@ -302,8 +299,6 @@ if __name__ == "__main__":
 			conf["debug"] = True
 		if opt[0] == "-e":
 			conf["interface"] = opt[1]
-		if opt[0] == "-f":
-			conf["pwdfailfile"] = opt[1]
 		if opt[0] == "-l":
 			conf["logging"] = True
 			conf["logfile"] = opt[1]
@@ -359,22 +354,35 @@ if __name__ == "__main__":
 		if not conf["debug"]:
 			sys.exit(-1)
 	
-	logSys.debug("logFilePath is "+conf["pwdfailfile"])
+	logSys.debug("ConfFile is "+conf["conffile"])
 	logSys.debug("BanTime is "+`conf["bantime"]`)
 	logSys.debug("retryAllowed is "+`conf["maxretry"]`)
 	
+	# Reads the config file and create a LogReader instance for
+	# each log file to check.
+	confReader = ConfigReader(conf["conffile"]);
+	confReader.openConf()
+	logList = list()
+	for t in confReader.getSections():
+		l = confReader.getLogOptions(t)
+		lObj = LogReader(logSys, l["logfile"], l["timeregex"],
+						l["timepattern"], l["failregex"])
+		lObj.openLogFile()
+		logList.append(lObj)
+	
 	# Creates one instance of Iptables (thanks to Pyhton dynamic
 	# features) and one of LogReader.
 	fireWallObj = eval(fireWallName)
 	fireWall = fireWallObj(conf["bantime"], logSys, conf["interface"])
-	logFile = LogReader(conf["pwdfailfile"], logSys, conf["bantime"])
 	
 	# We add 127.0.0.1 to the ignore list has we do not want
 	# to be ban ourself.
-	logFile.addIgnoreIP("127.0.0.1")
+	for element in logList:
+		element.addIgnoreIP("127.0.0.1")
 	while len(ignoreIPList) > 0:
 		ip = ignoreIPList.pop()
-		logFile.addIgnoreIP(ip)
+		for element in logList:
+			element.addIgnoreIP(ip)
 	
 	logSys.info("Fail2Ban v"+version+" is running")
 	# Main loop
@@ -390,12 +398,19 @@ if __name__ == "__main__":
 			# If the log file has not been modified since the
 			# last time, we sleep for 1 second. This is active
 			# polling so not very effective.
-			if not logFile.isModified():
+			isModified = False
+			for element in logList:
+				if element.isModified():
+					isModified = True
+			
+			if not isModified:
 				time.sleep(conf["polltime"])
 				continue
 			
 			# Gets the failure list from the log file.
-			failList = logFile.getPwdFailure()
+			failList = dict()
+			for element in logList:
+				failList.update(element.getFailures())
 			
 			# We iterate the failure list and ban IP that make
 			# *retryAllowed* login failures.
diff --git a/log-test/apache b/log-test/apache
new file mode 100644
index 00000000..35248fd2
--- /dev/null
+++ b/log-test/apache
@@ -0,0 +1,102 @@
+[Mon Jan 03 05:02:15 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:21 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/\xe0
+[Mon Jan 03 05:02:23 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msdac
+[Mon Jan 03 05:02:23 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msdac
+[Mon Jan 03 05:02:24 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/PBServer
+[Mon Jan 03 05:02:24 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/PBServer
+[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/Rpc
+[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/Rpc
+[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/samples
+[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/samples
+[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts..\xc1\x9c..
+[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:32 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:32 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:34 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:34 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:39 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:39 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 11:08:29 2005] [error] [client 128.178.150.127] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Mon Jan 03 20:08:52 2005] [error] [client 83.76.202.195] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:19:50 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:19:55 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:01 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:05 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:08 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:12 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:16 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:22 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:26 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:28 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:38 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 20:54:59 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 20:55:04 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 20:55:29 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 21:34:29 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 21:34:32 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 00:17:41 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 00:18:03 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 00:18:12 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:24:38 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:24:40 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:24:46 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:24:48 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:25:58 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:26:34 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:26:37 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 10:13:02 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 10:13:07 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 10:13:10 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 10:17:07 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:41:40 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:41:45 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:41:47 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:41:51 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:55:30 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:03:44 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:03:48 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:03:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:03:57 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:06:45 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Mar 05 15:07:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Jan 05 15:08:01 2005] [error] [client 192.168.0.128] user  not found: /phpinfo
+[Wed Jan 05 15:10:45 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/css/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
+[Wed Jan 05 15:10:45 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/images/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
+[Wed Jan 05 15:10:45 2005] [error] [client 192.168.0.128] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:11:09 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 05 15:11:10 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 06 15:11:11 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 06 15:11:13 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 06 15:11:14 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 05 15:11:15 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/css/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
+[Wed Jan 05 15:11:15 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/images/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
+[Wed Jan 05 15:11:15 2005] [error] [client 192.168.0.128] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:12:32 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:48 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:51 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:54 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:56 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:59 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:14:20 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:14:24 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:14:29 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:14:34 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Mar 05 15:08:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 05 15:09:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
\ No newline at end of file
diff --git a/log-test/current b/log-test/current
index 6537a6aa..d4b9f00a 100644
--- a/log-test/current
+++ b/log-test/current
@@ -1,4 +1,5 @@
-                - Last output repeated 2 times -
-Oct  7 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
-Oct  7 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
-Oct  7 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
+Jan  7 17:53:15 [sshd] (pam_unix) 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.220.137.36  user=kevin
+Jan  7 17:53:26 [sshd] (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.220.137.36  user=kevin
+Mar  7 17:53:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
+Mar  7 17:55:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
diff --git a/log-test/test b/log-test/test
index 30fc4868..d370ca46 100644
--- a/log-test/test
+++ b/log-test/test
@@ -425,7 +425,8 @@ Oct  7 01:03:12 [sshd] Failed password for illegal user tata from 128.178.164.52
                 - Last output repeated 2 times -
 Oct  7 01:03:20 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37187 ssh2
                 - Last output repeated 2 times -
-Oct 11 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
-Oct 11 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
-Oct 11 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
-Oct 12 21:54:11 yellow sshd[16069]: Failed password for cyril from 212.41.79.210 port 29404 ssh2
+Nov 14 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
+Nov 14 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
+Nov 14 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
+Nov 15 11:12:11 yellow sshd[16069]: Failed password for cyril from 212.41.79.210 port 29404 ssh2
+Nov 15 21:54:11 yellow sshd[16069]: Illegal user for cyril from 212.41.79.210 port 29404 ssh2
diff --git a/logreader/logreader.py b/logreader/logreader.py
index 12a24d85..24b8458f 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -24,9 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import os, sys, time
-
-from sshd import Sshd
+import os, sys, time, re
 
 class LogReader:
 	""" Reads a log file and reports information about IP that make password
@@ -34,13 +32,15 @@ class LogReader:
 		attempt.	
 	"""
 	
-	def __init__(self, logPath, logSys, findTime = 3600):
+	def __init__(self, logSys, logPath, timeregex, timepattern, failregex, findTime = 3600):
 		self.logPath = logPath
+		self.timeregex = timeregex
+		self.timepattern = timepattern
+		self.failregex = failregex
 		self.findTime = findTime
 		self.ignoreIpList = []
 		self.lastModTime = 0
 		self.logSys = logSys
-		self.parserList = ["Sshd"]
 	
 	def addIgnoreIP(self, ip):
 		""" Adds an IP to the ignore list.
@@ -79,30 +79,14 @@ class LogReader:
 			self.lastModTime = logStats.st_mtime
 			return True
 	
-	def matchLine(self, line):
-		""" Checks if the line contains a pattern. It does this for all
-			classes specified in *parserList*. We use a singleton to avoid
-			creating/destroying objects too much.
-			
-			Return a dict with the IP and number of retries.
-		"""
-		for i in self.parserList:
-			match = eval(i).getInstance().parseLogLine(line)
-			if match:
-				return match
-		return None
-	
-	def getFailInfo(self, findTime):
-		""" Gets the failed login attempt. Returns a dict() which contains
-			IP and the number of retries.
-		"""
+	def getFailures(self):
 		ipList = dict()
 		logFile = self.openLogFile()
 		for line in logFile.readlines():
-			match = self.matchLine(line)
-			if match:
-				ip = match[0]
-				unixTime = match[1]
+			value = self.findFailure(line)
+			if value:
+				ip = value[0]
+				unixTime = value[1]
 				if unixTime < time.time()-self.findTime:
 					continue
 				if self.inIgnoreIPList(ip):
@@ -115,9 +99,35 @@ class LogReader:
 					ipList[ip] = (1, unixTime)
 		logFile.close()
 		return ipList
+
+	def findFailure(self, line):
+		match = self.matchLine(line, self.failregex)
+		if match:
+			timeMatch = self.matchLine(match.string, self.timeregex)
+			if timeMatch:
+				date = self.getUnixTime(timeMatch.group(), self.timepattern)
+				ipMatch = self.matchAddress(match.string)
+				if ipMatch:
+					ip = ipMatch.group()
+					return [ip, date]
+		return None
+		
+	def getUnixTime(self, value, pattern):
+		date = list(time.strptime(value, pattern))
+		if date[0] < 2000:
+			date[0] = time.gmtime()[0]
+		unixTime = time.mktime(date)
+		return unixTime
 	
-	def getPwdFailure(self):
-		""" Executes the getFailInfo method. Not very usefull...
+	def matchLine(self, line, pattern):
+		""" Checks if the line contains a pattern. It does this for all
+			classes specified in *parserList*. We use a singleton to avoid
+			creating/destroying objects too much.
+			
+			Return a dict with the IP and number of retries.
 		"""
-		failList = self.getFailInfo(self.findTime)
-		return failList
+		return re.search(pattern, line)
+		
+	def matchAddress(self, line):
+		return re.search("(?:\d{1,3}\.){3}\d{1,3}", line)
+	
\ No newline at end of file
diff --git a/logreader/parser.py b/logreader/parser.py
deleted file mode 100644
index d3067543..00000000
--- a/logreader/parser.py
+++ /dev/null
@@ -1,67 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import time, re
-
-class Parser:
-    """ This class is the main log parser class. It should be inherited
-        by all the service specific classes.
-    """
-    
-    def getLogMatch(self, pattern, line):
-        """ Returns a match if pattern is found in line.
-        """
-        return re.search(pattern, line)
-        
-    def getLogIPv4(self, line):
-        """ Returns IP if one is found in line. Match IPv4 string.
-        """
-        matchIP = re.search("(?:\d{1,3}\.){3}\d{1,3}", line)
-        if matchIP:
-            return matchIP.group()
-        else:
-            return None
-        
-    def getLogIP(self, line):
-        """ Returns IP if one is found in line.
-        """
-        return self.getLogIPv4(line)
-    
-    def getLogTimeStandard(self, line):
-        """ Returns the log time of line using a standard log format.
-            
-            Format: Oct 14 11:47:08
-        """
-        date = list(time.strptime(line[0:15], "%b %d %H:%M:%S"))
-        date[0] = time.gmtime()[0]
-        unixTime = time.mktime(date)
-        return unixTime
-        
-    def getLogTime(self, line):
-        """ Returns the log time of line.
-        """
-        return self.getLogTimeStandard(line)
-    
\ No newline at end of file
diff --git a/setup.py b/setup.py
index b1eafeda..1e05ff47 100755
--- a/setup.py
+++ b/setup.py
@@ -38,5 +38,5 @@ setup(
         url = "http://www.sourceforge.net/projects/fail2ban",
         scripts = ['fail2ban.py'],
         py_modules = ['version'],
-        packages = ['firewall', 'logreader']
+        packages = ['firewall', 'logreader', 'confreader']
 )
\ No newline at end of file
diff --git a/version.py b/version.py
index cbfd96b8..cb074256 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.1.2"
+version = "0.3.0-CVS"

From 78dab1db70f705d0bf9f0b634e4393e67a6a3345 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 18 Feb 2005 21:45:34 +0000
Subject: [PATCH 045/549] - Updated information

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@51 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 README | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/README b/README
index 30b27060..aa5c8dde 100644
--- a/README
+++ b/README
@@ -4,13 +4,14 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.1.1)                           10/23/2004
+Fail2Ban (version 0.3.0)                           02/??/2005
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
 that makes too much password failures. It updates firewall
-rules to reject the IP address. Currently sshd, iptables,
-ipfw and ipfwadm are supported. It needs log4py.
+rules to reject the IP address. Currently iptables, ipfw and
+ipfwadm are supported. Fail2Ban can read multiple log files
+such as sshd or Apache web server ones. It needs log4py.
 
 This is my first Python program. I began learning Python for
 less than one week so please be understanding ;-) English is
@@ -31,17 +32,21 @@ some google searches, I found that sshd was not able of that.
 So I search for a script or program that do it. Found
 nothing :-( So I decide to write mine and to learn Python :-)
 
-I read the log file (/var/log/pwdfail/current on metalog) and
-search for a given pattern which indicates a login attempt.
-Then I get the ip and if it has already done 3 or more
-password failure in the last banTime, I ban the ip for
+For each sections defined in the configuration file, Fail2Ban
+tries to find lines which match the failregex. Then it
+retrieves the message time using timeregex and timepattern.
+It finally gets the ip and if it has already done 3 or more
+password failures in the last banTime, the ip is banned for
 banTime using a iptable rule. After banTime, the rule is
 deleted.
 
+Sections can be freely added so it is possible to monitor
+several daemons at the same time.
+
 Runs on my server and does its job rather well :-) The idea
-is to make fail2ban usable with most syslog daemons and
-services that require a login (sshd, telnetd, ...). It should
-also support others firewalls than iptables.
+is to make fail2ban usable with daemons and services that
+require a login (sshd, telnetd, ...). It should also support
+others firewalls than iptables.
 
 
 Installation:
@@ -52,8 +57,8 @@ Require: python-2.3 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.1.2.tar.bz2
-> cd fail2ban-0.1.2
+> tar xvfj fail2ban-0.3.0.tar.bz2
+> cd fail2ban-0.3.0
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The

From b5eb68d884b24f8f152476d63c09d8f446838f5b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 18 Feb 2005 21:46:56 +0000
Subject: [PATCH 046/549] - Only scan log files which were modified

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@52 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG   | 1 +
 fail2ban.py | 9 +++++----
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index d954dec9..fa723d04 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -12,6 +12,7 @@ ver. 0.3.0 (02/??/2005) - alpha
 - Re-writting of parts of the code in order to handle several
   log files with different rules
 - Removed sshd.py because it is no more needed
+- Fixed a bug when exiting with IP in the ban list
 
 ver. 0.1.2 (11/21/2004) - beta
 ----------
diff --git a/fail2ban.py b/fail2ban.py
index a7adfd2d..3270a67b 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -43,8 +43,8 @@ from firewall.iptables import Iptables
 from firewall.ipfw import Ipfw
 from firewall.ipfwadm import Ipfwadm
 from logreader.logreader import LogReader
-from version import version
 from confreader.configreader import ConfigReader
+from version import version
 
 def usage():
 	print "Usage: fail2ban.py [OPTIONS]"
@@ -173,7 +173,6 @@ if __name__ == "__main__":
 	conf["background"] = False
 	conf["debug"] = False
 	conf["conffile"] = "/etc/fail2ban.conf"
-	conf["apachefile"] = "log-test/current"
 	conf["logging"] = False
 	conf["logfile"] = "/var/log/fail2ban.log"
 	conf["maxretry"] = 3
@@ -360,7 +359,7 @@ if __name__ == "__main__":
 	
 	# Reads the config file and create a LogReader instance for
 	# each log file to check.
-	confReader = ConfigReader(conf["conffile"]);
+	confReader = ConfigReader(logSys, conf["conffile"]);
 	confReader.openConf()
 	logList = list()
 	for t in confReader.getSections():
@@ -399,9 +398,11 @@ if __name__ == "__main__":
 			# last time, we sleep for 1 second. This is active
 			# polling so not very effective.
 			isModified = False
+			modList = list()
 			for element in logList:
 				if element.isModified():
 					isModified = True
+					modList.append(element)
 			
 			if not isModified:
 				time.sleep(conf["polltime"])
@@ -409,7 +410,7 @@ if __name__ == "__main__":
 			
 			# Gets the failure list from the log file.
 			failList = dict()
-			for element in logList:
+			for element in modList:
 				failList.update(element.getFailures())
 			
 			# We iterate the failure list and ban IP that make

From f4b083d79b3059a3044607df38a01eb291fc12f7 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 18 Feb 2005 21:48:34 +0000
Subject: [PATCH 047/549] - Added more comments - Catch exception when option
 not present in section

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@53 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 confreader/configreader.py | 62 ++++++++++++++++++++++----------------
 1 file changed, 36 insertions(+), 26 deletions(-)

diff --git a/confreader/configreader.py b/confreader/configreader.py
index 5f8679dd..1b43cf4f 100644
--- a/confreader/configreader.py
+++ b/confreader/configreader.py
@@ -29,29 +29,39 @@ import os, sys, time
 from ConfigParser import *
 
 class ConfigReader:
-    """ Reads a log file and reports information about IP that make password
-        failure, bad user or anything else that is considered as doubtful login
-        attempt.    
-    """
-    
-    optionValues = ("logfile", "timeregex", "timepattern", "failregex")
-    
-    def __init__(self, confPath):
-        self.confPath = confPath
-        self.configParser = SafeConfigParser()
-        
-    def openConf(self):
-        self.configParser.read(self.confPath)
-    
-    def getSections(self):
-        return self.configParser.sections()
-        
-    def getLogOptions(self, sec):
-        values = dict()
-        for option in self.optionValues:
-            v = self.configParser.get(sec, option)
-            values[option] = v
-        return values
-        
-    
-    
+	""" This class allow the handling of the configuration options.
+		The DEFAULT section contains the global information about
+		Fail2Ban. Each other section is for a different log file.
+	"""
+	
+	optionValues = ("logfile", "timeregex", "timepattern", "failregex")
+	
+	def __init__(self, logSys, confPath):
+		self.confPath = confPath
+		self.configParser = SafeConfigParser()
+		self.logSys = logSys
+		
+	def openConf(self):
+		""" Opens the configuration file.
+		"""
+		self.configParser.read(self.confPath)
+	
+	def getSections(self):
+		""" Returns all the sections present in the configuration
+			file except the DEFAULT section.
+		"""
+		return self.configParser.sections()
+		
+	def getLogOptions(self, sec):
+		""" Gets all the options of a given section. The options
+			are defined in the optionValues list.
+		"""
+		values = dict()
+		for option in self.optionValues:
+			try:
+				v = self.configParser.get(sec, option)
+				values[option] = v
+			except NoOptionError:
+				self.logSys.info("No "+option+" defined in "+sec)
+		return values
+		
\ No newline at end of file

From e339a487519f1e0a8fff9648ef1763df8905502a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 18 Feb 2005 21:49:51 +0000
Subject: [PATCH 048/549] - Fixed bug when flushing ban list

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@54 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/firewall.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/firewall/firewall.py b/firewall/firewall.py
index 38782bde..959373c3 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -79,7 +79,8 @@ class Firewall:
 		""" Flushes the ban list and of course the firewall rules.
 			Called when fail2ban exits.
 		"""
-		iterBanList = self.banList.iteritems()
+		banListTemp = self.banList.copy()
+		iterBanList = banListTemp.iteritems()
 		for i in range(len(self.banList)):
 			element = iterBanList.next()
 			ip = element[0]
@@ -101,4 +102,3 @@ class Firewall:
 		for i in range(len(self.banList)):
 			element = iterBanList.next()
 			print element
-		

From ff088ec33373e0fe7d8212e452074c69120252d8 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 18 Feb 2005 21:51:32 +0000
Subject: [PATCH 049/549] - Added more comments

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@55 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default |  3 ++-
 logreader/logreader.py       | 39 ++++++++++++++++++++++++++----------
 2 files changed, 30 insertions(+), 12 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 3a4e79cc..5aa5b740 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -41,7 +41,8 @@ interface = eth0
 polltime = 1
 
 # You can define a new section for each log file to check for
-# password failure.
+# password failure. Each section has to define the following
+# options: logfile, timeregex, timepattern, failregex.
 
 [Apache]
 # logfile: file to monitor.
diff --git a/logreader/logreader.py b/logreader/logreader.py
index 24b8458f..083e59d6 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -80,6 +80,12 @@ class LogReader:
 			return True
 	
 	def getFailures(self):
+		""" Gets all the failure in the log file which are
+			newer than time.time()-self.findTime.
+			
+			Returns a dict with the IP, the number of failure
+			and the latest failure time.
+		"""
 		ipList = dict()
 		logFile = self.openLogFile()
 		for line in logFile.readlines():
@@ -101,33 +107,44 @@ class LogReader:
 		return ipList
 
 	def findFailure(self, line):
-		match = self.matchLine(line, self.failregex)
+		""" Finds the failure in line. Uses the failregex pattern
+			to find it and timeregex in order to find the logging
+			time.
+			
+			Returns a dict with IP and timestamp.
+		"""
+		match = self.matchLine(self.failregex, line)
 		if match:
-			timeMatch = self.matchLine(match.string, self.timeregex)
+			timeMatch = self.matchLine(self.timeregex, match.string)
 			if timeMatch:
-				date = self.getUnixTime(timeMatch.group(), self.timepattern)
+				date = self.getUnixTime(timeMatch.group())
 				ipMatch = self.matchAddress(match.string)
 				if ipMatch:
 					ip = ipMatch.group()
 					return [ip, date]
 		return None
 		
-	def getUnixTime(self, value, pattern):
-		date = list(time.strptime(value, pattern))
+	def getUnixTime(self, value):
+		""" Returns the Unix timestamp of the given value.
+			Pattern should describe the date construction of
+			value.
+		"""
+		date = list(time.strptime(value, self.timepattern))
 		if date[0] < 2000:
 			date[0] = time.gmtime()[0]
 		unixTime = time.mktime(date)
 		return unixTime
 	
-	def matchLine(self, line, pattern):
-		""" Checks if the line contains a pattern. It does this for all
-			classes specified in *parserList*. We use a singleton to avoid
-			creating/destroying objects too much.
+	def matchLine(self, pattern, line):
+		""" Checks if the line contains a pattern.
 			
-			Return a dict with the IP and number of retries.
+			Return a match object.
 		"""
 		return re.search(pattern, line)
 		
 	def matchAddress(self, line):
-		return re.search("(?:\d{1,3}\.){3}\d{1,3}", line)
+		""" Return a match on the IP address present in
+			line.		
+		"""
+		return self.matchLine("(?:\d{1,3}\.){3}\d{1,3}", line)
 	
\ No newline at end of file

From 2b5812ef9be7cb9fa71c76ffced288df836f286e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 18 Feb 2005 21:53:16 +0000
Subject: [PATCH 050/549] - parser.py no more needed

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@56 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 1 -
 1 file changed, 1 deletion(-)

diff --git a/MANIFEST b/MANIFEST
index d31f45f5..df4de156 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -11,7 +11,6 @@ firewall/ipfw.py
 firewall/ipfwadm.py
 logreader/__init__.py
 logreader/logreader.py
-logreader/parser.py
 confreader/__init__.py
 confreader/configreader.py
 config/fail2ban.conf.default

From c7947c68e9ed83a1b0f65993cf772e36c962873c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 18 Feb 2005 22:14:02 +0000
Subject: [PATCH 051/549] - Bantime was not used in the log reader

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@57 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban.py b/fail2ban.py
index 3270a67b..3bb06f3e 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -365,7 +365,7 @@ if __name__ == "__main__":
 	for t in confReader.getSections():
 		l = confReader.getLogOptions(t)
 		lObj = LogReader(logSys, l["logfile"], l["timeregex"],
-						l["timepattern"], l["failregex"])
+						l["timepattern"], l["failregex"], conf["bantime"])
 		lObj.openLogFile()
 		logList.append(lObj)
 	

From 16dbc44607e44494ba5c2df894952ceea9670360 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Feb 2005 11:15:06 +0000
Subject: [PATCH 052/549] - Added TODO file

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@58 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST |  1 +
 TODO     | 15 +++++++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 TODO

diff --git a/MANIFEST b/MANIFEST
index df4de156..90767c9e 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -1,5 +1,6 @@
 README
 CHANGELOG
+TODO
 setup.cfg
 setup.py
 version.py
diff --git a/TODO b/TODO
new file mode 100644
index 00000000..62d421f1
--- /dev/null
+++ b/TODO
@@ -0,0 +1,15 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+ToDo
+=============================================================
+
+- cleanup fail2ban.py
+- resolve DNS with 'host' and os.popen (???)
+- improve configuration file and command line options
+  handling
+- improve installation process
+- create a web page for the project

From deffa8f5aa85db787777ff13b8bedb41be597075 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Feb 2005 11:16:56 +0000
Subject: [PATCH 053/549] - Added log reader name

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@59 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index 083e59d6..b782a140 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -41,6 +41,16 @@ class LogReader:
 		self.ignoreIpList = []
 		self.lastModTime = 0
 		self.logSys = logSys
+		
+	def setName(self, name):
+		""" Sets the name of the log reader.
+		"""
+		self.name = name
+		
+	def getName(self):
+		""" Gets the name of the log reader.
+		"""
+		return self.name
 	
 	def addIgnoreIP(self, ip):
 		""" Adds an IP to the ignore list.

From 1711a87dff81834d57421d179e28f8a6360d847b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Feb 2005 13:33:17 +0000
Subject: [PATCH 054/549] - Added PID lock file support - Added log reader name
 support - Improve some algorithms - Changed some info messages to warn

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@60 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 75 ++++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 66 insertions(+), 9 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index 3bb06f3e..5dac3a00 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -56,6 +56,7 @@ def usage():
 	print "  -d         start fail2ban in debug mode"
 	print "  -e <INTF>  ban IP on the INTF interface"
 	print "  -c <FILE>  read configuration file FILE"
+	print "  -p <FILE>  create PID lock in FILE"
 	print "  -h         display this help message"
 	print "  -i <IP(s)> IP(s) to ignore"
 	print "  -l <FILE>  log message in FILE"
@@ -161,6 +162,30 @@ def sigTERMhandler(signum, frame):
 	fireWall.flushBanList(conf["debug"])
 	logSys.info("Exiting...")
 	sys.exit(0)
+	
+def checkForPID(lockfile):
+	""" Checks for running Fail2Ban.
+	
+		Returns the current PID if Fail2Ban is running or False
+		if no instance found.
+	"""
+	try:
+		fileHandler = open(lockfile)
+		pid = fileHandler.readline()
+		return pid
+	except IOError:
+		fileHandler = open(lockfile, mode='w')
+		pid = os.getpid()
+		fileHandler.write(`pid`+'\n')
+		fileHandler.close()
+		logSys.debug("Created PID lock ("+`pid`+") in "+lockfile)
+		return False
+		
+def removePID(lockfile):
+	""" Remove PID lock.
+	"""
+	os.remove(lockfile)
+	logSys.debug("Removed PID lock "+lockfile)
 
 if __name__ == "__main__":
 	
@@ -173,6 +198,7 @@ if __name__ == "__main__":
 	conf["background"] = False
 	conf["debug"] = False
 	conf["conffile"] = "/etc/fail2ban.conf"
+	conf["pidlock"] = "/tmp/fail2ban.pid"
 	conf["logging"] = False
 	conf["logfile"] = "/var/log/fail2ban.log"
 	conf["maxretry"] = 3
@@ -184,7 +210,7 @@ if __name__ == "__main__":
 	
 	# Reads the command line options.
 	try:
-		optList, args = getopt.getopt(sys.argv[1:], 'hvbdc:l:t:i:r:e:w:')
+		optList, args = getopt.getopt(sys.argv[1:], 'hvbdc:l:t:i:r:e:w:p:')
 	except getopt.GetoptError:
 		usage()
 	
@@ -227,6 +253,16 @@ if __name__ == "__main__":
 		logSys.warn("logfile option not in config file")
 		logSys.warn("Using default value")
 		
+	# pidlock
+	try:
+		conf["pidlock"] = configParser.get("DEFAULT", "pidlock")
+	except ValueError:
+		logSys.warn("pidlock option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("pidlock option not in config file")
+		logSys.warn("Using default value")
+		
 	# maxretry
 	try:
 		conf["maxretry"] = configParser.getint("DEFAULT", "maxretry")
@@ -313,6 +349,8 @@ if __name__ == "__main__":
 			conf["retrymax"] = int(opt[1])
 		if opt[0] == "-w":
 			conf["firewall"] = opt[1]
+		if opt[0] == "-p":
+			conf["pidlock"] = opt[1]
 
 	# Process some options
 	for c in conf:
@@ -352,6 +390,12 @@ if __name__ == "__main__":
 		logSys.error("You must be root")
 		if not conf["debug"]:
 			sys.exit(-1)
+			
+	# Checks that no instance of Fail2Ban is currently running.
+	pid = checkForPID(conf["pidlock"])
+	if pid:
+		logSys.error("Fail2Ban already running with PID "+pid)
+		sys.exit(-1)
 	
 	logSys.debug("ConfFile is "+conf["conffile"])
 	logSys.debug("BanTime is "+`conf["bantime"]`)
@@ -366,7 +410,7 @@ if __name__ == "__main__":
 		l = confReader.getLogOptions(t)
 		lObj = LogReader(logSys, l["logfile"], l["timeregex"],
 						l["timepattern"], l["failregex"], conf["bantime"])
-		lObj.openLogFile()
+		lObj.setName(t)
 		logList.append(lObj)
 	
 	# Creates one instance of Iptables (thanks to Pyhton dynamic
@@ -383,7 +427,7 @@ if __name__ == "__main__":
 		for element in logList:
 			element.addIgnoreIP(ip)
 	
-	logSys.info("Fail2Ban v"+version+" is running")
+	logSys.warn("Fail2Ban v"+version+" is running")
 	# Main loop
 	while True:
 		try:
@@ -397,21 +441,31 @@ if __name__ == "__main__":
 			# If the log file has not been modified since the
 			# last time, we sleep for 1 second. This is active
 			# polling so not very effective.
-			isModified = False
 			modList = list()
 			for element in logList:
 				if element.isModified():
-					isModified = True
 					modList.append(element)
 			
-			if not isModified:
+			if len(modList) == 0:
 				time.sleep(conf["polltime"])
 				continue
 			
-			# Gets the failure list from the log file.
+			# Gets the failure list from the log file. For a given IP,
+			# takes only the service which has the most password failures.
 			failList = dict()
 			for element in modList:
-				failList.update(element.getFailures())
+				e = element.getFailures()
+				iter = e.iterkeys()
+				for i in range(len(e)):
+					key = iter.next()
+					if failList.has_key(key):
+						if failList[key][0] < e[key][0]:
+							failList[key] = (e[key][0], e[key][1],
+											element.getName())
+					else:
+						failList[key] = (e[key][0], e[key][1],
+										element.getName())
+				
 			
 			# We iterate the failure list and ban IP that make
 			# *retryAllowed* login failures.
@@ -419,6 +473,8 @@ if __name__ == "__main__":
 			for i in range(len(failList)):
 				element = iterFailList.next()
 				if element[1][0] >= conf["maxretry"]:
+					logSys.warn(`element[1][2]`+": "+element[0]+" has "+
+								`element[1][0]`+" login failure(s). Banned.")
 					fireWall.addBanIP(element[0], conf["debug"])
 			
 		except KeyboardInterrupt:
@@ -426,5 +482,6 @@ if __name__ == "__main__":
 			# and exit nicely.
 			logSys.info("Restoring iptables...")
 			fireWall.flushBanList(conf["debug"])
-			logSys.info("Exiting...")
+			removePID(conf["pidlock"])
+			logSys.warn("Exiting...")
 			sys.exit(0)

From 2131d080c29023b0063825886d86da17ea011dec Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Feb 2005 13:33:55 +0000
Subject: [PATCH 055/549] - Added PID lock file option

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@61 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 README | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README b/README
index aa5c8dde..5c80b7d3 100644
--- a/README
+++ b/README
@@ -85,6 +85,7 @@ options:
   -d         start fail2ban in debug mode
   -e <INTF>  ban IP on the INTF interface
   -c <FILE>  read configuration file FILE
+  -p <FILE>  create PID lock in FILE
   -h         display this help message
   -i <IP(s)> IP(s) to ignore
   -l <FILE>  log message in FILE

From 4961847529aadc51115a78fbe9d25fe9cca3b14a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Feb 2005 13:34:43 +0000
Subject: [PATCH 056/549] - Added PID lock file support - Improved some parts
 of the code

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@62 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index fa723d04..f2b37ce1 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -13,6 +13,8 @@ ver. 0.3.0 (02/??/2005) - alpha
   log files with different rules
 - Removed sshd.py because it is no more needed
 - Fixed a bug when exiting with IP in the ban list
+- Added PID lock file
+- Improved some parts of the code
 
 ver. 0.1.2 (11/21/2004) - beta
 ----------

From 3122f5eeae809bcac6d5eaa16d77df49881a2691 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Feb 2005 13:38:10 +0000
Subject: [PATCH 057/549] - Added PID lock file option - Added more comments

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@63 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 5aa5b740..fc9be3ab 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -16,6 +16,10 @@ background = false
 # and bypass root user test.
 debug = false
 
+# pidlock: the path of the PID lock file. Fail2Ban must be
+# able to write into that file.
+#pidlock = /var/run/fail2ban.pid
+
 # logfile: the path of the file for logging messages of
 # fail2ban.
 logfile = /var/log/fail2ban.log
@@ -54,12 +58,13 @@ logfile = log-test/apache
 timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
 
 # timepattern: indicates the "timeregex" fields signification.
+# Notice that '%' must be espaced with '%'.
 # See syntax here: http://rgruet.free.fr/PQR2.3.html#timeModule
 timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
 
 # failregex: regular expression which have to match the
 # message written in the log file in case of password failure.
-failregex = authentication failure
+failregex = authentication failure|user .* not found
 
 [SSH]
 # logfile: file to monitor.
@@ -71,10 +76,11 @@ logfile = log-test/current
 timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
 
 # timepattern: indicates the "timeregex" fields signification.
+# Notice that '%' must be espaced with '%'.
 # See syntax here: http://rgruet.free.fr/PQR2.3.html#timeModule
 timepattern = %%b %%d %%H:%%M:%%S
 
 # failregex: regular expression which have to match the
 # message written in the log file in case of password failure.
-failregex = Authentication failure
+failregex = Authentication failure|Failed password
 

From 78b32ef3b2d1883343a4dcdae15c89fa7bfd4819 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Feb 2005 21:08:36 +0000
Subject: [PATCH 058/549] - Added "ipfw-start-rule" option (thanks to Robert
 Edeker) - Added "enabled" option

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@64 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index fc9be3ab..43f08b86 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -8,6 +8,10 @@
 # the available options are: iptables, ipfwadm, ipfw
 firewall = iptables
 
+# ipfw-start-rule: set the first rule number used by Fail2Ban.
+# This option is only used if firewall = ipfw.
+ipfw-start-rule = 100
+
 # background: true to start fail2ban as a daemon. Output
 # is redirect to logfile.
 background = false
@@ -49,6 +53,9 @@ polltime = 1
 # options: logfile, timeregex, timepattern, failregex.
 
 [Apache]
+# enabled: is this section active ?
+enabled = true
+
 # logfile: file to monitor.
 logfile = log-test/apache
 
@@ -67,6 +74,9 @@ timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
 failregex = authentication failure|user .* not found
 
 [SSH]
+# enabled: is this section active ?
+enabled = true
+
 # logfile: file to monitor.
 logfile = log-test/current
 

From 7b13c386f970936affa8c212a40648552d52eff8 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Feb 2005 21:10:08 +0000
Subject: [PATCH 059/549] - The options have a specified type now

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@65 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 confreader/configreader.py | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/confreader/configreader.py b/confreader/configreader.py
index 1b43cf4f..bd2aaba0 100644
--- a/confreader/configreader.py
+++ b/confreader/configreader.py
@@ -34,7 +34,9 @@ class ConfigReader:
 		Fail2Ban. Each other section is for a different log file.
 	"""
 	
-	optionValues = ("logfile", "timeregex", "timepattern", "failregex")
+	optionValues = (["bool", "enabled"], ["str", "logfile"],
+					["str", "timeregex"], ["str", "timepattern"],
+					["str", "failregex"])
 	
 	def __init__(self, logSys, confPath):
 		self.confPath = confPath
@@ -59,8 +61,14 @@ class ConfigReader:
 		values = dict()
 		for option in self.optionValues:
 			try:
-				v = self.configParser.get(sec, option)
-				values[option] = v
+				if option[0] == "bool":
+					v = self.configParser.getboolean(sec, option[1])
+				elif option[0] == "int":
+					v = self.configParser.getint(sec, option[1])
+				else:
+					v = self.configParser.get(sec, option[1])
+				
+				values[option[1]] = v
 			except NoOptionError:
 				self.logSys.info("No "+option+" defined in "+sec)
 		return values

From acbbb11578c2fb124095cb0f725583aade5bab7d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Feb 2005 21:11:17 +0000
Subject: [PATCH 060/549] - A rule is added with a specified number now

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@66 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/ipfw.py | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/firewall/ipfw.py b/firewall/ipfw.py
index c8cd3cba..4e3e8f57 100644
--- a/firewall/ipfw.py
+++ b/firewall/ipfw.py
@@ -37,10 +37,23 @@ class Ipfw(Firewall):
 		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
 	"""
 	
+	crtRuleNbr = 0
+	
+	def getCrtRuleNbr():
+		""" Gets the current rule number.
+		"""
+		return self.crtRuleNbr
+		
+	def setCrtRuleNbr(self, value):
+		""" Sets the current rule number.
+		"""
+		self.crtRuleNbr = value
+	
 	def banIP(self, ip):
 		""" Returns query to ban IP.
 		"""
-		query = "ipfw -q add deny ip from "+ip+" to any"
+		self.crtRuleNbr = self.crtRuleNbr + 1
+		query = "ipfw -q add "+`self.crtRuleNbr`+" deny ip from "+ip+" to any"
 		return query
 	
 	def unBanIP(self, ip):

From 9a74701807130928eb1c5913b7170f287e5f54b2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Feb 2005 21:11:46 +0000
Subject: [PATCH 061/549] - Added "ipfw-start-rule" option (thanks to Robert
 Edeker)

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@67 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index f2b37ce1..9fc1ade7 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,7 +7,7 @@
 Fail2Ban (version 0.3.0)                           02/??/2005
 =============================================================
 
-ver. 0.3.0 (02/??/2005) - alpha
+ver. 0.3.0 (02/??/2005) - beta
 ----------
 - Re-writting of parts of the code in order to handle several
   log files with different rules
@@ -15,6 +15,7 @@ ver. 0.3.0 (02/??/2005) - alpha
 - Fixed a bug when exiting with IP in the ban list
 - Added PID lock file
 - Improved some parts of the code
+- Added ipfw-start-rule option (thanks to Robert Edeker)
 
 ver. 0.1.2 (11/21/2004) - beta
 ----------

From 42937a5522cc65ce8292f6f73f50ee26d0f81706 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Feb 2005 21:14:04 +0000
Subject: [PATCH 062/549] - Added "ipfw-start-rule" option (thanks to Robert
 Edeker) - Added "enabled" option

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@68 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index 5dac3a00..00685ca2 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -206,6 +206,7 @@ if __name__ == "__main__":
 	conf["ignoreip"] = ''
 	conf["interface"] = "eth0"
 	conf["firewall"] = "iptables"
+	conf["ipfw-start-rule"] = 0
 	conf["polltime"] = 1
 	
 	# Reads the command line options.
@@ -312,6 +313,17 @@ if __name__ == "__main__":
 	except NoOptionError:
 		logSys.warn("firewall option not in config file")
 		logSys.warn("Using default value")
+	
+	# ipfw-start-rule
+	try:
+		conf["ipfw-start-rule"] = configParser.getint("DEFAULT",
+													"ipfw-start-rule")
+	except ValueError:
+		logSys.warn("ipfw-start-rule option should be an integer")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("ipfw-start-rule option not in config file")
+		logSys.warn("Using default value")
 
 	# polltime
 	try:
@@ -408,16 +420,22 @@ if __name__ == "__main__":
 	logList = list()
 	for t in confReader.getSections():
 		l = confReader.getLogOptions(t)
-		lObj = LogReader(logSys, l["logfile"], l["timeregex"],
-						l["timepattern"], l["failregex"], conf["bantime"])
-		lObj.setName(t)
-		logList.append(lObj)
+		if l["enabled"]:
+			lObj = LogReader(logSys, l["logfile"], l["timeregex"],
+							l["timepattern"], l["failregex"], conf["bantime"])
+			lObj.setName(t)
+			logList.append(lObj)
 	
 	# Creates one instance of Iptables (thanks to Pyhton dynamic
-	# features) and one of LogReader.
+	# features).
 	fireWallObj = eval(fireWallName)
 	fireWall = fireWallObj(conf["bantime"], logSys, conf["interface"])
 	
+	# IPFW needs rules number. The configuration option "ipfw-start-rule"
+	# defines the first rule number used by Fail2Ban.
+	if fireWallName == "Ipfw":
+		fireWall.setCrtRuleNbr(conf["ipfw-start-rule"])
+	
 	# We add 127.0.0.1 to the ignore list has we do not want
 	# to be ban ourself.
 	for element in logList:

From 45dd8ea43eaa3bf16bf69980c2a1fea0576050a2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 23 Feb 2005 16:53:03 +0000
Subject: [PATCH 063/549] - Increment "crtRuleNbr" after the creation of the
 rule

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@69 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/ipfw.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/firewall/ipfw.py b/firewall/ipfw.py
index 4e3e8f57..79fe7c66 100644
--- a/firewall/ipfw.py
+++ b/firewall/ipfw.py
@@ -52,8 +52,8 @@ class Ipfw(Firewall):
 	def banIP(self, ip):
 		""" Returns query to ban IP.
 		"""
-		self.crtRuleNbr = self.crtRuleNbr + 1
 		query = "ipfw -q add "+`self.crtRuleNbr`+" deny ip from "+ip+" to any"
+		self.crtRuleNbr = self.crtRuleNbr + 1
 		return query
 	
 	def unBanIP(self, ip):

From c429a69845a29a2e0284078eb817ad064b928e15 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 23 Feb 2005 16:56:29 +0000
Subject: [PATCH 064/549] - Added the "-k" option. Kills a currently running
 Fail2Ban

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@70 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG   |  1 +
 README      |  1 +
 fail2ban.py | 20 ++++++++++++++++++--
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 9fc1ade7..9ef9ca4c 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -16,6 +16,7 @@ ver. 0.3.0 (02/??/2005) - beta
 - Added PID lock file
 - Improved some parts of the code
 - Added ipfw-start-rule option (thanks to Robert Edeker)
+- Added -k option which kills a currently running Fail2Ban
 
 ver. 0.1.2 (11/21/2004) - beta
 ----------
diff --git a/README b/README
index 5c80b7d3..be98a10c 100644
--- a/README
+++ b/README
@@ -88,6 +88,7 @@ options:
   -p <FILE>  create PID lock in FILE
   -h         display this help message
   -i <IP(s)> IP(s) to ignore
+  -k         kill a currently running Fail2Ban instance
   -l <FILE>  log message in FILE
   -r <VALUE> allow a max of VALUE password failure
   -t <TIME>  ban IP for TIME seconds
diff --git a/fail2ban.py b/fail2ban.py
index 00685ca2..7372bae5 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -59,6 +59,7 @@ def usage():
 	print "  -p <FILE>  create PID lock in FILE"
 	print "  -h         display this help message"
 	print "  -i <IP(s)> IP(s) to ignore"
+	print "  -k         kill a currently running Fail2Ban instance"
 	print "  -l <FILE>  log message in FILE"
 	print "  -r <VALUE> allow a max of VALUE password failure"
 	print "  -t <TIME>  ban IP for TIME seconds"
@@ -187,6 +188,12 @@ def removePID(lockfile):
 	os.remove(lockfile)
 	logSys.debug("Removed PID lock "+lockfile)
 
+def killPID(pid):
+	""" Kills the process with the given PID using the
+		INT signal (same effect as <ctrl>+<c>).
+	"""
+	return os.kill(pid, 2)
+
 if __name__ == "__main__":
 	
 	# Gets an instance of log4py.
@@ -211,7 +218,7 @@ if __name__ == "__main__":
 	
 	# Reads the command line options.
 	try:
-		optList, args = getopt.getopt(sys.argv[1:], 'hvbdc:l:t:i:r:e:w:p:')
+		optList, args = getopt.getopt(sys.argv[1:], 'hvbdkc:l:t:i:r:e:w:p:')
 	except getopt.GetoptError:
 		usage()
 	
@@ -363,6 +370,15 @@ if __name__ == "__main__":
 			conf["firewall"] = opt[1]
 		if opt[0] == "-p":
 			conf["pidlock"] = opt[1]
+		if opt[0] == "-k":
+			pid = checkForPID(conf["pidlock"])
+			if pid:
+				killPID(int(pid))
+				logSys.warn("Killed Fail2Ban with PID "+pid)
+				sys.exit(0)
+			else:
+				logSys.error("No running Fail2Ban found")
+				sys.exit(-1)
 
 	# Process some options
 	for c in conf:
@@ -498,7 +514,7 @@ if __name__ == "__main__":
 		except KeyboardInterrupt:
 			# When the user press <ctrl>+<c> we flush the ban list
 			# and exit nicely.
-			logSys.info("Restoring iptables...")
+			logSys.info("Restoring firewall rules...")
 			fireWall.flushBanList(conf["debug"])
 			removePID(conf["pidlock"])
 			logSys.warn("Exiting...")

From 3d9318ad3e1882a02b9345dcae1459934585b793 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 23 Feb 2005 17:31:46 +0000
Subject: [PATCH 065/549] - Splitted "checkForPID" into "createPID" and
 "checkForPID". Fixed the bug which created a PID lock file when calling
 Fail2Ban with the kill option

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@71 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index 7372bae5..b0aa10cd 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -175,13 +175,17 @@ def checkForPID(lockfile):
 		pid = fileHandler.readline()
 		return pid
 	except IOError:
-		fileHandler = open(lockfile, mode='w')
-		pid = os.getpid()
-		fileHandler.write(`pid`+'\n')
-		fileHandler.close()
-		logSys.debug("Created PID lock ("+`pid`+") in "+lockfile)
 		return False
 		
+def createPID(lockfile):
+	""" Creates a PID lock file with the current PID.
+	"""
+	fileHandler = open(lockfile, mode='w')
+	pid = os.getpid()
+	fileHandler.write(`pid`+'\n')
+	fileHandler.close()
+	logSys.debug("Created PID lock ("+`pid`+") in "+lockfile)
+		
 def removePID(lockfile):
 	""" Remove PID lock.
 	"""
@@ -424,6 +428,8 @@ if __name__ == "__main__":
 	if pid:
 		logSys.error("Fail2Ban already running with PID "+pid)
 		sys.exit(-1)
+	else:
+		createPID(conf["pidlock"])
 	
 	logSys.debug("ConfFile is "+conf["conffile"])
 	logSys.debug("BanTime is "+`conf["bantime"]`)

From f0625224c74b4ff134099d646526aa45aa4a271d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 23 Feb 2005 17:47:30 +0000
Subject: [PATCH 066/549] - Added a default value for each option

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@72 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 confreader/configreader.py | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/confreader/configreader.py b/confreader/configreader.py
index bd2aaba0..dbdb5d2d 100644
--- a/confreader/configreader.py
+++ b/confreader/configreader.py
@@ -34,9 +34,15 @@ class ConfigReader:
 		Fail2Ban. Each other section is for a different log file.
 	"""
 	
-	optionValues = (["bool", "enabled"], ["str", "logfile"],
-					["str", "timeregex"], ["str", "timepattern"],
-					["str", "failregex"])
+	# Each optionValues entry is composed of an array with:
+	# 0 -> the type of the option
+	# 1 -> the name of the option
+	# 2 -> the default value for the option
+	optionValues = (["bool", "enabled", True],
+					["str", "logfile", "/dev/null"],
+					["str", "timeregex", ""],
+					["str", "timepattern", ""],
+					["str", "failregex", ""])
 	
 	def __init__(self, logSys, confPath):
 		self.confPath = confPath
@@ -70,6 +76,7 @@ class ConfigReader:
 				
 				values[option[1]] = v
 			except NoOptionError:
-				self.logSys.info("No "+option+" defined in "+sec)
+				self.logSys.info("No '"+option[1]+"' defined in '"+sec+"'")
+				values[option[1]] = option[2]
 		return values
 		
\ No newline at end of file

From 7fb2508960e780536351c23bed7d645542810cfd Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 24 Feb 2005 13:59:34 +0000
Subject: [PATCH 067/549] - Version 0.3.0. Named it 0.3 because there is a lot
 of changes in this release

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@73 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  | 4 ++--
 README     | 2 +-
 TODO       | 1 -
 version.py | 2 +-
 4 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 9ef9ca4c..dfe16bee 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.3.0)                           02/??/2005
+Fail2Ban (version 0.3.0)                           02/24/2005
 =============================================================
 
-ver. 0.3.0 (02/??/2005) - beta
+ver. 0.3.0 (02/24/2005) - beta
 ----------
 - Re-writting of parts of the code in order to handle several
   log files with different rules
diff --git a/README b/README
index be98a10c..daf7b222 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.3.0)                           02/??/2005
+Fail2Ban (version 0.3.0)                           02/24/2005
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
diff --git a/TODO b/TODO
index 62d421f1..d11e3503 100644
--- a/TODO
+++ b/TODO
@@ -12,4 +12,3 @@ ToDo
 - improve configuration file and command line options
   handling
 - improve installation process
-- create a web page for the project
diff --git a/version.py b/version.py
index cb074256..776fd44e 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.3.0-CVS"
+version = "0.3.0"

From d1ec7fb830cd68ff4ee82d4f8eaef7660e64c312 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Mar 2005 17:42:04 +0000
Subject: [PATCH 068/549] - Change to CVS version

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@75 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.py b/version.py
index 776fd44e..cb074256 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.3.0"
+version = "0.3.0-CVS"

From bc4524c165ab15385d32bf5a1e72abb6e3327ec7 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Mar 2005 17:42:59 +0000
Subject: [PATCH 069/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@76 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 8 +++++++-
 README    | 5 ++++-
 TODO      | 2 +-
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index dfe16bee..a8abaac6 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,15 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.3.0)                           02/24/2005
+Fail2Ban (version 0.3.1)                           ??/??/2005
 =============================================================
 
+ver. 0.3.1 (??/??/2005) - beta
+----------
+- Corrected level of messages
+- Added DNS lookup support
+- Improved parsing speed. Only parse the new log messages
+
 ver. 0.3.0 (02/24/2005) - beta
 ----------
 - Re-writting of parts of the code in order to handle several
diff --git a/README b/README
index daf7b222..54a34bb5 100644
--- a/README
+++ b/README
@@ -38,7 +38,9 @@ retrieves the message time using timeregex and timepattern.
 It finally gets the ip and if it has already done 3 or more
 password failures in the last banTime, the ip is banned for
 banTime using a iptable rule. After banTime, the rule is
-deleted.
+deleted. Notice that if no "plain" ip is available, Fail2Ban
+try to do DNS lookup in order to found one or several ip's to
+ban.
 
 Sections can be freely added so it is possible to monitor
 several daemons at the same time.
@@ -54,6 +56,7 @@ Installation:
 
 Require: python-2.3 (http://www.python.org)
          log4py-1.1 (http://sourceforge.net/projects/log4py)
+         host (http://www.isc.org/products/BIND/bind9.html)
 
 To install, just do:
 
diff --git a/TODO b/TODO
index d11e3503..cdd565ca 100644
--- a/TODO
+++ b/TODO
@@ -8,7 +8,7 @@ ToDo
 =============================================================
 
 - cleanup fail2ban.py
-- resolve DNS with 'host' and os.popen (???)
 - improve configuration file and command line options
   handling
 - improve installation process
+- add init script

From 1a876366a7937b4198e7b1273e153e766c352547 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Mar 2005 17:44:48 +0000
Subject: [PATCH 070/549] - Added a killApp() function - Dict iteration
 improved

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@77 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 32 +++++++++++++++-----------------
 1 file changed, 15 insertions(+), 17 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index b0aa10cd..258b79c4 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -152,15 +152,22 @@ def createDaemon():
 	os.open("/dev/null", os.O_RDWR)		# standard output (1)
 	os.open("/dev/null", os.O_RDWR)		# standard error (2)
 
-	return(0)
+	return True
 
 def sigTERMhandler(signum, frame):
 	""" Handles the TERM signal when in daemon mode in order to
 		exit properly.
 	"""
 	logSys.debug("Signal handler called with sig "+`signum`)
-	logSys.info("Restoring iptables...")
+	killApp()
+
+def killApp():
+	""" Flush the ban list, remove the PID lock file and exit
+		nicely.
+	"""
+	logSys.warn("Restoring firewall rules...")
 	fireWall.flushBanList(conf["debug"])
+	removePID(conf["pidlock"])
 	logSys.info("Exiting...")
 	sys.exit(0)
 	
@@ -467,7 +474,7 @@ if __name__ == "__main__":
 		for element in logList:
 			element.addIgnoreIP(ip)
 	
-	logSys.warn("Fail2Ban v"+version+" is running")
+	logSys.info("Fail2Ban v"+version+" is running")
 	# Main loop
 	while True:
 		try:
@@ -495,9 +502,7 @@ if __name__ == "__main__":
 			failList = dict()
 			for element in modList:
 				e = element.getFailures()
-				iter = e.iterkeys()
-				for i in range(len(e)):
-					key = iter.next()
+				for key in e.iterkeys():
 					if failList.has_key(key):
 						if failList[key][0] < e[key][0]:
 							failList[key] = (e[key][0], e[key][1],
@@ -509,19 +514,12 @@ if __name__ == "__main__":
 			
 			# We iterate the failure list and ban IP that make
 			# *retryAllowed* login failures.
-			iterFailList = failList.iteritems()
-			for i in range(len(failList)):
-				element = iterFailList.next()
+			for element in failList.iteritems():
 				if element[1][0] >= conf["maxretry"]:
-					logSys.warn(`element[1][2]`+": "+element[0]+" has "+
+					logSys.info(`element[1][2]`+": "+element[0]+" has "+
 								`element[1][0]`+" login failure(s). Banned.")
 					fireWall.addBanIP(element[0], conf["debug"])
 			
 		except KeyboardInterrupt:
-			# When the user press <ctrl>+<c> we flush the ban list
-			# and exit nicely.
-			logSys.info("Restoring firewall rules...")
-			fireWall.flushBanList(conf["debug"])
-			removePID(conf["pidlock"])
-			logSys.warn("Exiting...")
-			sys.exit(0)
+			# When the user press <ctrl>+<c> we exit nicely.
+			killApp()

From ad93288bd8f08cae88c7d19af1f743a446dfa71a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Mar 2005 17:45:55 +0000
Subject: [PATCH 071/549] - Corrected log level - Removed unused import

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@78 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 confreader/configreader.py | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/confreader/configreader.py b/confreader/configreader.py
index dbdb5d2d..c3eb271b 100644
--- a/confreader/configreader.py
+++ b/confreader/configreader.py
@@ -24,8 +24,6 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import os, sys, time
-
 from ConfigParser import *
 
 class ConfigReader:
@@ -76,7 +74,7 @@ class ConfigReader:
 				
 				values[option[1]] = v
 			except NoOptionError:
-				self.logSys.info("No '"+option[1]+"' defined in '"+sec+"'")
+				self.logSys.warn("No '"+option[1]+"' defined in '"+sec+"'")
 				values[option[1]] = option[2]
 		return values
 		
\ No newline at end of file

From f6b9749650dda41cd6f1a92eb4ff3b12e3c23fa2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Mar 2005 17:46:56 +0000
Subject: [PATCH 072/549] - Corrected log level - Dict iteration improved

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@79 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/firewall.py | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/firewall/firewall.py b/firewall/firewall.py
index 959373c3..a62a85ff 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -42,21 +42,21 @@ class Firewall:
 		""" Bans an IP.
 		"""
 		if not self.inBanList(ip):
-			self.logSys.info("Ban "+ip)
+			self.logSys.warn("Ban "+ip)
 			self.banList[ip] = time.time()
 			self.__executeCmd(self.banIP(ip), debug)
 		else:
-			self.logSys.info(ip+" already in ban list")
+			self.logSys.error(ip+" already in ban list")
 	
 	def delBanIP(self, ip, debug):
 		""" Unban an IP.
 		"""
 		if self.inBanList(ip):
-			self.logSys.info("Unban "+ip)
+			self.logSys.warn("Unban "+ip)
 			del self.banList[ip]
 			self.__executeCmd(self.unBanIP(ip), debug)
 		else:
-			self.logSys.info(ip+" not in ban list")
+			self.logSys.error(ip+" not in ban list")
 	
 	def inBanList(self, ip):
 		""" Checks if IP is in ban list.
@@ -67,9 +67,7 @@ class Firewall:
 		""" Check for IP to remove from ban list.
 		"""
 		banListTemp = self.banList.copy()
-		iterBanList = banListTemp.iteritems()
-		for i in range(len(self.banList)):
-			element = iterBanList.next()
+		for element in banListTemp.iteritems():
 			ip = element[0]
 			btime = element[1]
 			if btime < time.time()-self.banTime:
@@ -80,9 +78,7 @@ class Firewall:
 			Called when fail2ban exits.
 		"""
 		banListTemp = self.banList.copy()
-		iterBanList = banListTemp.iteritems()
-		for i in range(len(self.banList)):
-			element = iterBanList.next()
+		for element in banListTemp.iteritems():
 			ip = element[0]
 			self.delBanIP(ip, debug)
 	
@@ -98,7 +94,5 @@ class Firewall:
 	def viewBanList(self):
 		""" Prints the ban list on screen. Usefull for debugging.
 		"""
-		iterBanList = self.banList.iteritems()
-		for i in range(len(self.banList)):
-			element = iterBanList.next()
+		for element in self.banList.iteritems():
 			print element

From fa39e3b57d79b58c1b968a067c53ce5a6cb52210 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Mar 2005 17:47:51 +0000
Subject: [PATCH 073/549] - Added "self" in method parameters

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@80 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/ipfw.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/firewall/ipfw.py b/firewall/ipfw.py
index 79fe7c66..41fbc29b 100644
--- a/firewall/ipfw.py
+++ b/firewall/ipfw.py
@@ -39,7 +39,7 @@ class Ipfw(Firewall):
 	
 	crtRuleNbr = 0
 	
-	def getCrtRuleNbr():
+	def getCrtRuleNbr(self):
 		""" Gets the current rule number.
 		"""
 		return self.crtRuleNbr

From 6fb00dc5828e5c7e5d25fc020c4a8314bac26c7c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Mar 2005 17:49:41 +0000
Subject: [PATCH 074/549] - Improved log parsing speed. We remember the last
 position and restart from there when the file is modified - Added DNS lookup
 support - Removed unused functions

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@81 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 43 ++++++++++++++++++------------------------
 1 file changed, 18 insertions(+), 25 deletions(-)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index b782a140..9da4ae76 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -26,6 +26,8 @@ __license__ = "GPL"
 
 import os, sys, time, re
 
+from utils.dns import *
+
 class LogReader:
 	""" Reads a log file and reports information about IP that make password
 		failure, bad user or anything else that is considered as doubtful login
@@ -41,6 +43,7 @@ class LogReader:
 		self.ignoreIpList = []
 		self.lastModTime = 0
 		self.logSys = logSys
+		self.lastPos = 0
 		
 	def setName(self, name):
 		""" Sets the name of the log reader.
@@ -98,13 +101,15 @@ class LogReader:
 		"""
 		ipList = dict()
 		logFile = self.openLogFile()
+		self.logSys.debug("Setting file position to " + `self.lastPos`)
+		logFile.seek(self.lastPos)
 		for line in logFile.readlines():
-			value = self.findFailure(line)
-			if value:
-				ip = value[0]
-				unixTime = value[1]
+			failList = self.findFailure(line)
+			for element in failList:
+				ip = element[0]
+				unixTime = element[1]
 				if unixTime < time.time()-self.findTime:
-					continue
+					break
 				if self.inIgnoreIPList(ip):
 					self.logSys.debug("Ignore "+ip)
 					continue
@@ -113,6 +118,7 @@ class LogReader:
 					ipList[ip] = (ipList[ip][0]+1, unixTime)
 				else:
 					ipList[ip] = (1, unixTime)
+		self.lastPos = logFile.tell()
 		logFile.close()
 		return ipList
 
@@ -123,16 +129,17 @@ class LogReader:
 			
 			Returns a dict with IP and timestamp.
 		"""
-		match = self.matchLine(self.failregex, line)
+		failList = list()
+		match = re.search(self.failregex, line)
 		if match:
-			timeMatch = self.matchLine(self.timeregex, match.string)
+			timeMatch = re.search(self.timeregex, match.string)
 			if timeMatch:
 				date = self.getUnixTime(timeMatch.group())
-				ipMatch = self.matchAddress(match.string)
+				ipMatch = textToIp(match.string)
 				if ipMatch:
-					ip = ipMatch.group()
-					return [ip, date]
-		return None
+					for ip in ipMatch:
+						failList.append([ip, date])
+		return failList
 		
 	def getUnixTime(self, value):
 		""" Returns the Unix timestamp of the given value.
@@ -144,17 +151,3 @@ class LogReader:
 			date[0] = time.gmtime()[0]
 		unixTime = time.mktime(date)
 		return unixTime
-	
-	def matchLine(self, pattern, line):
-		""" Checks if the line contains a pattern.
-			
-			Return a match object.
-		"""
-		return re.search(pattern, line)
-		
-	def matchAddress(self, line):
-		""" Return a match on the IP address present in
-			line.		
-		"""
-		return self.matchLine("(?:\d{1,3}\.){3}\d{1,3}", line)
-	
\ No newline at end of file

From 7af62c05faed75844512c82fea77a01619806c07 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Mar 2005 17:51:24 +0000
Subject: [PATCH 075/549] - Initial import

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@82 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/__init__.py | 25 +++++++++++++
 utils/dns.py      | 94 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 119 insertions(+)
 create mode 100644 utils/__init__.py
 create mode 100644 utils/dns.py

diff --git a/utils/__init__.py b/utils/__init__.py
new file mode 100644
index 00000000..76dba873
--- /dev/null
+++ b/utils/__init__.py
@@ -0,0 +1,25 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
\ No newline at end of file
diff --git a/utils/dns.py b/utils/dns.py
new file mode 100644
index 00000000..13502cbe
--- /dev/null
+++ b/utils/dns.py
@@ -0,0 +1,94 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os, re
+
+def dnsToIp(dns):
+	""" Convert a DNS into an IP address using the "host" command.
+		We make sure that there is no malicious usage of this function.
+	"""
+	ipList = list()
+	# Check for command injection
+	if checkInjection(dns):
+		return ipList
+	result = os.popen("host "+dns, 'r')
+	for i in result.readlines():
+		match = re.search("(?:\d{1,3}\.){3}\d{1,3}", i)
+		if match:
+			ipList.append(match.group())
+	return ipList
+
+def checkInjection(command):
+	""" Check that command could not be used to inject shell commands.
+	"""
+	# Characters which have nothing to do in "command"
+	invalid = "<|>|;|\&|\||`|!"
+	match = re.search(invalid, command)
+	if match:
+		return True
+	else:
+		return False
+
+def textToDns(text):
+	""" Search for possible DNS in an arbitrary text.
+	"""
+	match = re.findall("\w*\.\w*\.\w*", text)
+	if match:
+		return match
+	else:
+		return None
+
+def searchIP(text):
+	""" Search if an IP address if directly available and return
+		it.
+	"""
+	match = re.findall("(?:\d{1,3}\.){3}\d{1,3}", text)
+	if match:
+		return match
+	else:
+		return None
+
+def textToIp(text):
+	""" Return the IP of DNS found in a given text.
+	"""
+	ipList = list()
+	# Search for plain IP
+	plainIP = searchIP(text)
+	if plainIP:
+		for element in plainIP:
+			ipList.append(element)
+	else:
+		# Try to get IP from possible DNS
+		dnsList = textToDns(text)
+		for element in dnsList:
+			dns = dnsToIp(element)
+			for e in dns:
+				ipList.append(e)
+	return ipList
+
+if __name__ == "__main__":
+	print textToIp("jlkjlk 123.456.789.000 jlkjl rhost=lslpc49.epfl.ch www.google.ch")
+	
\ No newline at end of file

From 54f2fc0ae5d6ae652a1562039e15d78cb64017e7 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Mar 2005 17:52:53 +0000
Subject: [PATCH 076/549] - Added utils/__init__.py and utils/dns.py

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@83 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MANIFEST b/MANIFEST
index 90767c9e..68e7eb3b 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -14,4 +14,6 @@ logreader/__init__.py
 logreader/logreader.py
 confreader/__init__.py
 confreader/configreader.py
+utils/__init__.py
+utils/dns.py
 config/fail2ban.conf.default

From d6c1eb15432751d6651457c39c11660d0b48e6e5 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Mar 2005 18:27:42 +0000
Subject: [PATCH 077/549] - Return value of createDaemon() changed to True

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@84 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban.py b/fail2ban.py
index 258b79c4..256533c9 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -402,7 +402,7 @@ if __name__ == "__main__":
 			retCode = createDaemon()
 			signal.signal(signal.SIGTERM, sigTERMhandler)
 			logSys.set_target(conf["logfile"])
-			if retCode != 0:
+			if not retCode:
 				logSys.error("Unable to start daemon")
 				sys.exit(-1)
 		elif c == "logging" and conf[c]:

From dabc1e96818e0c3547d7162bf828508c6653efc9 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Mar 2005 18:28:19 +0000
Subject: [PATCH 078/549] - Added "utils" to packages

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@85 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 setup.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/setup.py b/setup.py
index 1e05ff47..b2bc7908 100755
--- a/setup.py
+++ b/setup.py
@@ -38,5 +38,5 @@ setup(
         url = "http://www.sourceforge.net/projects/fail2ban",
         scripts = ['fail2ban.py'],
         py_modules = ['version'],
-        packages = ['firewall', 'logreader', 'confreader']
-)
\ No newline at end of file
+        packages = ['firewall', 'logreader', 'confreader', 'utils']
+)

From 064ef28dc45fe8e09a8e3dd8833516dc9cfa9868 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 7 Mar 2005 14:46:33 +0000
Subject: [PATCH 079/549] - Bug fix: check for log rotation using the file
 size. Not the best solution...

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@86 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index 9da4ae76..fc9bda0c 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -44,6 +44,8 @@ class LogReader:
 		self.lastModTime = 0
 		self.logSys = logSys
 		self.lastPos = 0
+		self.lastSize = 0
+		self.logStats = None
 		
 	def setName(self, name):
 		""" Sets the name of the log reader.
@@ -80,18 +82,33 @@ class LogReader:
 		""" Checks if the log file has been modified using os.stat().
 		"""
 		try:
-			logStats = os.stat(self.logPath)
+			self.logStats = os.stat(self.logPath)
 		except OSError:
 			self.logSys.error("Unable to get stat on "+self.logPath)
 			sys.exit(-1)
 		
-		if self.lastModTime == logStats.st_mtime:
+		if self.lastModTime == self.logStats.st_mtime:
 			return False
 		else:
 			self.logSys.debug(self.logPath+" has been modified")
-			self.lastModTime = logStats.st_mtime
+			self.lastModTime = self.logStats.st_mtime
 			return True
 	
+	def setFilePos(self, file):
+		""" Sets the file position. We must take care of log file rotation
+			and reset the position to 0 in that case. Use the file size in
+			order to detect this. Not the best solution yet.		
+		"""
+		if self.lastSize > self.logStats.st_size:
+			self.logSys.debug("Size " + `self.logStats.st_size` + " is " +
+							"smaller than " + `self.lastSize`)
+			self.logSys.debug("Log rotation detected")
+			self.lastPos = 0
+		
+		self.lastSize = self.logStats.st_size
+		self.logSys.debug("Setting file position to " + `self.lastPos`)
+		file.seek(self.lastPos)
+	
 	def getFailures(self):
 		""" Gets all the failure in the log file which are
 			newer than time.time()-self.findTime.
@@ -101,8 +118,7 @@ class LogReader:
 		"""
 		ipList = dict()
 		logFile = self.openLogFile()
-		self.logSys.debug("Setting file position to " + `self.lastPos`)
-		logFile.seek(self.lastPos)
+		self.setFilePos(logFile)
 		for line in logFile.readlines():
 			failList = self.findFailure(line)
 			for element in failList:

From 36571c2ba9cd7e75c39df53215f6ed61e4250898 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 7 Mar 2005 17:08:38 +0000
Subject: [PATCH 080/549] - Bug fix: return [] instead of 'None'

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@87 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/dns.py | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/utils/dns.py b/utils/dns.py
index 13502cbe..91b1fdca 100644
--- a/utils/dns.py
+++ b/utils/dns.py
@@ -59,7 +59,7 @@ def textToDns(text):
 	if match:
 		return match
 	else:
-		return None
+		return []
 
 def searchIP(text):
 	""" Search if an IP address if directly available and return
@@ -69,7 +69,7 @@ def searchIP(text):
 	if match:
 		return match
 	else:
-		return None
+		return []
 
 def textToIp(text):
 	""" Return the IP of DNS found in a given text.
@@ -77,9 +77,8 @@ def textToIp(text):
 	ipList = list()
 	# Search for plain IP
 	plainIP = searchIP(text)
-	if plainIP:
-		for element in plainIP:
-			ipList.append(element)
+	for element in plainIP:
+		ipList.append(element)
 	else:
 		# Try to get IP from possible DNS
 		dnsList = textToDns(text)

From 10d0070d425817e3c6eafb10368b14e12528842c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 8 Mar 2005 21:08:16 +0000
Subject: [PATCH 081/549] - Log parsing improvements were totally wrong.
 Removed

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@88 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index fc9bda0c..5eb4cf6d 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -118,7 +118,7 @@ class LogReader:
 		"""
 		ipList = dict()
 		logFile = self.openLogFile()
-		self.setFilePos(logFile)
+		#self.setFilePos(logFile)
 		for line in logFile.readlines():
 			failList = self.findFailure(line)
 			for element in failList:
@@ -134,7 +134,7 @@ class LogReader:
 					ipList[ip] = (ipList[ip][0]+1, unixTime)
 				else:
 					ipList[ip] = (1, unixTime)
-		self.lastPos = logFile.tell()
+		#self.lastPos = logFile.tell()
 		logFile.close()
 		return ipList
 

From 0a80b69db56d11a5dccfa7e62d490060acc9bc33 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 8 Mar 2005 21:11:07 +0000
Subject: [PATCH 082/549] =?UTF-8?q?-=20Removed=20the=20"host"=20command=20?=
 =?UTF-8?q?dependency.=20Used=20Python=20socket=20module=20instead.=20Than?=
 =?UTF-8?q?ks=20to=20K=EF=BF=BDvin=20Drapel?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@89 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/dns.py | 35 +++++++++++------------------------
 1 file changed, 11 insertions(+), 24 deletions(-)

diff --git a/utils/dns.py b/utils/dns.py
index 91b1fdca..7b21daa5 100644
--- a/utils/dns.py
+++ b/utils/dns.py
@@ -24,33 +24,16 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import os, re
+import os, re, socket
 
 def dnsToIp(dns):
-	""" Convert a DNS into an IP address using the "host" command.
-		We make sure that there is no malicious usage of this function.
+	""" Convert a DNS into an IP address using the Python socket module.
+		Thanks to Kévin Drapel.
 	"""
-	ipList = list()
-	# Check for command injection
-	if checkInjection(dns):
-		return ipList
-	result = os.popen("host "+dns, 'r')
-	for i in result.readlines():
-		match = re.search("(?:\d{1,3}\.){3}\d{1,3}", i)
-		if match:
-			ipList.append(match.group())
-	return ipList
-
-def checkInjection(command):
-	""" Check that command could not be used to inject shell commands.
-	"""
-	# Characters which have nothing to do in "command"
-	invalid = "<|>|;|\&|\||`|!"
-	match = re.search(invalid, command)
-	if match:
-		return True
-	else:
-		return False
+	try:
+		return socket.gethostbyname_ex(dns)[2]
+	except socket.gaierror:
+		return list()
 
 def textToDns(text):
 	""" Search for possible DNS in an arbitrary text.
@@ -90,4 +73,8 @@ def textToIp(text):
 
 if __name__ == "__main__":
 	print textToIp("jlkjlk 123.456.789.000 jlkjl rhost=lslpc49.epfl.ch www.google.ch")
+	try:
+		print socket.gethostbyname_ex("www.google")[2]
+	except socket.gaierror:
+		print "Error"
 	
\ No newline at end of file

From 949eb89c76e2e2ef4dcc71da23b0242bfb200339 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 8 Mar 2005 21:11:46 +0000
Subject: [PATCH 083/549] - Removed the "host" command dependency

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@90 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 README | 1 -
 1 file changed, 1 deletion(-)

diff --git a/README b/README
index 54a34bb5..a201b81f 100644
--- a/README
+++ b/README
@@ -56,7 +56,6 @@ Installation:
 
 Require: python-2.3 (http://www.python.org)
          log4py-1.1 (http://sourceforge.net/projects/log4py)
-         host (http://www.isc.org/products/BIND/bind9.html)
 
 To install, just do:
 

From c442955e30ac29fa29d11156ecf3208c3961690a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 11 Mar 2005 15:33:36 +0000
Subject: [PATCH 084/549] - Bug fix: check for DNS only if no IP address found

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@91 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/dns.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/utils/dns.py b/utils/dns.py
index 7b21daa5..6675cf35 100644
--- a/utils/dns.py
+++ b/utils/dns.py
@@ -28,7 +28,7 @@ import os, re, socket
 
 def dnsToIp(dns):
 	""" Convert a DNS into an IP address using the Python socket module.
-		Thanks to Kévin Drapel.
+		Thanks to Kevin Drapel.
 	"""
 	try:
 		return socket.gethostbyname_ex(dns)[2]
@@ -62,7 +62,7 @@ def textToIp(text):
 	plainIP = searchIP(text)
 	for element in plainIP:
 		ipList.append(element)
-	else:
+	if not ipList:
 		# Try to get IP from possible DNS
 		dnsList = textToDns(text)
 		for element in dnsList:
@@ -74,7 +74,7 @@ def textToIp(text):
 if __name__ == "__main__":
 	print textToIp("jlkjlk 123.456.789.000 jlkjl rhost=lslpc49.epfl.ch www.google.ch")
 	try:
-		print socket.gethostbyname_ex("www.google")[2]
+		print socket.gethostbyname_ex("195.122.223.30")[2]
 	except socket.gaierror:
 		print "Error"
-	
\ No newline at end of file
+	

From 7f62f9df89602bd1e1af0291abd1140ae3a53d4e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 29 Mar 2005 14:37:46 +0000
Subject: [PATCH 085/549] - The optimization in log reading should work

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@92 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 38 ++++++++++++++++++++++++++++----------
 1 file changed, 28 insertions(+), 10 deletions(-)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index 5eb4cf6d..d76b39d8 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -34,7 +34,8 @@ class LogReader:
 		attempt.	
 	"""
 	
-	def __init__(self, logSys, logPath, timeregex, timepattern, failregex, findTime = 3600):
+	def __init__(self, logSys, logPath, timeregex, timepattern, failregex,
+		findTime = 3600):
 		self.logPath = logPath
 		self.timeregex = timeregex
 		self.timepattern = timepattern
@@ -44,7 +45,7 @@ class LogReader:
 		self.lastModTime = 0
 		self.logSys = logSys
 		self.lastPos = 0
-		self.lastSize = 0
+		self.lastDate = 0
 		self.logStats = None
 		
 	def setName(self, name):
@@ -57,6 +58,11 @@ class LogReader:
 		"""
 		return self.name
 	
+	def getFindTime(self):
+		""" Gets the find time.
+		"""
+		return self.findTime
+	
 	def addIgnoreIP(self, ip):
 		""" Adds an IP to the ignore list.
 		"""
@@ -96,16 +102,16 @@ class LogReader:
 	
 	def setFilePos(self, file):
 		""" Sets the file position. We must take care of log file rotation
-			and reset the position to 0 in that case. Use the file size in
-			order to detect this. Not the best solution yet.		
+			and reset the position to 0 in that case. Use the log message
+			timestamp in order to detect this.		
 		"""
-		if self.lastSize > self.logStats.st_size:
-			self.logSys.debug("Size " + `self.logStats.st_size` + " is " +
-							"smaller than " + `self.lastSize`)
+		line = file.readline()
+		if self.lastDate < self.getTime(line):
+			self.logSys.debug("Date " + `self.lastDate` + " is " +
+							"smaller than " + `self.getTime(line)`)
 			self.logSys.debug("Log rotation detected")
 			self.lastPos = 0
 		
-		self.lastSize = self.logStats.st_size
 		self.logSys.debug("Setting file position to " + `self.lastPos`)
 		file.seek(self.lastPos)
 	
@@ -118,8 +124,10 @@ class LogReader:
 		"""
 		ipList = dict()
 		logFile = self.openLogFile()
-		#self.setFilePos(logFile)
+		self.setFilePos(logFile)
+		lastLine = ''
 		for line in logFile.readlines():
+			lastLine = line
 			failList = self.findFailure(line)
 			for element in failList:
 				ip = element[0]
@@ -134,7 +142,8 @@ class LogReader:
 					ipList[ip] = (ipList[ip][0]+1, unixTime)
 				else:
 					ipList[ip] = (1, unixTime)
-		#self.lastPos = logFile.tell()
+		self.lastPos = logFile.tell()
+		self.lastDate = self.getTime(lastLine)
 		logFile.close()
 		return ipList
 
@@ -156,6 +165,15 @@ class LogReader:
 					for ip in ipMatch:
 						failList.append([ip, date])
 		return failList
+	
+	def getTime(self, line):
+		""" Gets the time of a log message.
+		"""
+		date = 0
+		timeMatch = re.search(self.timeregex, line)
+		if timeMatch:
+			date = self.getUnixTime(timeMatch.group())
+		return date
 		
 	def getUnixTime(self, value):
 		""" Returns the Unix timestamp of the given value.

From 3368f7dd147d9312140f9f6db15462d01af0e929 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 29 Mar 2005 14:38:56 +0000
Subject: [PATCH 086/549] - Updated TODO list

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@93 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 1 +
 1 file changed, 1 insertion(+)

diff --git a/TODO b/TODO
index cdd565ca..569a127c 100644
--- a/TODO
+++ b/TODO
@@ -12,3 +12,4 @@ ToDo
   handling
 - improve installation process
 - add init script
+- use FAM (inotify, gamin, ...)

From 4d9615f68a9699a59bb97f97c65f531f2acf35b1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 29 Mar 2005 14:41:34 +0000
Subject: [PATCH 087/549] - Updated main loop (needed by logreader
 optimization)

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@94 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 35 ++++++++++++++++++++++++++---------
 1 file changed, 26 insertions(+), 9 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index 256533c9..22587391 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -475,6 +475,7 @@ if __name__ == "__main__":
 			element.addIgnoreIP(ip)
 	
 	logSys.info("Fail2Ban v"+version+" is running")
+	failListFull = dict()
 	# Main loop
 	while True:
 		try:
@@ -505,20 +506,36 @@ if __name__ == "__main__":
 				for key in e.iterkeys():
 					if failList.has_key(key):
 						if failList[key][0] < e[key][0]:
-							failList[key] = (e[key][0], e[key][1],
-											element.getName())
+							failList[key] = (e[key][0], e[key][1], element)
 					else:
-						failList[key] = (e[key][0], e[key][1],
-										element.getName())
+						failList[key] = (e[key][0], e[key][1], element)
 				
+			# Add the last log failures to the global failure list.
+			for key in failList.iterkeys():
+				if failListFull.has_key(key):
+					failListFull[key] = (failListFull[key][0] + 1,
+										failList[key][1], failList[key][2])
+				else:
+					failListFull[key] = failList[key]
+			
+			# Remove the oldest failure attempts from the global list.
+			unixTime = time.time()
+			failListFullTemp = failListFull.copy()
+			for key in failListFullTemp.iterkeys():
+				failTime = failListFullTemp[key][2].getFindTime()
+				if failListFullTemp[key][1] < unixTime - failTime:
+					del failListFull[key]
 			
 			# We iterate the failure list and ban IP that make
 			# *retryAllowed* login failures.
-			for element in failList.iteritems():
-				if element[1][0] >= conf["maxretry"]:
-					logSys.info(`element[1][2]`+": "+element[0]+" has "+
-								`element[1][0]`+" login failure(s). Banned.")
-					fireWall.addBanIP(element[0], conf["debug"])
+			failListFullTemp = failListFull.copy()
+			for key in failListFullTemp.iterkeys():
+				element = failListFullTemp[key]
+				if element[0] >= conf["maxretry"]:
+					logSys.info(element[2].getName()+": "+key+" has "+
+								`element[0]`+" login failure(s). Banned.")
+					fireWall.addBanIP(key, conf["debug"])
+					del failListFull[key]
 			
 		except KeyboardInterrupt:
 			# When the user press <ctrl>+<c> we exit nicely.

From 62feec3227746dbb4d68d9b125481c11fd53786f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 30 Mar 2005 22:48:38 +0000
Subject: [PATCH 088/549] - Improved verbose mode

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@95 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG   |  1 +
 README      |  2 +-
 fail2ban.py | 14 +++++++++-----
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index a8abaac6..86e83aaf 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -12,6 +12,7 @@ ver. 0.3.1 (??/??/2005) - beta
 - Corrected level of messages
 - Added DNS lookup support
 - Improved parsing speed. Only parse the new log messages
+- Added a second verbose level (-vv)
 
 ver. 0.3.0 (02/24/2005) - beta
 ----------
diff --git a/README b/README
index a201b81f..658d900b 100644
--- a/README
+++ b/README
@@ -94,7 +94,7 @@ options:
   -l <FILE>  log message in FILE
   -r <VALUE> allow a max of VALUE password failure
   -t <TIME>  ban IP for TIME seconds
-  -v         verbose
+  -v         verbose. Use twice for greater effect
   -w <FIWA>  select the firewall to use. Can be iptables,
              ipfwadm or ipfw
 
diff --git a/fail2ban.py b/fail2ban.py
index 22587391..d7ee42df 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -63,7 +63,7 @@ def usage():
 	print "  -l <FILE>  log message in FILE"
 	print "  -r <VALUE> allow a max of VALUE password failure"
 	print "  -t <TIME>  ban IP for TIME seconds"
-	print "  -v         verbose"
+	print "  -v         verbose. Use twice for greater effect"
 	print "  -w <FIWA>  select the firewall to use. Can be iptables,"
 	print "             ipfwadm or ipfw"
 	print
@@ -212,7 +212,7 @@ if __name__ == "__main__":
 	logSys.set_formatstring("%T %L %M")
 	
 	conf = dict()
-	conf["verbose"] = False
+	conf["verbose"] = 0
 	conf["background"] = False
 	conf["debug"] = False
 	conf["conffile"] = "/etc/fail2ban.conf"
@@ -357,7 +357,7 @@ if __name__ == "__main__":
 		if opt[0] == "-h":
 			usage()
 		if opt[0] == "-v":
-			conf["verbose"] = True
+			conf["verbose"] = conf["verbose"] + 1
 		if opt[0] == "-b":
 			conf["background"] = True
 		if opt[0] == "-d":
@@ -393,8 +393,12 @@ if __name__ == "__main__":
 
 	# Process some options
 	for c in conf:
-		if c == "verbose" and conf[c]:
-			logSys.set_loglevel(log4py.LOGLEVEL_VERBOSE)
+		if c == "verbose":
+			logSys.warn("Verbose level is "+`conf[c]`)
+			if conf[c] == 1:
+				logSys.set_loglevel(log4py.LOGLEVEL_VERBOSE)
+			elif conf[c] > 1:
+				logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
 		elif c == "debug" and conf[c]:
 			logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
 			logSys.set_formatstring(log4py.FMT_DEBUG)

From 6f6742266c57d0ad83146b06b3e39c6964091d20 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 31 Mar 2005 15:45:24 +0000
Subject: [PATCH 089/549] - Improved debug messages

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@96 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index d76b39d8..4778b3ba 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -109,10 +109,11 @@ class LogReader:
 		if self.lastDate < self.getTime(line):
 			self.logSys.debug("Date " + `self.lastDate` + " is " +
 							"smaller than " + `self.getTime(line)`)
-			self.logSys.debug("Log rotation detected")
+			self.logSys.debug("Log rotation detected for " + self.logPath)
 			self.lastPos = 0
 		
-		self.logSys.debug("Setting file position to " + `self.lastPos`)
+		self.logSys.debug("Setting file position to " + `self.lastPos` + " for "
+						+ self.logPath)
 		file.seek(self.lastPos)
 	
 	def getFailures(self):
@@ -123,6 +124,7 @@ class LogReader:
 			and the latest failure time.
 		"""
 		ipList = dict()
+		self.logSys.debug(self.logPath)
 		logFile = self.openLogFile()
 		self.setFilePos(logFile)
 		lastLine = ''

From 35e12b9ef32308db889736dcd665c617f36cc021 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 31 Mar 2005 15:46:57 +0000
Subject: [PATCH 090/549] - Cleanups

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@97 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/dns.py | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/utils/dns.py b/utils/dns.py
index 6675cf35..70007714 100644
--- a/utils/dns.py
+++ b/utils/dns.py
@@ -70,11 +70,3 @@ def textToIp(text):
 			for e in dns:
 				ipList.append(e)
 	return ipList
-
-if __name__ == "__main__":
-	print textToIp("jlkjlk 123.456.789.000 jlkjl rhost=lslpc49.epfl.ch www.google.ch")
-	try:
-		print socket.gethostbyname_ex("195.122.223.30")[2]
-	except socket.gaierror:
-		print "Error"
-	

From 04ae381215c87789a577e4fdbb90ee7ea137673a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 31 Mar 2005 15:52:02 +0000
Subject: [PATCH 091/549] - Prepared for 0.3.1 release

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@98 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  | 4 ++--
 README     | 8 ++++----
 setup.py   | 2 +-
 version.py | 2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 86e83aaf..cfb448aa 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.3.1)                           ??/??/2005
+Fail2Ban (version 0.3.1)                           31/03/2005
 =============================================================
 
-ver. 0.3.1 (??/??/2005) - beta
+ver. 0.3.1 (03/31/2005) - beta
 ----------
 - Corrected level of messages
 - Added DNS lookup support
diff --git a/README b/README
index 658d900b..df7a97e0 100644
--- a/README
+++ b/README
@@ -4,11 +4,11 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.3.0)                           02/24/2005
+Fail2Ban (version 0.3.1)                           03/31/2005
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
-that makes too much password failures. It updates firewall
+that makes too many password failures. It updates firewall
 rules to reject the IP address. Currently iptables, ipfw and
 ipfwadm are supported. Fail2Ban can read multiple log files
 such as sshd or Apache web server ones. It needs log4py.
@@ -59,8 +59,8 @@ Require: python-2.3 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.3.0.tar.bz2
-> cd fail2ban-0.3.0
+> tar xvfj fail2ban-0.3.1.tar.bz2
+> cd fail2ban-0.3.1
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The
diff --git a/setup.py b/setup.py
index b2bc7908..eee601bc 100755
--- a/setup.py
+++ b/setup.py
@@ -32,7 +32,7 @@ from version import version
 setup(
         name = "fail2ban",
         version = version,
-        description = "Ban IPs that make too much password failure",
+        description = "Ban IPs that make too many password failure",
         author = "Cyril Jaquier",
         author_email = "lostcontrol@users.sourceforge.net",
         url = "http://www.sourceforge.net/projects/fail2ban",
diff --git a/version.py b/version.py
index cb074256..50e0dcba 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.3.0-CVS"
+version = "0.3.1"

From 77dc3e426117c05e12a8277a176e22af1426ba00 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 31 Mar 2005 16:04:52 +0000
Subject: [PATCH 092/549] =?UTF-8?q?-=20Fixed=20exception=20if=20trying=20t?=
 =?UTF-8?q?o=20kill=20Fail2Ban=20with=20a=20fail2ban.pid=20file=20present.?=
 =?UTF-8?q?=20Thanks=20to=20K=EF=BF=BDvin=20Drapel?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@99 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fail2ban.py b/fail2ban.py
index d7ee42df..bc2f1f80 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -203,7 +203,12 @@ def killPID(pid):
 	""" Kills the process with the given PID using the
 		INT signal (same effect as <ctrl>+<c>).
 	"""
-	return os.kill(pid, 2)
+	try:
+		return os.kill(pid, 2)
+	except OSError:
+		logSys.error("Can not kill process " + `pid` + ". Please check that " +
+					"Fail2Ban is not running and remove the file " +
+					"'/tmp/fail2ban.pid'")
 
 if __name__ == "__main__":
 	

From a4ff90cd0a1e0ed90d343b7fd09c39d06dc9e06b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 3 Apr 2005 12:08:57 +0000
Subject: [PATCH 093/549] =?UTF-8?q?-=20Fixed=20textToDNS=20method=20which?=
 =?UTF-8?q?=20did=20not=20recognize=20"12-344-54-33.adsl.xyz.ab".=20Thanks?=
 =?UTF-8?q?=20to=20K=EF=BF=BDvin=20Drapel?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@101 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/dns.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/utils/dns.py b/utils/dns.py
index 70007714..9c8e47a7 100644
--- a/utils/dns.py
+++ b/utils/dns.py
@@ -38,7 +38,7 @@ def dnsToIp(dns):
 def textToDns(text):
 	""" Search for possible DNS in an arbitrary text.
 	"""
-	match = re.findall("\w*\.\w*\.\w*", text)
+	match = re.findall("\S*\.\w*\.\w*", text)
 	if match:
 		return match
 	else:

From 0c9c50397ae30716ce6db36524d4ff855848e4d5 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 3 Apr 2005 12:12:52 +0000
Subject: [PATCH 094/549] - Fixed bug in utils/dns.py

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@102 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index cfb448aa..466abc2b 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,14 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.3.1)                           31/03/2005
+Fail2Ban (version 0.3.2)                           ??/??/2005
 =============================================================
 
+ver. 0.3.2 (??/??/2005) - ????
+----------
+- Fixed textToDNS which did not recognize strings like
+  "12-345-67-890.abcd.mnopqr.xyz"
+
 ver. 0.3.1 (03/31/2005) - beta
 ----------
 - Corrected level of messages

From 468f70dc15faa0ad6c9b7b30785cce892f0f2e30 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 3 Apr 2005 12:13:11 +0000
Subject: [PATCH 095/549] - Changed to CVS version

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@103 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.py b/version.py
index 50e0dcba..18e7d984 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.3.1"
+version = "0.3.1-CVS"

From b0cae2c43f4196783598d6198a3ec8b82f333d5f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 24 Apr 2005 11:03:44 +0000
Subject: [PATCH 096/549] - Changed all sections to disabled by default - Add
 "Invalid user" to SSH failregex

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@104 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 43f08b86..19aceec1 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -54,7 +54,7 @@ polltime = 1
 
 [Apache]
 # enabled: is this section active ?
-enabled = true
+enabled = false
 
 # logfile: file to monitor.
 logfile = log-test/apache
@@ -75,7 +75,7 @@ failregex = authentication failure|user .* not found
 
 [SSH]
 # enabled: is this section active ?
-enabled = true
+enabled = false
 
 # logfile: file to monitor.
 logfile = log-test/current
@@ -92,5 +92,4 @@ timepattern = %%b %%d %%H:%%M:%%S
 
 # failregex: regular expression which have to match the
 # message written in the log file in case of password failure.
-failregex = Authentication failure|Failed password
-
+failregex = Authentication failure|Failed password|Invalid user

From a051e05cb441d866025153faf22ccaa25c9defb7 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 24 Apr 2005 11:04:29 +0000
Subject: [PATCH 097/549] - Prepared for 0.4.0 release

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@105 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  |  4 ++--
 README     | 15 ++++++++-------
 version.py |  2 +-
 3 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 466abc2b..31040708 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.3.2)                           ??/??/2005
+Fail2Ban (version 0.4.0)                           04/24/2005
 =============================================================
 
-ver. 0.3.2 (??/??/2005) - ????
+ver. 0.4.0 (04/24/2005) - stable
 ----------
 - Fixed textToDNS which did not recognize strings like
   "12-345-67-890.abcd.mnopqr.xyz"
diff --git a/README b/README
index df7a97e0..a10875a9 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.3.1)                           03/31/2005
+Fail2Ban (version 0.4.0)                           04/24/2005
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -13,9 +13,8 @@ rules to reject the IP address. Currently iptables, ipfw and
 ipfwadm are supported. Fail2Ban can read multiple log files
 such as sshd or Apache web server ones. It needs log4py.
 
-This is my first Python program. I began learning Python for
-less than one week so please be understanding ;-) English is
-not either my mother tongue...
+This is my first Python program. Moreover, English is not my
+mother tongue...
 
 
 More details:
@@ -28,8 +27,8 @@ brute force or scripts. They try 10, 20 and sometimes more
 user/password (without success anyway). In order to
 discourage these script kiddies, I wanted that sshd refuse
 login from a specific ip after 3 password failures. After
-some google searches, I found that sshd was not able of that.
-So I search for a script or program that do it. Found
+some Google searches, I found that sshd was not able of that.
+So I search for a script or program that do it. I found
 nothing :-( So I decide to write mine and to learn Python :-)
 
 For each sections defined in the configuration file, Fail2Ban
@@ -37,7 +36,7 @@ tries to find lines which match the failregex. Then it
 retrieves the message time using timeregex and timepattern.
 It finally gets the ip and if it has already done 3 or more
 password failures in the last banTime, the ip is banned for
-banTime using a iptable rule. After banTime, the rule is
+banTime using a firewall rule. After banTime, the rule is
 deleted. Notice that if no "plain" ip is available, Fail2Ban
 try to do DNS lookup in order to found one or several ip's to
 ban.
@@ -66,6 +65,8 @@ To install, just do:
 This will install Fail2Ban into /usr/lib/fail2ban. The
 fail2ban.py executable is placed into /usr/bin.
 
+For Gentoo users, an ebuild is available on the website.
+
 Fail2Ban should now be correctly installed. Just type:
 
 > fail2ban.py -h
diff --git a/version.py b/version.py
index 18e7d984..8334c777 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.3.1-CVS"
+version = "0.4.0"

From 51f1dcee55cf2d48bdea05435cd042c888028400 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 28 May 2005 19:46:18 +0000
Subject: [PATCH 098/549] - Fixed textToDNS method which generated wrong
 matches for "rhost=12-xyz...". Thanks to Tom Pike

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@107 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/dns.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/utils/dns.py b/utils/dns.py
index 9c8e47a7..ce629d69 100644
--- a/utils/dns.py
+++ b/utils/dns.py
@@ -37,8 +37,9 @@ def dnsToIp(dns):
 
 def textToDns(text):
 	""" Search for possible DNS in an arbitrary text.
+		Thanks to Tom Pike.
 	"""
-	match = re.findall("\S*\.\w*\.\w*", text)
+	match = re.findall("(?:(?:\w|-)+\.){2,}\w+", text)
 	if match:
 		return match
 	else:

From 9317581b187cfa7a82128606c2f379d5f7cf5ddd Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 29 Jun 2005 06:17:28 +0000
Subject: [PATCH 099/549] - Modified for readability. Thanks to Iain Lea

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@108 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 142 +++++++++++++++++++++++------------
 1 file changed, 95 insertions(+), 47 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 19aceec1..0e547bb4 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -1,51 +1,75 @@
 # Fail2Ban configuration file
 #
 # $Revision$
+#
+# 2005.06.21  modified for readability  Iain Lea  iain@bricbrac.de
 
 [DEFAULT]
-
-# firewall: select the firewall system to use. Actually,
-# the available options are: iptables, ipfwadm, ipfw
+# Option:  firewall
+# Notes.:  select the firewall system to use.
+# Values:  [iptables | ipfwadm | ipfw]  Default:  iptables
+#
 firewall = iptables
 
-# ipfw-start-rule: set the first rule number used by Fail2Ban.
-# This option is only used if firewall = ipfw.
+# Option:  ipfw-start-rule
+# Notes.:  set first firewall rule number used (only used if firewall = ipfw).
+# Values:  NUM  Default:  100
+#
 ipfw-start-rule = 100
 
-# background: true to start fail2ban as a daemon. Output
-# is redirect to logfile.
+# Option:  background
+# Notes.:  start fail2ban as a daemon. Output is redirect to logfile.
+# Values:  [true | false]  Default:  false
+#
 background = false
 
-# debug: true to enable debug mode. More verbose output
-# and bypass root user test.
+# Option:  debug
+# Notes.:  enable debug mode. More verbose output and bypass root user test.
+# Values:  [true | false]  Default:  false
+#
 debug = false
 
-# pidlock: the path of the PID lock file. Fail2Ban must be
-# able to write into that file.
-#pidlock = /var/run/fail2ban.pid
+# Option:  pidlock
+# Notes.:  path of the PID lock file (must be able to write to file).
+# Values:  FILE  Default:  /var/run/fail2ban.pid
+#
+pidlock = /var/run/fail2ban.pid
 
-# logfile: the path of the file for logging messages of
-# fail2ban.
+# Option:  logfile
+# Notes.:  logfile for logging fail2ban messages.
+# Values:  FILE  Default:  /var/log/fail2ban.log
+#
 logfile = /var/log/fail2ban.log
 
-# maxretry: the number of retry before IP gets ban.
+# Option:  maxretry
+# Notes.:  number of retrys before IP gets banned.
+# Values:  NUM  Default:  3
+#
 maxretry = 3
 
-# bantime: the number of seconds an IP will be ban.
+# Option:  bantime
+# Notes.:  number of seconds an IP will be banned.
+# Values:  NUM  Default:  600
+#
 bantime = 600
 
-# ignoreip: a space separated list that contains IP which
-# will be ignore by fail2ban. Example:
-# ignoreip = 192.168.0.1 123.45.235.65
+# Option:  ignoreip
+# Notes.:  space separated list of IP's to be ignored by fail2ban
+#          Example:  ignoreip = 192.168.0.1 123.45.235.65
+# Values:  IP  Default:  
+#
 ignoreip = 
 
-# interface: the interface name on which the IP will be
-# banned.
+# Option:  interface
+# Notes.:  interface name on which the IP will be banned.
+# Values:  INT  Default:  eth0
+#
 interface = eth0
 
-# polltime: the number of seconds that fail2ban sleeps
-# between two iteration (check for IP to unban - parse
-# log file). 1 is a good value.
+# Option:  polltime
+# Notes.:  number of seconds fail2ban sleeps between iterations.
+# Values:  NUM  Default:  1
+#
 polltime = 1
 
 # You can define a new section for each log file to check for
@@ -53,43 +77,67 @@ polltime = 1
 # options: logfile, timeregex, timepattern, failregex.
 
 [Apache]
-# enabled: is this section active ?
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  false
+#
 enabled = false
 
-# logfile: file to monitor.
-logfile = log-test/apache
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/httpd/access_log
+#
+logfile = /var/log/httpd/access_log
 
-# timeregex: regular expression which have to match the
-# timestamp of an Apache log event.
-# [Wed Jan 05 15:08:01 2005]
+# Option:  timeregex
+# Notes.:  regex to match timestamp in Apache logfile.
+# Values:  [Wed Jan 05 15:08:01 2005]  
+# Default  \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+#
 timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
 
-# timepattern: indicates the "timeregex" fields signification.
-# Notice that '%' must be espaced with '%'.
-# See syntax here: http://rgruet.free.fr/PQR2.3.html#timeModule
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
+#
 timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
 
-# failregex: regular expression which have to match the
-# message written in the log file in case of password failure.
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile.
+# Values:  TEXT  Default:  authentication failure|user .* not found
+#
 failregex = authentication failure|user .* not found
 
 [SSH]
-# enabled: is this section active ?
-enabled = false
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  true
+#
+enabled = true
 
-# logfile: file to monitor.
-logfile = log-test/current
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/secure
+#
+logfile = /var/log/secure
 
-# timeregex: regular expression which have to match the
-# timestamp of an Apache log event.
-# Mar  7 17:53:28
+# Option:  timeregex
+# Notes.:  regex to match timestamp in SSH logfile.
+# Values:  [Mar  7 17:53:28]  
+# Default  \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
 timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
 
-# timepattern: indicates the "timeregex" fields signification.
-# Notice that '%' must be espaced with '%'.
-# See syntax here: http://rgruet.free.fr/PQR2.3.html#timeModule
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
+#
 timepattern = %%b %%d %%H:%%M:%%S
 
-# failregex: regular expression which have to match the
-# message written in the log file in case of password failure.
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile.
+# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
+#
 failregex = Authentication failure|Failed password|Invalid user

From 7b118f42d307b6cdf6aa6445c7c106bc6b697da1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 30 Jun 2005 09:25:28 +0000
Subject: [PATCH 100/549] - Initd script for Gentoo

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@109 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/gentoo-confd | 23 +++++++++++++++++++++
 config/gentoo-initd | 50 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 73 insertions(+)
 create mode 100644 config/gentoo-confd
 create mode 100755 config/gentoo-initd

diff --git a/config/gentoo-confd b/config/gentoo-confd
new file mode 100644
index 00000000..e156c368
--- /dev/null
+++ b/config/gentoo-confd
@@ -0,0 +1,23 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+# Command line options for Fail2Ban. Refer to "fail2ban.py -h" for
+# valid options.
+FAIL2BAN_OPTS="-v"
diff --git a/config/gentoo-initd b/config/gentoo-initd
new file mode 100755
index 00000000..b6b2a0b1
--- /dev/null
+++ b/config/gentoo-initd
@@ -0,0 +1,50 @@
+#!/sbin/runscript
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# Author: Sireyessire, Cyril Jaquier
+# 
+# $Revision$
+
+opts="start stop restart showlog"
+
+FAIL2BAN="/usr/bin/fail2ban.py"
+
+depend() {
+	need net
+	need logger
+	after iptables
+}
+
+start() {
+	ebegin "Starting fail2ban"
+	${FAIL2BAN} -b ${FAIL2BAN_OPTS}
+	eend $? "Failed to start fail2ban"
+}
+
+stop() {
+	ebegin "Stopping fail2ban"
+	${FAIL2BAN} -k
+	eend $? "Failed to stop fail2ban"
+}
+
+zap() {
+	rm /var/run/fail2ban.pid
+}
+
+showlog(){
+	less /var/log/fail2ban.log
+}

From be43f2eaebe78a6cadd8d0f7e682cce7bc6ecc87 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 30 Jun 2005 09:26:38 +0000
Subject: [PATCH 101/549] - Changed PID lock file location from /tmp to
 /var/run

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@110 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban.py b/fail2ban.py
index bc2f1f80..5fdfe698 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -221,7 +221,7 @@ if __name__ == "__main__":
 	conf["background"] = False
 	conf["debug"] = False
 	conf["conffile"] = "/etc/fail2ban.conf"
-	conf["pidlock"] = "/tmp/fail2ban.pid"
+	conf["pidlock"] = "/var/run/fail2ban.pid"
 	conf["logging"] = False
 	conf["logfile"] = "/var/log/fail2ban.log"
 	conf["maxretry"] = 3

From 73ff1540e8e198fbaa94d0dc2de0fe389a275e95 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 30 Jun 2005 09:30:59 +0000
Subject: [PATCH 102/549] - Prepared for 0.4.1

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@111 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  | 11 ++++++++++-
 MANIFEST   |  2 ++
 README     | 16 ++++++++++++----
 version.py |  2 +-
 4 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 31040708..6cbe1675 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,18 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.4.0)                           04/24/2005
+Fail2Ban (version 0.4.1)                           06/30/2005
 =============================================================
 
+ver. 0.4.1 (06/30/2005) - stable
+----------
+- Fixed textToDNS method which generated wrong matches for
+  "rhost=12-xyz...". Thanks to Tom Pike
+- fail2ban.conf modified for readability. Thanks to Iain Lea
+- Added an initd script for Gentoo
+- Changed default PID lock file location from /tmp to
+  /var/run
+
 ver. 0.4.0 (04/24/2005) - stable
 ----------
 - Fixed textToDNS which did not recognize strings like
diff --git a/MANIFEST b/MANIFEST
index 68e7eb3b..330728f8 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -17,3 +17,5 @@ confreader/configreader.py
 utils/__init__.py
 utils/dns.py
 config/fail2ban.conf.default
+config/gentoo-initd
+config/gentoo-confd
diff --git a/README b/README
index a10875a9..7882c60d 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.4.0)                           04/24/2005
+Fail2Ban (version 0.4.1)                           06/30/2005
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -58,8 +58,8 @@ Require: python-2.3 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.3.1.tar.bz2
-> cd fail2ban-0.3.1
+> tar xvfj fail2ban-0.4.1.tar.bz2
+> cd fail2ban-0.4.1
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The
@@ -75,6 +75,13 @@ to see if everything is alright. You can configure fail2ban
 with a config file. Copy config/fail2ban.conf.default to
 /etc/fail2ban.conf.
 
+Gentoo users can use the initd script available in config/.
+Copy gentoo-initd to /etc/init.d/fail2ban and gentoo-confd
+to /etc/conf.d/fail2ban. You can start fail2ban and add it
+to your default runlevel:
+
+> /etc/init.d/fail2ban start
+> rc-update add fail2ban default
 
 Configuration:
 --------------
@@ -113,7 +120,8 @@ Cyril Jaquier: <lostcontrol@users.sourceforge.net>
 Thanks:
 -------
 
-Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker
+Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
+Tom Pike, Iain Lea
 
 
 License:
diff --git a/version.py b/version.py
index 8334c777..3d2fe563 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.4.0"
+version = "0.4.1"

From ea9a671e880c602a7f5cc718649de183582aba24 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 1 Jul 2005 09:30:52 +0000
Subject: [PATCH 103/549] This commit was manufactured by cvs2svn to create
 branch 'FAIL2BAN-0_5'.

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@114 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                    |  71 +++++
 MANIFEST                     |  21 ++
 README                       | 145 +++++++++
 TODO                         |  15 +
 config/fail2ban.conf.default | 143 +++++++++
 config/gentoo-confd          |  23 ++
 config/gentoo-initd          |  50 ++++
 config/redhat-initd          |  78 +++++
 confreader/__init__.py       |  25 ++
 confreader/configreader.py   |  80 +++++
 fail2ban.py                  | 551 +++++++++++++++++++++++++++++++++++
 firewall/firewall.py         |  98 +++++++
 firewall/ipfw.py             |  72 +++++
 firewall/ipfwadm.py          |  48 +++
 firewall/iptables.py         |  48 +++
 log-test/apache              | 102 +++++++
 log-test/current             |   5 +
 log-test/test                | 432 +++++++++++++++++++++++++++
 logreader/logreader.py       | 189 ++++++++++++
 setup.cfg                    |   5 +
 setup.py                     |  42 +++
 utils/__init__.py            |  25 ++
 utils/dns.py                 |  73 +++++
 version.py                   |  27 ++
 24 files changed, 2368 insertions(+)
 create mode 100644 CHANGELOG
 create mode 100644 MANIFEST
 create mode 100644 README
 create mode 100644 TODO
 create mode 100644 config/fail2ban.conf.default
 create mode 100644 config/gentoo-confd
 create mode 100755 config/gentoo-initd
 create mode 100644 config/redhat-initd
 create mode 100644 confreader/__init__.py
 create mode 100644 confreader/configreader.py
 create mode 100755 fail2ban.py
 create mode 100644 firewall/firewall.py
 create mode 100644 firewall/ipfw.py
 create mode 100644 firewall/ipfwadm.py
 create mode 100644 firewall/iptables.py
 create mode 100644 log-test/apache
 create mode 100644 log-test/current
 create mode 100644 log-test/test
 create mode 100644 logreader/logreader.py
 create mode 100644 setup.cfg
 create mode 100755 setup.py
 create mode 100644 utils/__init__.py
 create mode 100644 utils/dns.py
 create mode 100644 version.py

diff --git a/CHANGELOG b/CHANGELOG
new file mode 100644
index 00000000..a05b6cbd
--- /dev/null
+++ b/CHANGELOG
@@ -0,0 +1,71 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+Fail2Ban (version 0.?.?)                           ??/??/2005
+=============================================================
+
+ver. 0.?.? (??/??/2005) - ???
+----------
+- Added an initd script for RedHat/Fedora. Thanks to Andrey
+  G. Grozin
+
+ver. 0.4.1 (06/30/2005) - stable
+----------
+- Fixed textToDNS method which generated wrong matches for
+  "rhost=12-xyz...". Thanks to Tom Pike
+- fail2ban.conf modified for readability. Thanks to Iain Lea
+- Added an initd script for Gentoo
+- Changed default PID lock file location from /tmp to
+  /var/run
+
+ver. 0.4.0 (04/24/2005) - stable
+----------
+- Fixed textToDNS which did not recognize strings like
+  "12-345-67-890.abcd.mnopqr.xyz"
+
+ver. 0.3.1 (03/31/2005) - beta
+----------
+- Corrected level of messages
+- Added DNS lookup support
+- Improved parsing speed. Only parse the new log messages
+- Added a second verbose level (-vv)
+
+ver. 0.3.0 (02/24/2005) - beta
+----------
+- Re-writting of parts of the code in order to handle several
+  log files with different rules
+- Removed sshd.py because it is no more needed
+- Fixed a bug when exiting with IP in the ban list
+- Added PID lock file
+- Improved some parts of the code
+- Added ipfw-start-rule option (thanks to Robert Edeker)
+- Added -k option which kills a currently running Fail2Ban
+
+ver. 0.1.2 (11/21/2004) - beta
+----------
+- Add ipfw and ipfwadm support. The rules are taken from
+  BlockIt. Thanks to Robert Edeker
+- Add -e option which allows to set the interface. Thanks to
+  Robert Edeker who reminded me this
+- Small code cleaning
+
+ver. 0.1.1 (10/23/2004) - beta
+----------
+- Add SIGTERM handler in order to exit nicely when in daemon
+  mode
+- Add -r option which allows to set the maximum number of
+  login failures
+- Remove the Metalog class as the log file are not so syslog
+  daemon specific
+- Rewrite log reader to be service centered. Sshd support
+  added. Match "Failed password" and "Illegal user"
+- Add /etc/fail2ban.conf configuration support
+- Code documentation
+
+
+ver. 0.1.0 (10/12/2004) - alpha
+----------
+- Initial release
diff --git a/MANIFEST b/MANIFEST
new file mode 100644
index 00000000..330728f8
--- /dev/null
+++ b/MANIFEST
@@ -0,0 +1,21 @@
+README
+CHANGELOG
+TODO
+setup.cfg
+setup.py
+version.py
+fail2ban.py
+firewall/__init__.py
+firewall/firewall.py
+firewall/iptables.py
+firewall/ipfw.py
+firewall/ipfwadm.py
+logreader/__init__.py
+logreader/logreader.py
+confreader/__init__.py
+confreader/configreader.py
+utils/__init__.py
+utils/dns.py
+config/fail2ban.conf.default
+config/gentoo-initd
+config/gentoo-confd
diff --git a/README b/README
new file mode 100644
index 00000000..7882c60d
--- /dev/null
+++ b/README
@@ -0,0 +1,145 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+Fail2Ban (version 0.4.1)                           06/30/2005
+=============================================================
+
+Fail2Ban scans log files like /var/log/pwdfail and bans IP
+that makes too many password failures. It updates firewall
+rules to reject the IP address. Currently iptables, ipfw and
+ipfwadm are supported. Fail2Ban can read multiple log files
+such as sshd or Apache web server ones. It needs log4py.
+
+This is my first Python program. Moreover, English is not my
+mother tongue...
+
+
+More details:
+-------------
+
+Fail2Ban is rather simple. I have a home server connected to
+the Internet which runs apache, samba, sshd, ... I see in my
+logs that people are trying to log into my box using "manual"
+brute force or scripts. They try 10, 20 and sometimes more
+user/password (without success anyway). In order to
+discourage these script kiddies, I wanted that sshd refuse
+login from a specific ip after 3 password failures. After
+some Google searches, I found that sshd was not able of that.
+So I search for a script or program that do it. I found
+nothing :-( So I decide to write mine and to learn Python :-)
+
+For each sections defined in the configuration file, Fail2Ban
+tries to find lines which match the failregex. Then it
+retrieves the message time using timeregex and timepattern.
+It finally gets the ip and if it has already done 3 or more
+password failures in the last banTime, the ip is banned for
+banTime using a firewall rule. After banTime, the rule is
+deleted. Notice that if no "plain" ip is available, Fail2Ban
+try to do DNS lookup in order to found one or several ip's to
+ban.
+
+Sections can be freely added so it is possible to monitor
+several daemons at the same time.
+
+Runs on my server and does its job rather well :-) The idea
+is to make fail2ban usable with daemons and services that
+require a login (sshd, telnetd, ...). It should also support
+others firewalls than iptables.
+
+
+Installation:
+-------------
+
+Require: python-2.3 (http://www.python.org)
+         log4py-1.1 (http://sourceforge.net/projects/log4py)
+
+To install, just do:
+
+> tar xvfj fail2ban-0.4.1.tar.bz2
+> cd fail2ban-0.4.1
+> python setup.py install
+
+This will install Fail2Ban into /usr/lib/fail2ban. The
+fail2ban.py executable is placed into /usr/bin.
+
+For Gentoo users, an ebuild is available on the website.
+
+Fail2Ban should now be correctly installed. Just type:
+
+> fail2ban.py -h
+
+to see if everything is alright. You can configure fail2ban
+with a config file. Copy config/fail2ban.conf.default to
+/etc/fail2ban.conf.
+
+Gentoo users can use the initd script available in config/.
+Copy gentoo-initd to /etc/init.d/fail2ban and gentoo-confd
+to /etc/conf.d/fail2ban. You can start fail2ban and add it
+to your default runlevel:
+
+> /etc/init.d/fail2ban start
+> rc-update add fail2ban default
+
+Configuration:
+--------------
+
+You can configure fail2ban using the file /etc/fail2ban.conf
+or using command line options. Command line options override
+the value stored in fail2ban.conf. Here are the command line
+options:
+
+  -b         start fail2ban in background
+  -d         start fail2ban in debug mode
+  -e <INTF>  ban IP on the INTF interface
+  -c <FILE>  read configuration file FILE
+  -p <FILE>  create PID lock in FILE
+  -h         display this help message
+  -i <IP(s)> IP(s) to ignore
+  -k         kill a currently running Fail2Ban instance
+  -l <FILE>  log message in FILE
+  -r <VALUE> allow a max of VALUE password failure
+  -t <TIME>  ban IP for TIME seconds
+  -v         verbose. Use twice for greater effect
+  -w <FIWA>  select the firewall to use. Can be iptables,
+             ipfwadm or ipfw
+
+Contact:
+--------
+
+You need some new features, you found bugs or you just
+appreciate this program, you can contact me at :
+
+Website: http://www.sourceforge.net/projects/fail2ban
+
+Cyril Jaquier: <lostcontrol@users.sourceforge.net>
+
+
+Thanks:
+-------
+
+Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
+Tom Pike, Iain Lea
+
+
+License:
+--------
+
+Fail2Ban is free software; you can redistribute it
+and/or modify it under the terms of the GNU General Public
+License as published by the Free Software Foundation; either
+version 2 of the License, or (at your option) any later
+version.
+
+Fail2Ban is distributed in the hope that it will be
+useful, but WITHOUT ANY WARRANTY; without even the implied
+warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public
+License along with Fail2Ban; if not, write to the Free
+Software Foundation, Inc., 59 Temple Place, Suite 330,
+Boston, MA  02111-1307  USA
diff --git a/TODO b/TODO
new file mode 100644
index 00000000..569a127c
--- /dev/null
+++ b/TODO
@@ -0,0 +1,15 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+ToDo
+=============================================================
+
+- cleanup fail2ban.py
+- improve configuration file and command line options
+  handling
+- improve installation process
+- add init script
+- use FAM (inotify, gamin, ...)
diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
new file mode 100644
index 00000000..0e547bb4
--- /dev/null
+++ b/config/fail2ban.conf.default
@@ -0,0 +1,143 @@
+# Fail2Ban configuration file
+#
+# $Revision$
+#
+# 2005.06.21  modified for readability  Iain Lea  iain@bricbrac.de
+
+[DEFAULT]
+# Option:  firewall
+# Notes.:  select the firewall system to use.
+# Values:  [iptables | ipfwadm | ipfw]  Default:  iptables
+#
+firewall = iptables
+
+# Option:  ipfw-start-rule
+# Notes.:  set first firewall rule number used (only used if firewall = ipfw).
+# Values:  NUM  Default:  100
+#
+ipfw-start-rule = 100
+
+# Option:  background
+# Notes.:  start fail2ban as a daemon. Output is redirect to logfile.
+# Values:  [true | false]  Default:  false
+#
+background = false
+
+# Option:  debug
+# Notes.:  enable debug mode. More verbose output and bypass root user test.
+# Values:  [true | false]  Default:  false
+#
+debug = false
+
+# Option:  pidlock
+# Notes.:  path of the PID lock file (must be able to write to file).
+# Values:  FILE  Default:  /var/run/fail2ban.pid
+#
+pidlock = /var/run/fail2ban.pid
+
+# Option:  logfile
+# Notes.:  logfile for logging fail2ban messages.
+# Values:  FILE  Default:  /var/log/fail2ban.log
+#
+logfile = /var/log/fail2ban.log
+
+# Option:  maxretry
+# Notes.:  number of retrys before IP gets banned.
+# Values:  NUM  Default:  3
+#
+maxretry = 3
+
+# Option:  bantime
+# Notes.:  number of seconds an IP will be banned.
+# Values:  NUM  Default:  600
+#
+bantime = 600
+
+# Option:  ignoreip
+# Notes.:  space separated list of IP's to be ignored by fail2ban
+#          Example:  ignoreip = 192.168.0.1 123.45.235.65
+# Values:  IP  Default:  
+#
+ignoreip = 
+
+# Option:  interface
+# Notes.:  interface name on which the IP will be banned.
+# Values:  INT  Default:  eth0
+#
+interface = eth0
+
+# Option:  polltime
+# Notes.:  number of seconds fail2ban sleeps between iterations.
+# Values:  NUM  Default:  1
+#
+polltime = 1
+
+# You can define a new section for each log file to check for
+# password failure. Each section has to define the following
+# options: logfile, timeregex, timepattern, failregex.
+
+[Apache]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/httpd/access_log
+#
+logfile = /var/log/httpd/access_log
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in Apache logfile.
+# Values:  [Wed Jan 05 15:08:01 2005]  
+# Default  \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+#
+timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
+#
+timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile.
+# Values:  TEXT  Default:  authentication failure|user .* not found
+#
+failregex = authentication failure|user .* not found
+
+[SSH]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  true
+#
+enabled = true
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/secure
+#
+logfile = /var/log/secure
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in SSH logfile.
+# Values:  [Mar  7 17:53:28]  
+# Default  \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile.
+# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
+#
+failregex = Authentication failure|Failed password|Invalid user
diff --git a/config/gentoo-confd b/config/gentoo-confd
new file mode 100644
index 00000000..e156c368
--- /dev/null
+++ b/config/gentoo-confd
@@ -0,0 +1,23 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+# Command line options for Fail2Ban. Refer to "fail2ban.py -h" for
+# valid options.
+FAIL2BAN_OPTS="-v"
diff --git a/config/gentoo-initd b/config/gentoo-initd
new file mode 100755
index 00000000..b6b2a0b1
--- /dev/null
+++ b/config/gentoo-initd
@@ -0,0 +1,50 @@
+#!/sbin/runscript
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# Author: Sireyessire, Cyril Jaquier
+# 
+# $Revision$
+
+opts="start stop restart showlog"
+
+FAIL2BAN="/usr/bin/fail2ban.py"
+
+depend() {
+	need net
+	need logger
+	after iptables
+}
+
+start() {
+	ebegin "Starting fail2ban"
+	${FAIL2BAN} -b ${FAIL2BAN_OPTS}
+	eend $? "Failed to start fail2ban"
+}
+
+stop() {
+	ebegin "Stopping fail2ban"
+	${FAIL2BAN} -k
+	eend $? "Failed to stop fail2ban"
+}
+
+zap() {
+	rm /var/run/fail2ban.pid
+}
+
+showlog(){
+	less /var/log/fail2ban.log
+}
diff --git a/config/redhat-initd b/config/redhat-initd
new file mode 100644
index 00000000..27369962
--- /dev/null
+++ b/config/redhat-initd
@@ -0,0 +1,78 @@
+#!/bin/bash
+#
+# fail2ban
+#
+# chkconfig: 345 91 9
+# description: if many unsuccessfull login attempts from some ip address \
+#              during a short period happen, this address is banned \
+#              by the firewall
+#
+# Author: Andrey G. Grozin
+# 
+# $Revision$
+
+# Source function library.
+. /etc/init.d/functions
+
+# Get config.
+. /etc/sysconfig/network
+
+# Check that networking is up.
+[ "${NETWORKING}" = "no" ] && exit 0
+[ -f /etc/fail2ban.conf ] || exit 0
+
+FAIL2BAN="/usr/bin/fail2ban.py"
+PIDFILE="/var/run/fail2ban.pid"
+
+RETVAL=0
+
+start() {
+    echo -n $"Starting fail2ban: "
+    "${FAIL2BAN}" -b
+    RETVAL=$?
+    echo
+}
+
+stop() {
+    if [ -f "${PIDFILE}" ]; then
+	echo -n $"Stopping fail2ban: "
+	"${FAIL2BAN}" -k
+	echo
+    fi
+}
+
+restart() {
+    stop
+    start
+}
+
+# See how we were called.
+case "$1" in
+  start)
+        start
+        ;;
+  stop)
+        stop
+        ;;
+  status)
+        status fail2ban.py
+        RETVAL=$?
+        ;;
+  reload)
+        restart
+        ;;
+  restart)
+        restart
+        ;;
+  condrestart)
+        if [ -f "${PIDFILE}" ]; then
+            restart
+        fi
+        ;;
+  *)
+        echo $"Usage: $0 {start|stop|status|restart|condrestart}"
+        exit 1
+        ;;
+esac
+
+exit $RETVAL
diff --git a/confreader/__init__.py b/confreader/__init__.py
new file mode 100644
index 00000000..76dba873
--- /dev/null
+++ b/confreader/__init__.py
@@ -0,0 +1,25 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
\ No newline at end of file
diff --git a/confreader/configreader.py b/confreader/configreader.py
new file mode 100644
index 00000000..c3eb271b
--- /dev/null
+++ b/confreader/configreader.py
@@ -0,0 +1,80 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from ConfigParser import *
+
+class ConfigReader:
+	""" This class allow the handling of the configuration options.
+		The DEFAULT section contains the global information about
+		Fail2Ban. Each other section is for a different log file.
+	"""
+	
+	# Each optionValues entry is composed of an array with:
+	# 0 -> the type of the option
+	# 1 -> the name of the option
+	# 2 -> the default value for the option
+	optionValues = (["bool", "enabled", True],
+					["str", "logfile", "/dev/null"],
+					["str", "timeregex", ""],
+					["str", "timepattern", ""],
+					["str", "failregex", ""])
+	
+	def __init__(self, logSys, confPath):
+		self.confPath = confPath
+		self.configParser = SafeConfigParser()
+		self.logSys = logSys
+		
+	def openConf(self):
+		""" Opens the configuration file.
+		"""
+		self.configParser.read(self.confPath)
+	
+	def getSections(self):
+		""" Returns all the sections present in the configuration
+			file except the DEFAULT section.
+		"""
+		return self.configParser.sections()
+		
+	def getLogOptions(self, sec):
+		""" Gets all the options of a given section. The options
+			are defined in the optionValues list.
+		"""
+		values = dict()
+		for option in self.optionValues:
+			try:
+				if option[0] == "bool":
+					v = self.configParser.getboolean(sec, option[1])
+				elif option[0] == "int":
+					v = self.configParser.getint(sec, option[1])
+				else:
+					v = self.configParser.get(sec, option[1])
+				
+				values[option[1]] = v
+			except NoOptionError:
+				self.logSys.warn("No '"+option[1]+"' defined in '"+sec+"'")
+				values[option[1]] = option[2]
+		return values
+		
\ No newline at end of file
diff --git a/fail2ban.py b/fail2ban.py
new file mode 100755
index 00000000..5fdfe698
--- /dev/null
+++ b/fail2ban.py
@@ -0,0 +1,551 @@
+#!/usr/bin/env python
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time, sys, getopt, os, signal, string
+from ConfigParser import *
+
+# Checks if log4py is present.
+try:
+	import log4py
+except:
+	print "log4py is needed (see README)"
+	sys.exit(-1)
+
+# Appends our own modules path
+sys.path.append('/usr/lib/fail2ban')
+
+from firewall.iptables import Iptables
+from firewall.ipfw import Ipfw
+from firewall.ipfwadm import Ipfwadm
+from logreader.logreader import LogReader
+from confreader.configreader import ConfigReader
+from version import version
+
+def usage():
+	print "Usage: fail2ban.py [OPTIONS]"
+	print
+	print "Fail2Ban v"+version+" reads log file that contains password failure report"
+	print "and bans the corresponding IP address using iptables."
+	print
+	print "  -b         start fail2ban in background"
+	print "  -d         start fail2ban in debug mode"
+	print "  -e <INTF>  ban IP on the INTF interface"
+	print "  -c <FILE>  read configuration file FILE"
+	print "  -p <FILE>  create PID lock in FILE"
+	print "  -h         display this help message"
+	print "  -i <IP(s)> IP(s) to ignore"
+	print "  -k         kill a currently running Fail2Ban instance"
+	print "  -l <FILE>  log message in FILE"
+	print "  -r <VALUE> allow a max of VALUE password failure"
+	print "  -t <TIME>  ban IP for TIME seconds"
+	print "  -v         verbose. Use twice for greater effect"
+	print "  -w <FIWA>  select the firewall to use. Can be iptables,"
+	print "             ipfwadm or ipfw"
+	print
+	print "Report bugs to <lostcontrol@users.sourceforge.net>"
+	sys.exit(0)
+
+def checkForRoot():
+	""" Check for root user.
+	"""
+	uid = `os.getuid()`
+	if uid == '0':
+		return True
+	else:
+		return False
+
+def createDaemon():
+	"""Detach a process from the controlling terminal and run it in the
+	background as a daemon.
+	
+	http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
+	"""
+
+	try:
+		# Fork a child process so the parent can exit.  This will return control
+		# to the command line or shell.  This is required so that the new process
+		# is guaranteed not to be a process group leader.  We have this guarantee
+		# because the process GID of the parent is inherited by the child, but
+		# the child gets a new PID, making it impossible for its PID to equal its
+		# PGID.
+		pid = os.fork()
+	except OSError, e:
+		return((e.errno, e.strerror))	 # ERROR (return a tuple)
+
+	if (pid == 0):	   # The first child.
+
+		# Next we call os.setsid() to become the session leader of this new
+		# session.  The process also becomes the process group leader of the
+		# new process group.  Since a controlling terminal is associated with a
+		# session, and this new session has not yet acquired a controlling
+		# terminal our process now has no controlling terminal.  This shouldn't
+		# fail, since we're guaranteed that the child is not a process group
+		# leader.
+		os.setsid()
+	
+		# When the first child terminates, all processes in the second child
+		# are sent a SIGHUP, so it's ignored.
+		signal.signal(signal.SIGHUP, signal.SIG_IGN)
+	
+		try:
+			# Fork a second child to prevent zombies.  Since the first child is
+			# a session leader without a controlling terminal, it's possible for
+			# it to acquire one by opening a terminal in the future.  This second
+			# fork guarantees that the child is no longer a session leader, thus
+			# preventing the daemon from ever acquiring a controlling terminal.
+			pid = os.fork()		# Fork a second child.
+		except OSError, e:
+			return((e.errno, e.strerror))  # ERROR (return a tuple)
+	
+		if (pid == 0):	  # The second child.
+			# Ensure that the daemon doesn't keep any directory in use.  Failure
+			# to do this could make a filesystem unmountable.
+			os.chdir("/")
+			# Give the child complete control over permissions.
+			os.umask(0)
+		else:
+			os._exit(0)	  # Exit parent (the first child) of the second child.
+	else:
+		os._exit(0)		 # Exit parent of the first child.
+
+	# Close all open files.  Try the system configuration variable, SC_OPEN_MAX,
+	# for the maximum number of open files to close.  If it doesn't exist, use
+	# the default value (configurable).
+	try:
+		maxfd = os.sysconf("SC_OPEN_MAX")
+	except (AttributeError, ValueError):
+		maxfd = 256	   # default maximum
+
+	for fd in range(0, maxfd):
+		try:
+			os.close(fd)
+		except OSError:   # ERROR (ignore)
+			pass
+
+	# Redirect the standard file descriptors to /dev/null.
+   	os.open("/dev/null", os.O_RDONLY)	# standard input (0)
+	os.open("/dev/null", os.O_RDWR)		# standard output (1)
+	os.open("/dev/null", os.O_RDWR)		# standard error (2)
+
+	return True
+
+def sigTERMhandler(signum, frame):
+	""" Handles the TERM signal when in daemon mode in order to
+		exit properly.
+	"""
+	logSys.debug("Signal handler called with sig "+`signum`)
+	killApp()
+
+def killApp():
+	""" Flush the ban list, remove the PID lock file and exit
+		nicely.
+	"""
+	logSys.warn("Restoring firewall rules...")
+	fireWall.flushBanList(conf["debug"])
+	removePID(conf["pidlock"])
+	logSys.info("Exiting...")
+	sys.exit(0)
+	
+def checkForPID(lockfile):
+	""" Checks for running Fail2Ban.
+	
+		Returns the current PID if Fail2Ban is running or False
+		if no instance found.
+	"""
+	try:
+		fileHandler = open(lockfile)
+		pid = fileHandler.readline()
+		return pid
+	except IOError:
+		return False
+		
+def createPID(lockfile):
+	""" Creates a PID lock file with the current PID.
+	"""
+	fileHandler = open(lockfile, mode='w')
+	pid = os.getpid()
+	fileHandler.write(`pid`+'\n')
+	fileHandler.close()
+	logSys.debug("Created PID lock ("+`pid`+") in "+lockfile)
+		
+def removePID(lockfile):
+	""" Remove PID lock.
+	"""
+	os.remove(lockfile)
+	logSys.debug("Removed PID lock "+lockfile)
+
+def killPID(pid):
+	""" Kills the process with the given PID using the
+		INT signal (same effect as <ctrl>+<c>).
+	"""
+	try:
+		return os.kill(pid, 2)
+	except OSError:
+		logSys.error("Can not kill process " + `pid` + ". Please check that " +
+					"Fail2Ban is not running and remove the file " +
+					"'/tmp/fail2ban.pid'")
+
+if __name__ == "__main__":
+	
+	# Gets an instance of log4py.
+	logSys = log4py.Logger().get_instance()
+	logSys.set_formatstring("%T %L %M")
+	
+	conf = dict()
+	conf["verbose"] = 0
+	conf["background"] = False
+	conf["debug"] = False
+	conf["conffile"] = "/etc/fail2ban.conf"
+	conf["pidlock"] = "/var/run/fail2ban.pid"
+	conf["logging"] = False
+	conf["logfile"] = "/var/log/fail2ban.log"
+	conf["maxretry"] = 3
+	conf["bantime"] = 600
+	conf["ignoreip"] = ''
+	conf["interface"] = "eth0"
+	conf["firewall"] = "iptables"
+	conf["ipfw-start-rule"] = 0
+	conf["polltime"] = 1
+	
+	# Reads the command line options.
+	try:
+		optList, args = getopt.getopt(sys.argv[1:], 'hvbdkc:l:t:i:r:e:w:p:')
+	except getopt.GetoptError:
+		usage()
+	
+	# Pre-parsing of command line options for the -c option
+	for opt in optList:
+		if opt[0] == "-c":
+			conf["conffile"] = opt[1]
+	
+	# Config file
+	configParser = SafeConfigParser()
+	configParser.read(conf["conffile"])
+	
+	# background
+	try:
+		conf["background"] = configParser.getboolean("DEFAULT", "background")
+	except ValueError:
+		logSys.warn("background option should be a boolean")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("background option not in config file")
+		logSys.warn("Using default value")
+
+	# debug
+	try:
+		conf["debug"] = configParser.getboolean("DEFAULT", "debug")
+	except ValueError:
+		logSys.warn("debug option should be a boolean")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("debug option not in config file")
+		logSys.warn("Using default value")
+
+	# logfile
+	try:
+		conf["logfile"] = configParser.get("DEFAULT", "logfile")
+	except ValueError:
+		logSys.warn("logfile option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("logfile option not in config file")
+		logSys.warn("Using default value")
+		
+	# pidlock
+	try:
+		conf["pidlock"] = configParser.get("DEFAULT", "pidlock")
+	except ValueError:
+		logSys.warn("pidlock option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("pidlock option not in config file")
+		logSys.warn("Using default value")
+		
+	# maxretry
+	try:
+		conf["maxretry"] = configParser.getint("DEFAULT", "maxretry")
+	except ValueError:
+		logSys.warn("maxretry option should be an integer")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("maxretry option not in config file")
+		logSys.warn("Using default value")
+
+	# bantime
+	try:
+		conf["bantime"] = configParser.getint("DEFAULT", "bantime")
+	except ValueError:
+		logSys.warn("bantime option should be an integer")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("bantime option not in config file")
+		logSys.warn("Using default value")
+
+	# ignoreip
+	try:
+		conf["ignoreip"] = configParser.get("DEFAULT", "ignoreip")
+	except ValueError:
+		logSys.warn("ignoreip option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("ignoreip option not in config file")
+		logSys.warn("Using default value")
+		
+	# interface
+	try:
+		conf["interface"] = configParser.get("DEFAULT", "interface")
+	except ValueError:
+		logSys.warn("interface option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("interface option not in config file")
+		logSys.warn("Using default value")
+		
+	# firewall
+	try:
+		conf["firewall"] = configParser.get("DEFAULT", "firewall")
+	except ValueError:
+		logSys.warn("firewall option should be a string")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("firewall option not in config file")
+		logSys.warn("Using default value")
+	
+	# ipfw-start-rule
+	try:
+		conf["ipfw-start-rule"] = configParser.getint("DEFAULT",
+													"ipfw-start-rule")
+	except ValueError:
+		logSys.warn("ipfw-start-rule option should be an integer")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("ipfw-start-rule option not in config file")
+		logSys.warn("Using default value")
+
+	# polltime
+	try:
+		conf["polltime"] = configParser.getint("DEFAULT", "polltime")
+	except ValueError:
+		logSys.warn("polltime option should be an integer")
+		logSys.warn("Using default value")
+	except NoOptionError:
+		logSys.warn("polltime option not in config file")
+		logSys.warn("Using default value")
+	
+	for opt in optList:
+		if opt[0] == "-h":
+			usage()
+		if opt[0] == "-v":
+			conf["verbose"] = conf["verbose"] + 1
+		if opt[0] == "-b":
+			conf["background"] = True
+		if opt[0] == "-d":
+			conf["debug"] = True
+		if opt[0] == "-e":
+			conf["interface"] = opt[1]
+		if opt[0] == "-l":
+			conf["logging"] = True
+			conf["logfile"] = opt[1]
+		if opt[0] == "-t":
+			try:
+				conf["bantime"] = int(opt[1])
+			except ValueError:
+				logSys.warn("banTime must be an integer")
+				logSys.warn("Using default value")
+		if opt[0] == "-i":
+			conf["ignoreip"] = opt[1]
+		if opt[0] == "-r":
+			conf["retrymax"] = int(opt[1])
+		if opt[0] == "-w":
+			conf["firewall"] = opt[1]
+		if opt[0] == "-p":
+			conf["pidlock"] = opt[1]
+		if opt[0] == "-k":
+			pid = checkForPID(conf["pidlock"])
+			if pid:
+				killPID(int(pid))
+				logSys.warn("Killed Fail2Ban with PID "+pid)
+				sys.exit(0)
+			else:
+				logSys.error("No running Fail2Ban found")
+				sys.exit(-1)
+
+	# Process some options
+	for c in conf:
+		if c == "verbose":
+			logSys.warn("Verbose level is "+`conf[c]`)
+			if conf[c] == 1:
+				logSys.set_loglevel(log4py.LOGLEVEL_VERBOSE)
+			elif conf[c] > 1:
+				logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
+		elif c == "debug" and conf[c]:
+			logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
+			logSys.set_formatstring(log4py.FMT_DEBUG)
+		elif c == "background" and conf[c]:
+			retCode = createDaemon()
+			signal.signal(signal.SIGTERM, sigTERMhandler)
+			logSys.set_target(conf["logfile"])
+			if not retCode:
+				logSys.error("Unable to start daemon")
+				sys.exit(-1)
+		elif c == "logging" and conf[c]:
+			try:
+				open(conf["logfile"], "a")
+				logSys.set_target(conf["logfile"])
+			except IOError:
+				logSys.warn("Unable to log to "+conf["logfile"])
+				logSys.warn("Using default output for logging")
+		elif c == "ignoreip":
+			ignoreIPList = conf[c].split(' ')
+		elif c == "firewall":
+			conf[c] = string.lower(conf[c])
+			if conf[c] == "ipfw":
+				fireWallName = "Ipfw"
+			elif conf[c] == "ipfwadm":
+				fireWallName = "Ipfwadm"
+			else:
+				fireWallName = "Iptables"
+	
+	# Checks for root user. This is necessary because log files
+	# are owned by root and firewall needs root access.
+	if not checkForRoot():
+		logSys.error("You must be root")
+		if not conf["debug"]:
+			sys.exit(-1)
+			
+	# Checks that no instance of Fail2Ban is currently running.
+	pid = checkForPID(conf["pidlock"])
+	if pid:
+		logSys.error("Fail2Ban already running with PID "+pid)
+		sys.exit(-1)
+	else:
+		createPID(conf["pidlock"])
+	
+	logSys.debug("ConfFile is "+conf["conffile"])
+	logSys.debug("BanTime is "+`conf["bantime"]`)
+	logSys.debug("retryAllowed is "+`conf["maxretry"]`)
+	
+	# Reads the config file and create a LogReader instance for
+	# each log file to check.
+	confReader = ConfigReader(logSys, conf["conffile"]);
+	confReader.openConf()
+	logList = list()
+	for t in confReader.getSections():
+		l = confReader.getLogOptions(t)
+		if l["enabled"]:
+			lObj = LogReader(logSys, l["logfile"], l["timeregex"],
+							l["timepattern"], l["failregex"], conf["bantime"])
+			lObj.setName(t)
+			logList.append(lObj)
+	
+	# Creates one instance of Iptables (thanks to Pyhton dynamic
+	# features).
+	fireWallObj = eval(fireWallName)
+	fireWall = fireWallObj(conf["bantime"], logSys, conf["interface"])
+	
+	# IPFW needs rules number. The configuration option "ipfw-start-rule"
+	# defines the first rule number used by Fail2Ban.
+	if fireWallName == "Ipfw":
+		fireWall.setCrtRuleNbr(conf["ipfw-start-rule"])
+	
+	# We add 127.0.0.1 to the ignore list has we do not want
+	# to be ban ourself.
+	for element in logList:
+		element.addIgnoreIP("127.0.0.1")
+	while len(ignoreIPList) > 0:
+		ip = ignoreIPList.pop()
+		for element in logList:
+			element.addIgnoreIP(ip)
+	
+	logSys.info("Fail2Ban v"+version+" is running")
+	failListFull = dict()
+	# Main loop
+	while True:
+		try:
+			sys.stdout.flush()
+			sys.stderr.flush()
+			
+			# Checks if some IP have to be remove from ban
+			# list.
+			fireWall.checkForUnBan(conf["debug"])
+			
+			# If the log file has not been modified since the
+			# last time, we sleep for 1 second. This is active
+			# polling so not very effective.
+			modList = list()
+			for element in logList:
+				if element.isModified():
+					modList.append(element)
+			
+			if len(modList) == 0:
+				time.sleep(conf["polltime"])
+				continue
+			
+			# Gets the failure list from the log file. For a given IP,
+			# takes only the service which has the most password failures.
+			failList = dict()
+			for element in modList:
+				e = element.getFailures()
+				for key in e.iterkeys():
+					if failList.has_key(key):
+						if failList[key][0] < e[key][0]:
+							failList[key] = (e[key][0], e[key][1], element)
+					else:
+						failList[key] = (e[key][0], e[key][1], element)
+				
+			# Add the last log failures to the global failure list.
+			for key in failList.iterkeys():
+				if failListFull.has_key(key):
+					failListFull[key] = (failListFull[key][0] + 1,
+										failList[key][1], failList[key][2])
+				else:
+					failListFull[key] = failList[key]
+			
+			# Remove the oldest failure attempts from the global list.
+			unixTime = time.time()
+			failListFullTemp = failListFull.copy()
+			for key in failListFullTemp.iterkeys():
+				failTime = failListFullTemp[key][2].getFindTime()
+				if failListFullTemp[key][1] < unixTime - failTime:
+					del failListFull[key]
+			
+			# We iterate the failure list and ban IP that make
+			# *retryAllowed* login failures.
+			failListFullTemp = failListFull.copy()
+			for key in failListFullTemp.iterkeys():
+				element = failListFullTemp[key]
+				if element[0] >= conf["maxretry"]:
+					logSys.info(element[2].getName()+": "+key+" has "+
+								`element[0]`+" login failure(s). Banned.")
+					fireWall.addBanIP(key, conf["debug"])
+					del failListFull[key]
+			
+		except KeyboardInterrupt:
+			# When the user press <ctrl>+<c> we exit nicely.
+			killApp()
diff --git a/firewall/firewall.py b/firewall/firewall.py
new file mode 100644
index 00000000..a62a85ff
--- /dev/null
+++ b/firewall/firewall.py
@@ -0,0 +1,98 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time, os
+
+class Firewall:
+	""" Manages the ban list and executes the command that ban
+		the IP.
+	"""
+	
+	banList = dict()
+	
+	def __init__(self, banTime, logSys, interface):
+		self.banTime = banTime
+		self.logSys = logSys
+		self.interface = interface
+	
+	def addBanIP(self, ip, debug):
+		""" Bans an IP.
+		"""
+		if not self.inBanList(ip):
+			self.logSys.warn("Ban "+ip)
+			self.banList[ip] = time.time()
+			self.__executeCmd(self.banIP(ip), debug)
+		else:
+			self.logSys.error(ip+" already in ban list")
+	
+	def delBanIP(self, ip, debug):
+		""" Unban an IP.
+		"""
+		if self.inBanList(ip):
+			self.logSys.warn("Unban "+ip)
+			del self.banList[ip]
+			self.__executeCmd(self.unBanIP(ip), debug)
+		else:
+			self.logSys.error(ip+" not in ban list")
+	
+	def inBanList(self, ip):
+		""" Checks if IP is in ban list.
+		"""
+		return self.banList.has_key(ip)
+	
+	def checkForUnBan(self, debug):
+		""" Check for IP to remove from ban list.
+		"""
+		banListTemp = self.banList.copy()
+		for element in banListTemp.iteritems():
+			ip = element[0]
+			btime = element[1]
+			if btime < time.time()-self.banTime:
+				self.delBanIP(ip, debug)
+	
+	def flushBanList(self, debug):
+		""" Flushes the ban list and of course the firewall rules.
+			Called when fail2ban exits.
+		"""
+		banListTemp = self.banList.copy()
+		for element in banListTemp.iteritems():
+			ip = element[0]
+			self.delBanIP(ip, debug)
+	
+	def __executeCmd(self, cmd, debug):
+		""" Executes an OS command.
+		"""
+		self.logSys.debug(cmd)
+		if not debug:
+			return os.system(cmd)
+		else:
+			return None
+		
+	def viewBanList(self):
+		""" Prints the ban list on screen. Usefull for debugging.
+		"""
+		for element in self.banList.iteritems():
+			print element
diff --git a/firewall/ipfw.py b/firewall/ipfw.py
new file mode 100644
index 00000000..41fbc29b
--- /dev/null
+++ b/firewall/ipfw.py
@@ -0,0 +1,72 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os
+
+from firewall import Firewall
+
+class Ipfw(Firewall):
+	""" This class contains specific methods and variables for the
+		iptables firewall. Must implements the 'abstracts' methods
+		banIP(ip) and unBanIP(ip).
+		
+		Must adds abstract methods definition:
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
+	"""
+	
+	crtRuleNbr = 0
+	
+	def getCrtRuleNbr(self):
+		""" Gets the current rule number.
+		"""
+		return self.crtRuleNbr
+		
+	def setCrtRuleNbr(self, value):
+		""" Sets the current rule number.
+		"""
+		self.crtRuleNbr = value
+	
+	def banIP(self, ip):
+		""" Returns query to ban IP.
+		"""
+		query = "ipfw -q add "+`self.crtRuleNbr`+" deny ip from "+ip+" to any"
+		self.crtRuleNbr = self.crtRuleNbr + 1
+		return query
+	
+	def unBanIP(self, ip):
+		""" Returns query to unban IP.
+		"""
+		ruleNbr = str(self.__findRuleNumber(ip))
+		query = "ipfw -q delete "+ruleNbr
+		return query
+		
+	def __findRuleNumber(self, ip):
+		""" Uses shell commands in order to find the rule
+			number we want to delete.
+		"""
+		output = os.popen("ipfw list|grep \"from "+ip+" to\"|awk '{print $1}'",
+						  "r");
+		return output.read()
diff --git a/firewall/ipfwadm.py b/firewall/ipfwadm.py
new file mode 100644
index 00000000..cfdccbd8
--- /dev/null
+++ b/firewall/ipfwadm.py
@@ -0,0 +1,48 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from firewall import Firewall
+
+class Ipfwadm(Firewall):
+	""" This class contains specific methods and variables for the
+		iptables firewall. Must implements the 'abstracts' methods
+		banIP(ip) and unBanIP(ip).
+		
+		Must adds abstract methods definition:
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
+	"""
+	
+	def banIP(self, ip):
+		""" Returns query to ban IP.
+		"""
+		query = "ipfwadm -I -a deny -W "+self.interface+" -S "+ip
+		return query
+	
+	def unBanIP(self, ip):
+		""" Returns query to unban IP.
+		"""
+		query = "ipfwadm -I -d deny -W "+self.interface+" -S "+ip
+		return query
diff --git a/firewall/iptables.py b/firewall/iptables.py
new file mode 100644
index 00000000..7b78c69c
--- /dev/null
+++ b/firewall/iptables.py
@@ -0,0 +1,48 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from firewall import Firewall
+
+class Iptables(Firewall):
+	""" This class contains specific methods and variables for the
+		iptables firewall. Must implements the 'abstracts' methods
+		banIP(ip) and unBanIP(ip).
+		
+		Must adds abstract methods definition:
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
+	"""
+	
+	def banIP(self, ip):
+		""" Returns query to ban IP.
+		"""
+		query = "iptables -I INPUT 1 -i "+self.interface+" -s "+ip+" -j DROP"
+		return query
+	
+	def unBanIP(self, ip):
+		""" Returns query to unban IP.
+		"""
+		query = "iptables -D INPUT -i "+self.interface+" -s "+ip+" -j DROP"
+		return query
diff --git a/log-test/apache b/log-test/apache
new file mode 100644
index 00000000..35248fd2
--- /dev/null
+++ b/log-test/apache
@@ -0,0 +1,102 @@
+[Mon Jan 03 05:02:15 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:21 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
+[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/\xe0
+[Mon Jan 03 05:02:23 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msdac
+[Mon Jan 03 05:02:23 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msdac
+[Mon Jan 03 05:02:24 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/PBServer
+[Mon Jan 03 05:02:24 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/PBServer
+[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/Rpc
+[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/Rpc
+[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/samples
+[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/samples
+[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts..\xc1\x9c..
+[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:32 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:32 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:34 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:34 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:39 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 05:02:39 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
+[Mon Jan 03 11:08:29 2005] [error] [client 128.178.150.127] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Mon Jan 03 20:08:52 2005] [error] [client 83.76.202.195] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:19:50 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:19:55 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:01 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:05 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:08 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:12 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:16 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:22 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:26 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:28 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 15:20:38 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 20:54:59 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 20:55:04 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 20:55:29 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 21:34:29 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Tue Jan 04 21:34:32 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 00:17:41 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 00:18:03 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 00:18:12 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:24:38 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:24:40 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:24:46 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:24:48 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:25:58 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:26:34 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 01:26:37 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 10:13:02 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 10:13:07 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 10:13:10 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 10:17:07 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:41:40 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:41:45 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:41:47 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:41:51 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 14:55:30 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:03:44 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:03:48 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:03:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:03:57 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:06:45 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Mar 05 15:07:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Jan 05 15:08:01 2005] [error] [client 192.168.0.128] user  not found: /phpinfo
+[Wed Jan 05 15:10:45 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/css/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
+[Wed Jan 05 15:10:45 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/images/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
+[Wed Jan 05 15:10:45 2005] [error] [client 192.168.0.128] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:11:09 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 05 15:11:10 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 06 15:11:11 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 06 15:11:13 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 06 15:11:14 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
+[Wed Jan 05 15:11:15 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/css/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
+[Wed Jan 05 15:11:15 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/images/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
+[Wed Jan 05 15:11:15 2005] [error] [client 192.168.0.128] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:12:32 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:48 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:51 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:54 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:56 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:13:59 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:14:20 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:14:24 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:14:29 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Jan 05 15:14:34 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
+[Wed Mar 05 15:08:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 05 15:09:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
\ No newline at end of file
diff --git a/log-test/current b/log-test/current
new file mode 100644
index 00000000..d4b9f00a
--- /dev/null
+++ b/log-test/current
@@ -0,0 +1,5 @@
+Jan  7 17:53:15 [sshd] (pam_unix) 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.220.137.36  user=kevin
+Jan  7 17:53:26 [sshd] (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.220.137.36  user=kevin
+Mar  7 17:53:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
+Mar  7 17:55:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
diff --git a/log-test/test b/log-test/test
new file mode 100644
index 00000000..d370ca46
--- /dev/null
+++ b/log-test/test
@@ -0,0 +1,432 @@
+Sep 28 13:18:43 [sshd] Failed password for illegal user test from 211.112.229.69 port 59506 ssh2
+Sep 28 13:18:45 [sshd] Failed password for illegal user guest from 211.112.229.69 port 59584 ssh2
+Sep 28 13:18:48 [sshd] Failed password for illegal user admin from 211.112.229.69 port 59668 ssh2
+Sep 28 13:18:51 [sshd] Failed password for illegal user admin from 211.112.229.69 port 59746 ssh2
+Sep 28 13:18:54 [sshd] Failed password for illegal user user from 211.112.229.69 port 59809 ssh2
+Sep 28 13:18:57 [sshd] Failed password for illegal user root from 211.112.229.69 port 59881 ssh2
+Sep 28 13:19:00 [sshd] Failed password for illegal user root from 211.112.229.69 port 59944 ssh2
+Sep 28 13:19:03 [sshd] Failed password for illegal user root from 211.112.229.69 port 59999 ssh2
+Sep 28 13:19:06 [sshd] Failed password for illegal user test from 211.112.229.69 port 60055 ssh2
+Sep 28 21:05:25 [sshd(pam_unix)] authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.128.local.home  user=cyril
+Sep 28 21:05:27 [sshd] error: PAM: Authentication failure for cyril from 192.168.0.128.local.home
+Sep 29 03:45:18 [sshd] Failed password for illegal user nobody from 203.198.168.66 port 55927 ssh2
+Sep 29 03:45:21 [sshd] Failed password for illegal user patrick from 203.198.168.66 port 55973 ssh2
+Sep 29 03:45:23 [sshd] Failed password for illegal user patrick from 203.198.168.66 port 56010 ssh2
+Sep 29 03:45:26 [sshd] Failed password for illegal user root from 203.198.168.66 port 56060 ssh2
+Sep 29 03:45:29 [sshd] Failed password for illegal user root from 203.198.168.66 port 56107 ssh2
+Sep 29 03:45:32 [sshd] Failed password for illegal user root from 203.198.168.66 port 56152 ssh2
+Sep 29 03:45:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 56200 ssh2
+Sep 29 03:45:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 56243 ssh2
+Sep 29 03:45:40 [sshd] Failed password for illegal user rolo from 203.198.168.66 port 56288 ssh2
+Sep 29 03:45:43 [sshd] Failed password for illegal user iceuser from 203.198.168.66 port 56333 ssh2
+Sep 29 03:45:46 [sshd] Failed password for illegal user horde from 203.198.168.66 port 56379 ssh2
+Sep 29 03:45:48 [sshd] Failed password for illegal user cyrus from 203.198.168.66 port 56425 ssh2
+Sep 29 03:45:52 [sshd] Failed password for illegal user www from 203.198.168.66 port 56470 ssh2
+Sep 29 03:45:55 [sshd] Failed password for illegal user wwwrun from 203.198.168.66 port 56534 ssh2
+Sep 29 03:45:58 [sshd] Failed password for illegal user matt from 203.198.168.66 port 56572 ssh2
+Sep 29 03:46:01 [sshd] Failed password for illegal user test from 203.198.168.66 port 56616 ssh2
+Sep 29 03:46:03 [sshd] Failed password for illegal user test from 203.198.168.66 port 56660 ssh2
+Sep 29 03:46:06 [sshd] Failed password for illegal user test from 203.198.168.66 port 56704 ssh2
+Sep 29 03:46:09 [sshd] Failed password for illegal user test from 203.198.168.66 port 56752 ssh2
+Sep 29 03:46:12 [sshd] Failed password for illegal user www-data from 203.198.168.66 port 56795 ssh2
+Sep 29 03:46:15 [sshd] Failed password for illegal user mysql from 203.198.168.66 port 56839 ssh2
+Sep 29 03:46:17 [sshd] Failed password for illegal user operator from 203.198.168.66 port 56882 ssh2
+Sep 29 03:46:20 [sshd] Failed password for illegal user adm from 203.198.168.66 port 56929 ssh2
+Sep 29 03:46:23 [sshd] Failed password for illegal user apache from 203.198.168.66 port 56971 ssh2
+Sep 29 03:46:26 [sshd] Failed password for illegal user irc from 203.198.168.66 port 57011 ssh2
+Sep 29 03:46:29 [sshd] Failed password for illegal user irc from 203.198.168.66 port 57060 ssh2
+Sep 29 03:46:31 [sshd] Failed password for illegal user adm from 203.198.168.66 port 57100 ssh2
+Sep 29 03:46:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 57148 ssh2
+Sep 29 03:46:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 57194 ssh2
+Sep 29 03:46:40 [sshd] Failed password for illegal user root from 203.198.168.66 port 57236 ssh2
+Sep 29 03:46:43 [sshd] Failed password for illegal user jane from 203.198.168.66 port 57281 ssh2
+Sep 29 03:46:45 [sshd] Failed password for illegal user pamela from 203.198.168.66 port 57328 ssh2
+Sep 29 03:46:48 [sshd] Failed password for illegal user root from 203.198.168.66 port 57372 ssh2
+Sep 29 03:46:51 [sshd] Failed password for illegal user root from 203.198.168.66 port 57418 ssh2
+Sep 29 03:46:54 [sshd] Failed password for illegal user root from 203.198.168.66 port 57463 ssh2
+Sep 29 03:46:57 [sshd] Failed password for illegal user root from 203.198.168.66 port 57506 ssh2
+Sep 29 03:46:59 [sshd] Failed password for illegal user root from 203.198.168.66 port 57549 ssh2
+Sep 29 03:47:02 [sshd] Failed password for illegal user cosmin from 203.198.168.66 port 57594 ssh2
+Sep 29 03:47:05 [sshd] Failed password for illegal user root from 203.198.168.66 port 57637 ssh2
+Sep 29 03:47:08 [sshd] Failed password for illegal user root from 203.198.168.66 port 57689 ssh2
+Sep 29 03:47:11 [sshd] Failed password for illegal user root from 203.198.168.66 port 57730 ssh2
+Sep 29 03:47:13 [sshd] Failed password for illegal user root from 203.198.168.66 port 57774 ssh2
+Sep 29 03:47:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 57820 ssh2
+Sep 29 03:47:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 57866 ssh2
+Sep 29 03:47:22 [sshd] Failed password for illegal user root from 203.198.168.66 port 57901 ssh2
+Sep 29 03:47:25 [sshd] Failed password for illegal user root from 203.198.168.66 port 57944 ssh2
+Sep 29 03:47:27 [sshd] Failed password for illegal user root from 203.198.168.66 port 57990 ssh2
+Sep 29 03:47:31 [sshd] Failed password for illegal user root from 203.198.168.66 port 58031 ssh2
+Sep 29 03:47:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 58098 ssh2
+Sep 29 03:47:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 58137 ssh2
+Sep 29 03:47:40 [sshd] Failed password for illegal user root from 203.198.168.66 port 58183 ssh2
+Sep 29 03:47:42 [sshd] Failed password for illegal user root from 203.198.168.66 port 58228 ssh2
+Sep 29 03:47:45 [sshd] Failed password for illegal user root from 203.198.168.66 port 58273 ssh2
+Sep 29 03:47:48 [sshd] Failed password for illegal user root from 203.198.168.66 port 58314 ssh2
+Sep 29 03:47:51 [sshd] Failed password for illegal user root from 203.198.168.66 port 58358 ssh2
+Sep 29 03:47:54 [sshd] Failed password for illegal user root from 203.198.168.66 port 58401 ssh2
+Sep 29 03:47:56 [sshd] Failed password for illegal user root from 203.198.168.66 port 58443 ssh2
+Sep 29 03:47:59 [sshd] Failed password for illegal user root from 203.198.168.66 port 58484 ssh2
+Sep 29 03:48:02 [sshd] Failed password for illegal user root from 203.198.168.66 port 58528 ssh2
+Sep 29 03:48:05 [sshd] Failed password for illegal user root from 203.198.168.66 port 58574 ssh2
+Sep 29 03:48:07 [sshd] Failed password for illegal user root from 203.198.168.66 port 58613 ssh2
+Sep 29 03:48:10 [sshd] Failed password for illegal user root from 203.198.168.66 port 58662 ssh2
+Sep 29 03:48:13 [sshd] Failed password for illegal user root from 203.198.168.66 port 58703 ssh2
+Sep 29 03:48:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 58748 ssh2
+Sep 29 03:48:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 58792 ssh2
+Sep 29 03:48:21 [sshd] Failed password for illegal user root from 203.198.168.66 port 58839 ssh2
+Sep 29 03:48:24 [sshd] Failed password for illegal user root from 203.198.168.66 port 58880 ssh2
+Sep 29 03:48:27 [sshd] Failed password for illegal user root from 203.198.168.66 port 58926 ssh2
+Sep 29 03:48:30 [sshd] Failed password for illegal user root from 203.198.168.66 port 58967 ssh2
+Sep 29 03:48:33 [sshd] Failed password for illegal user root from 203.198.168.66 port 59012 ssh2
+Sep 29 03:48:35 [sshd] Failed password for illegal user root from 203.198.168.66 port 59052 ssh2
+Sep 29 03:48:38 [sshd] Failed password for illegal user root from 203.198.168.66 port 59095 ssh2
+Sep 29 03:48:41 [sshd] Failed password for illegal user root from 203.198.168.66 port 59140 ssh2
+Sep 29 03:48:44 [sshd] Failed password for illegal user root from 203.198.168.66 port 59182 ssh2
+Sep 29 03:48:47 [sshd] Failed password for illegal user cip52 from 203.198.168.66 port 59222 ssh2
+Sep 29 03:48:49 [sshd] Failed password for illegal user cip51 from 203.198.168.66 port 59264 ssh2
+Sep 29 03:48:52 [sshd] Failed password for illegal user root from 203.198.168.66 port 59309 ssh2
+Sep 29 03:48:55 [sshd] Failed password for illegal user noc from 203.198.168.66 port 59351 ssh2
+Sep 29 03:48:58 [sshd] Failed password for illegal user root from 203.198.168.66 port 59395 ssh2
+Sep 29 03:49:01 [sshd] Failed password for illegal user root from 203.198.168.66 port 59432 ssh2
+Sep 29 03:49:04 [sshd] Failed password for illegal user root from 203.198.168.66 port 59479 ssh2
+Sep 29 03:49:07 [sshd] Failed password for illegal user root from 203.198.168.66 port 59951 ssh2
+Sep 29 03:49:11 [sshd] Failed password for illegal user webmaster from 203.198.168.66 port 60006 ssh2
+Sep 29 03:49:14 [sshd] Failed password for illegal user data from 203.198.168.66 port 60463 ssh2
+Sep 29 03:49:17 [sshd] Failed password for illegal user user from 203.198.168.66 port 60880 ssh2
+Sep 29 03:49:20 [sshd] Failed password for illegal user user from 203.198.168.66 port 60947 ssh2
+Sep 29 03:49:23 [sshd] Failed password for illegal user user from 203.198.168.66 port 33137 ssh2
+Sep 29 03:49:26 [sshd] Failed password for illegal user web from 203.198.168.66 port 33572 ssh2
+Sep 29 03:49:31 [sshd] Failed password for illegal user web from 203.198.168.66 port 33630 ssh2
+Sep 29 03:49:34 [sshd] Failed password for illegal user oracle from 203.198.168.66 port 34129 ssh2
+Sep 29 03:49:39 [sshd] Failed password for illegal user sybase from 203.198.168.66 port 34558 ssh2
+Sep 29 03:49:42 [sshd] Failed password for illegal user master from 203.198.168.66 port 35018 ssh2
+Sep 29 03:49:45 [sshd] Failed password for illegal user account from 203.198.168.66 port 35095 ssh2
+Sep 29 03:49:48 [sshd] Failed password for illegal user backup from 203.198.168.66 port 35506 ssh2
+Sep 29 03:49:51 [sshd] Failed password for illegal user server from 203.198.168.66 port 35935 ssh2
+Sep 29 03:49:54 [sshd] Failed password for illegal user adam from 203.198.168.66 port 36016 ssh2
+Sep 29 03:49:57 [sshd] Failed password for illegal user alan from 203.198.168.66 port 36399 ssh2
+Sep 29 03:49:59 [sshd] Failed password for illegal user frank from 203.198.168.66 port 36488 ssh2
+Sep 29 03:50:04 [sshd] Failed password for illegal user george from 203.198.168.66 port 36876 ssh2
+Sep 29 03:50:07 [sshd] Failed password for illegal user henry from 203.198.168.66 port 37333 ssh2
+Sep 29 03:50:11 [sshd] Failed password for illegal user john from 203.198.168.66 port 37423 ssh2
+Sep 29 03:50:14 [sshd] Failed password for illegal user root from 203.198.168.66 port 37837 ssh2
+Sep 29 03:50:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 38210 ssh2
+Sep 29 03:50:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 38286 ssh2
+Sep 29 03:50:22 [sshd] Failed password for illegal user root from 203.198.168.66 port 38653 ssh2
+Sep 29 03:50:26 [sshd] Failed password for illegal user root from 203.198.168.66 port 38749 ssh2
+Sep 29 03:50:29 [sshd] Failed password for illegal user test from 203.198.168.66 port 39162 ssh2
+Sep 29 10:19:26 [sshd] Failed password for illegal user test from 24.19.0.105 port 3765 ssh2
+Sep 29 10:19:32 [sshd] Failed password for illegal user guest from 24.19.0.105 port 3846 ssh2
+Sep 29 10:19:39 [sshd] Failed password for illegal user admin from 24.19.0.105 port 3929 ssh2
+Sep 29 10:19:45 [sshd] Failed password for illegal user admin from 24.19.0.105 port 3992 ssh2
+Sep 29 10:19:49 [sshd] Failed password for illegal user user from 24.19.0.105 port 4057 ssh2
+Sep 29 10:19:54 [sshd] Failed password for illegal user root from 24.19.0.105 port 4115 ssh2
+Sep 29 10:19:58 [sshd] Failed password for illegal user root from 24.19.0.105 port 4170 ssh2
+Sep 29 10:20:01 [sshd] Failed password for illegal user root from 24.19.0.105 port 4202 ssh2
+Sep 29 10:20:04 [sshd] Failed password for illegal user test from 24.19.0.105 port 4242 ssh2
+Oct  1 15:53:46 [sshd] Failed password for illegal user test from 210.51.173.75 port 40940 ssh2
+Oct  1 15:53:53 [sshd] Failed password for illegal user guest from 210.51.173.75 port 41196 ssh2
+Oct  1 15:53:59 [sshd] Failed password for illegal user admin from 210.51.173.75 port 41480 ssh2
+Oct  1 15:54:05 [sshd] Failed password for illegal user admin from 210.51.173.75 port 41738 ssh2
+Oct  1 15:54:12 [sshd] Failed password for illegal user user from 210.51.173.75 port 42036 ssh2
+Oct  1 15:54:18 [sshd] Failed password for illegal user root from 210.51.173.75 port 42393 ssh2
+Oct  1 15:54:24 [sshd] Failed password for illegal user root from 210.51.173.75 port 42721 ssh2
+Oct  1 15:54:30 [sshd] Failed password for illegal user root from 210.51.173.75 port 42984 ssh2
+Oct  1 15:54:36 [sshd] Failed password for illegal user test from 210.51.173.75 port 43299 ssh2
+Oct  2 20:24:36 [sshd] Failed password for illegal user test from 220.64.223.249 port 2460 ssh2
+Oct  2 20:24:39 [sshd] Failed password for illegal user guest from 220.64.223.249 port 2527 ssh2
+Oct  2 20:24:42 [sshd] Failed password for illegal user admin from 220.64.223.249 port 2584 ssh2
+Oct  2 20:24:45 [sshd] Failed password for illegal user admin from 220.64.223.249 port 2645 ssh2
+Oct  2 20:24:48 [sshd] Failed password for illegal user user from 220.64.223.249 port 2708 ssh2
+Oct  2 20:24:51 [sshd] Failed password for illegal user root from 220.64.223.249 port 2794 ssh2
+Oct  2 20:24:54 [sshd] Failed password for illegal user root from 220.64.223.249 port 2868 ssh2
+Oct  2 20:24:58 [sshd] Failed password for illegal user root from 220.64.223.249 port 2931 ssh2
+Oct  2 20:25:01 [sshd] Failed password for illegal user test from 220.64.223.249 port 2994 ssh2
+Oct  3 02:17:47 [sshd] Failed password for illegal user nobody from 216.65.197.170 port 54324 ssh2
+Oct  3 02:17:48 [sshd] Failed password for illegal user patrick from 216.65.197.170 port 54491 ssh2
+Oct  3 02:17:50 [sshd] Failed password for illegal user patrick from 216.65.197.170 port 54669 ssh2
+Oct  3 02:17:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 54845 ssh2
+Oct  3 02:17:53 [sshd] Failed password for illegal user root from 216.65.197.170 port 55021 ssh2
+Oct  3 02:17:55 [sshd] Failed password for illegal user root from 216.65.197.170 port 55201 ssh2
+Oct  3 02:17:57 [sshd] Failed password for illegal user root from 216.65.197.170 port 55381 ssh2
+Oct  3 02:17:59 [sshd] Failed password for illegal user root from 216.65.197.170 port 55553 ssh2
+Oct  3 02:18:00 [sshd] Failed password for illegal user rolo from 216.65.197.170 port 55730 ssh2
+Oct  3 02:18:02 [sshd] Failed password for illegal user iceuser from 216.65.197.170 port 55892 ssh2
+Oct  3 02:18:04 [sshd] Failed password for illegal user horde from 216.65.197.170 port 56054 ssh2
+Oct  3 02:18:05 [sshd] Failed password for illegal user cyrus from 216.65.197.170 port 56231 ssh2
+Oct  3 02:18:07 [sshd] Failed password for illegal user www from 216.65.197.170 port 56412 ssh2
+Oct  3 02:18:09 [sshd] Failed password for illegal user wwwrun from 216.65.197.170 port 56594 ssh2
+Oct  3 02:18:11 [sshd] Failed password for illegal user matt from 216.65.197.170 port 56755 ssh2
+Oct  3 02:18:12 [sshd] Failed password for illegal user test from 216.65.197.170 port 56928 ssh2
+Oct  3 02:18:14 [sshd] Failed password for illegal user test from 216.65.197.170 port 57112 ssh2
+Oct  3 02:18:16 [sshd] Failed password for illegal user test from 216.65.197.170 port 57292 ssh2
+Oct  3 02:18:17 [sshd] Failed password for illegal user test from 216.65.197.170 port 57465 ssh2
+Oct  3 02:18:19 [sshd] Failed password for illegal user www-data from 216.65.197.170 port 57631 ssh2
+Oct  3 02:18:21 [sshd] Failed password for illegal user mysql from 216.65.197.170 port 57802 ssh2
+Oct  3 02:18:22 [sshd] Failed password for illegal user operator from 216.65.197.170 port 57989 ssh2
+Oct  3 02:18:24 [sshd] Failed password for illegal user adm from 216.65.197.170 port 58151 ssh2
+Oct  3 02:18:26 [sshd] Failed password for illegal user apache from 216.65.197.170 port 58319 ssh2
+Oct  3 02:18:28 [sshd] Failed password for illegal user irc from 216.65.197.170 port 58492 ssh2
+Oct  3 02:18:29 [sshd] Failed password for illegal user irc from 216.65.197.170 port 58662 ssh2
+Oct  3 02:18:31 [sshd] Failed password for illegal user adm from 216.65.197.170 port 58818 ssh2
+Oct  3 02:18:33 [sshd] Failed password for illegal user root from 216.65.197.170 port 58976 ssh2
+Oct  3 02:18:34 [sshd] Failed password for illegal user root from 216.65.197.170 port 59147 ssh2
+Oct  3 02:18:36 [sshd] Failed password for illegal user root from 216.65.197.170 port 59306 ssh2
+Oct  3 02:18:38 [sshd] Failed password for illegal user jane from 216.65.197.170 port 59474 ssh2
+Oct  3 02:18:40 [sshd] Failed password for illegal user pamela from 216.65.197.170 port 59644 ssh2
+Oct  3 02:18:41 [sshd] Failed password for illegal user root from 216.65.197.170 port 59797 ssh2
+Oct  3 02:18:43 [sshd] Failed password for illegal user root from 216.65.197.170 port 59963 ssh2
+Oct  3 02:18:45 [sshd] Failed password for illegal user root from 216.65.197.170 port 60139 ssh2
+Oct  3 02:18:47 [sshd] Failed password for illegal user root from 216.65.197.170 port 60308 ssh2
+Oct  3 02:18:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 60479 ssh2
+Oct  3 02:18:50 [sshd] Failed password for illegal user cosmin from 216.65.197.170 port 60654 ssh2
+Oct  3 02:18:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 60830 ssh2
+Oct  3 02:18:54 [sshd] Failed password for illegal user root from 216.65.197.170 port 60992 ssh2
+Oct  3 02:18:55 [sshd] Failed password for illegal user root from 216.65.197.170 port 32945 ssh2
+Oct  3 02:18:58 [sshd] Failed password for illegal user root from 216.65.197.170 port 33101 ssh2
+Oct  3 02:18:59 [sshd] Failed password for illegal user root from 216.65.197.170 port 33343 ssh2
+Oct  3 02:19:02 [sshd] Failed password for illegal user root from 216.65.197.170 port 33501 ssh2
+Oct  3 02:19:03 [sshd] Failed password for illegal user root from 216.65.197.170 port 33733 ssh2
+Oct  3 02:19:05 [sshd] Failed password for illegal user root from 216.65.197.170 port 33892 ssh2
+Oct  3 02:19:07 [sshd] Failed password for illegal user root from 216.65.197.170 port 34066 ssh2
+Oct  3 02:19:08 [sshd] Failed password for illegal user root from 216.65.197.170 port 34212 ssh2
+Oct  3 02:19:10 [sshd] Failed password for illegal user root from 216.65.197.170 port 34376 ssh2
+Oct  3 02:19:12 [sshd] Failed password for illegal user root from 216.65.197.170 port 34535 ssh2
+Oct  3 02:19:14 [sshd] Failed password for illegal user root from 216.65.197.170 port 34704 ssh2
+Oct  3 02:19:16 [sshd] Failed password for illegal user root from 216.65.197.170 port 34853 ssh2
+Oct  3 02:19:18 [sshd] Failed password for illegal user root from 216.65.197.170 port 35092 ssh2
+Oct  3 02:19:19 [sshd] Failed password for illegal user root from 216.65.197.170 port 35261 ssh2
+Oct  3 02:19:21 [sshd] Failed password for illegal user root from 216.65.197.170 port 35425 ssh2
+Oct  3 02:19:23 [sshd] Failed password for illegal user root from 216.65.197.170 port 35583 ssh2
+Oct  3 02:19:24 [sshd] Failed password for illegal user root from 216.65.197.170 port 35753 ssh2
+Oct  3 02:19:26 [sshd] Failed password for illegal user root from 216.65.197.170 port 35901 ssh2
+Oct  3 02:19:28 [sshd] Failed password for illegal user root from 216.65.197.170 port 36068 ssh2
+Oct  3 02:19:30 [sshd] Failed password for illegal user root from 216.65.197.170 port 36227 ssh2
+Oct  3 02:19:33 [sshd] Failed password for illegal user root from 216.65.197.170 port 36453 ssh2
+Oct  3 02:19:34 [sshd] Failed password for illegal user root from 216.65.197.170 port 36673 ssh2
+Oct  3 02:19:36 [sshd] Failed password for illegal user root from 216.65.197.170 port 36823 ssh2
+Oct  3 02:19:38 [sshd] Failed password for illegal user root from 216.65.197.170 port 36981 ssh2
+Oct  3 02:19:39 [sshd] Failed password for illegal user root from 216.65.197.170 port 37152 ssh2
+Oct  3 02:19:41 [sshd] Failed password for illegal user root from 216.65.197.170 port 37310 ssh2
+Oct  3 02:19:43 [sshd] Failed password for illegal user root from 216.65.197.170 port 37484 ssh2
+Oct  3 02:19:45 [sshd] Failed password for illegal user root from 216.65.197.170 port 37644 ssh2
+Oct  3 02:19:46 [sshd] Failed password for illegal user root from 216.65.197.170 port 37827 ssh2
+Oct  3 02:19:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 37989 ssh2
+Oct  3 02:19:50 [sshd] Failed password for illegal user root from 216.65.197.170 port 38163 ssh2
+Oct  3 02:19:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 38329 ssh2
+Oct  3 02:19:54 [sshd] Failed password for illegal user root from 216.65.197.170 port 38559 ssh2
+Oct  3 02:19:56 [sshd] Failed password for illegal user root from 216.65.197.170 port 38735 ssh2
+Oct  3 02:19:58 [sshd] Failed password for illegal user cip52 from 216.65.197.170 port 38893 ssh2
+Oct  3 02:20:00 [sshd] Failed password for illegal user cip51 from 216.65.197.170 port 39109 ssh2
+Oct  3 02:20:01 [sshd] Failed password for illegal user root from 216.65.197.170 port 39282 ssh2
+Oct  3 02:20:03 [sshd] Failed password for illegal user noc from 216.65.197.170 port 39448 ssh2
+Oct  3 02:20:05 [sshd] Failed password for illegal user root from 216.65.197.170 port 39621 ssh2
+Oct  3 02:20:06 [sshd] Failed password for illegal user root from 216.65.197.170 port 39781 ssh2
+Oct  3 02:20:08 [sshd] Failed password for illegal user root from 216.65.197.170 port 39958 ssh2
+Oct  3 02:20:10 [sshd] Failed password for illegal user root from 216.65.197.170 port 40125 ssh2
+Oct  3 02:20:12 [sshd] Failed password for illegal user webmaster from 216.65.197.170 port 40316 ssh2
+Oct  3 02:20:13 [sshd] Failed password for illegal user data from 216.65.197.170 port 40473 ssh2
+Oct  3 02:20:15 [sshd] Failed password for illegal user user from 216.65.197.170 port 40645 ssh2
+Oct  3 02:20:17 [sshd] Failed password for illegal user user from 216.65.197.170 port 40800 ssh2
+Oct  3 02:20:19 [sshd] Failed password for illegal user user from 216.65.197.170 port 40965 ssh2
+Oct  3 02:20:20 [sshd] Failed password for illegal user web from 216.65.197.170 port 41120 ssh2
+Oct  3 02:20:22 [sshd] Failed password for illegal user web from 216.65.197.170 port 41300 ssh2
+Oct  3 02:20:24 [sshd] Failed password for illegal user oracle from 216.65.197.170 port 41468 ssh2
+Oct  3 02:20:25 [sshd] Failed password for illegal user sybase from 216.65.197.170 port 41642 ssh2
+Oct  3 02:20:27 [sshd] Failed password for illegal user master from 216.65.197.170 port 41809 ssh2
+Oct  3 02:20:29 [sshd] Failed password for illegal user account from 216.65.197.170 port 41987 ssh2
+Oct  3 02:20:31 [sshd] Failed password for illegal user backup from 216.65.197.170 port 42143 ssh2
+Oct  3 02:20:32 [sshd] Failed password for illegal user server from 216.65.197.170 port 42316 ssh2
+Oct  3 02:20:34 [sshd] Failed password for illegal user adam from 216.65.197.170 port 42481 ssh2
+Oct  3 02:20:36 [sshd] Failed password for illegal user alan from 216.65.197.170 port 42647 ssh2
+Oct  3 02:20:37 [sshd] Failed password for illegal user frank from 216.65.197.170 port 42817 ssh2
+Oct  3 02:20:39 [sshd] Failed password for illegal user george from 216.65.197.170 port 42993 ssh2
+Oct  3 02:20:41 [sshd] Failed password for illegal user henry from 216.65.197.170 port 43170 ssh2
+Oct  3 02:20:43 [sshd] Failed password for illegal user john from 216.65.197.170 port 43319 ssh2
+Oct  3 02:20:44 [sshd] Failed password for illegal user root from 216.65.197.170 port 43504 ssh2
+Oct  3 02:20:46 [sshd] Failed password for illegal user root from 216.65.197.170 port 43664 ssh2
+Oct  3 02:20:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 43844 ssh2
+Oct  3 02:20:49 [sshd] Failed password for illegal user root from 216.65.197.170 port 44008 ssh2
+Oct  3 02:20:51 [sshd] Failed password for illegal user root from 216.65.197.170 port 44182 ssh2
+Oct  3 02:20:53 [sshd] Failed password for illegal user test from 216.65.197.170 port 44338 ssh2
+Oct  3 06:37:34 [sshd] Failed password for illegal user nobody from 217.56.33.194 port 1969 ssh2
+Oct  3 06:37:36 [sshd] Failed password for illegal user patrick from 217.56.33.194 port 2002 ssh2
+Oct  3 06:37:37 [sshd] Failed password for illegal user patrick from 217.56.33.194 port 2039 ssh2
+Oct  3 06:37:38 [sshd] Failed password for illegal user root from 217.56.33.194 port 2070 ssh2
+Oct  3 06:37:40 [sshd] Failed password for illegal user root from 217.56.33.194 port 2109 ssh2
+Oct  3 06:37:41 [sshd] Failed password for illegal user root from 217.56.33.194 port 2142 ssh2
+Oct  3 06:37:42 [sshd] Failed password for illegal user root from 217.56.33.194 port 2173 ssh2
+Oct  3 06:37:44 [sshd] Failed password for illegal user root from 217.56.33.194 port 2211 ssh2
+Oct  3 06:37:45 [sshd] Failed password for illegal user rolo from 217.56.33.194 port 2244 ssh2
+Oct  3 06:37:46 [sshd] Failed password for illegal user iceuser from 217.56.33.194 port 2272 ssh2
+Oct  3 06:37:48 [sshd] Failed password for illegal user horde from 217.56.33.194 port 2305 ssh2
+Oct  3 06:37:49 [sshd] Failed password for illegal user cyrus from 217.56.33.194 port 2337 ssh2
+Oct  3 06:37:50 [sshd] Failed password for illegal user www from 217.56.33.194 port 2373 ssh2
+Oct  3 06:37:52 [sshd] Failed password for illegal user wwwrun from 217.56.33.194 port 2407 ssh2
+Oct  3 06:37:53 [sshd] Failed password for illegal user matt from 217.56.33.194 port 2439 ssh2
+Oct  3 06:37:55 [sshd] Failed password for illegal user test from 217.56.33.194 port 2466 ssh2
+Oct  3 06:37:56 [sshd] Failed password for illegal user test from 217.56.33.194 port 2501 ssh2
+Oct  3 06:37:57 [sshd] Failed password for illegal user test from 217.56.33.194 port 2533 ssh2
+Oct  3 06:37:59 [sshd] Failed password for illegal user test from 217.56.33.194 port 2567 ssh2
+Oct  3 06:38:00 [sshd] Failed password for illegal user www-data from 217.56.33.194 port 2605 ssh2
+Oct  3 06:38:01 [sshd] Failed password for illegal user mysql from 217.56.33.194 port 2635 ssh2
+Oct  3 06:38:03 [sshd] Failed password for illegal user operator from 217.56.33.194 port 2667 ssh2
+Oct  3 06:38:04 [sshd] Failed password for illegal user adm from 217.56.33.194 port 2697 ssh2
+Oct  3 06:38:05 [sshd] Failed password for illegal user apache from 217.56.33.194 port 2733 ssh2
+Oct  3 06:38:07 [sshd] Failed password for illegal user irc from 217.56.33.194 port 2768 ssh2
+Oct  3 06:38:08 [sshd] Failed password for illegal user irc from 217.56.33.194 port 2804 ssh2
+Oct  3 06:38:09 [sshd] Failed password for illegal user adm from 217.56.33.194 port 2837 ssh2
+Oct  3 06:38:11 [sshd] Failed password for illegal user root from 217.56.33.194 port 2872 ssh2
+Oct  3 06:38:13 [sshd] Failed password for illegal user root from 217.56.33.194 port 2907 ssh2
+Oct  3 06:38:14 [sshd] Failed password for illegal user root from 217.56.33.194 port 2950 ssh2
+Oct  3 06:38:16 [sshd] Failed password for illegal user jane from 217.56.33.194 port 2986 ssh2
+Oct  3 06:38:17 [sshd] Failed password for illegal user pamela from 217.56.33.194 port 3019 ssh2
+Oct  3 06:38:18 [sshd] Failed password for illegal user root from 217.56.33.194 port 3053 ssh2
+Oct  3 06:38:20 [sshd] Failed password for illegal user root from 217.56.33.194 port 3085 ssh2
+Oct  3 06:38:21 [sshd] Failed password for illegal user root from 217.56.33.194 port 3115 ssh2
+Oct  3 06:38:22 [sshd] Failed password for illegal user root from 217.56.33.194 port 3147 ssh2
+Oct  3 06:38:24 [sshd] Failed password for illegal user root from 217.56.33.194 port 3177 ssh2
+Oct  3 06:38:25 [sshd] Failed password for illegal user cosmin from 217.56.33.194 port 3208 ssh2
+Oct  3 06:38:26 [sshd] Failed password for illegal user root from 217.56.33.194 port 3239 ssh2
+Oct  3 06:38:28 [sshd] Failed password for illegal user root from 217.56.33.194 port 3272 ssh2
+Oct  3 06:38:29 [sshd] Failed password for illegal user root from 217.56.33.194 port 3302 ssh2
+Oct  3 06:38:30 [sshd] Failed password for illegal user root from 217.56.33.194 port 3336 ssh2
+Oct  3 06:38:32 [sshd] Failed password for illegal user root from 217.56.33.194 port 3367 ssh2
+Oct  3 06:38:33 [sshd] Failed password for illegal user root from 217.56.33.194 port 3403 ssh2
+Oct  3 06:38:34 [sshd] Failed password for illegal user root from 217.56.33.194 port 3432 ssh2
+Oct  3 06:38:36 [sshd] Failed password for illegal user root from 217.56.33.194 port 3458 ssh2
+Oct  3 06:38:37 [sshd] Failed password for illegal user root from 217.56.33.194 port 3494 ssh2
+Oct  3 06:38:38 [sshd] Failed password for illegal user root from 217.56.33.194 port 3525 ssh2
+Oct  3 06:38:40 [sshd] Failed password for illegal user root from 217.56.33.194 port 3554 ssh2
+Oct  3 06:38:41 [sshd] Failed password for illegal user root from 217.56.33.194 port 3590 ssh2
+Oct  3 06:38:42 [sshd] Failed password for illegal user root from 217.56.33.194 port 3623 ssh2
+Oct  3 06:38:44 [sshd] Failed password for illegal user root from 217.56.33.194 port 3654 ssh2
+Oct  3 06:38:45 [sshd] Failed password for illegal user root from 217.56.33.194 port 3690 ssh2
+Oct  3 06:38:46 [sshd] Failed password for illegal user root from 217.56.33.194 port 3720 ssh2
+Oct  3 06:38:48 [sshd] Failed password for illegal user root from 217.56.33.194 port 3752 ssh2
+Oct  3 06:38:49 [sshd] Failed password for illegal user root from 217.56.33.194 port 3785 ssh2
+Oct  3 06:38:51 [sshd] Failed password for illegal user root from 217.56.33.194 port 3817 ssh2
+Oct  3 06:38:52 [sshd] Failed password for illegal user root from 217.56.33.194 port 3853 ssh2
+Oct  3 06:38:53 [sshd] Failed password for illegal user root from 217.56.33.194 port 3886 ssh2
+Oct  3 06:38:55 [sshd] Failed password for illegal user root from 217.56.33.194 port 3923 ssh2
+Oct  3 06:38:56 [sshd] Failed password for illegal user root from 217.56.33.194 port 3955 ssh2
+Oct  3 06:38:57 [sshd] Failed password for illegal user root from 217.56.33.194 port 3983 ssh2
+Oct  3 06:38:59 [sshd] Failed password for illegal user root from 217.56.33.194 port 4016 ssh2
+Oct  3 06:39:00 [sshd] Failed password for illegal user root from 217.56.33.194 port 4045 ssh2
+Oct  3 06:39:01 [sshd] Failed password for illegal user root from 217.56.33.194 port 4073 ssh2
+Oct  3 06:39:03 [sshd] Failed password for illegal user root from 217.56.33.194 port 4110 ssh2
+Oct  3 06:39:04 [sshd] Failed password for illegal user root from 217.56.33.194 port 4140 ssh2
+Oct  3 06:39:05 [sshd] Failed password for illegal user root from 217.56.33.194 port 4171 ssh2
+Oct  3 06:39:07 [sshd] Failed password for illegal user root from 217.56.33.194 port 4201 ssh2
+Oct  3 06:39:08 [sshd] Failed password for illegal user root from 217.56.33.194 port 4235 ssh2
+Oct  3 06:39:09 [sshd] Failed password for illegal user root from 217.56.33.194 port 4267 ssh2
+Oct  3 06:39:11 [sshd] Failed password for illegal user root from 217.56.33.194 port 4300 ssh2
+Oct  3 06:39:12 [sshd] Failed password for illegal user root from 217.56.33.194 port 4326 ssh2
+Oct  3 06:39:13 [sshd] Failed password for illegal user root from 217.56.33.194 port 4358 ssh2
+Oct  3 06:39:15 [sshd] Failed password for illegal user cip52 from 217.56.33.194 port 4390 ssh2
+Oct  3 06:39:16 [sshd] Failed password for illegal user cip51 from 217.56.33.194 port 4427 ssh2
+Oct  3 06:39:18 [sshd] Failed password for illegal user root from 217.56.33.194 port 4459 ssh2
+Oct  3 06:39:19 [sshd] Failed password for illegal user noc from 217.56.33.194 port 4492 ssh2
+Oct  3 06:39:20 [sshd] Failed password for illegal user root from 217.56.33.194 port 4526 ssh2
+Oct  3 06:39:22 [sshd] Failed password for illegal user root from 217.56.33.194 port 4557 ssh2
+Oct  3 06:39:23 [sshd] Failed password for illegal user root from 217.56.33.194 port 4588 ssh2
+Oct  3 06:39:24 [sshd] Failed password for illegal user root from 217.56.33.194 port 4618 ssh2
+Oct  3 06:39:26 [sshd] Failed password for illegal user webmaster from 217.56.33.194 port 4652 ssh2
+Oct  3 06:39:27 [sshd] Failed password for illegal user data from 217.56.33.194 port 4679 ssh2
+Oct  3 06:39:28 [sshd] Failed password for illegal user user from 217.56.33.194 port 4716 ssh2
+Oct  3 06:39:30 [sshd] Failed password for illegal user user from 217.56.33.194 port 4744 ssh2
+Oct  3 06:39:31 [sshd] Failed password for illegal user user from 217.56.33.194 port 4777 ssh2
+Oct  3 06:39:32 [sshd] Failed password for illegal user web from 217.56.33.194 port 4808 ssh2
+Oct  3 06:39:34 [sshd] Failed password for illegal user web from 217.56.33.194 port 4842 ssh2
+Oct  3 06:39:35 [sshd] Failed password for illegal user oracle from 217.56.33.194 port 4869 ssh2
+Oct  3 06:39:36 [sshd] Failed password for illegal user sybase from 217.56.33.194 port 4899 ssh2
+Oct  3 06:39:38 [sshd] Failed password for illegal user master from 217.56.33.194 port 4933 ssh2
+Oct  3 06:39:39 [sshd] Failed password for illegal user account from 217.56.33.194 port 4969 ssh2
+Oct  3 06:39:40 [sshd] Failed password for illegal user backup from 217.56.33.194 port 4999 ssh2
+Oct  3 06:39:42 [sshd] Failed password for illegal user server from 217.56.33.194 port 1051 ssh2
+Oct  3 06:39:43 [sshd] Failed password for illegal user adam from 217.56.33.194 port 1082 ssh2
+Oct  3 06:39:44 [sshd] Failed password for illegal user alan from 217.56.33.194 port 1114 ssh2
+Oct  3 06:39:46 [sshd] Failed password for illegal user frank from 217.56.33.194 port 1141 ssh2
+Oct  3 06:39:47 [sshd] Failed password for illegal user george from 217.56.33.194 port 1174 ssh2
+Oct  3 06:39:49 [sshd] Failed password for illegal user henry from 217.56.33.194 port 1205 ssh2
+Oct  3 06:39:50 [sshd] Failed password for illegal user john from 217.56.33.194 port 1236 ssh2
+Oct  3 06:39:51 [sshd] Failed password for illegal user root from 217.56.33.194 port 1271 ssh2
+Oct  3 06:39:53 [sshd] Failed password for illegal user root from 217.56.33.194 port 1300 ssh2
+Oct  3 06:39:55 [sshd] Failed password for illegal user root from 217.56.33.194 port 1332 ssh2
+Oct  3 06:39:56 [sshd] Failed password for illegal user root from 217.56.33.194 port 1380 ssh2
+Oct  3 06:39:57 [sshd] Failed password for illegal user root from 217.56.33.194 port 1412 ssh2
+Oct  3 06:39:59 [sshd] Failed password for illegal user test from 217.56.33.194 port 1449 ssh2
+Oct  4 04:43:59 [sshd] Failed password for illegal user test from 212.204.226.21 port 60349 ssh2
+Oct  4 04:44:03 [sshd] Failed password for illegal user guest from 212.204.226.21 port 60394 ssh2
+Oct  4 04:44:06 [sshd] Failed password for illegal user admin from 212.204.226.21 port 60540 ssh2
+Oct  4 04:44:08 [sshd] Failed password for illegal user admin from 212.204.226.21 port 60620 ssh2
+Oct  4 04:44:11 [sshd] Failed password for illegal user user from 212.204.226.21 port 60679 ssh2
+Oct  4 04:44:14 [sshd] Failed password for illegal user root from 212.204.226.21 port 60773 ssh2
+Oct  4 04:44:15 [sshd] Failed password for illegal user root from 212.204.226.21 port 60828 ssh2
+Oct  4 04:44:18 [sshd] Failed password for illegal user root from 212.204.226.21 port 60880 ssh2
+Oct  4 04:44:21 [sshd] Failed password for illegal user test from 212.204.226.21 port 60957 ssh2
+Oct  4 09:32:21 [sshd] Failed password for illegal user test from 62.141.56.70 port 45600 ssh2
+Oct  4 09:32:27 [sshd] Failed password for illegal user guest from 62.141.56.70 port 47635 ssh2
+Oct  4 09:32:32 [sshd] Failed password for illegal user admin from 62.141.56.70 port 49967 ssh2
+Oct  4 09:32:37 [sshd] Failed password for illegal user admin from 62.141.56.70 port 52093 ssh2
+Oct  4 09:32:42 [sshd] Failed password for illegal user user from 62.141.56.70 port 53840 ssh2
+Oct  4 09:32:47 [sshd] Failed password for illegal user root from 62.141.56.70 port 55568 ssh2
+Oct  4 09:32:51 [sshd] Failed password for illegal user root from 62.141.56.70 port 57526 ssh2
+Oct  4 09:32:51 [sshd] Failed password for illegal user root from 62.141.56.70 port 58454 ssh2
+Oct  4 09:32:52 [sshd] Failed password for illegal user test from 62.141.56.70 port 58819 ssh2
+Oct  4 14:09:11 [sshd] Failed password for illegal user test from 211.234.125.100 port 46642 ssh2
+Oct  4 14:09:18 [sshd] Failed password for illegal user guest from 211.234.125.100 port 46788 ssh2
+Oct  4 14:09:23 [sshd] Failed password for illegal user admin from 211.234.125.100 port 46886 ssh2
+Oct  4 14:09:30 [sshd] Failed password for illegal user admin from 211.234.125.100 port 46960 ssh2
+Oct  4 14:09:43 [sshd] Failed password for illegal user user from 211.234.125.100 port 47025 ssh2
+Oct  6 04:13:11 [sshd] Failed password for illegal user test from 64.246.30.17 port 58277 ssh2
+Oct  6 04:13:13 [sshd] Failed password for illegal user guest from 64.246.30.17 port 58360 ssh2
+Oct  6 04:13:15 [sshd] Failed password for illegal user admin from 64.246.30.17 port 58428 ssh2
+Oct  6 04:13:17 [sshd] Failed password for illegal user admin from 64.246.30.17 port 58514 ssh2
+Oct  6 22:13:56 [sshd] Failed password for illegal user test from 61.11.98.217 port 45434 ssh2
+Oct  6 22:14:00 [sshd] Failed password for illegal user guest from 61.11.98.217 port 45586 ssh2
+Oct  6 22:14:05 [sshd] Failed password for illegal user admin from 61.11.98.217 port 45672 ssh2
+Oct  6 22:14:10 [sshd] Failed password for illegal user admin from 61.11.98.217 port 45748 ssh2
+Oct  6 22:14:18 [sshd] Failed password for illegal user user from 61.11.98.217 port 45833 ssh2
+Oct  7 00:25:34 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37086 ssh2
+Oct  7 00:25:34 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37086 ssh2
+                - Last output repeated twice -
+Oct  7 00:26:27 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37089 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:26:37 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37092 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:27:21 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37095 ssh2
+                - Last output repeated twice -
+Oct  7 00:51:31 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37130 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:51:48 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37138 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:52:02 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37141 ssh2
+Oct  7 00:56:10 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37153 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:56:41 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37156 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:57:00 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37159 ssh2
+Oct  7 00:58:17 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37162 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:58:29 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37165 ssh2
+                - Last output repeated 2 times -
+Oct  7 00:58:39 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37168 ssh2
+Oct  7 01:00:32 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37171 ssh2
+                - Last output repeated 2 times -
+Oct  7 01:00:44 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37175 ssh2
+                - Last output repeated 2 times -
+Oct  7 01:01:23 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37178 ssh2
+                - Last output repeated 2 times -
+Oct  7 01:03:01 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37181 ssh2
+                - Last output repeated 2 times -
+Oct  7 01:03:12 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37184 ssh2
+                - Last output repeated 2 times -
+Oct  7 01:03:20 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37187 ssh2
+                - Last output repeated 2 times -
+Nov 14 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
+Nov 14 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
+Nov 14 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
+Nov 15 11:12:11 yellow sshd[16069]: Failed password for cyril from 212.41.79.210 port 29404 ssh2
+Nov 15 21:54:11 yellow sshd[16069]: Illegal user for cyril from 212.41.79.210 port 29404 ssh2
diff --git a/logreader/logreader.py b/logreader/logreader.py
new file mode 100644
index 00000000..4778b3ba
--- /dev/null
+++ b/logreader/logreader.py
@@ -0,0 +1,189 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os, sys, time, re
+
+from utils.dns import *
+
+class LogReader:
+	""" Reads a log file and reports information about IP that make password
+		failure, bad user or anything else that is considered as doubtful login
+		attempt.	
+	"""
+	
+	def __init__(self, logSys, logPath, timeregex, timepattern, failregex,
+		findTime = 3600):
+		self.logPath = logPath
+		self.timeregex = timeregex
+		self.timepattern = timepattern
+		self.failregex = failregex
+		self.findTime = findTime
+		self.ignoreIpList = []
+		self.lastModTime = 0
+		self.logSys = logSys
+		self.lastPos = 0
+		self.lastDate = 0
+		self.logStats = None
+		
+	def setName(self, name):
+		""" Sets the name of the log reader.
+		"""
+		self.name = name
+		
+	def getName(self):
+		""" Gets the name of the log reader.
+		"""
+		return self.name
+	
+	def getFindTime(self):
+		""" Gets the find time.
+		"""
+		return self.findTime
+	
+	def addIgnoreIP(self, ip):
+		""" Adds an IP to the ignore list.
+		"""
+		self.logSys.debug("Add "+ip+" to ignore list")
+		self.ignoreIpList.append(ip)
+		
+	def inIgnoreIPList(self, ip):
+		""" Checks if IP is in the ignore list.
+		"""
+		return ip in self.ignoreIpList
+	
+	def openLogFile(self):
+		""" Opens the log file specified on init.
+		"""
+		try:
+			fileHandler = open(self.logPath)
+		except OSError:
+			self.logSys.error("Unable to open "+self.logPath)
+			sys.exit(-1)
+		return fileHandler
+		
+	def isModified(self):
+		""" Checks if the log file has been modified using os.stat().
+		"""
+		try:
+			self.logStats = os.stat(self.logPath)
+		except OSError:
+			self.logSys.error("Unable to get stat on "+self.logPath)
+			sys.exit(-1)
+		
+		if self.lastModTime == self.logStats.st_mtime:
+			return False
+		else:
+			self.logSys.debug(self.logPath+" has been modified")
+			self.lastModTime = self.logStats.st_mtime
+			return True
+	
+	def setFilePos(self, file):
+		""" Sets the file position. We must take care of log file rotation
+			and reset the position to 0 in that case. Use the log message
+			timestamp in order to detect this.		
+		"""
+		line = file.readline()
+		if self.lastDate < self.getTime(line):
+			self.logSys.debug("Date " + `self.lastDate` + " is " +
+							"smaller than " + `self.getTime(line)`)
+			self.logSys.debug("Log rotation detected for " + self.logPath)
+			self.lastPos = 0
+		
+		self.logSys.debug("Setting file position to " + `self.lastPos` + " for "
+						+ self.logPath)
+		file.seek(self.lastPos)
+	
+	def getFailures(self):
+		""" Gets all the failure in the log file which are
+			newer than time.time()-self.findTime.
+			
+			Returns a dict with the IP, the number of failure
+			and the latest failure time.
+		"""
+		ipList = dict()
+		self.logSys.debug(self.logPath)
+		logFile = self.openLogFile()
+		self.setFilePos(logFile)
+		lastLine = ''
+		for line in logFile.readlines():
+			lastLine = line
+			failList = self.findFailure(line)
+			for element in failList:
+				ip = element[0]
+				unixTime = element[1]
+				if unixTime < time.time()-self.findTime:
+					break
+				if self.inIgnoreIPList(ip):
+					self.logSys.debug("Ignore "+ip)
+					continue
+				self.logSys.debug("Found "+ip)
+				if ipList.has_key(ip):
+					ipList[ip] = (ipList[ip][0]+1, unixTime)
+				else:
+					ipList[ip] = (1, unixTime)
+		self.lastPos = logFile.tell()
+		self.lastDate = self.getTime(lastLine)
+		logFile.close()
+		return ipList
+
+	def findFailure(self, line):
+		""" Finds the failure in line. Uses the failregex pattern
+			to find it and timeregex in order to find the logging
+			time.
+			
+			Returns a dict with IP and timestamp.
+		"""
+		failList = list()
+		match = re.search(self.failregex, line)
+		if match:
+			timeMatch = re.search(self.timeregex, match.string)
+			if timeMatch:
+				date = self.getUnixTime(timeMatch.group())
+				ipMatch = textToIp(match.string)
+				if ipMatch:
+					for ip in ipMatch:
+						failList.append([ip, date])
+		return failList
+	
+	def getTime(self, line):
+		""" Gets the time of a log message.
+		"""
+		date = 0
+		timeMatch = re.search(self.timeregex, line)
+		if timeMatch:
+			date = self.getUnixTime(timeMatch.group())
+		return date
+		
+	def getUnixTime(self, value):
+		""" Returns the Unix timestamp of the given value.
+			Pattern should describe the date construction of
+			value.
+		"""
+		date = list(time.strptime(value, self.timepattern))
+		if date[0] < 2000:
+			date[0] = time.gmtime()[0]
+		unixTime = time.mktime(date)
+		return unixTime
diff --git a/setup.cfg b/setup.cfg
new file mode 100644
index 00000000..fba97f88
--- /dev/null
+++ b/setup.cfg
@@ -0,0 +1,5 @@
+[install]
+install-purelib=/usr/lib/fail2ban
+
+[sdist]
+formats=bztar
diff --git a/setup.py b/setup.py
new file mode 100755
index 00000000..eee601bc
--- /dev/null
+++ b/setup.py
@@ -0,0 +1,42 @@
+#!/usr/bin/env python
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from distutils.core import setup
+from version import version
+
+setup(
+        name = "fail2ban",
+        version = version,
+        description = "Ban IPs that make too many password failure",
+        author = "Cyril Jaquier",
+        author_email = "lostcontrol@users.sourceforge.net",
+        url = "http://www.sourceforge.net/projects/fail2ban",
+        scripts = ['fail2ban.py'],
+        py_modules = ['version'],
+        packages = ['firewall', 'logreader', 'confreader', 'utils']
+)
diff --git a/utils/__init__.py b/utils/__init__.py
new file mode 100644
index 00000000..76dba873
--- /dev/null
+++ b/utils/__init__.py
@@ -0,0 +1,25 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
\ No newline at end of file
diff --git a/utils/dns.py b/utils/dns.py
new file mode 100644
index 00000000..ce629d69
--- /dev/null
+++ b/utils/dns.py
@@ -0,0 +1,73 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os, re, socket
+
+def dnsToIp(dns):
+	""" Convert a DNS into an IP address using the Python socket module.
+		Thanks to Kevin Drapel.
+	"""
+	try:
+		return socket.gethostbyname_ex(dns)[2]
+	except socket.gaierror:
+		return list()
+
+def textToDns(text):
+	""" Search for possible DNS in an arbitrary text.
+		Thanks to Tom Pike.
+	"""
+	match = re.findall("(?:(?:\w|-)+\.){2,}\w+", text)
+	if match:
+		return match
+	else:
+		return []
+
+def searchIP(text):
+	""" Search if an IP address if directly available and return
+		it.
+	"""
+	match = re.findall("(?:\d{1,3}\.){3}\d{1,3}", text)
+	if match:
+		return match
+	else:
+		return []
+
+def textToIp(text):
+	""" Return the IP of DNS found in a given text.
+	"""
+	ipList = list()
+	# Search for plain IP
+	plainIP = searchIP(text)
+	for element in plainIP:
+		ipList.append(element)
+	if not ipList:
+		# Try to get IP from possible DNS
+		dnsList = textToDns(text)
+		for element in dnsList:
+			dns = dnsToIp(element)
+			for e in dns:
+				ipList.append(e)
+	return ipList
diff --git a/version.py b/version.py
new file mode 100644
index 00000000..3d2fe563
--- /dev/null
+++ b/version.py
@@ -0,0 +1,27 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+version = "0.4.1"

From 07d127bebd604d0c1bd9574b0b0a31146727c74d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 1 Jul 2005 09:30:52 +0000
Subject: [PATCH 104/549] - Added an initd script for RedHat/Fedora. Thanks to
 Andrey G. Grozin

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@113 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG           |  7 +++-
 config/redhat-initd | 78 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 84 insertions(+), 1 deletion(-)
 create mode 100644 config/redhat-initd

diff --git a/CHANGELOG b/CHANGELOG
index 6cbe1675..a05b6cbd 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,14 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.4.1)                           06/30/2005
+Fail2Ban (version 0.?.?)                           ??/??/2005
 =============================================================
 
+ver. 0.?.? (??/??/2005) - ???
+----------
+- Added an initd script for RedHat/Fedora. Thanks to Andrey
+  G. Grozin
+
 ver. 0.4.1 (06/30/2005) - stable
 ----------
 - Fixed textToDNS method which generated wrong matches for
diff --git a/config/redhat-initd b/config/redhat-initd
new file mode 100644
index 00000000..27369962
--- /dev/null
+++ b/config/redhat-initd
@@ -0,0 +1,78 @@
+#!/bin/bash
+#
+# fail2ban
+#
+# chkconfig: 345 91 9
+# description: if many unsuccessfull login attempts from some ip address \
+#              during a short period happen, this address is banned \
+#              by the firewall
+#
+# Author: Andrey G. Grozin
+# 
+# $Revision$
+
+# Source function library.
+. /etc/init.d/functions
+
+# Get config.
+. /etc/sysconfig/network
+
+# Check that networking is up.
+[ "${NETWORKING}" = "no" ] && exit 0
+[ -f /etc/fail2ban.conf ] || exit 0
+
+FAIL2BAN="/usr/bin/fail2ban.py"
+PIDFILE="/var/run/fail2ban.pid"
+
+RETVAL=0
+
+start() {
+    echo -n $"Starting fail2ban: "
+    "${FAIL2BAN}" -b
+    RETVAL=$?
+    echo
+}
+
+stop() {
+    if [ -f "${PIDFILE}" ]; then
+	echo -n $"Stopping fail2ban: "
+	"${FAIL2BAN}" -k
+	echo
+    fi
+}
+
+restart() {
+    stop
+    start
+}
+
+# See how we were called.
+case "$1" in
+  start)
+        start
+        ;;
+  stop)
+        stop
+        ;;
+  status)
+        status fail2ban.py
+        RETVAL=$?
+        ;;
+  reload)
+        restart
+        ;;
+  restart)
+        restart
+        ;;
+  condrestart)
+        if [ -f "${PIDFILE}" ]; then
+            restart
+        fi
+        ;;
+  *)
+        echo $"Usage: $0 {start|stop|status|restart|condrestart}"
+        exit 1
+        ;;
+esac
+
+exit $RETVAL

From 685f4aad997ec75ceed31d43df66d36ebb79c311 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 5 Jul 2005 12:57:20 +0000
Subject: [PATCH 105/549] - Initial 0.5 commit

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@115 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                    |   2 +
 MANIFEST                     |   5 +-
 README                       |   3 +-
 config/fail2ban.conf.default |  40 ++++++-
 confreader/configreader.py   |  14 ++-
 fail2ban.py                  | 224 ++++++++---------------------------
 firewall/firewall.py         |  40 +++++--
 firewall/ipfw.py             |  72 -----------
 firewall/ipfwadm.py          |  48 --------
 firewall/iptables.py         |  48 --------
 log-test/apache              |  10 +-
 log-test/current             |   6 +
 logreader/logreader.py       |  44 +++----
 version.py                   |   2 +-
 14 files changed, 165 insertions(+), 393 deletions(-)
 delete mode 100644 firewall/ipfw.py
 delete mode 100644 firewall/ipfwadm.py
 delete mode 100644 firewall/iptables.py

diff --git a/CHANGELOG b/CHANGELOG
index a05b6cbd..7969fd7a 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,6 +9,8 @@ Fail2Ban (version 0.?.?)                           ??/??/2005
 
 ver. 0.?.? (??/??/2005) - ???
 ----------
+- Added firewall rules definition in the configuration file
+- Cleaned a bit fail2ban.py
 - Added an initd script for RedHat/Fedora. Thanks to Andrey
   G. Grozin
 
diff --git a/MANIFEST b/MANIFEST
index 330728f8..3da375cc 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -7,15 +7,14 @@ version.py
 fail2ban.py
 firewall/__init__.py
 firewall/firewall.py
-firewall/iptables.py
-firewall/ipfw.py
-firewall/ipfwadm.py
 logreader/__init__.py
 logreader/logreader.py
 confreader/__init__.py
 confreader/configreader.py
 utils/__init__.py
 utils/dns.py
+utils/process.py
 config/fail2ban.conf.default
 config/gentoo-initd
 config/gentoo-confd
+config/redhat-initd
diff --git a/README b/README
index 7882c60d..b88f1731 100644
--- a/README
+++ b/README
@@ -121,8 +121,7 @@ Thanks:
 -------
 
 Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
-Tom Pike, Iain Lea
-
+Tom Pike, Iain Lea, Andrey G. Grozin
 
 License:
 --------
diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 0e547bb4..cf00c4aa 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -87,7 +87,25 @@ enabled = false
 # Notes.:  logfile to monitor.
 # Values:  FILE  Default:  /var/log/httpd/access_log
 #
-logfile = /var/log/httpd/access_log
+logfile = /home/cyril/workspace/fail2ban/log-test/apache
+
+# Option:  fwbanrule
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+#          <if>  interface name
+#          <ip>  IP address
+# Values:  CMD
+# Default  iptables -I INPUT 1 -i <if> -s <ip> -j DROP
+fwbanrule = iptables -I INPUT 1 -i <if> -s <ip> -j DROP
+
+# Option:  fwunbanrule
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+#          <if>  interface name
+#          <ip>  IP address
+# Values:  CMD
+# Default  iptables -D INPUT -i <if> -s <ip> -j DROP
+fwunbanrule = iptables -D INPUT -i <if> -s <ip> -j DROP
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in Apache logfile.
@@ -120,7 +138,25 @@ enabled = true
 # Notes.:  logfile to monitor.
 # Values:  FILE  Default:  /var/log/secure
 #
-logfile = /var/log/secure
+logfile = /home/cyril/workspace/fail2ban/log-test/test
+
+# Option:  fwbanrule
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+#          <if>  interface name
+#          <ip>  IP address
+# Values:  CMD
+# Default  iptables -I INPUT 1 -i <if> -s <ip> -j DROP
+fwbanrule = iptables -I INPUT 1 -i <if> -s <ip> -j DROP
+
+# Option:  fwunbanrule
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+#          <if>  interface name
+#          <ip>  IP address
+# Values:  CMD
+# Default  iptables -D INPUT -i <if> -s <ip> -j DROP
+fwunbanrule = iptables -D INPUT -i <if> -s <ip> -j DROP
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in SSH logfile.
diff --git a/confreader/configreader.py b/confreader/configreader.py
index c3eb271b..9c64a0aa 100644
--- a/confreader/configreader.py
+++ b/confreader/configreader.py
@@ -24,8 +24,13 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
+import log4py
+
 from ConfigParser import *
 
+# Gets the instance of log4py.
+logSys = log4py.Logger().get_instance()
+
 class ConfigReader:
 	""" This class allow the handling of the configuration options.
 		The DEFAULT section contains the global information about
@@ -40,12 +45,13 @@ class ConfigReader:
 					["str", "logfile", "/dev/null"],
 					["str", "timeregex", ""],
 					["str", "timepattern", ""],
-					["str", "failregex", ""])
+					["str", "failregex", ""],
+					["str", "fwbanrule", ""],
+					["str", "fwunbanrule", ""])
 	
-	def __init__(self, logSys, confPath):
+	def __init__(self, confPath):
 		self.confPath = confPath
 		self.configParser = SafeConfigParser()
-		self.logSys = logSys
 		
 	def openConf(self):
 		""" Opens the configuration file.
@@ -74,7 +80,7 @@ class ConfigReader:
 				
 				values[option[1]] = v
 			except NoOptionError:
-				self.logSys.warn("No '"+option[1]+"' defined in '"+sec+"'")
+				logSys.warn("No '" + option[1] + "' defined in '" + sec + "'")
 				values[option[1]] = option[2]
 		return values
 		
\ No newline at end of file
diff --git a/fail2ban.py b/fail2ban.py
index 5fdfe698..301975b5 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -26,7 +26,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, sys, getopt, os, signal, string
+import time, sys, getopt, os, string, signal
 from ConfigParser import *
 
 # Checks if log4py is present.
@@ -39,13 +39,15 @@ except:
 # Appends our own modules path
 sys.path.append('/usr/lib/fail2ban')
 
-from firewall.iptables import Iptables
-from firewall.ipfw import Ipfw
-from firewall.ipfwadm import Ipfwadm
+from firewall.firewall import Firewall
 from logreader.logreader import LogReader
 from confreader.configreader import ConfigReader
+from utils.process import *
 from version import version
 
+# Gets the instance of log4py.
+logSys = log4py.Logger().get_instance()
+
 def usage():
 	print "Usage: fail2ban.py [OPTIONS]"
 	print
@@ -79,141 +81,26 @@ def checkForRoot():
 	else:
 		return False
 
-def createDaemon():
-	"""Detach a process from the controlling terminal and run it in the
-	background as a daemon.
-	
-	http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
-	"""
-
-	try:
-		# Fork a child process so the parent can exit.  This will return control
-		# to the command line or shell.  This is required so that the new process
-		# is guaranteed not to be a process group leader.  We have this guarantee
-		# because the process GID of the parent is inherited by the child, but
-		# the child gets a new PID, making it impossible for its PID to equal its
-		# PGID.
-		pid = os.fork()
-	except OSError, e:
-		return((e.errno, e.strerror))	 # ERROR (return a tuple)
-
-	if (pid == 0):	   # The first child.
-
-		# Next we call os.setsid() to become the session leader of this new
-		# session.  The process also becomes the process group leader of the
-		# new process group.  Since a controlling terminal is associated with a
-		# session, and this new session has not yet acquired a controlling
-		# terminal our process now has no controlling terminal.  This shouldn't
-		# fail, since we're guaranteed that the child is not a process group
-		# leader.
-		os.setsid()
-	
-		# When the first child terminates, all processes in the second child
-		# are sent a SIGHUP, so it's ignored.
-		signal.signal(signal.SIGHUP, signal.SIG_IGN)
-	
-		try:
-			# Fork a second child to prevent zombies.  Since the first child is
-			# a session leader without a controlling terminal, it's possible for
-			# it to acquire one by opening a terminal in the future.  This second
-			# fork guarantees that the child is no longer a session leader, thus
-			# preventing the daemon from ever acquiring a controlling terminal.
-			pid = os.fork()		# Fork a second child.
-		except OSError, e:
-			return((e.errno, e.strerror))  # ERROR (return a tuple)
-	
-		if (pid == 0):	  # The second child.
-			# Ensure that the daemon doesn't keep any directory in use.  Failure
-			# to do this could make a filesystem unmountable.
-			os.chdir("/")
-			# Give the child complete control over permissions.
-			os.umask(0)
-		else:
-			os._exit(0)	  # Exit parent (the first child) of the second child.
-	else:
-		os._exit(0)		 # Exit parent of the first child.
-
-	# Close all open files.  Try the system configuration variable, SC_OPEN_MAX,
-	# for the maximum number of open files to close.  If it doesn't exist, use
-	# the default value (configurable).
-	try:
-		maxfd = os.sysconf("SC_OPEN_MAX")
-	except (AttributeError, ValueError):
-		maxfd = 256	   # default maximum
-
-	for fd in range(0, maxfd):
-		try:
-			os.close(fd)
-		except OSError:   # ERROR (ignore)
-			pass
-
-	# Redirect the standard file descriptors to /dev/null.
-   	os.open("/dev/null", os.O_RDONLY)	# standard input (0)
-	os.open("/dev/null", os.O_RDWR)		# standard output (1)
-	os.open("/dev/null", os.O_RDWR)		# standard error (2)
-
-	return True
-
 def sigTERMhandler(signum, frame):
 	""" Handles the TERM signal when in daemon mode in order to
 		exit properly.
 	"""
 	logSys.debug("Signal handler called with sig "+`signum`)
-	killApp()
+	killApp()	
 
 def killApp():
 	""" Flush the ban list, remove the PID lock file and exit
 		nicely.
 	"""
 	logSys.warn("Restoring firewall rules...")
-	fireWall.flushBanList(conf["debug"])
+	for element in logFwList:
+		element[2].flushBanList(conf["debug"])
 	removePID(conf["pidlock"])
 	logSys.info("Exiting...")
 	sys.exit(0)
-	
-def checkForPID(lockfile):
-	""" Checks for running Fail2Ban.
-	
-		Returns the current PID if Fail2Ban is running or False
-		if no instance found.
-	"""
-	try:
-		fileHandler = open(lockfile)
-		pid = fileHandler.readline()
-		return pid
-	except IOError:
-		return False
-		
-def createPID(lockfile):
-	""" Creates a PID lock file with the current PID.
-	"""
-	fileHandler = open(lockfile, mode='w')
-	pid = os.getpid()
-	fileHandler.write(`pid`+'\n')
-	fileHandler.close()
-	logSys.debug("Created PID lock ("+`pid`+") in "+lockfile)
-		
-def removePID(lockfile):
-	""" Remove PID lock.
-	"""
-	os.remove(lockfile)
-	logSys.debug("Removed PID lock "+lockfile)
-
-def killPID(pid):
-	""" Kills the process with the given PID using the
-		INT signal (same effect as <ctrl>+<c>).
-	"""
-	try:
-		return os.kill(pid, 2)
-	except OSError:
-		logSys.error("Can not kill process " + `pid` + ". Please check that " +
-					"Fail2Ban is not running and remove the file " +
-					"'/tmp/fail2ban.pid'")
 
 if __name__ == "__main__":
 	
-	# Gets an instance of log4py.
-	logSys = log4py.Logger().get_instance()
 	logSys.set_formatstring("%T %L %M")
 	
 	conf = dict()
@@ -453,38 +340,32 @@ if __name__ == "__main__":
 	
 	# Reads the config file and create a LogReader instance for
 	# each log file to check.
-	confReader = ConfigReader(logSys, conf["conffile"]);
+	confReader = ConfigReader(conf["conffile"]);
 	confReader.openConf()
-	logList = list()
+	logFwList = list()
 	for t in confReader.getSections():
 		l = confReader.getLogOptions(t)
 		if l["enabled"]:
-			lObj = LogReader(logSys, l["logfile"], l["timeregex"],
-							l["timepattern"], l["failregex"], conf["bantime"])
-			lObj.setName(t)
-			logList.append(lObj)
-	
-	# Creates one instance of Iptables (thanks to Pyhton dynamic
-	# features).
-	fireWallObj = eval(fireWallName)
-	fireWall = fireWallObj(conf["bantime"], logSys, conf["interface"])
-	
-	# IPFW needs rules number. The configuration option "ipfw-start-rule"
-	# defines the first rule number used by Fail2Ban.
-	if fireWallName == "Ipfw":
-		fireWall.setCrtRuleNbr(conf["ipfw-start-rule"])
+			# Creates a logreader object
+			lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
+								l["failregex"], conf["bantime"])
+			# Creates a firewall object
+			fObj = Firewall(l["fwbanrule"], l["fwunbanrule"], conf["bantime"],
+							conf["interface"])
+			# Links them into a list. I'm not really happy
+			# with this :/
+			logFwList.append([t, lObj, fObj, dict()])
 	
 	# We add 127.0.0.1 to the ignore list has we do not want
 	# to be ban ourself.
-	for element in logList:
-		element.addIgnoreIP("127.0.0.1")
+	for element in logFwList:
+		element[1].addIgnoreIP("127.0.0.1")
 	while len(ignoreIPList) > 0:
 		ip = ignoreIPList.pop()
-		for element in logList:
-			element.addIgnoreIP(ip)
+		for element in logFwList:
+			element[1].addIgnoreIP(ip)
 	
 	logSys.info("Fail2Ban v"+version+" is running")
-	failListFull = dict()
 	# Main loop
 	while True:
 		try:
@@ -493,14 +374,15 @@ if __name__ == "__main__":
 			
 			# Checks if some IP have to be remove from ban
 			# list.
-			fireWall.checkForUnBan(conf["debug"])
-			
+			for element in logFwList:
+				element[2].checkForUnBan(conf["debug"])
+
 			# If the log file has not been modified since the
 			# last time, we sleep for 1 second. This is active
 			# polling so not very effective.
 			modList = list()
-			for element in logList:
-				if element.isModified():
+			for element in logFwList:
+				if element[1].isModified():
 					modList.append(element)
 			
 			if len(modList) == 0:
@@ -509,42 +391,32 @@ if __name__ == "__main__":
 			
 			# Gets the failure list from the log file. For a given IP,
 			# takes only the service which has the most password failures.
-			failList = dict()
 			for element in modList:
-				e = element.getFailures()
+				e = element[1].getFailures()
 				for key in e.iterkeys():
-					if failList.has_key(key):
-						if failList[key][0] < e[key][0]:
-							failList[key] = (e[key][0], e[key][1], element)
+					if element[3].has_key(key):
+						element[3][key] = (element[3][key][0] + e[key][0],
+											e[key][1])
 					else:
-						failList[key] = (e[key][0], e[key][1], element)
-				
-			# Add the last log failures to the global failure list.
-			for key in failList.iterkeys():
-				if failListFull.has_key(key):
-					failListFull[key] = (failListFull[key][0] + 1,
-										failList[key][1], failList[key][2])
-				else:
-					failListFull[key] = failList[key]
+						element[3][key] = (e[key][0], e[key][1])
 			
 			# Remove the oldest failure attempts from the global list.
-			unixTime = time.time()
-			failListFullTemp = failListFull.copy()
-			for key in failListFullTemp.iterkeys():
-				failTime = failListFullTemp[key][2].getFindTime()
-				if failListFullTemp[key][1] < unixTime - failTime:
-					del failListFull[key]
-			
 			# We iterate the failure list and ban IP that make
 			# *retryAllowed* login failures.
-			failListFullTemp = failListFull.copy()
-			for key in failListFullTemp.iterkeys():
-				element = failListFullTemp[key]
-				if element[0] >= conf["maxretry"]:
-					logSys.info(element[2].getName()+": "+key+" has "+
-								`element[0]`+" login failure(s). Banned.")
-					fireWall.addBanIP(key, conf["debug"])
-					del failListFull[key]
+			unixTime = time.time()
+			for element in logFwList:
+				fails = element[3].copy()
+				findTime = element[1].getFindTime()
+				for attempt in fails:
+					failTime = fails[attempt][1]
+					if failTime < unixTime - failTime:
+						del element[3][attempt]
+					elif fails[attempt][0] >= conf["maxretry"]:
+						logSys.info(element[0] + ": " + attempt + " has " +
+									`element[3][attempt][0]` +
+									" login failure(s). Banned.")
+						element[2].addBanIP(attempt, conf["debug"])
+						del element[3][attempt]
 			
 		except KeyboardInterrupt:
 			# When the user press <ctrl>+<c> we exit nicely.
diff --git a/firewall/firewall.py b/firewall/firewall.py
index a62a85ff..38351863 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -24,7 +24,10 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, os
+import time, os, log4py, re
+
+# Gets the instance of log4py.
+logSys = log4py.Logger().get_instance()
 
 class Firewall:
 	""" Manages the ban list and executes the command that ban
@@ -33,30 +36,31 @@ class Firewall:
 	
 	banList = dict()
 	
-	def __init__(self, banTime, logSys, interface):
+	def __init__(self, banRule, unBanRule, banTime, interface):
+		self.banRule = banRule
+		self.unBanRule = unBanRule
 		self.banTime = banTime
-		self.logSys = logSys
 		self.interface = interface
 	
 	def addBanIP(self, ip, debug):
 		""" Bans an IP.
 		"""
 		if not self.inBanList(ip):
-			self.logSys.warn("Ban "+ip)
+			logSys.warn("Ban "+ip)
 			self.banList[ip] = time.time()
 			self.__executeCmd(self.banIP(ip), debug)
 		else:
-			self.logSys.error(ip+" already in ban list")
+			logSys.error(ip+" already in ban list")
 	
 	def delBanIP(self, ip, debug):
 		""" Unban an IP.
 		"""
 		if self.inBanList(ip):
-			self.logSys.warn("Unban "+ip)
+			logSys.warn("Unban "+ip)
 			del self.banList[ip]
 			self.__executeCmd(self.unBanIP(ip), debug)
 		else:
-			self.logSys.error(ip+" not in ban list")
+			logSys.error(ip+" not in ban list")
 	
 	def inBanList(self, ip):
 		""" Checks if IP is in ban list.
@@ -85,12 +89,30 @@ class Firewall:
 	def __executeCmd(self, cmd, debug):
 		""" Executes an OS command.
 		"""
-		self.logSys.debug(cmd)
+		logSys.debug(cmd)
 		if not debug:
 			return os.system(cmd)
 		else:
 			return None
-		
+			
+	def banIP(self, ip):
+		""" Returns query to ban IP.
+		"""
+		query = self.replaceTag(self.banRule, ip, self.interface)
+		return query
+	
+	def unBanIP(self, ip):
+		""" Returns query to unban IP.
+		"""
+		query = self.replaceTag(self.unBanRule, ip, self.interface)
+		return query
+	
+	def replaceTag(self, query, ip, interface):
+		string = query
+		string = string.replace("<ip>", ip)
+		string = string.replace("<if>", interface)
+		return string
+	
 	def viewBanList(self):
 		""" Prints the ban list on screen. Usefull for debugging.
 		"""
diff --git a/firewall/ipfw.py b/firewall/ipfw.py
deleted file mode 100644
index 41fbc29b..00000000
--- a/firewall/ipfw.py
+++ /dev/null
@@ -1,72 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import os
-
-from firewall import Firewall
-
-class Ipfw(Firewall):
-	""" This class contains specific methods and variables for the
-		iptables firewall. Must implements the 'abstracts' methods
-		banIP(ip) and unBanIP(ip).
-		
-		Must adds abstract methods definition:
-		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
-	"""
-	
-	crtRuleNbr = 0
-	
-	def getCrtRuleNbr(self):
-		""" Gets the current rule number.
-		"""
-		return self.crtRuleNbr
-		
-	def setCrtRuleNbr(self, value):
-		""" Sets the current rule number.
-		"""
-		self.crtRuleNbr = value
-	
-	def banIP(self, ip):
-		""" Returns query to ban IP.
-		"""
-		query = "ipfw -q add "+`self.crtRuleNbr`+" deny ip from "+ip+" to any"
-		self.crtRuleNbr = self.crtRuleNbr + 1
-		return query
-	
-	def unBanIP(self, ip):
-		""" Returns query to unban IP.
-		"""
-		ruleNbr = str(self.__findRuleNumber(ip))
-		query = "ipfw -q delete "+ruleNbr
-		return query
-		
-	def __findRuleNumber(self, ip):
-		""" Uses shell commands in order to find the rule
-			number we want to delete.
-		"""
-		output = os.popen("ipfw list|grep \"from "+ip+" to\"|awk '{print $1}'",
-						  "r");
-		return output.read()
diff --git a/firewall/ipfwadm.py b/firewall/ipfwadm.py
deleted file mode 100644
index cfdccbd8..00000000
--- a/firewall/ipfwadm.py
+++ /dev/null
@@ -1,48 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-from firewall import Firewall
-
-class Ipfwadm(Firewall):
-	""" This class contains specific methods and variables for the
-		iptables firewall. Must implements the 'abstracts' methods
-		banIP(ip) and unBanIP(ip).
-		
-		Must adds abstract methods definition:
-		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
-	"""
-	
-	def banIP(self, ip):
-		""" Returns query to ban IP.
-		"""
-		query = "ipfwadm -I -a deny -W "+self.interface+" -S "+ip
-		return query
-	
-	def unBanIP(self, ip):
-		""" Returns query to unban IP.
-		"""
-		query = "ipfwadm -I -d deny -W "+self.interface+" -S "+ip
-		return query
diff --git a/firewall/iptables.py b/firewall/iptables.py
deleted file mode 100644
index 7b78c69c..00000000
--- a/firewall/iptables.py
+++ /dev/null
@@ -1,48 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-from firewall import Firewall
-
-class Iptables(Firewall):
-	""" This class contains specific methods and variables for the
-		iptables firewall. Must implements the 'abstracts' methods
-		banIP(ip) and unBanIP(ip).
-		
-		Must adds abstract methods definition:
-		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
-	"""
-	
-	def banIP(self, ip):
-		""" Returns query to ban IP.
-		"""
-		query = "iptables -I INPUT 1 -i "+self.interface+" -s "+ip+" -j DROP"
-		return query
-	
-	def unBanIP(self, ip):
-		""" Returns query to unban IP.
-		"""
-		query = "iptables -D INPUT -i "+self.interface+" -s "+ip+" -j DROP"
-		return query
diff --git a/log-test/apache b/log-test/apache
index 35248fd2..227f8df9 100644
--- a/log-test/apache
+++ b/log-test/apache
@@ -1,3 +1,4 @@
+[Wed Mar 31 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
 [Mon Jan 03 05:02:15 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
 [Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
 [Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
@@ -98,5 +99,10 @@
 [Wed Jan 05 15:14:24 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
 [Wed Jan 05 15:14:29 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
 [Wed Jan 05 15:14:34 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Mar 05 15:08:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 05 15:09:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
\ No newline at end of file
+[Wed Mar 10 15:08:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 10 15:09:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 10 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
\ No newline at end of file
diff --git a/log-test/current b/log-test/current
index d4b9f00a..18258689 100644
--- a/log-test/current
+++ b/log-test/current
@@ -3,3 +3,9 @@ Jan  7 17:53:26 [sshd] (pam_unix) authentication failure; logname= uid=0 euid=0
 Mar  7 17:53:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
 Mar  7 17:55:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
 Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from www.google.ch
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from www.google.ch
diff --git a/logreader/logreader.py b/logreader/logreader.py
index 4778b3ba..79f5e7db 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -24,18 +24,21 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import os, sys, time, re
+import os, sys, time, re, log4py
 
 from utils.dns import *
 
+# Gets the instance of log4py.
+logSys = log4py.Logger().get_instance()
+
 class LogReader:
 	""" Reads a log file and reports information about IP that make password
 		failure, bad user or anything else that is considered as doubtful login
 		attempt.	
 	"""
 	
-	def __init__(self, logSys, logPath, timeregex, timepattern, failregex,
-		findTime = 3600):
+	def __init__(self, logPath, timeregex, timepattern, failregex,
+				  findTime = 3600):
 		self.logPath = logPath
 		self.timeregex = timeregex
 		self.timepattern = timepattern
@@ -43,20 +46,9 @@ class LogReader:
 		self.findTime = findTime
 		self.ignoreIpList = []
 		self.lastModTime = 0
-		self.logSys = logSys
 		self.lastPos = 0
 		self.lastDate = 0
 		self.logStats = None
-		
-	def setName(self, name):
-		""" Sets the name of the log reader.
-		"""
-		self.name = name
-		
-	def getName(self):
-		""" Gets the name of the log reader.
-		"""
-		return self.name
 	
 	def getFindTime(self):
 		""" Gets the find time.
@@ -66,7 +58,7 @@ class LogReader:
 	def addIgnoreIP(self, ip):
 		""" Adds an IP to the ignore list.
 		"""
-		self.logSys.debug("Add "+ip+" to ignore list")
+		logSys.debug("Add "+ip+" to ignore list")
 		self.ignoreIpList.append(ip)
 		
 	def inIgnoreIPList(self, ip):
@@ -80,7 +72,7 @@ class LogReader:
 		try:
 			fileHandler = open(self.logPath)
 		except OSError:
-			self.logSys.error("Unable to open "+self.logPath)
+			logSys.error("Unable to open "+self.logPath)
 			sys.exit(-1)
 		return fileHandler
 		
@@ -90,13 +82,13 @@ class LogReader:
 		try:
 			self.logStats = os.stat(self.logPath)
 		except OSError:
-			self.logSys.error("Unable to get stat on "+self.logPath)
+			logSys.error("Unable to get stat on "+self.logPath)
 			sys.exit(-1)
 		
 		if self.lastModTime == self.logStats.st_mtime:
 			return False
 		else:
-			self.logSys.debug(self.logPath+" has been modified")
+			logSys.debug(self.logPath+" has been modified")
 			self.lastModTime = self.logStats.st_mtime
 			return True
 	
@@ -107,13 +99,13 @@ class LogReader:
 		"""
 		line = file.readline()
 		if self.lastDate < self.getTime(line):
-			self.logSys.debug("Date " + `self.lastDate` + " is " +
-							"smaller than " + `self.getTime(line)`)
-			self.logSys.debug("Log rotation detected for " + self.logPath)
+			logSys.debug("Date " + `self.lastDate` + " is " + "smaller than " +
+							`self.getTime(line)`)
+			logSys.debug("Log rotation detected for " + self.logPath)
 			self.lastPos = 0
 		
-		self.logSys.debug("Setting file position to " + `self.lastPos` + " for "
-						+ self.logPath)
+		logSys.debug("Setting file position to " + `self.lastPos` + " for " +
+						self.logPath)
 		file.seek(self.lastPos)
 	
 	def getFailures(self):
@@ -124,7 +116,7 @@ class LogReader:
 			and the latest failure time.
 		"""
 		ipList = dict()
-		self.logSys.debug(self.logPath)
+		logSys.debug(self.logPath)
 		logFile = self.openLogFile()
 		self.setFilePos(logFile)
 		lastLine = ''
@@ -137,9 +129,9 @@ class LogReader:
 				if unixTime < time.time()-self.findTime:
 					break
 				if self.inIgnoreIPList(ip):
-					self.logSys.debug("Ignore "+ip)
+					logSys.debug("Ignore "+ip)
 					continue
-				self.logSys.debug("Found "+ip)
+				logSys.debug("Found "+ip)
 				if ipList.has_key(ip):
 					ipList[ip] = (ipList[ip][0]+1, unixTime)
 				else:
diff --git a/version.py b/version.py
index 3d2fe563..8f21d385 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.4.1"
+version = "0.5.0-CVS"

From 992a3f7d31a2cc291e8b666a0125b0a258a4f4a0 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Jul 2005 16:50:20 +0000
Subject: [PATCH 106/549] - Added start and end command options

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@116 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 68 +++++++++++++++++++++++++-----------
 1 file changed, 47 insertions(+), 21 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index cf00c4aa..c7a014d4 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -60,11 +60,17 @@ bantime = 600
 #
 ignoreip = 
 
-# Option:  interface
-# Notes.:  interface name on which the IP will be banned.
-# Values:  INT  Default:  eth0
-#
-interface = eth0
+# Option:  cmdstart
+# Notes.:  command executed once at the start of Fail2Ban
+# Values:  CMD
+# Default  
+cmdstart = 
+
+# Option:  cmdend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+# Default  
+cmdend = 
 
 # Option:  polltime
 # Notes.:  number of seconds fail2ban sleeps between iterations.
@@ -87,25 +93,35 @@ enabled = false
 # Notes.:  logfile to monitor.
 # Values:  FILE  Default:  /var/log/httpd/access_log
 #
-logfile = /home/cyril/workspace/fail2ban/log-test/apache
+logfile = /home/cyril/workspace/fail2ban-unstable/log-test/apache
 
-# Option:  fwbanrule
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban
+# Values:  CMD
+# Default  
+fwstart = 
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+# Default  
+fwend = 
+
+# Option:  fwban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-#          <if>  interface name
 #          <ip>  IP address
 # Values:  CMD
-# Default  iptables -I INPUT 1 -i <if> -s <ip> -j DROP
-fwbanrule = iptables -I INPUT 1 -i <if> -s <ip> -j DROP
+# Default  iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
+fwban = iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 
-# Option:  fwunbanrule
+# Option:  fwunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-#          <if>  interface name
 #          <ip>  IP address
 # Values:  CMD
-# Default  iptables -D INPUT -i <if> -s <ip> -j DROP
-fwunbanrule = iptables -D INPUT -i <if> -s <ip> -j DROP
+# Default  iptables -D INPUT -i eth0 -s <ip> -j DROP
+fwunban = iptables -D INPUT -i eth0 -s <ip> -j DROP
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in Apache logfile.
@@ -138,25 +154,35 @@ enabled = true
 # Notes.:  logfile to monitor.
 # Values:  FILE  Default:  /var/log/secure
 #
-logfile = /home/cyril/workspace/fail2ban/log-test/test
+logfile = /home/cyril/workspace/fail2ban-unstable/log-test/test
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban
+# Values:  CMD
+# Default  
+fwstart = 
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+# Default  
+fwend = 
 
 # Option:  fwbanrule
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-#          <if>  interface name
 #          <ip>  IP address
 # Values:  CMD
-# Default  iptables -I INPUT 1 -i <if> -s <ip> -j DROP
-fwbanrule = iptables -I INPUT 1 -i <if> -s <ip> -j DROP
+# Default  iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
+fwban = iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 
 # Option:  fwunbanrule
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-#          <if>  interface name
 #          <ip>  IP address
 # Values:  CMD
-# Default  iptables -D INPUT -i <if> -s <ip> -j DROP
-fwunbanrule = iptables -D INPUT -i <if> -s <ip> -j DROP
+# Default  iptables -D INPUT -i eth0 -s <ip> -j DROP
+fwunban = iptables -D INPUT -i eth0 -s <ip> -j DROP
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in SSH logfile.

From 1014183f3f1f0440c08bcdb4add6d10b7cfd6699 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Jul 2005 16:50:56 +0000
Subject: [PATCH 107/549] - Changed fail2ban binary name

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@117 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/gentoo-initd | 2 +-
 config/redhat-initd | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/gentoo-initd b/config/gentoo-initd
index b6b2a0b1..11b81e7d 100755
--- a/config/gentoo-initd
+++ b/config/gentoo-initd
@@ -21,7 +21,7 @@
 
 opts="start stop restart showlog"
 
-FAIL2BAN="/usr/bin/fail2ban.py"
+FAIL2BAN="/usr/bin/fail2ban"
 
 depend() {
 	need net
diff --git a/config/redhat-initd b/config/redhat-initd
index 27369962..b1753672 100644
--- a/config/redhat-initd
+++ b/config/redhat-initd
@@ -21,7 +21,7 @@
 [ "${NETWORKING}" = "no" ] && exit 0
 [ -f /etc/fail2ban.conf ] || exit 0
 
-FAIL2BAN="/usr/bin/fail2ban.py"
+FAIL2BAN="/usr/bin/fail2ban"
 PIDFILE="/var/run/fail2ban.pid"
 
 RETVAL=0
@@ -55,7 +55,7 @@ case "$1" in
         stop
         ;;
   status)
-        status fail2ban.py
+        status fail2ban
         RETVAL=$?
         ;;
   reload)

From 65fef83e5668a23cce8693afb262c558969c4f82 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Jul 2005 16:51:52 +0000
Subject: [PATCH 108/549] - Made configreader more generic. Also used for
 global options now

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@118 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 confreader/configreader.py | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/confreader/configreader.py b/confreader/configreader.py
index 9c64a0aa..a1227055 100644
--- a/confreader/configreader.py
+++ b/confreader/configreader.py
@@ -36,19 +36,7 @@ class ConfigReader:
 		The DEFAULT section contains the global information about
 		Fail2Ban. Each other section is for a different log file.
 	"""
-	
-	# Each optionValues entry is composed of an array with:
-	# 0 -> the type of the option
-	# 1 -> the name of the option
-	# 2 -> the default value for the option
-	optionValues = (["bool", "enabled", True],
-					["str", "logfile", "/dev/null"],
-					["str", "timeregex", ""],
-					["str", "timepattern", ""],
-					["str", "failregex", ""],
-					["str", "fwbanrule", ""],
-					["str", "fwunbanrule", ""])
-	
+
 	def __init__(self, confPath):
 		self.confPath = confPath
 		self.configParser = SafeConfigParser()
@@ -63,13 +51,17 @@ class ConfigReader:
 			file except the DEFAULT section.
 		"""
 		return self.configParser.sections()
-		
-	def getLogOptions(self, sec):
+	
+	# Each optionValues entry is composed of an array with:
+	# 0 -> the type of the option
+	# 1 -> the name of the option
+	# 2 -> the default value for the option
+	def getLogOptions(self, sec, options):
 		""" Gets all the options of a given section. The options
 			are defined in the optionValues list.
 		"""
 		values = dict()
-		for option in self.optionValues:
+		for option in options:
 			try:
 				if option[0] == "bool":
 					v = self.configParser.getboolean(sec, option[1])

From 3df3c510f41352a73daf962d93dbbd9b66659a0d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Jul 2005 16:52:54 +0000
Subject: [PATCH 109/549] - Moved __executeCmd to utils/process.py - Removed
 interface

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@119 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/firewall.py | 27 ++++++++++-----------------
 1 file changed, 10 insertions(+), 17 deletions(-)

diff --git a/firewall/firewall.py b/firewall/firewall.py
index 38351863..4d8e364d 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -26,6 +26,8 @@ __license__ = "GPL"
 
 import time, os, log4py, re
 
+from utils.process import executeCmd
+
 # Gets the instance of log4py.
 logSys = log4py.Logger().get_instance()
 
@@ -36,11 +38,10 @@ class Firewall:
 	
 	banList = dict()
 	
-	def __init__(self, banRule, unBanRule, banTime, interface):
+	def __init__(self, banRule, unBanRule, banTime):
 		self.banRule = banRule
 		self.unBanRule = unBanRule
 		self.banTime = banTime
-		self.interface = interface
 	
 	def addBanIP(self, ip, debug):
 		""" Bans an IP.
@@ -48,7 +49,7 @@ class Firewall:
 		if not self.inBanList(ip):
 			logSys.warn("Ban "+ip)
 			self.banList[ip] = time.time()
-			self.__executeCmd(self.banIP(ip), debug)
+			executeCmd(self.banIP(ip), debug)
 		else:
 			logSys.error(ip+" already in ban list")
 	
@@ -58,7 +59,7 @@ class Firewall:
 		if self.inBanList(ip):
 			logSys.warn("Unban "+ip)
 			del self.banList[ip]
-			self.__executeCmd(self.unBanIP(ip), debug)
+			executeCmd(self.unBanIP(ip), debug)
 		else:
 			logSys.error(ip+" not in ban list")
 	
@@ -85,32 +86,24 @@ class Firewall:
 		for element in banListTemp.iteritems():
 			ip = element[0]
 			self.delBanIP(ip, debug)
-	
-	def __executeCmd(self, cmd, debug):
-		""" Executes an OS command.
-		"""
-		logSys.debug(cmd)
-		if not debug:
-			return os.system(cmd)
-		else:
-			return None
 			
 	def banIP(self, ip):
 		""" Returns query to ban IP.
 		"""
-		query = self.replaceTag(self.banRule, ip, self.interface)
+		query = self.replaceTag(self.banRule, ip)
 		return query
 	
 	def unBanIP(self, ip):
 		""" Returns query to unban IP.
 		"""
-		query = self.replaceTag(self.unBanRule, ip, self.interface)
+		query = self.replaceTag(self.unBanRule, ip)
 		return query
 	
-	def replaceTag(self, query, ip, interface):
+	def replaceTag(self, query, ip):
+		""" Replace tag in query
+		"""
 		string = query
 		string = string.replace("<ip>", ip)
-		string = string.replace("<if>", interface)
 		return string
 	
 	def viewBanList(self):

From 3d79d9d1cb1d9288ab984544fd9a821676c51df1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Jul 2005 16:53:47 +0000
Subject: [PATCH 110/549] - Initial import

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@120 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/process.py | 158 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 158 insertions(+)
 create mode 100644 utils/process.py

diff --git a/utils/process.py b/utils/process.py
new file mode 100644
index 00000000..9cfaf789
--- /dev/null
+++ b/utils/process.py
@@ -0,0 +1,158 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os, log4py, signal
+
+# Gets the instance of log4py.
+logSys = log4py.Logger().get_instance()
+
+def createDaemon():
+	"""Detach a process from the controlling terminal and run it in the
+	background as a daemon.
+	
+	http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
+	"""
+
+	try:
+		# Fork a child process so the parent can exit.  This will return control
+		# to the command line or shell.  This is required so that the new process
+		# is guaranteed not to be a process group leader.  We have this guarantee
+		# because the process GID of the parent is inherited by the child, but
+		# the child gets a new PID, making it impossible for its PID to equal its
+		# PGID.
+		pid = os.fork()
+	except OSError, e:
+		return((e.errno, e.strerror))	 # ERROR (return a tuple)
+
+	if (pid == 0):	   # The first child.
+
+		# Next we call os.setsid() to become the session leader of this new
+		# session.  The process also becomes the process group leader of the
+		# new process group.  Since a controlling terminal is associated with a
+		# session, and this new session has not yet acquired a controlling
+		# terminal our process now has no controlling terminal.  This shouldn't
+		# fail, since we're guaranteed that the child is not a process group
+		# leader.
+		os.setsid()
+	
+		# When the first child terminates, all processes in the second child
+		# are sent a SIGHUP, so it's ignored.
+		signal.signal(signal.SIGHUP, signal.SIG_IGN)
+	
+		try:
+			# Fork a second child to prevent zombies.  Since the first child is
+			# a session leader without a controlling terminal, it's possible for
+			# it to acquire one by opening a terminal in the future.  This second
+			# fork guarantees that the child is no longer a session leader, thus
+			# preventing the daemon from ever acquiring a controlling terminal.
+			pid = os.fork()		# Fork a second child.
+		except OSError, e:
+			return((e.errno, e.strerror))  # ERROR (return a tuple)
+	
+		if (pid == 0):	  # The second child.
+			# Ensure that the daemon doesn't keep any directory in use.  Failure
+			# to do this could make a filesystem unmountable.
+			os.chdir("/")
+			# Give the child complete control over permissions.
+			os.umask(0)
+		else:
+			os._exit(0)	  # Exit parent (the first child) of the second child.
+	else:
+		os._exit(0)		 # Exit parent of the first child.
+
+	# Close all open files.  Try the system configuration variable, SC_OPEN_MAX,
+	# for the maximum number of open files to close.  If it doesn't exist, use
+	# the default value (configurable).
+	try:
+		maxfd = os.sysconf("SC_OPEN_MAX")
+	except (AttributeError, ValueError):
+		maxfd = 256	   # default maximum
+
+	for fd in range(0, maxfd):
+		try:
+			os.close(fd)
+		except OSError:   # ERROR (ignore)
+			pass
+
+	# Redirect the standard file descriptors to /dev/null.
+   	os.open("/dev/null", os.O_RDONLY)	# standard input (0)
+	os.open("/dev/null", os.O_RDWR)		# standard output (1)
+	os.open("/dev/null", os.O_RDWR)		# standard error (2)
+
+	return True
+	
+def checkForPID(lockfile):
+	""" Checks for running Fail2Ban.
+	
+		Returns the current PID if Fail2Ban is running or False
+		if no instance found.
+	"""
+	try:
+		fileHandler = open(lockfile)
+		pid = fileHandler.readline()
+		return pid
+	except IOError:
+		return False
+		
+def createPID(lockfile):
+	""" Creates a PID lock file with the current PID.
+	"""
+	fileHandler = open(lockfile, mode='w')
+	pid = os.getpid()
+	fileHandler.write(`pid`+'\n')
+	fileHandler.close()
+	logSys.debug("Created PID lock ("+`pid`+") in "+lockfile)
+		
+def removePID(lockfile):
+	""" Remove PID lock.
+	"""
+	os.remove(lockfile)
+	logSys.debug("Removed PID lock "+lockfile)
+
+def killPID(pid):
+	""" Kills the process with the given PID using the
+		INT signal (same effect as <ctrl>+<c>).
+	"""
+	try:
+		return os.kill(pid, 2)
+	except OSError:
+		logSys.error("Can not kill process " + `pid` + ". Please check that " +
+					"Fail2Ban is not running and remove the file " +
+					"'/tmp/fail2ban.pid'")
+		return False
+
+def executeCmd(cmd, debug):
+	""" Executes an OS command.
+	"""
+	if cmd == "":
+		logSys.debug("Nothing to do")
+		return None
+	
+	logSys.debug(cmd)
+	if not debug:
+		return os.system(cmd)
+	else:
+		return None

From e98f8c8182081bddea507e88068a2a4030f3ee1b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Jul 2005 16:55:50 +0000
Subject: [PATCH 111/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@121 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG |  5 ++++-
 README    | 29 ++++++++++++++---------------
 2 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 7969fd7a..3edb0931 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,8 +9,11 @@ Fail2Ban (version 0.?.?)                           ??/??/2005
 
 ver. 0.?.? (??/??/2005) - ???
 ----------
+- Remove interface option
+- Added start and end commands in the configuration file.
+  Thanks to Yaroslav Halchenko
 - Added firewall rules definition in the configuration file
-- Cleaned a bit fail2ban.py
+- Cleaned fail2ban.py
 - Added an initd script for RedHat/Fedora. Thanks to Andrey
   G. Grozin
 
diff --git a/README b/README
index b88f1731..c23b9d5c 100644
--- a/README
+++ b/README
@@ -4,14 +4,14 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.4.1)                           06/30/2005
+Fail2Ban (version 0.?.?)                           ??/??/2005
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
 that makes too many password failures. It updates firewall
-rules to reject the IP address. Currently iptables, ipfw and
-ipfwadm are supported. Fail2Ban can read multiple log files
-such as sshd or Apache web server ones. It needs log4py.
+rules to reject the IP address. These rules can be defined by
+the user. Fail2Ban can read multiple log files such as sshd
+or Apache web server ones. It needs log4py.
 
 This is my first Python program. Moreover, English is not my
 mother tongue...
@@ -36,18 +36,19 @@ tries to find lines which match the failregex. Then it
 retrieves the message time using timeregex and timepattern.
 It finally gets the ip and if it has already done 3 or more
 password failures in the last banTime, the ip is banned for
-banTime using a firewall rule. After banTime, the rule is
-deleted. Notice that if no "plain" ip is available, Fail2Ban
-try to do DNS lookup in order to found one or several ip's to
-ban.
+banTime using a firewall rule. This rule is set by the user
+in the configuration file. Thus, Fail2Ban can be adapted for
+lots of firewall. After banTime, the rule is deleted. Notice
+that if no "plain" ip is available, Fail2Ban try to do DNS
+lookup in order to found one or several ip's to ban.
 
 Sections can be freely added so it is possible to monitor
 several daemons at the same time.
 
 Runs on my server and does its job rather well :-) The idea
 is to make fail2ban usable with daemons and services that
-require a login (sshd, telnetd, ...). It should also support
-others firewalls than iptables.
+require a login (sshd, telnetd, ...) and with different
+firewalls.
 
 
 Installation:
@@ -65,7 +66,8 @@ To install, just do:
 This will install Fail2Ban into /usr/lib/fail2ban. The
 fail2ban.py executable is placed into /usr/bin.
 
-For Gentoo users, an ebuild is available on the website.
+Gentoo: an ebuild is available on the website.
+Debian: a package is available on the website.
 
 Fail2Ban should now be correctly installed. Just type:
 
@@ -93,7 +95,6 @@ options:
 
   -b         start fail2ban in background
   -d         start fail2ban in debug mode
-  -e <INTF>  ban IP on the INTF interface
   -c <FILE>  read configuration file FILE
   -p <FILE>  create PID lock in FILE
   -h         display this help message
@@ -103,8 +104,6 @@ options:
   -r <VALUE> allow a max of VALUE password failure
   -t <TIME>  ban IP for TIME seconds
   -v         verbose. Use twice for greater effect
-  -w <FIWA>  select the firewall to use. Can be iptables,
-             ipfwadm or ipfw
 
 Contact:
 --------
@@ -121,7 +120,7 @@ Thanks:
 -------
 
 Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
-Tom Pike, Iain Lea, Andrey G. Grozin
+Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko
 
 License:
 --------

From 5595ffcac7867c87251d064fc3bae5fa422cfacb Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Jul 2005 16:56:30 +0000
Subject: [PATCH 112/549] - Lot of changes. Most of them are cleanup

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@122 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 266 ++++++++++++++++------------------------------------
 1 file changed, 81 insertions(+), 185 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index 301975b5..12ae2d77 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python
-
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -26,19 +24,9 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, sys, getopt, os, string, signal
+import time, sys, getopt, os, string, signal, log4py
 from ConfigParser import *
 
-# Checks if log4py is present.
-try:
-	import log4py
-except:
-	print "log4py is needed (see README)"
-	sys.exit(-1)
-
-# Appends our own modules path
-sys.path.append('/usr/lib/fail2ban')
-
 from firewall.firewall import Firewall
 from logreader.logreader import LogReader
 from confreader.configreader import ConfigReader
@@ -48,15 +36,18 @@ from version import version
 # Gets the instance of log4py.
 logSys = log4py.Logger().get_instance()
 
+# Global variables
+logFwList = list()
+conf = dict()
+
 def usage():
-	print "Usage: fail2ban.py [OPTIONS]"
+	print "Usage: fail2ban [OPTIONS]"
 	print
 	print "Fail2Ban v"+version+" reads log file that contains password failure report"
 	print "and bans the corresponding IP address using iptables."
 	print
 	print "  -b         start fail2ban in background"
 	print "  -d         start fail2ban in debug mode"
-	print "  -e <INTF>  ban IP on the INTF interface"
 	print "  -c <FILE>  read configuration file FILE"
 	print "  -p <FILE>  create PID lock in FILE"
 	print "  -h         display this help message"
@@ -66,8 +57,6 @@ def usage():
 	print "  -r <VALUE> allow a max of VALUE password failure"
 	print "  -t <TIME>  ban IP for TIME seconds"
 	print "  -v         verbose. Use twice for greater effect"
-	print "  -w <FIWA>  select the firewall to use. Can be iptables,"
-	print "             ipfwadm or ipfw"
 	print
 	print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	sys.exit(0)
@@ -95,156 +84,20 @@ def killApp():
 	logSys.warn("Restoring firewall rules...")
 	for element in logFwList:
 		element[2].flushBanList(conf["debug"])
+	# Execute end command of each section
+	for element in logFwList:
+		l = element[4]
+		executeCmd(l["fwend"], conf["debug"])
+	# Execute global start command
+	executeCmd(conf["cmdend"], conf["debug"])
+	# Remove the PID lock
 	removePID(conf["pidlock"])
 	logSys.info("Exiting...")
 	sys.exit(0)
 
-if __name__ == "__main__":
-	
-	logSys.set_formatstring("%T %L %M")
-	
-	conf = dict()
-	conf["verbose"] = 0
-	conf["background"] = False
-	conf["debug"] = False
-	conf["conffile"] = "/etc/fail2ban.conf"
-	conf["pidlock"] = "/var/run/fail2ban.pid"
-	conf["logging"] = False
-	conf["logfile"] = "/var/log/fail2ban.log"
-	conf["maxretry"] = 3
-	conf["bantime"] = 600
-	conf["ignoreip"] = ''
-	conf["interface"] = "eth0"
-	conf["firewall"] = "iptables"
-	conf["ipfw-start-rule"] = 0
-	conf["polltime"] = 1
-	
-	# Reads the command line options.
-	try:
-		optList, args = getopt.getopt(sys.argv[1:], 'hvbdkc:l:t:i:r:e:w:p:')
-	except getopt.GetoptError:
-		usage()
-	
-	# Pre-parsing of command line options for the -c option
-	for opt in optList:
-		if opt[0] == "-c":
-			conf["conffile"] = opt[1]
-	
-	# Config file
-	configParser = SafeConfigParser()
-	configParser.read(conf["conffile"])
-	
-	# background
-	try:
-		conf["background"] = configParser.getboolean("DEFAULT", "background")
-	except ValueError:
-		logSys.warn("background option should be a boolean")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("background option not in config file")
-		logSys.warn("Using default value")
-
-	# debug
-	try:
-		conf["debug"] = configParser.getboolean("DEFAULT", "debug")
-	except ValueError:
-		logSys.warn("debug option should be a boolean")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("debug option not in config file")
-		logSys.warn("Using default value")
-
-	# logfile
-	try:
-		conf["logfile"] = configParser.get("DEFAULT", "logfile")
-	except ValueError:
-		logSys.warn("logfile option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("logfile option not in config file")
-		logSys.warn("Using default value")
-		
-	# pidlock
-	try:
-		conf["pidlock"] = configParser.get("DEFAULT", "pidlock")
-	except ValueError:
-		logSys.warn("pidlock option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("pidlock option not in config file")
-		logSys.warn("Using default value")
-		
-	# maxretry
-	try:
-		conf["maxretry"] = configParser.getint("DEFAULT", "maxretry")
-	except ValueError:
-		logSys.warn("maxretry option should be an integer")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("maxretry option not in config file")
-		logSys.warn("Using default value")
-
-	# bantime
-	try:
-		conf["bantime"] = configParser.getint("DEFAULT", "bantime")
-	except ValueError:
-		logSys.warn("bantime option should be an integer")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("bantime option not in config file")
-		logSys.warn("Using default value")
-
-	# ignoreip
-	try:
-		conf["ignoreip"] = configParser.get("DEFAULT", "ignoreip")
-	except ValueError:
-		logSys.warn("ignoreip option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("ignoreip option not in config file")
-		logSys.warn("Using default value")
-		
-	# interface
-	try:
-		conf["interface"] = configParser.get("DEFAULT", "interface")
-	except ValueError:
-		logSys.warn("interface option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("interface option not in config file")
-		logSys.warn("Using default value")
-		
-	# firewall
-	try:
-		conf["firewall"] = configParser.get("DEFAULT", "firewall")
-	except ValueError:
-		logSys.warn("firewall option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("firewall option not in config file")
-		logSys.warn("Using default value")
-	
-	# ipfw-start-rule
-	try:
-		conf["ipfw-start-rule"] = configParser.getint("DEFAULT",
-													"ipfw-start-rule")
-	except ValueError:
-		logSys.warn("ipfw-start-rule option should be an integer")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("ipfw-start-rule option not in config file")
-		logSys.warn("Using default value")
-
-	# polltime
-	try:
-		conf["polltime"] = configParser.getint("DEFAULT", "polltime")
-	except ValueError:
-		logSys.warn("polltime option should be an integer")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("polltime option not in config file")
-		logSys.warn("Using default value")
-	
+def getCmdLineOptions(optList):
+	""" Gets the command line options
+	"""
 	for opt in optList:
 		if opt[0] == "-h":
 			usage()
@@ -254,8 +107,6 @@ if __name__ == "__main__":
 			conf["background"] = True
 		if opt[0] == "-d":
 			conf["debug"] = True
-		if opt[0] == "-e":
-			conf["interface"] = opt[1]
 		if opt[0] == "-l":
 			conf["logging"] = True
 			conf["logfile"] = opt[1]
@@ -269,8 +120,6 @@ if __name__ == "__main__":
 			conf["ignoreip"] = opt[1]
 		if opt[0] == "-r":
 			conf["retrymax"] = int(opt[1])
-		if opt[0] == "-w":
-			conf["firewall"] = opt[1]
 		if opt[0] == "-p":
 			conf["pidlock"] = opt[1]
 		if opt[0] == "-k":
@@ -283,6 +132,49 @@ if __name__ == "__main__":
 				logSys.error("No running Fail2Ban found")
 				sys.exit(-1)
 
+def main():
+	""" Fail2Ban main function
+	"""
+	logSys.set_formatstring("%T %L %M")
+	
+	conf["verbose"] = 0
+	conf["conffile"] = "/etc/fail2ban.conf"
+	conf["logging"] = False
+	
+	# Reads the command line options.
+	try:
+		optList, args = getopt.getopt(sys.argv[1:], 'hvbdkc:l:t:i:r:p:')
+	except getopt.GetoptError:
+		usage()
+	
+	# Pre-parsing of command line options for the -c option
+	for opt in optList:
+		if opt[0] == "-c":
+			conf["conffile"] = opt[1]
+	
+	# Reads the config file and create a LogReader instance for
+	# each log file to check.
+	confReader = ConfigReader(conf["conffile"]);
+	confReader.openConf()
+	
+	# Options
+	optionValues = (["bool", "background", False],
+					["bool", "debug", False],
+					["str", "logfile", "/var/log/fail2ban.log"],
+					["str", "pidlock", "/var/run/fail2ban.pid"],
+					["int", "maxretry", 3],
+					["int", "bantime", 600],
+					["str", "ignoreip", ""],
+					["int", "polltime", 1],
+					["str", "cmdstart", ""],
+					["str", "cmdend", ""])
+	
+	# Gets global configuration options
+	conf.update(confReader.getLogOptions("DEFAULT", optionValues))
+	
+	# Gets command line options
+	getCmdLineOptions(optList)
+
 	# Process some options
 	for c in conf:
 		if c == "verbose":
@@ -310,14 +202,6 @@ if __name__ == "__main__":
 				logSys.warn("Using default output for logging")
 		elif c == "ignoreip":
 			ignoreIPList = conf[c].split(' ')
-		elif c == "firewall":
-			conf[c] = string.lower(conf[c])
-			if conf[c] == "ipfw":
-				fireWallName = "Ipfw"
-			elif conf[c] == "ipfwadm":
-				fireWallName = "Ipfwadm"
-			else:
-				fireWallName = "Iptables"
 	
 	# Checks for root user. This is necessary because log files
 	# are owned by root and firewall needs root access.
@@ -338,23 +222,29 @@ if __name__ == "__main__":
 	logSys.debug("BanTime is "+`conf["bantime"]`)
 	logSys.debug("retryAllowed is "+`conf["maxretry"]`)
 	
-	# Reads the config file and create a LogReader instance for
-	# each log file to check.
-	confReader = ConfigReader(conf["conffile"]);
-	confReader.openConf()
-	logFwList = list()
+	# Options
+	optionValues = (["bool", "enabled", True],
+					["str", "logfile", "/dev/null"],
+					["str", "timeregex", ""],
+					["str", "timepattern", ""],
+					["str", "failregex", ""],
+					["str", "fwstart", ""],
+					["str", "fwend", ""],
+					["str", "fwban", ""],
+					["str", "fwunban", ""])
+					
+	# Gets the options of each sections
 	for t in confReader.getSections():
-		l = confReader.getLogOptions(t)
+		l = confReader.getLogOptions(t, optionValues)
 		if l["enabled"]:
 			# Creates a logreader object
 			lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
 								l["failregex"], conf["bantime"])
 			# Creates a firewall object
-			fObj = Firewall(l["fwbanrule"], l["fwunbanrule"], conf["bantime"],
-							conf["interface"])
+			fObj = Firewall(l["fwban"], l["fwunban"], conf["bantime"])
 			# Links them into a list. I'm not really happy
 			# with this :/
-			logFwList.append([t, lObj, fObj, dict()])
+			logFwList.append([t, lObj, fObj, dict(), l])
 	
 	# We add 127.0.0.1 to the ignore list has we do not want
 	# to be ban ourself.
@@ -366,6 +256,12 @@ if __name__ == "__main__":
 			element[1].addIgnoreIP(ip)
 	
 	logSys.info("Fail2Ban v"+version+" is running")
+	# Execute global start command
+	executeCmd(conf["cmdstart"], conf["debug"])
+	# Execute start command of each section
+	for element in logFwList:
+		l = element[4]
+		executeCmd(l["fwstart"], conf["debug"])
 	# Main loop
 	while True:
 		try:
@@ -409,7 +305,7 @@ if __name__ == "__main__":
 				findTime = element[1].getFindTime()
 				for attempt in fails:
 					failTime = fails[attempt][1]
-					if failTime < unixTime - failTime:
+					if failTime < unixTime - findTime:
 						del element[3][attempt]
 					elif fails[attempt][0] >= conf["maxretry"]:
 						logSys.info(element[0] + ": " + attempt + " has " +

From ebccfea6cbb8d6ecca70e52617031d2099c83cf3 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Jul 2005 16:57:05 +0000
Subject: [PATCH 113/549] - Added new fail2ban binary

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@123 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 1 +
 setup.py | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/MANIFEST b/MANIFEST
index 3da375cc..0be0cc71 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -4,6 +4,7 @@ TODO
 setup.cfg
 setup.py
 version.py
+fail2ban
 fail2ban.py
 firewall/__init__.py
 firewall/firewall.py
diff --git a/setup.py b/setup.py
index eee601bc..d4ea5dd5 100755
--- a/setup.py
+++ b/setup.py
@@ -35,8 +35,8 @@ setup(
         description = "Ban IPs that make too many password failure",
         author = "Cyril Jaquier",
         author_email = "lostcontrol@users.sourceforge.net",
-        url = "http://www.sourceforge.net/projects/fail2ban",
-        scripts = ['fail2ban.py'],
-        py_modules = ['version'],
+        url = "http://fail2ban.sourceforge.net",
+        scripts = ['fail2ban'],
+        py_modules = ['fail2ban', 'version'],
         packages = ['firewall', 'logreader', 'confreader', 'utils']
 )

From 8e16185ef151c4b07299fd31f564282716ba5548 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 8 Jul 2005 10:01:04 +0000
Subject: [PATCH 114/549] - Applied changes (command line options) from
 Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@124 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index 12ae2d77..0632cdc7 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -40,8 +40,10 @@ logSys = log4py.Logger().get_instance()
 logFwList = list()
 conf = dict()
 
-def usage():
-	print "Usage: fail2ban [OPTIONS]"
+def dispUsage():
+	""" Prints Fail2Ban command line options and exits
+	"""
+	print "Usage: "+sys.argv[0]+" [OPTIONS]"
 	print
 	print "Fail2Ban v"+version+" reads log file that contains password failure report"
 	print "and bans the corresponding IP address using iptables."
@@ -57,10 +59,17 @@ def usage():
 	print "  -r <VALUE> allow a max of VALUE password failure"
 	print "  -t <TIME>  ban IP for TIME seconds"
 	print "  -v         verbose. Use twice for greater effect"
+	print "  -V         print software version"
 	print
 	print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	sys.exit(0)
 
+def dispVersion():
+	""" Prints Fail2Ban version and exits
+	"""
+	print sys.argv[0]+" "+version
+	sys.exit(0)
+
 def checkForRoot():
 	""" Check for root user.
 	"""
@@ -99,8 +108,10 @@ def getCmdLineOptions(optList):
 	""" Gets the command line options
 	"""
 	for opt in optList:
-		if opt[0] == "-h":
-			usage()
+		if opt[0] in ["-h", "--help"]:
+ 			dispUsage()
+		if opt[0] in ["-V", "--version"]:
+			dispVersion()
 		if opt[0] == "-v":
 			conf["verbose"] = conf["verbose"] + 1
 		if opt[0] == "-b":
@@ -143,9 +154,11 @@ def main():
 	
 	# Reads the command line options.
 	try:
-		optList, args = getopt.getopt(sys.argv[1:], 'hvbdkc:l:t:i:r:p:')
+		cmdOpts = 'hvVbdkc:l:t:i:r:p:'
+		cmdLongOpts = ['help','version']
+		optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
 	except getopt.GetoptError:
-		usage()
+		dispUsage()
 	
 	# Pre-parsing of command line options for the -c option
 	for opt in optList:

From cb97a9e091743f09bf4b8591af9dd2fd66699d24 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 8 Jul 2005 10:21:52 +0000
Subject: [PATCH 115/549] - Oups... I forgot to add this one. Now, this is the
 main executable

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@125 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100755 fail2ban

diff --git a/fail2ban b/fail2ban
new file mode 100755
index 00000000..33c7d364
--- /dev/null
+++ b/fail2ban
@@ -0,0 +1,46 @@
+#!/usr/bin/env python
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from sys import exit, path
+
+# Checks for required libs
+# Checks if log4py is present.
+try:
+	import log4py
+except:
+	print "log4py is needed (see README)"
+	exit(-1)
+
+# Appends our own modules path
+path.append('/usr/lib/fail2ban')
+
+# Now we can import our module
+import fail2ban
+
+# Start the application
+fail2ban.main()

From 6ae86bd7d6bfc4f3cfeed7f922f3877ec834fe92 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 9 Jul 2005 13:18:59 +0000
Subject: [PATCH 116/549] - Removed unused options - Cleanup

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@126 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 55 ++++++++++++++++--------------------
 1 file changed, 24 insertions(+), 31 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index c7a014d4..51d5394c 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -5,18 +5,6 @@
 # 2005.06.21  modified for readability  Iain Lea  iain@bricbrac.de
 
 [DEFAULT]
-# Option:  firewall
-# Notes.:  select the firewall system to use.
-# Values:  [iptables | ipfwadm | ipfw]  Default:  iptables
-#
-firewall = iptables
-
-# Option:  ipfw-start-rule
-# Notes.:  set first firewall rule number used (only used if firewall = ipfw).
-# Values:  NUM  Default:  100
-#
-ipfw-start-rule = 100
-
 # Option:  background
 # Notes.:  start fail2ban as a daemon. Output is redirect to logfile.
 # Values:  [true | false]  Default:  false
@@ -62,14 +50,14 @@ ignoreip =
 
 # Option:  cmdstart
 # Notes.:  command executed once at the start of Fail2Ban
-# Values:  CMD
-# Default  
+# Values:  CMD  Default:
+#
 cmdstart = 
 
 # Option:  cmdend
 # Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-# Default  
+# Values:  CMD  Default:
+#
 cmdend = 
 
 # Option:  polltime
@@ -80,7 +68,8 @@ polltime = 1
 
 # You can define a new section for each log file to check for
 # password failure. Each section has to define the following
-# options: logfile, timeregex, timepattern, failregex.
+# options: logfile, fwban, fwunban, timeregex, timepattern,
+# failregex.
 
 [Apache]
 # Option:  enabled
@@ -97,14 +86,14 @@ logfile = /home/cyril/workspace/fail2ban-unstable/log-test/apache
 
 # Option:  fwstart
 # Notes.:  command executed once at the start of Fail2Ban
-# Values:  CMD
-# Default  
+# Values:  CMD  Default:
+#
 fwstart = 
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-# Default  
+# Values:  CMD  Default:
+#
 fwend = 
 
 # Option:  fwban
@@ -112,7 +101,8 @@ fwend =
 #          command is executed with Fail2Ban user rights.
 #          <ip>  IP address
 # Values:  CMD
-# Default  iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
+# Default: iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
+#
 fwban = iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 
 # Option:  fwunban
@@ -120,13 +110,14 @@ fwban = iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 #          command is executed with Fail2Ban user rights.
 #          <ip>  IP address
 # Values:  CMD
-# Default  iptables -D INPUT -i eth0 -s <ip> -j DROP
+# Default: iptables -D INPUT -i eth0 -s <ip> -j DROP
+#
 fwunban = iptables -D INPUT -i eth0 -s <ip> -j DROP
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in Apache logfile.
 # Values:  [Wed Jan 05 15:08:01 2005]  
-# Default  \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
 #
 timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
 
@@ -158,14 +149,14 @@ logfile = /home/cyril/workspace/fail2ban-unstable/log-test/test
 
 # Option:  fwstart
 # Notes.:  command executed once at the start of Fail2Ban
-# Values:  CMD
-# Default  
+# Values:  CMD  Default:
+#
 fwstart = 
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-# Default  
+# Values:  CMD  Default:
+#
 fwend = 
 
 # Option:  fwbanrule
@@ -173,7 +164,8 @@ fwend =
 #          command is executed with Fail2Ban user rights.
 #          <ip>  IP address
 # Values:  CMD
-# Default  iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
+# Default: iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
+#
 fwban = iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 
 # Option:  fwunbanrule
@@ -181,13 +173,14 @@ fwban = iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 #          command is executed with Fail2Ban user rights.
 #          <ip>  IP address
 # Values:  CMD
-# Default  iptables -D INPUT -i eth0 -s <ip> -j DROP
+# Default: iptables -D INPUT -i eth0 -s <ip> -j DROP
+#
 fwunban = iptables -D INPUT -i eth0 -s <ip> -j DROP
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in SSH logfile.
 # Values:  [Mar  7 17:53:28]  
-# Default  \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
 #
 timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
 

From 18486d66bdc52359d2b029be6e7b18e1104aba12 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 9 Jul 2005 15:09:03 +0000
Subject: [PATCH 117/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@127 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 3edb0931..9cdbfc91 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,7 +9,9 @@ Fail2Ban (version 0.?.?)                           ??/??/2005
 
 ver. 0.?.? (??/??/2005) - ???
 ----------
-- Remove interface option
+- Added tags replacement in rules definition. Should allow a
+  clean solution for Feature Request #1229479
+- Removed "interface" and "firewall" options
 - Added start and end commands in the configuration file.
   Thanks to Yaroslav Halchenko
 - Added firewall rules definition in the configuration file

From 7cdb6c94bb78193dc64bf2a7da76863804b9d21a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 9 Jul 2005 15:11:48 +0000
Subject: [PATCH 118/549] - Added more tags in firewall rules definition.
 Should help for Feature Request #1229479

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@128 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 18 +++++++++++----
 fail2ban.py                  |  9 +++++---
 firewall/firewall.py         | 43 ++++++++++++++++++++++--------------
 3 files changed, 46 insertions(+), 24 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 51d5394c..a1c0e070 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -99,7 +99,10 @@ fwend =
 # Option:  fwban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-#          <ip>  IP address
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
 # Values:  CMD
 # Default: iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 #
@@ -108,7 +111,9 @@ fwban = iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 # Option:  fwunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-#          <ip>  IP address
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
 # Values:  CMD
 # Default: iptables -D INPUT -i eth0 -s <ip> -j DROP
 #
@@ -162,7 +167,10 @@ fwend =
 # Option:  fwbanrule
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-#          <ip>  IP address
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
 # Values:  CMD
 # Default: iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 #
@@ -171,7 +179,9 @@ fwban = iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 # Option:  fwunbanrule
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-#          <ip>  IP address
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
 # Values:  CMD
 # Default: iptables -D INPUT -i eth0 -s <ip> -j DROP
 #
diff --git a/fail2ban.py b/fail2ban.py
index 0632cdc7..0f3f536e 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -321,10 +321,13 @@ def main():
 					if failTime < unixTime - findTime:
 						del element[3][attempt]
 					elif fails[attempt][0] >= conf["maxretry"]:
-						logSys.info(element[0] + ": " + attempt + " has " +
-									`element[3][attempt][0]` +
+						aInfo = {"ip": attempt,
+								 "failures": element[3][attempt][0],
+								 "failtime": failTime}
+						logSys.info(element[0] + ": " + aInfo["ip"] +
+									" has " + `aInfo["failures"]` +
 									" login failure(s). Banned.")
-						element[2].addBanIP(attempt, conf["debug"])
+						element[2].addBanIP(aInfo, conf["debug"])
 						del element[3][attempt]
 			
 		except KeyboardInterrupt:
diff --git a/firewall/firewall.py b/firewall/firewall.py
index 4d8e364d..e022f78c 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -43,23 +43,27 @@ class Firewall:
 		self.unBanRule = unBanRule
 		self.banTime = banTime
 	
-	def addBanIP(self, ip, debug):
+	def addBanIP(self, aInfo, debug):
 		""" Bans an IP.
 		"""
+		ip = aInfo["ip"]
 		if not self.inBanList(ip):
-			logSys.warn("Ban "+ip)
-			self.banList[ip] = time.time()
-			executeCmd(self.banIP(ip), debug)
+			crtTime = time.time()
+			logSys.warn("Ban " + ip)
+			self.banList[ip] = crtTime
+			aInfo["bantime"] = crtTime
+			executeCmd(self.banIP(aInfo), debug)
 		else:
 			logSys.error(ip+" already in ban list")
 	
-	def delBanIP(self, ip, debug):
+	def delBanIP(self, aInfo, debug):
 		""" Unban an IP.
 		"""
+		ip = aInfo["ip"]
 		if self.inBanList(ip):
 			logSys.warn("Unban "+ip)
 			del self.banList[ip]
-			executeCmd(self.unBanIP(ip), debug)
+			executeCmd(self.unBanIP(aInfo), debug)
 		else:
 			logSys.error(ip+" not in ban list")
 	
@@ -73,10 +77,12 @@ class Firewall:
 		"""
 		banListTemp = self.banList.copy()
 		for element in banListTemp.iteritems():
-			ip = element[0]
 			btime = element[1]
 			if btime < time.time()-self.banTime:
-				self.delBanIP(ip, debug)
+				aInfo = {"ip": element[0],
+						 "bantime": btime,
+						 "unbantime": time.time()}
+				self.delBanIP(aInfo, debug)
 	
 	def flushBanList(self, debug):
 		""" Flushes the ban list and of course the firewall rules.
@@ -84,26 +90,29 @@ class Firewall:
 		"""
 		banListTemp = self.banList.copy()
 		for element in banListTemp.iteritems():
-			ip = element[0]
-			self.delBanIP(ip, debug)
+			aInfo = {"ip": element[0],
+					 "bantime": element[1],
+					 "unbantime": time.time()}
+			self.delBanIP(aInfo, debug)
 			
-	def banIP(self, ip):
+	def banIP(self, aInfo):
 		""" Returns query to ban IP.
 		"""
-		query = self.replaceTag(self.banRule, ip)
+		query = self.replaceTag(self.banRule, aInfo)
 		return query
 	
-	def unBanIP(self, ip):
+	def unBanIP(self, aInfo):
 		""" Returns query to unban IP.
 		"""
-		query = self.replaceTag(self.unBanRule, ip)
+		query = self.replaceTag(self.unBanRule, aInfo)
 		return query
 	
-	def replaceTag(self, query, ip):
-		""" Replace tag in query
+	def replaceTag(self, query, aInfo):
+		""" Replace tags in query
 		"""
 		string = query
-		string = string.replace("<ip>", ip)
+		for tag in aInfo:
+			string = string.replace('<'+tag+'>', `aInfo[tag]`)
 		return string
 	
 	def viewBanList(self):

From 6ae8556d15652f5662866e0f1e2927259695e676 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Jul 2005 13:06:25 +0000
Subject: [PATCH 119/549] - Added mail notification support - Added CIDR mask
 support in ignoreip

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@129 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 63 +++++++++++++++++++++++++++++++++---
 1 file changed, 59 insertions(+), 4 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index a1c0e070..f64fddf5 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -42,11 +42,12 @@ maxretry = 3
 bantime = 600
 
 # Option:  ignoreip
-# Notes.:  space separated list of IP's to be ignored by fail2ban
-#          Example:  ignoreip = 192.168.0.1 123.45.235.65
-# Values:  IP  Default:  
+# Notes.:  space separated list of IP's to be ignored by fail2ban.
+#          You can use CIDR mask in order to specify a range.
+#          Example:  ignoreip = 192.168.0.1/24 123.45.235.65
+# Values:  IP  Default:  192.168.0.0/24
 #
-ignoreip = 
+ignoreip = 192.168.0.0/24
 
 # Option:  cmdstart
 # Notes.:  command executed once at the start of Fail2Ban
@@ -66,6 +67,60 @@ cmdend =
 #
 polltime = 1
 
+[MAIL]
+# Option:  enabled
+# Notes.:  enable mail notification when banning an IP address.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  host
+# Notes.:  host running the mail server.
+# Values:  STR  Default:  localhost
+#
+host = localhost
+
+# Option:  port
+# Notes.:  port of the mail server.
+# Values:  INT  Default:  25
+#
+port = 25
+
+# Option:  from
+# Notes.:  e-mail address of the sender.
+# Values:  MAIL  Default:  fail2ban
+#
+from = fail2ban
+
+# Option:  to
+# Notes.:  e-mail address of the receiver.
+# Values:  MAIL  Default:  root
+#
+to = root
+
+# Option:  subject
+# Notes.:  subject of the e-mail.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+# Values:  TEXT  Default:  [Fail2Ban] Banned <ip>
+#
+subject = [Fail2Ban] Banned <ip>
+
+# Option:  message
+# Notes.:  message of the e-mail.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <br>  new line
+# Values:  TEXT  Default:  
+#
+message = Hi,<br>
+		  The IP <ip> has just been banned by Fail2Ban after
+		  <failures> attempts.<br>
+		  Regards,<br>
+		  Fail2Ban
+
 # You can define a new section for each log file to check for
 # password failure. Each section has to define the following
 # options: logfile, fwban, fwunban, timeregex, timepattern,

From 8a94f873deecc06215cd6f05f6bd6ec83ae9d243 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Jul 2005 13:07:35 +0000
Subject: [PATCH 120/549] - Removed MAIL for getSections()

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@130 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 confreader/configreader.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/confreader/configreader.py b/confreader/configreader.py
index a1227055..981292ec 100644
--- a/confreader/configreader.py
+++ b/confreader/configreader.py
@@ -48,9 +48,12 @@ class ConfigReader:
 	
 	def getSections(self):
 		""" Returns all the sections present in the configuration
-			file except the DEFAULT section.
+			file except the DEFAULT and MAIL sections.
 		"""
-		return self.configParser.sections()
+		sections = self.configParser.sections()
+		sections.remove("MAIL")
+		logSys.debug("Found sections: " + `sections`)
+		return sections
 	
 	# Each optionValues entry is composed of an array with:
 	# 0 -> the type of the option

From dba169ae9c491434146efe12d3f82533944542b0 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Jul 2005 13:08:24 +0000
Subject: [PATCH 121/549] - Moved replaceTag() to utils/strings.py

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@131 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/firewall.py | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/firewall/firewall.py b/firewall/firewall.py
index e022f78c..66034e18 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -27,6 +27,7 @@ __license__ = "GPL"
 import time, os, log4py, re
 
 from utils.process import executeCmd
+from utils.strings import replaceTag
 
 # Gets the instance of log4py.
 logSys = log4py.Logger().get_instance()
@@ -98,23 +99,15 @@ class Firewall:
 	def banIP(self, aInfo):
 		""" Returns query to ban IP.
 		"""
-		query = self.replaceTag(self.banRule, aInfo)
+		query = replaceTag(self.banRule, aInfo)
 		return query
 	
 	def unBanIP(self, aInfo):
 		""" Returns query to unban IP.
 		"""
-		query = self.replaceTag(self.unBanRule, aInfo)
+		query = replaceTag(self.unBanRule, aInfo)
 		return query
 	
-	def replaceTag(self, query, aInfo):
-		""" Replace tags in query
-		"""
-		string = query
-		for tag in aInfo:
-			string = string.replace('<'+tag+'>', `aInfo[tag]`)
-		return string
-	
 	def viewBanList(self):
 		""" Prints the ban list on screen. Usefull for debugging.
 		"""

From a50d0ace814f048fb9cfbf845529b8567e422845 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Jul 2005 13:09:47 +0000
Subject: [PATCH 122/549] - Initial commit

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@132 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/mail.py    | 71 ++++++++++++++++++++++++++++++++++++++++++++++++
 utils/strings.py | 40 +++++++++++++++++++++++++++
 2 files changed, 111 insertions(+)
 create mode 100644 utils/mail.py
 create mode 100644 utils/strings.py

diff --git a/utils/mail.py b/utils/mail.py
new file mode 100644
index 00000000..aab02b4e
--- /dev/null
+++ b/utils/mail.py
@@ -0,0 +1,71 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import log4py, smtplib
+
+from utils.strings import replaceTag
+
+# Gets the instance of log4py.
+logSys = log4py.Logger().get_instance()
+
+class Mail:
+	""" Mailer class
+	"""
+	
+	def __init__(self, host, port = 25):
+		self.host = host
+		self.port = port
+		
+	def setFromAddr(self, fromAddr):
+		""" Set from: address
+		"""
+		self.fromAddr = fromAddr
+	
+	def setToAddr(self, toAddr):
+		""" Set to: address
+		"""
+		self.toAddr = toAddr.split()
+
+	def sendmail(self, subject, message, aInfo):
+		""" Send an email using smtplib
+		"""
+		subj = replaceTag(subject, aInfo)
+		msg = replaceTag(message, aInfo)
+		
+		mail = ("From: %s\r\nTo: %s\r\nSubject: %s\r\n\r\n" %
+				 (self.fromAddr, ", ".join(self.toAddr), subj)) + msg
+		
+		try:
+			server = smtplib.SMTP(self.host, self.port)
+			#server.set_debuglevel(1)
+			server.sendmail(self.fromAddr, self.toAddr, mail)
+			logSys.debug("Email sent to " + `self.toAddr`)
+			server.quit()	
+		except Exception:
+			logSys.error("Unable to send mail to " + self.host + ":" +
+						 `self.port` + " from " + self.fromAddr + " to " +
+						 `self.toAddr`)
+		
\ No newline at end of file
diff --git a/utils/strings.py b/utils/strings.py
new file mode 100644
index 00000000..ae0108d2
--- /dev/null
+++ b/utils/strings.py
@@ -0,0 +1,40 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import log4py
+
+# Gets the instance of log4py.
+logSys = log4py.Logger().get_instance()
+
+def replaceTag(query, aInfo):
+	""" Replace tags in query
+	"""
+	string = query
+	for tag in aInfo:
+		string = string.replace('<'+tag+'>', `aInfo[tag]`)
+	# New line
+	string = string.replace('<br>', '\n')
+	return string

From 3acb0b854864af6a4eac7e24d46ba662149bce32 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Jul 2005 13:10:14 +0000
Subject: [PATCH 123/549] - Added CIDR mask support

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@133 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 12 +++++++++++-
 utils/dns.py           | 20 +++++++++++++++++++-
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index 79f5e7db..eb9169ab 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -64,7 +64,17 @@ class LogReader:
 	def inIgnoreIPList(self, ip):
 		""" Checks if IP is in the ignore list.
 		"""
-		return ip in self.ignoreIpList
+		for i in self.ignoreIpList:
+			s = i.split('/', 1)
+			# IP address without CIDR mask
+			if len(s) == 1:
+				s.insert(1, '32')
+			s[1] = long(s[1])
+			a = cidr(s[0], s[1])
+			b = cidr(ip, s[1])
+			if a == b:
+				return True
+		return False
 	
 	def openLogFile(self):
 		""" Opens the log file specified on init.
diff --git a/utils/dns.py b/utils/dns.py
index ce629d69..729f599d 100644
--- a/utils/dns.py
+++ b/utils/dns.py
@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import os, re, socket
+import os, re, socket, struct
 
 def dnsToIp(dns):
 	""" Convert a DNS into an IP address using the Python socket module.
@@ -71,3 +71,21 @@ def textToIp(text):
 			for e in dns:
 				ipList.append(e)
 	return ipList
+
+def cidr(i, n):
+	""" Convert an IP address string with a CIDR mask into a 32-bit
+		integer.
+	"""
+	# 32-bit IPv4 address mask
+	MASK = 0xFFFFFFFFL
+	return ~(MASK >> n) & MASK & addr2bin(i)
+
+def addr2bin(str):
+	""" Convert a string IPv4 address into an unsigned integer.
+	"""
+	return struct.unpack("!L", socket.inet_aton(str))[0]
+
+def bin2addr(addr):
+	""" Convert a numeric IPv4 address into string n.n.n.n form.
+	"""
+	return socket.inet_ntoa(struct.pack("!L", addr))

From 0a8905e3a66548e2c163f4ead82c338580046ad4 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Jul 2005 13:11:58 +0000
Subject: [PATCH 124/549] - Fixed bug #1234699 - Added mail notification
 support

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@134 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 86 ++++++++++++++++++++++++++++++++++++-----------------
 1 file changed, 58 insertions(+), 28 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index 0f3f536e..60de7aa5 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -31,6 +31,7 @@ from firewall.firewall import Firewall
 from logreader.logreader import LogReader
 from confreader.configreader import ConfigReader
 from utils.process import *
+from utils.mail import Mail
 from version import version
 
 # Gets the instance of log4py.
@@ -55,7 +56,7 @@ def dispUsage():
 	print "  -h         display this help message"
 	print "  -i <IP(s)> IP(s) to ignore"
 	print "  -k         kill a currently running Fail2Ban instance"
-	print "  -l <FILE>  log message in FILE"
+	print "  -l <FILE>  log messages in FILE"
 	print "  -r <VALUE> allow a max of VALUE password failure"
 	print "  -t <TIME>  ban IP for TIME seconds"
 	print "  -v         verbose. Use twice for greater effect"
@@ -119,7 +120,6 @@ def getCmdLineOptions(optList):
 		if opt[0] == "-d":
 			conf["debug"] = True
 		if opt[0] == "-l":
-			conf["logging"] = True
 			conf["logfile"] = opt[1]
 		if opt[0] == "-t":
 			try:
@@ -150,7 +150,6 @@ def main():
 	
 	conf["verbose"] = 0
 	conf["conffile"] = "/etc/fail2ban.conf"
-	conf["logging"] = False
 	
 	# Reads the command line options.
 	try:
@@ -189,32 +188,39 @@ def main():
 	getCmdLineOptions(optList)
 
 	# Process some options
-	for c in conf:
-		if c == "verbose":
-			logSys.warn("Verbose level is "+`conf[c]`)
-			if conf[c] == 1:
-				logSys.set_loglevel(log4py.LOGLEVEL_VERBOSE)
-			elif conf[c] > 1:
-				logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
-		elif c == "debug" and conf[c]:
+	# Verbose level
+	if conf["verbose"]:
+		logSys.warn("Verbose level is "+`conf["verbose"]`)
+		if conf["verbose"] == 1:
+			logSys.set_loglevel(log4py.LOGLEVEL_VERBOSE)
+		elif conf["verbose"] > 1:
 			logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
-			logSys.set_formatstring(log4py.FMT_DEBUG)
-		elif c == "background" and conf[c]:
-			retCode = createDaemon()
-			signal.signal(signal.SIGTERM, sigTERMhandler)
+		
+	# Set debug log level
+	if conf["debug"]:
+		logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
+		logSys.set_formatstring(log4py.FMT_DEBUG)
+		logSys.warn("DEBUG MODE: FIREWALL COMMANDS ARE _NOT_ EXECUTED BUT " +
+					"ONLY DISPLAYED IN THE LOG MESSAGES")
+
+	# Start Fail2Ban in daemon mode
+	if conf["background"]:
+		retCode = createDaemon()
+		signal.signal(signal.SIGTERM, sigTERMhandler)
+		if not retCode:
+			logSys.error("Unable to start daemon")
+			sys.exit(-1)
+		# Bug fix for #1234699
+		os.umask(0077)
+		try:
+			open(conf["logfile"], "a")
 			logSys.set_target(conf["logfile"])
-			if not retCode:
-				logSys.error("Unable to start daemon")
-				sys.exit(-1)
-		elif c == "logging" and conf[c]:
-			try:
-				open(conf["logfile"], "a")
-				logSys.set_target(conf["logfile"])
-			except IOError:
-				logSys.warn("Unable to log to "+conf["logfile"])
-				logSys.warn("Using default output for logging")
-		elif c == "ignoreip":
-			ignoreIPList = conf[c].split(' ')
+		except IOError:
+			logSys.error("Unable to log to " + conf["logfile"])
+			logSys.warn("Using default output for logging")
+	
+	# Ignores IP list
+	ignoreIPList = conf["ignoreip"].split(' ')
 	
 	# Checks for root user. This is necessary because log files
 	# are owned by root and firewall needs root access.
@@ -235,6 +241,26 @@ def main():
 	logSys.debug("BanTime is "+`conf["bantime"]`)
 	logSys.debug("retryAllowed is "+`conf["maxretry"]`)
 	
+	# Options
+	optionValues = (["bool", "enabled", False],
+					["str", "host", "localhost"],
+					["int", "port", "25"],
+					["str", "from", "root"],
+					["str", "to", "root"],
+					["str", "subject", "[Fail2Ban] Banned <ip>"],
+					["str", "message", "Fail2Ban notification"])
+	
+	# Gets global configuration options
+	mailConf = confReader.getLogOptions("MAIL", optionValues)
+	
+	# Create mailer if enabled
+	if mailConf["enabled"]:
+		logSys.debug("Mail enabled")
+		mail = Mail(mailConf["host"], mailConf["port"])
+		mail.setFromAddr(mailConf["from"])
+		mail.setToAddr(mailConf["to"])
+		logSys.debug("to: " + mailConf["to"] + " from: " + mailConf["from"])
+	
 	# Options
 	optionValues = (["bool", "enabled", True],
 					["str", "logfile", "/dev/null"],
@@ -252,7 +278,7 @@ def main():
 		if l["enabled"]:
 			# Creates a logreader object
 			lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
-								l["failregex"], conf["bantime"])
+							 l["failregex"], conf["bantime"])
 			# Creates a firewall object
 			fObj = Firewall(l["fwban"], l["fwunban"], conf["bantime"])
 			# Links them into a list. I'm not really happy
@@ -328,6 +354,10 @@ def main():
 									" has " + `aInfo["failures"]` +
 									" login failure(s). Banned.")
 						element[2].addBanIP(aInfo, conf["debug"])
+						# Send a mail notification
+						if 'mail' in locals():
+							mail.sendmail(mailConf["subject"],
+										  mailConf["message"], aInfo)
 						del element[3][attempt]
 			
 		except KeyboardInterrupt:

From 158110aa46b2a500db7007b0fd6132eb0e940d43 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Jul 2005 13:12:22 +0000
Subject: [PATCH 125/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@135 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 21 ++++++++++++---------
 MANIFEST  |  2 ++
 README    | 11 ++++++-----
 3 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 9cdbfc91..b4acc6d9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,11 +4,14 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.?.?)                           ??/??/2005
+Fail2Ban (version 0.5.0)                           2005/07/12
 =============================================================
 
-ver. 0.?.? (??/??/2005) - ???
+ver. 0.5.0 (2005/07/12) - beta
 ----------
+- Added support for CIDR mask in ignoreip
+- Added mail notification support
+- Fixed bug #1234699
 - Added tags replacement in rules definition. Should allow a
   clean solution for Feature Request #1229479
 - Removed "interface" and "firewall" options
@@ -19,7 +22,7 @@ ver. 0.?.? (??/??/2005) - ???
 - Added an initd script for RedHat/Fedora. Thanks to Andrey
   G. Grozin
 
-ver. 0.4.1 (06/30/2005) - stable
+ver. 0.4.1 (2005/06/30) - stable
 ----------
 - Fixed textToDNS method which generated wrong matches for
   "rhost=12-xyz...". Thanks to Tom Pike
@@ -28,19 +31,19 @@ ver. 0.4.1 (06/30/2005) - stable
 - Changed default PID lock file location from /tmp to
   /var/run
 
-ver. 0.4.0 (04/24/2005) - stable
+ver. 0.4.0 (2005/04/24) - stable
 ----------
 - Fixed textToDNS which did not recognize strings like
   "12-345-67-890.abcd.mnopqr.xyz"
 
-ver. 0.3.1 (03/31/2005) - beta
+ver. 0.3.1 (2005/03/31) - beta
 ----------
 - Corrected level of messages
 - Added DNS lookup support
 - Improved parsing speed. Only parse the new log messages
 - Added a second verbose level (-vv)
 
-ver. 0.3.0 (02/24/2005) - beta
+ver. 0.3.0 (2005/02/24) - beta
 ----------
 - Re-writting of parts of the code in order to handle several
   log files with different rules
@@ -51,7 +54,7 @@ ver. 0.3.0 (02/24/2005) - beta
 - Added ipfw-start-rule option (thanks to Robert Edeker)
 - Added -k option which kills a currently running Fail2Ban
 
-ver. 0.1.2 (11/21/2004) - beta
+ver. 0.1.2 (2004/11/21) - beta
 ----------
 - Add ipfw and ipfwadm support. The rules are taken from
   BlockIt. Thanks to Robert Edeker
@@ -59,7 +62,7 @@ ver. 0.1.2 (11/21/2004) - beta
   Robert Edeker who reminded me this
 - Small code cleaning
 
-ver. 0.1.1 (10/23/2004) - beta
+ver. 0.1.1 (2004/10/23) - beta
 ----------
 - Add SIGTERM handler in order to exit nicely when in daemon
   mode
@@ -73,6 +76,6 @@ ver. 0.1.1 (10/23/2004) - beta
 - Code documentation
 
 
-ver. 0.1.0 (10/12/2004) - alpha
+ver. 0.1.0 (2004/10/12) - alpha
 ----------
 - Initial release
diff --git a/MANIFEST b/MANIFEST
index 0be0cc71..ebe7a9c5 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -15,6 +15,8 @@ confreader/configreader.py
 utils/__init__.py
 utils/dns.py
 utils/process.py
+utils/mail.py
+utils/strings.py
 config/fail2ban.conf.default
 config/gentoo-initd
 config/gentoo-confd
diff --git a/README b/README
index c23b9d5c..bf9e1809 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.?.?)                           ??/??/2005
+Fail2Ban (version 0.5.0)                           2005/07/12
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -59,8 +59,8 @@ Require: python-2.3 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.4.1.tar.bz2
-> cd fail2ban-0.4.1
+> tar xvfj fail2ban-0.5.0.tar.bz2
+> cd fail2ban-0.5.0
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The
@@ -100,10 +100,11 @@ options:
   -h         display this help message
   -i <IP(s)> IP(s) to ignore
   -k         kill a currently running Fail2Ban instance
-  -l <FILE>  log message in FILE
+  -l <FILE>  log messages in FILE
   -r <VALUE> allow a max of VALUE password failure
   -t <TIME>  ban IP for TIME seconds
   -v         verbose. Use twice for greater effect
+  -V         print software version
 
 Contact:
 --------
@@ -111,7 +112,7 @@ Contact:
 You need some new features, you found bugs or you just
 appreciate this program, you can contact me at :
 
-Website: http://www.sourceforge.net/projects/fail2ban
+Website: http://fail2ban.sourceforge.net
 
 Cyril Jaquier: <lostcontrol@users.sourceforge.net>
 

From df28acf495ea995b1e4c1b8de88e298f29e2a929 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Jul 2005 13:12:40 +0000
Subject: [PATCH 126/549] - Prepared for 0.5.0

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@136 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.py b/version.py
index 8f21d385..414a8ed4 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.5.0-CVS"
+version = "0.5.0"

From e919d8372b2e732400b12eb222f6afe22fb9c50b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 15 Jul 2005 14:04:39 +0000
Subject: [PATCH 127/549] - Initial commit. Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@137 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/debian-initd | 61 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 config/debian-initd

diff --git a/config/debian-initd b/config/debian-initd
new file mode 100644
index 00000000..b3892991
--- /dev/null
+++ b/config/debian-initd
@@ -0,0 +1,61 @@
+#! /bin/sh
+#
+# skeleton	example file to build /etc/init.d/ scripts.
+#		This file should be used to construct scripts for /etc/init.d.
+#
+#		Written by Miquel van Smoorenburg <miquels@cistron.nl>.
+#		Modified for Debian 
+#		by Ian Murdock <imurdock@gnu.ai.mit.edu>.
+#
+# Version:	@(#)skeleton  1.9  26-Feb-2001  miquels@cistron.nl
+#
+
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+DAEMON=/usr/bin/fail2ban
+NAME=fail2ban
+DESC=fail2ban
+PIDFILE=/var/run/$NAME.pid
+
+test -x $DAEMON || exit 0
+
+# Include fail2ban defaults if available
+if [ -f /etc/default/fail2ban ] ; then
+	. /etc/default/fail2ban
+fi
+DAEMON_OPTS=$FAIL2BAN_OPTS
+set -e
+
+case "$1" in
+  start)
+	echo -n "Starting $DESC: "
+        [ -f $PIDFILE ] && [ ! -d /proc/`cat $PIDFILE` ] && rm -f $PIDFILE
+	start-stop-daemon --start --quiet --pidfile /var/run/$NAME.pid \
+	        -b --exec $DAEMON -- $DAEMON_OPTS
+	echo "$NAME."
+	;;
+  stop)
+	echo -n "Stopping $DESC: "
+	start-stop-daemon --stop --quiet --pidfile /var/run/$NAME.pid 
+        rm -f $PIDFILE
+	echo "$NAME."
+	;;
+  restart|force-reload)
+	#
+	#	If the "reload" option is implemented, move the "force-reload"
+	#	option to the "reload" entry above. If not, "force-reload" is
+	#	just the same as "restart".
+	#
+	echo -n "Restarting $DESC: "
+        ( $0 stop )
+	sleep 1
+        $0 start
+	;;
+  *)
+	N=/etc/init.d/$NAME
+	# echo "Usage: $N {start|stop|restart|reload|force-reload}" >&2
+	echo "Usage: $N {start|stop|restart|force-reload}" >&2
+	exit 1
+	;;
+esac
+
+exit 0
\ No newline at end of file

From 6be14566e120a5da91b0bcb9848671eda6018806 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 15 Jul 2005 14:06:11 +0000
Subject: [PATCH 128/549] - Corrected logfile path - Changed firewall rules in
 order to create a specific chain for each section

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@138 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 39 ++++++++++++++++++++++--------------
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index f64fddf5..2e7204ec 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -93,7 +93,8 @@ port = 25
 from = fail2ban
 
 # Option:  to
-# Notes.:  e-mail address of the receiver.
+# Notes.:  e-mail addresses of the receiver. Addresses are space
+#          separated.
 # Values:  MAIL  Default:  root
 #
 to = root
@@ -116,10 +117,10 @@ subject = [Fail2Ban] Banned <ip>
 # Values:  TEXT  Default:  
 #
 message = Hi,<br>
-		  The IP <ip> has just been banned by Fail2Ban after
-		  <failures> attempts.<br>
-		  Regards,<br>
-		  Fail2Ban
+          The IP <ip> has just been banned by Fail2Ban after
+          <failures> attempts.<br>
+          Regards,<br>
+          Fail2Ban
 
 # You can define a new section for each log file to check for
 # password failure. Each section has to define the following
@@ -137,19 +138,23 @@ enabled = false
 # Notes.:  logfile to monitor.
 # Values:  FILE  Default:  /var/log/httpd/access_log
 #
-logfile = /home/cyril/workspace/fail2ban-unstable/log-test/apache
+logfile = /var/log/httpd/access_log
 
 # Option:  fwstart
 # Notes.:  command executed once at the start of Fail2Ban
 # Values:  CMD  Default:
 #
-fwstart = 
+fwstart = iptables -N FAIL2BAN-HTTP
+          iptables -I INPUT -i eth0 -p tcp --dport http -j FAIL2BAN-HTTP
+          iptables -A FAIL2BAN-HTTP -j RETURN
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD  Default:
 #
-fwend = 
+fwend = iptables -D INPUT -i eth0 -p tcp --dport http -j FAIL2BAN-HTTP
+        iptables -D FAIL2BAN-HTTP -j RETURN
+        iptables -X FAIL2BAN-HTTP
 
 # Option:  fwban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -161,7 +166,7 @@ fwend =
 # Values:  CMD
 # Default: iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 #
-fwban = iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
+fwban = iptables -I FAIL2BAN-HTTP 1 -i eth0 -s <ip> -j DROP
 
 # Option:  fwunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -172,7 +177,7 @@ fwban = iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 # Values:  CMD
 # Default: iptables -D INPUT -i eth0 -s <ip> -j DROP
 #
-fwunban = iptables -D INPUT -i eth0 -s <ip> -j DROP
+fwunban = iptables -D FAIL2BAN-HTTP -i eth0 -s <ip> -j DROP
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in Apache logfile.
@@ -205,19 +210,23 @@ enabled = true
 # Notes.:  logfile to monitor.
 # Values:  FILE  Default:  /var/log/secure
 #
-logfile = /home/cyril/workspace/fail2ban-unstable/log-test/test
+logfile = /var/log/secure
 
 # Option:  fwstart
 # Notes.:  command executed once at the start of Fail2Ban
 # Values:  CMD  Default:
 #
-fwstart = 
+fwstart = iptables -N FAIL2BAN-SSH
+          iptables -I INPUT -i eth0 -p tcp --dport ssh -j FAIL2BAN-SSH
+          iptables -A FAIL2BAN-SSH -j RETURN
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD  Default:
 #
-fwend = 
+fwend = iptables -D INPUT -i eth0 -p tcp --dport ssh -j FAIL2BAN-SSH
+        iptables -D FAIL2BAN-SSH -j RETURN
+        iptables -X FAIL2BAN-SSH
 
 # Option:  fwbanrule
 # Notes.:  command executed when banning an IP. Take care that the
@@ -229,7 +238,7 @@ fwend =
 # Values:  CMD
 # Default: iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 #
-fwban = iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
+fwban = iptables -I FAIL2BAN-SSH 1 -i eth0 -s <ip> -j DROP
 
 # Option:  fwunbanrule
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -240,7 +249,7 @@ fwban = iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 # Values:  CMD
 # Default: iptables -D INPUT -i eth0 -s <ip> -j DROP
 #
-fwunban = iptables -D INPUT -i eth0 -s <ip> -j DROP
+fwunban = iptables -D FAIL2BAN-SSH -i eth0 -s <ip> -j DROP
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in SSH logfile.

From d2f7dc05217992a23eaf4e017db8ee7b92b63569 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 15 Jul 2005 14:07:08 +0000
Subject: [PATCH 129/549] - Fixed banList which must not be static

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@139 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 firewall/firewall.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/firewall/firewall.py b/firewall/firewall.py
index 66034e18..9b072c78 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -37,12 +37,11 @@ class Firewall:
 		the IP.
 	"""
 	
-	banList = dict()
-	
 	def __init__(self, banRule, unBanRule, banTime):
 		self.banRule = banRule
 		self.unBanRule = unBanRule
 		self.banTime = banTime
+		self.banList = dict()
 	
 	def addBanIP(self, aInfo, debug):
 		""" Bans an IP.

From 3b154baae52589be16372f7efe83d6c71141f84b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 15 Jul 2005 14:08:17 +0000
Subject: [PATCH 130/549] - Removed os.umask(0) as it is a potential security
 issue. Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@140 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/process.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/utils/process.py b/utils/process.py
index 9cfaf789..4739303e 100644
--- a/utils/process.py
+++ b/utils/process.py
@@ -76,8 +76,6 @@ def createDaemon():
 			# Ensure that the daemon doesn't keep any directory in use.  Failure
 			# to do this could make a filesystem unmountable.
 			os.chdir("/")
-			# Give the child complete control over permissions.
-			os.umask(0)
 		else:
 			os._exit(0)	  # Exit parent (the first child) of the second child.
 	else:

From 8e43d98ca410f0a1f6c1977c78a2e46a33d3e3e4 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 15 Jul 2005 14:11:21 +0000
Subject: [PATCH 131/549] - Moved path.append() before importing log4py

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@141 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fail2ban b/fail2ban
index 33c7d364..abc9f9e2 100755
--- a/fail2ban
+++ b/fail2ban
@@ -28,6 +28,10 @@ __license__ = "GPL"
 
 from sys import exit, path
 
+# Appends our own modules path. Added before log4py import
+# because log4py could be distributed with Fail2Ban.
+path.append("/usr/lib/fail2ban")
+
 # Checks for required libs
 # Checks if log4py is present.
 try:
@@ -36,9 +40,6 @@ except:
 	print "log4py is needed (see README)"
 	exit(-1)
 
-# Appends our own modules path
-path.append('/usr/lib/fail2ban')
-
 # Now we can import our module
 import fail2ban
 

From cd1ede8d5ba15c5ed45ed69438fe35a3d2028bbf Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 15 Jul 2005 14:11:49 +0000
Subject: [PATCH 132/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@142 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  | 11 ++++++++++-
 MANIFEST   |  1 +
 TODO       | 10 ++++------
 version.py |  2 +-
 4 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index b4acc6d9..daa5bcb1 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,18 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.5.0)                           2005/07/12
+Fail2Ban (version 0.5.?)                           2005/07/??
 =============================================================
 
+ver. 0.5.? (2005/07/??) - beta
+----------
+- Changed iptables rules in order to create a separated chain
+  for each section
+- Fixed static banList in firewall.py
+- Added an initd script for Debian. Thanks to Yaroslav
+  Halchenko
+- Check for obsolete files after install
+
 ver. 0.5.0 (2005/07/12) - beta
 ----------
 - Added support for CIDR mask in ignoreip
diff --git a/MANIFEST b/MANIFEST
index ebe7a9c5..31824576 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -21,3 +21,4 @@ config/fail2ban.conf.default
 config/gentoo-initd
 config/gentoo-confd
 config/redhat-initd
+config/debian-initd
diff --git a/TODO b/TODO
index 569a127c..9ba78225 100644
--- a/TODO
+++ b/TODO
@@ -7,9 +7,7 @@
 ToDo
 =============================================================
 
-- cleanup fail2ban.py
-- improve configuration file and command line options
-  handling
-- improve installation process
-- add init script
-- use FAM (inotify, gamin, ...)
+See Feature Request Tracking System at SourceForge.net
+
+- improve installation process (better prefix support)
+- add better documentation (man page)
diff --git a/version.py b/version.py
index 414a8ed4..8f21d385 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.5.0"
+version = "0.5.0-CVS"

From 2b8df84fa916df5511a1a9f5d30ebe207b901306 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 15 Jul 2005 14:12:51 +0000
Subject: [PATCH 133/549] - Changed Fail2Ban description

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@143 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban.py b/fail2ban.py
index 60de7aa5..d492f35e 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -47,7 +47,7 @@ def dispUsage():
 	print "Usage: "+sys.argv[0]+" [OPTIONS]"
 	print
 	print "Fail2Ban v"+version+" reads log file that contains password failure report"
-	print "and bans the corresponding IP address using iptables."
+	print "and bans the corresponding IP addresses using firewall rules."
 	print
 	print "  -b         start fail2ban in background"
 	print "  -d         start fail2ban in debug mode"

From 74dfb8440e9b2319aa5880d4d45bba64328789f2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 15 Jul 2005 14:14:12 +0000
Subject: [PATCH 134/549] - Added obsolete files detection and update config
 reminder after install

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@144 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 setup.py | 48 +++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 39 insertions(+), 9 deletions(-)

diff --git a/setup.py b/setup.py
index d4ea5dd5..9c394177 100755
--- a/setup.py
+++ b/setup.py
@@ -28,15 +28,45 @@ __license__ = "GPL"
 
 from distutils.core import setup
 from version import version
+from os.path import isfile, join
+from sys import exit, argv
 
 setup(
-        name = "fail2ban",
-        version = version,
-        description = "Ban IPs that make too many password failure",
-        author = "Cyril Jaquier",
-        author_email = "lostcontrol@users.sourceforge.net",
-        url = "http://fail2ban.sourceforge.net",
-        scripts = ['fail2ban'],
-        py_modules = ['fail2ban', 'version'],
-        packages = ['firewall', 'logreader', 'confreader', 'utils']
+	name = "fail2ban",
+	version = version,
+	description = "Ban IPs that make too many password failure",
+	author = "Cyril Jaquier",
+	author_email = "lostcontrol@users.sourceforge.net",
+	url = "http://fail2ban.sourceforge.net",
+	scripts = ['fail2ban'],
+	py_modules = ['fail2ban', 'version'],
+	packages = ['firewall', 'logreader', 'confreader', 'utils']
 )
+
+# Do some checks after installation
+# Search for obsolete files.
+obsoleteFiles = []
+elements = {"/usr/bin/": ["fail2ban.py"],
+			"/usr/lib/fail2ban/firewall/": ["iptables.py", "ipfwadm.py",
+											"ipfw.py"]}
+for dir in elements:
+	for f in elements[dir]:
+		path = join(dir, f)
+		if isfile(path):
+			obsoleteFiles.append(path)
+if obsoleteFiles:
+	print
+	print "Obsolete files from previous Fail2Ban versions were found on " \
+		  "your system."
+	print "Please delete them:"
+	print
+	for f in obsoleteFiles:
+		print "\t" + f
+	print
+
+# Update config file
+if argv[1] == "install":
+	print
+	print "Please do not forget to update your configuration file."
+	print "Use config/fail2ban.conf.default as example."
+	print

From bb430ec25c99f636ca606514c9fda550ad3af5d0 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 15 Jul 2005 19:27:38 +0000
Subject: [PATCH 135/549] - Removed logfile option and added logtargets

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@145 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 12 +++++------
 fail2ban.py                  | 40 ++++++++++++++++++++++++------------
 2 files changed, 33 insertions(+), 19 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 2e7204ec..581555ca 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -17,18 +17,18 @@ background = false
 #
 debug = false
 
+# Option:  logtargets
+# Notes.:  log targets. Space separated list of logging targets.
+# Values:  STDOUT STDERR SYSLOG file  Default:  STDOUT /var/log/fail2ban.log
+#
+logtargets = STDOUT /var/log/fail2ban.log
+
 # Option:  pidlock
 # Notes.:  path of the PID lock file (must be able to write to file).
 # Values:  FILE  Default:  /var/run/fail2ban.pid
 #
 pidlock = /var/run/fail2ban.pid
 
-# Option:  logfile
-# Notes.:  logfile for logging fail2ban messages.
-# Values:  FILE  Default:  /var/log/fail2ban.log
-#
-logfile = /var/log/fail2ban.log
-
 # Option:  maxretry
 # Notes.:  number of retrys before IP gets banned.
 # Values:  NUM  Default:  3
diff --git a/fail2ban.py b/fail2ban.py
index d492f35e..dd380263 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -56,7 +56,6 @@ def dispUsage():
 	print "  -h         display this help message"
 	print "  -i <IP(s)> IP(s) to ignore"
 	print "  -k         kill a currently running Fail2Ban instance"
-	print "  -l <FILE>  log messages in FILE"
 	print "  -r <VALUE> allow a max of VALUE password failure"
 	print "  -t <TIME>  ban IP for TIME seconds"
 	print "  -v         verbose. Use twice for greater effect"
@@ -119,8 +118,6 @@ def getCmdLineOptions(optList):
 			conf["background"] = True
 		if opt[0] == "-d":
 			conf["debug"] = True
-		if opt[0] == "-l":
-			conf["logfile"] = opt[1]
 		if opt[0] == "-t":
 			try:
 				conf["bantime"] = int(opt[1])
@@ -153,7 +150,7 @@ def main():
 	
 	# Reads the command line options.
 	try:
-		cmdOpts = 'hvVbdkc:l:t:i:r:p:'
+		cmdOpts = 'hvVbdkc:t:i:r:p:'
 		cmdLongOpts = ['help','version']
 		optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
 	except getopt.GetoptError:
@@ -171,8 +168,8 @@ def main():
 	
 	# Options
 	optionValues = (["bool", "background", False],
+					["str", "logtargets", "STDOUT /var/log/fail2ban.log"],
 					["bool", "debug", False],
-					["str", "logfile", "/var/log/fail2ban.log"],
 					["str", "pidlock", "/var/run/fail2ban.pid"],
 					["int", "maxretry", 3],
 					["int", "bantime", 600],
@@ -188,6 +185,31 @@ def main():
 	getCmdLineOptions(optList)
 
 	# Process some options
+	# Log targets
+	# Bug fix for #1234699
+	os.umask(0077)
+	# Remove all the targets before setting our own
+	logSys.remove_all_targets()
+	for target in conf["logtargets"].split():
+		if target == "STDOUT":
+			logSys.add_target(log4py.TARGET_SYS_STDOUT)
+		elif target == "STDERR":
+			logSys.add_target(log4py.TARGET_SYS_STDERR)
+		elif target == "SYSLOG":
+			logSys.add_target(log4py.TARGET_SYSLOG)
+		else:
+			# Target should be a file
+			try:
+				open(target, "a")
+				logSys.add_target(target)
+			except IOError:
+				logSys.error("Unable to log to " + target)
+	
+	# Check if at least one target exists
+	if len(logSys.get_targets()) == 0:
+		logSys.add_target(log4py.TARGET_SYS_STDOUT)
+		logSys.error("No valid logging target found. Logging to STDOUT")
+	
 	# Verbose level
 	if conf["verbose"]:
 		logSys.warn("Verbose level is "+`conf["verbose"]`)
@@ -210,14 +232,6 @@ def main():
 		if not retCode:
 			logSys.error("Unable to start daemon")
 			sys.exit(-1)
-		# Bug fix for #1234699
-		os.umask(0077)
-		try:
-			open(conf["logfile"], "a")
-			logSys.set_target(conf["logfile"])
-		except IOError:
-			logSys.error("Unable to log to " + conf["logfile"])
-			logSys.warn("Using default output for logging")
 	
 	# Ignores IP list
 	ignoreIPList = conf["ignoreip"].split(' ')

From 5dbed848bc59d8db6ac06cbd57e88670bd33e764 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 15 Jul 2005 19:28:15 +0000
Subject: [PATCH 136/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@146 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 1 +
 README    | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index daa5bcb1..edd12bc9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,6 +9,7 @@ Fail2Ban (version 0.5.?)                           2005/07/??
 
 ver. 0.5.? (2005/07/??) - beta
 ----------
+- Added log targets in configuration file. Removed -l option
 - Changed iptables rules in order to create a separated chain
   for each section
 - Fixed static banList in firewall.py
diff --git a/README b/README
index bf9e1809..fda87782 100644
--- a/README
+++ b/README
@@ -100,7 +100,6 @@ options:
   -h         display this help message
   -i <IP(s)> IP(s) to ignore
   -k         kill a currently running Fail2Ban instance
-  -l <FILE>  log messages in FILE
   -r <VALUE> allow a max of VALUE password failure
   -t <TIME>  ban IP for TIME seconds
   -v         verbose. Use twice for greater effect

From bbfc65f5694d77b6c65f5def0c8de675ce40cca8 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 22 Jul 2005 21:10:29 +0000
Subject: [PATCH 137/549] - Fixed bug #1241756

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@147 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index eb9169ab..8d134666 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -186,6 +186,12 @@ class LogReader:
 		"""
 		date = list(time.strptime(value, self.timepattern))
 		if date[0] < 2000:
+			# There is probably no year field in the logs
 			date[0] = time.gmtime()[0]
+			# Bug fix for #1241756
+			# If the date is greater than the current time, we suppose
+			# that the log is not from this year but from the year before
+			if date > time.time():
+				date[0] -= 1
 		unixTime = time.mktime(date)
 		return unixTime

From ec299bd60f242e2ee4c2791f38b364c85af4552c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 22 Jul 2005 21:11:42 +0000
Subject: [PATCH 138/549] - Better check of IPv4 validity

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@148 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/dns.py | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/utils/dns.py b/utils/dns.py
index 729f599d..0dc060a9 100644
--- a/utils/dns.py
+++ b/utils/dns.py
@@ -55,6 +55,15 @@ def searchIP(text):
 	else:
 		return []
 
+def isValidIP(str):
+	""" Return true if str is a valid IP
+	"""
+	try:
+		socket.inet_aton(str)
+		return True
+	except socket.error:
+		return False
+
 def textToIp(text):
 	""" Return the IP of DNS found in a given text.
 	"""
@@ -62,7 +71,8 @@ def textToIp(text):
 	# Search for plain IP
 	plainIP = searchIP(text)
 	for element in plainIP:
-		ipList.append(element)
+		if isValidIP(element):
+			ipList.append(element)
 	if not ipList:
 		# Try to get IP from possible DNS
 		dnsList = textToDns(text)

From a3f30d8555236c7b5cf86d448590a564dc1ec022 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 22 Jul 2005 21:12:14 +0000
Subject: [PATCH 139/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@149 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG b/CHANGELOG
index edd12bc9..6e3050d6 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,6 +9,7 @@ Fail2Ban (version 0.5.?)                           2005/07/??
 
 ver. 0.5.? (2005/07/??) - beta
 ----------
+- Fixed bugs #1241756, #1239557
 - Added log targets in configuration file. Removed -l option
 - Changed iptables rules in order to create a separated chain
   for each section

From 02386131e9b10c8eea315e9e8ad805a492c9aa3a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 22 Jul 2005 21:13:19 +0000
Subject: [PATCH 140/549] - Fixed bug #1239557

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@150 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index dd380263..b93b6c51 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -27,12 +27,13 @@ __license__ = "GPL"
 import time, sys, getopt, os, string, signal, log4py
 from ConfigParser import *
 
+from version import version
 from firewall.firewall import Firewall
 from logreader.logreader import LogReader
 from confreader.configreader import ConfigReader
-from utils.process import *
 from utils.mail import Mail
-from version import version
+from utils.dns import *
+from utils.process import *
 
 # Gets the instance of log4py.
 logSys = log4py.Logger().get_instance()
@@ -305,8 +306,10 @@ def main():
 		element[1].addIgnoreIP("127.0.0.1")
 	while len(ignoreIPList) > 0:
 		ip = ignoreIPList.pop()
-		for element in logFwList:
-			element[1].addIgnoreIP(ip)
+		# Bug fix for #1239557
+		if isValidIP(ip):
+			for element in logFwList:
+				element[1].addIgnoreIP(ip)
 	
 	logSys.info("Fail2Ban v"+version+" is running")
 	# Execute global start command

From 891b8d9e8ac75eead15a2ab985bd3cd840a97348 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 23 Jul 2005 09:07:53 +0000
Subject: [PATCH 141/549] - Fixed a bug in the previous... bug fix

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@151 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index 8d134666..b7765d11 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -191,7 +191,7 @@ class LogReader:
 			# Bug fix for #1241756
 			# If the date is greater than the current time, we suppose
 			# that the log is not from this year but from the year before
-			if date > time.time():
+			if time.mktime(date) > time.time():
 				date[0] -= 1
 		unixTime = time.mktime(date)
 		return unixTime

From d6e7bc7b03d76244cc013644d7754fe8f56b7c58 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 23 Jul 2005 09:31:12 +0000
Subject: [PATCH 142/549] - Prepared for 0.5.1

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@152 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  |  4 ++--
 README     | 24 +++++++++++++-----------
 version.py |  2 +-
 3 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 6e3050d6..46d5771d 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.5.?)                           2005/07/??
+Fail2Ban (version 0.5.1)                           2005/07/23
 =============================================================
 
-ver. 0.5.? (2005/07/??) - beta
+ver. 0.5.1 (2005/07/23) - beta
 ----------
 - Fixed bugs #1241756, #1239557
 - Added log targets in configuration file. Removed -l option
diff --git a/README b/README
index fda87782..b82a42c0 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.5.0)                           2005/07/12
+Fail2Ban (version 0.5.1)                           2005/07/23
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -55,34 +55,36 @@ Installation:
 -------------
 
 Require: python-2.3 (http://www.python.org)
-         log4py-1.1 (http://sourceforge.net/projects/log4py)
+         log4py-1.3 (http://sourceforge.net/projects/log4py)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.5.0.tar.bz2
-> cd fail2ban-0.5.0
+> tar xvfj fail2ban-0.5.1.tar.bz2
+> cd fail2ban-0.5.1
 > python setup.py install
 
-This will install Fail2Ban into /usr/lib/fail2ban. The
-fail2ban.py executable is placed into /usr/bin.
+This will install Fail2Ban into /usr/lib/fail2ban. The fail2ban
+executable is placed into /usr/bin.
 
 Gentoo: an ebuild is available on the website.
 Debian: a package is available on the website.
 
 Fail2Ban should now be correctly installed. Just type:
 
-> fail2ban.py -h
+> fail2ban -h
 
 to see if everything is alright. You can configure fail2ban
 with a config file. Copy config/fail2ban.conf.default to
 /etc/fail2ban.conf.
 
-Gentoo users can use the initd script available in config/.
-Copy gentoo-initd to /etc/init.d/fail2ban and gentoo-confd
-to /etc/conf.d/fail2ban. You can start fail2ban and add it
-to your default runlevel:
+You can use the initd script available in config/. Copy
+<dist>-initd to /etc/init.d/fail2ban. Gentoo users must copy
+gentoo-confd to /etc/conf.d/fail2ban. You can start fail2ban:
 
 > /etc/init.d/fail2ban start
+
+Gentoo users can add it to the default runlevel:
+
 > rc-update add fail2ban default
 
 Configuration:
diff --git a/version.py b/version.py
index 8f21d385..96535407 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.5.0-CVS"
+version = "0.5.1"

From 46a4f1fcf34d64a97d45312209c6d9f731c0710c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 28 Jul 2005 20:18:59 +0000
Subject: [PATCH 143/549] - Changed custom chains to lowercase

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@154 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 581555ca..bbdce173 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -144,17 +144,17 @@ logfile = /var/log/httpd/access_log
 # Notes.:  command executed once at the start of Fail2Ban
 # Values:  CMD  Default:
 #
-fwstart = iptables -N FAIL2BAN-HTTP
-          iptables -I INPUT -i eth0 -p tcp --dport http -j FAIL2BAN-HTTP
-          iptables -A FAIL2BAN-HTTP -j RETURN
+fwstart = iptables -N fail2ban-http
+          iptables -I INPUT -i eth0 -p tcp --dport http -j fail2ban-http
+          iptables -A fail2ban-http -j RETURN
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD  Default:
 #
-fwend = iptables -D INPUT -i eth0 -p tcp --dport http -j FAIL2BAN-HTTP
-        iptables -D FAIL2BAN-HTTP -j RETURN
-        iptables -X FAIL2BAN-HTTP
+fwend = iptables -D INPUT -i eth0 -p tcp --dport http -j fail2ban-http
+        iptables -D fail2ban-http -j RETURN
+        iptables -X fail2ban-http
 
 # Option:  fwban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -166,7 +166,7 @@ fwend = iptables -D INPUT -i eth0 -p tcp --dport http -j FAIL2BAN-HTTP
 # Values:  CMD
 # Default: iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 #
-fwban = iptables -I FAIL2BAN-HTTP 1 -i eth0 -s <ip> -j DROP
+fwban = iptables -I fail2ban-http 1 -i eth0 -s <ip> -j DROP
 
 # Option:  fwunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -177,7 +177,7 @@ fwban = iptables -I FAIL2BAN-HTTP 1 -i eth0 -s <ip> -j DROP
 # Values:  CMD
 # Default: iptables -D INPUT -i eth0 -s <ip> -j DROP
 #
-fwunban = iptables -D FAIL2BAN-HTTP -i eth0 -s <ip> -j DROP
+fwunban = iptables -D fail2ban-http -i eth0 -s <ip> -j DROP
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in Apache logfile.
@@ -216,17 +216,17 @@ logfile = /var/log/secure
 # Notes.:  command executed once at the start of Fail2Ban
 # Values:  CMD  Default:
 #
-fwstart = iptables -N FAIL2BAN-SSH
-          iptables -I INPUT -i eth0 -p tcp --dport ssh -j FAIL2BAN-SSH
-          iptables -A FAIL2BAN-SSH -j RETURN
+fwstart = iptables -N fail2ban-ssh
+          iptables -I INPUT -i eth0 -p tcp --dport ssh -j fail2ban-ssh
+          iptables -A fail2ban-ssh -j RETURN
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD  Default:
 #
-fwend = iptables -D INPUT -i eth0 -p tcp --dport ssh -j FAIL2BAN-SSH
-        iptables -D FAIL2BAN-SSH -j RETURN
-        iptables -X FAIL2BAN-SSH
+fwend = iptables -D INPUT -i eth0 -p tcp --dport ssh -j fail2ban-ssh
+        iptables -D fail2ban-ssh -j RETURN
+        iptables -X fail2ban-ssh
 
 # Option:  fwbanrule
 # Notes.:  command executed when banning an IP. Take care that the
@@ -238,7 +238,7 @@ fwend = iptables -D INPUT -i eth0 -p tcp --dport ssh -j FAIL2BAN-SSH
 # Values:  CMD
 # Default: iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
 #
-fwban = iptables -I FAIL2BAN-SSH 1 -i eth0 -s <ip> -j DROP
+fwban = iptables -I fail2ban-ssh 1 -i eth0 -s <ip> -j DROP
 
 # Option:  fwunbanrule
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -249,7 +249,7 @@ fwban = iptables -I FAIL2BAN-SSH 1 -i eth0 -s <ip> -j DROP
 # Values:  CMD
 # Default: iptables -D INPUT -i eth0 -s <ip> -j DROP
 #
-fwunban = iptables -D FAIL2BAN-SSH -i eth0 -s <ip> -j DROP
+fwunban = iptables -D fail2ban-ssh -i eth0 -s <ip> -j DROP
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in SSH logfile.

From 8686151421590d6be9183c7bdebaafa6bc5809e4 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 28 Jul 2005 20:20:13 +0000
Subject: [PATCH 144/549] - Fixed crash on wrong option value in configuration
 file

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@155 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 confreader/configreader.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/confreader/configreader.py b/confreader/configreader.py
index 981292ec..e413103b 100644
--- a/confreader/configreader.py
+++ b/confreader/configreader.py
@@ -77,5 +77,9 @@ class ConfigReader:
 			except NoOptionError:
 				logSys.warn("No '" + option[1] + "' defined in '" + sec + "'")
 				values[option[1]] = option[2]
+			except ValueError:
+				logSys.warn("Wrong value for '" + option[1] + "' in '" + sec +
+							"'. Using default one: '" + `option[2]` + "'")
+				values[option[1]] = option[2]
 		return values
 		
\ No newline at end of file

From 45426598dd6f3c5438d6b7c1253eea8091c2c6a3 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 28 Jul 2005 20:27:26 +0000
Subject: [PATCH 145/549] - "maxretry" and "bantime" can be overridden in each
 section - Fixed bug #1246278 (excessive memory usage)

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@156 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index b7765d11..e96dc903 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -38,8 +38,9 @@ class LogReader:
 	"""
 	
 	def __init__(self, logPath, timeregex, timepattern, failregex,
-				  findTime = 3600):
+				  maxRetry, findTime):
 		self.logPath = logPath
+		self.maxRetry = maxRetry
 		self.timeregex = timeregex
 		self.timepattern = timepattern
 		self.failregex = failregex
@@ -50,6 +51,11 @@ class LogReader:
 		self.lastDate = 0
 		self.logStats = None
 	
+	def getMaxRetry(self):
+		""" Gets the maximum number of failures
+		"""
+		return self.maxRetry
+	
 	def getFindTime(self):
 		""" Gets the find time.
 		"""
@@ -130,7 +136,7 @@ class LogReader:
 		logFile = self.openLogFile()
 		self.setFilePos(logFile)
 		lastLine = ''
-		for line in logFile.readlines():
+		for line in logFile:
 			lastLine = line
 			failList = self.findFailure(line)
 			for element in failList:

From 84042dbd3160a3c8e2c71d45138ce023b04b3ca8 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 28 Jul 2005 20:29:45 +0000
Subject: [PATCH 146/549] - "maxretry" and "bantime" can be overridden in each
 section

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@157 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index b93b6c51..9cab58d3 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -128,7 +128,7 @@ def getCmdLineOptions(optList):
 		if opt[0] == "-i":
 			conf["ignoreip"] = opt[1]
 		if opt[0] == "-r":
-			conf["retrymax"] = int(opt[1])
+			conf["maxretry"] = int(opt[1])
 		if opt[0] == "-p":
 			conf["pidlock"] = opt[1]
 		if opt[0] == "-k":
@@ -237,6 +237,12 @@ def main():
 	# Ignores IP list
 	ignoreIPList = conf["ignoreip"].split(' ')
 	
+	# maxretry option
+	maxRetry = conf["maxretry"]
+	
+	# bantime option
+	banTime = conf["bantime"]
+	
 	# Checks for root user. This is necessary because log files
 	# are owned by root and firewall needs root access.
 	if not checkForRoot():
@@ -277,8 +283,10 @@ def main():
 		logSys.debug("to: " + mailConf["to"] + " from: " + mailConf["from"])
 	
 	# Options
-	optionValues = (["bool", "enabled", True],
+	optionValues = (["bool", "enabled", False],
 					["str", "logfile", "/dev/null"],
+					["int", "maxretry", None],
+					["int", "bantime", None],
 					["str", "timeregex", ""],
 					["str", "timepattern", ""],
 					["str", "failregex", ""],
@@ -291,11 +299,19 @@ def main():
 	for t in confReader.getSections():
 		l = confReader.getLogOptions(t, optionValues)
 		if l["enabled"]:
+			# Override maxretry option
+			if not l["maxretry"] == None:
+				maxRetry = l["maxretry"]
+			
+			# Override bantime option
+			if not l["bantime"] == None:
+				banTime = l["bantime"]
+			
 			# Creates a logreader object
 			lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
-							 l["failregex"], conf["bantime"])
+							 l["failregex"], maxRetry, banTime)
 			# Creates a firewall object
-			fObj = Firewall(l["fwban"], l["fwunban"], conf["bantime"])
+			fObj = Firewall(l["fwban"], l["fwunban"], banTime)
 			# Links them into a list. I'm not really happy
 			# with this :/
 			logFwList.append([t, lObj, fObj, dict(), l])
@@ -363,7 +379,7 @@ def main():
 					failTime = fails[attempt][1]
 					if failTime < unixTime - findTime:
 						del element[3][attempt]
-					elif fails[attempt][0] >= conf["maxretry"]:
+					elif fails[attempt][0] >= element[1].getMaxRetry():
 						aInfo = {"ip": attempt,
 								 "failures": element[3][attempt][0],
 								 "failtime": failTime}

From e40dd99727635d79a952223f6e5c21464a6b0d90 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 28 Jul 2005 20:30:34 +0000
Subject: [PATCH 147/549] - Added description

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@158 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 setup.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/setup.py b/setup.py
index 9c394177..a2d4b4bc 100755
--- a/setup.py
+++ b/setup.py
@@ -31,13 +31,23 @@ from version import version
 from os.path import isfile, join
 from sys import exit, argv
 
+longdesc = '''
+Fail2Ban scans log files like /var/log/pwdfail or
+/var/log/apache/error_log and bans IP that makes
+too many password failures. It updates firewall rules
+to reject the IP address or executes user defined
+commands. It needs log4py.'''
+
 setup(
 	name = "fail2ban",
 	version = version,
 	description = "Ban IPs that make too many password failure",
+	long_description = longdesc,
 	author = "Cyril Jaquier",
 	author_email = "lostcontrol@users.sourceforge.net",
 	url = "http://fail2ban.sourceforge.net",
+	license = "GPL",
+	platforms = "Posix",
 	scripts = ['fail2ban'],
 	py_modules = ['fail2ban', 'version'],
 	packages = ['firewall', 'logreader', 'confreader', 'utils']

From bebba84f0ef3277035965d65f6a0ce1fa4f458af Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 28 Jul 2005 20:31:00 +0000
Subject: [PATCH 148/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@159 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 46d5771d..47ba3312 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,16 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.5.1)                           2005/07/23
+Fail2Ban (version 0.5.?)                           2005/??/??
 =============================================================
 
+ver. 0.5.? (2005/??/??) - ???
+----------
+- "maxretry" and "bantime" can be overridden in each section
+- Fixed bug #1246278 (excessive memory usage)
+- Fixed crash on wrong option value in configuration file
+- Changed custom chains to lowercase
+
 ver. 0.5.1 (2005/07/23) - beta
 ----------
 - Fixed bugs #1241756, #1239557

From a081e8b3f574b297748680ca7ad70ef7a09474e2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 28 Jul 2005 20:59:28 +0000
Subject: [PATCH 149/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@160 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.py b/version.py
index 96535407..eadf2ecb 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.5.1"
+version = "0.5.1-CVS"

From bed25265d755584e1eba8e484915cd1208de5edb Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 1 Aug 2005 16:33:56 +0000
Subject: [PATCH 150/549] - Added man pages

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@161 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 man/fail2ban.8      | 58 +++++++++++++++++++++++++++++++++++++++++++++
 man/fail2ban.conf.5 | 20 ++++++++++++++++
 2 files changed, 78 insertions(+)
 create mode 100644 man/fail2ban.8
 create mode 100644 man/fail2ban.conf.5

diff --git a/man/fail2ban.8 b/man/fail2ban.8
new file mode 100644
index 00000000..f03038b0
--- /dev/null
+++ b/man/fail2ban.8
@@ -0,0 +1,58 @@
+.\" 
+.TH "FAIL2BAN" "8" "July 2005" "Cyril Jaquier" "System administration tools"
+.SH "NAME"
+fail2ban \- bans IP that makes too many password failures
+.SH "SYNOPSIS"
+.B fail2ban
+[\fIOPTIONS\fR]
+.SH "DESCRIPTION"
+\fBFail2Ban\fR reads log file that contains password failure report
+and bans the corresponding IP addresses using firewall rules. It updates
+firewall rules to reject the IP address.
+.SH "OPTIONS"
+.TP 
+\fB\-b\fR
+start in background
+.TP 
+\fB\-d\fR
+start in debug mode. Commands are NOT executed but only displayed
+.TP 
+\fB\-c\fR \fIFILE\fR
+read configuration file \fIFILE\fR
+.TP 
+\fB\-p\fR \fIFILE\fR
+create PID lock in \fIFILE\fR
+.TP 
+\fB\-h, \-\-help\fR
+display this help message
+.TP 
+\fB\-i\fR \fIIP\fR
+\fIIP\fR(s) to ignore
+.TP 
+\fB\-k\fR
+kill a currently running Fail2Ban instance
+.TP 
+\fB\-r\fR \fIVALUE\fR
+allow a max of \fIVALUE\fR password failure
+.TP 
+\fB\-t\fR \fITIME\fR
+ban IP for \fITIME\fR seconds
+.TP 
+\fB\-v\fR
+verbose. Use twice for greater effect
+.TP 
+\fB\-V, \-\-version\fR
+print software version
+.SH "FILES"
+.I /etc/fail2ban.conf
+.RS
+The configuration file. See \fBfail2ban.conf\fR(5) for further details.
+.SH "REPORTING BUGS"
+Please report bugs at http://sourceforge.net/projects/fail2ban/
+via bug tracker
+.SH "AUTHOR"
+Cyril Jaquier <lostcontrol@users.sourceforge.net>
+.SH "SEE ALSO"
+.TP 
+See
+.BR "http://fail2ban.sourceforge.net/".
diff --git a/man/fail2ban.conf.5 b/man/fail2ban.conf.5
new file mode 100644
index 00000000..91328a35
--- /dev/null
+++ b/man/fail2ban.conf.5
@@ -0,0 +1,20 @@
+.\" 
+.TH "FAIL2BAN.CONF" "5" "July 2005" "Cyril Jaquier" "System administration tools"
+.SH "NAME"
+fail2ban.conf \- configuration data for fail2ban
+.SH "DESCRIPTION"
+\fB/etc/fail2ban.conf\fR contains data about the general configuration of fail2ban, the mail notification and services to monitor.
+.SH "VARIABLES"
+Please look at the file itself
+.SH "FILES"
+.I /etc/fail2ban.conf
+.SH "REPORTING BUGS"
+Please report bugs at http://sourceforge.net/projects/fail2ban/
+via bug tracker
+.SH "AUTHOR"
+Cyril Jaquier <lostcontrol@users.sourceforge.net>
+.SH "SEE ALSO"
+.BR fail2ban (8)
+.TP 
+See
+.BR "http://fail2ban.sourceforge.net/".

From 4d9c24adbf5f99d86e1ba03dc41391536fb3890f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 1 Aug 2005 16:35:18 +0000
Subject: [PATCH 151/549] - Removed log4py dependency

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@162 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 4 ++--
 confreader/configreader.py   | 6 +++---
 firewall/firewall.py         | 6 +++---
 logreader/logreader.py       | 6 +++---
 utils/mail.py                | 6 +++---
 utils/strings.py             | 6 +++---
 6 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index bbdce173..45f063a7 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -19,9 +19,9 @@ debug = false
 
 # Option:  logtargets
 # Notes.:  log targets. Space separated list of logging targets.
-# Values:  STDOUT STDERR SYSLOG file  Default:  STDOUT /var/log/fail2ban.log
+# Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
 #
-logtargets = STDOUT /var/log/fail2ban.log
+logtargets = /var/log/fail2ban.log
 
 # Option:  pidlock
 # Notes.:  path of the PID lock file (must be able to write to file).
diff --git a/confreader/configreader.py b/confreader/configreader.py
index e413103b..150858b5 100644
--- a/confreader/configreader.py
+++ b/confreader/configreader.py
@@ -24,12 +24,12 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import log4py
+import logging
 
 from ConfigParser import *
 
-# Gets the instance of log4py.
-logSys = log4py.Logger().get_instance()
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
 
 class ConfigReader:
 	""" This class allow the handling of the configuration options.
diff --git a/firewall/firewall.py b/firewall/firewall.py
index 9b072c78..b0da3826 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -24,13 +24,13 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, os, log4py, re
+import time, os, logging, re
 
 from utils.process import executeCmd
 from utils.strings import replaceTag
 
-# Gets the instance of log4py.
-logSys = log4py.Logger().get_instance()
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
 
 class Firewall:
 	""" Manages the ban list and executes the command that ban
diff --git a/logreader/logreader.py b/logreader/logreader.py
index e96dc903..0dea9d70 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -24,12 +24,12 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import os, sys, time, re, log4py
+import os, sys, time, re, logging
 
 from utils.dns import *
 
-# Gets the instance of log4py.
-logSys = log4py.Logger().get_instance()
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
 
 class LogReader:
 	""" Reads a log file and reports information about IP that make password
diff --git a/utils/mail.py b/utils/mail.py
index aab02b4e..5781d89e 100644
--- a/utils/mail.py
+++ b/utils/mail.py
@@ -24,12 +24,12 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import log4py, smtplib
+import logging, smtplib
 
 from utils.strings import replaceTag
 
-# Gets the instance of log4py.
-logSys = log4py.Logger().get_instance()
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
 
 class Mail:
 	""" Mailer class
diff --git a/utils/strings.py b/utils/strings.py
index ae0108d2..6ed7ece8 100644
--- a/utils/strings.py
+++ b/utils/strings.py
@@ -24,10 +24,10 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import log4py
+import logging
 
-# Gets the instance of log4py.
-logSys = log4py.Logger().get_instance()
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
 
 def replaceTag(query, aInfo):
 	""" Replace tags in query

From 8688acab659fc1fefb5435828e52a76a29b616b6 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 1 Aug 2005 16:38:07 +0000
Subject: [PATCH 152/549] - Removed log4py dependency - Better handling of the
 return value of os.system()

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@163 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/process.py | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/utils/process.py b/utils/process.py
index 4739303e..0b5a0983 100644
--- a/utils/process.py
+++ b/utils/process.py
@@ -24,10 +24,10 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import os, log4py, signal
+import os, logging, signal
 
-# Gets the instance of log4py.
-logSys = log4py.Logger().get_instance()
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
 
 def createDaemon():
 	"""Detach a process from the controlling terminal and run it in the
@@ -111,6 +111,7 @@ def checkForPID(lockfile):
 	try:
 		fileHandler = open(lockfile)
 		pid = fileHandler.readline()
+		fileHandler.close()
 		return pid
 	except IOError:
 		return False
@@ -151,6 +152,9 @@ def executeCmd(cmd, debug):
 	
 	logSys.debug(cmd)
 	if not debug:
-		return os.system(cmd)
+		retval = os.system(cmd)
+		if not retval == 0:
+			logSys.error("'" + cmd + "' returned " + `retval`)
+		return retval
 	else:
 		return None

From c2d30a29de6c9c5503b3d1b4f2ca8e4634606bf1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 1 Aug 2005 16:39:11 +0000
Subject: [PATCH 153/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@164 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG |  2 ++
 MANIFEST  |  2 ++
 README    | 11 +++++------
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 47ba3312..1241bd66 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,6 +9,8 @@ Fail2Ban (version 0.5.?)                           2005/??/??
 
 ver. 0.5.? (2005/??/??) - ???
 ----------
+- Added man pages
+- Removed log4py dependency. Use logging module instead
 - "maxretry" and "bantime" can be overridden in each section
 - Fixed bug #1246278 (excessive memory usage)
 - Fixed crash on wrong option value in configuration file
diff --git a/MANIFEST b/MANIFEST
index 31824576..6a94f9e5 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -22,3 +22,5 @@ config/gentoo-initd
 config/gentoo-confd
 config/redhat-initd
 config/debian-initd
+man/fail2ban.8
+man/fail2ban.conf.5
diff --git a/README b/README
index b82a42c0..96d4ca0e 100644
--- a/README
+++ b/README
@@ -4,14 +4,14 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.5.1)                           2005/07/23
+Fail2Ban (version 0.5.?)                           2005/??/??
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
 that makes too many password failures. It updates firewall
 rules to reject the IP address. These rules can be defined by
 the user. Fail2Ban can read multiple log files such as sshd
-or Apache web server ones. It needs log4py.
+or Apache web server ones.
 
 This is my first Python program. Moreover, English is not my
 mother tongue...
@@ -55,7 +55,6 @@ Installation:
 -------------
 
 Require: python-2.3 (http://www.python.org)
-         log4py-1.3 (http://sourceforge.net/projects/log4py)
 
 To install, just do:
 
@@ -95,13 +94,13 @@ or using command line options. Command line options override
 the value stored in fail2ban.conf. Here are the command line
 options:
 
-  -b         start fail2ban in background
-  -d         start fail2ban in debug mode
+  -b         start in background
+  -d         start in debug mode
   -c <FILE>  read configuration file FILE
   -p <FILE>  create PID lock in FILE
   -h         display this help message
   -i <IP(s)> IP(s) to ignore
-  -k         kill a currently running Fail2Ban instance
+  -k         kill a currently running instance
   -r <VALUE> allow a max of VALUE password failure
   -t <TIME>  ban IP for TIME seconds
   -v         verbose. Use twice for greater effect

From 5a38a2563c0ee2d20cee1f010bdc764660da3ad2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 1 Aug 2005 16:40:46 +0000
Subject: [PATCH 154/549] - Removed log4py dependency - Catch the unhandled
 exceptions

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@165 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban | 36 +++++++++++++++++++++---------------
 1 file changed, 21 insertions(+), 15 deletions(-)

diff --git a/fail2ban b/fail2ban
index abc9f9e2..f904271d 100755
--- a/fail2ban
+++ b/fail2ban
@@ -26,22 +26,28 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from sys import exit, path
+import sys, traceback, logging
 
-# Appends our own modules path. Added before log4py import
-# because log4py could be distributed with Fail2Ban.
-path.append("/usr/lib/fail2ban")
+# Appends our own modules path.
+sys.path.append("/usr/lib/fail2ban")
 
-# Checks for required libs
-# Checks if log4py is present.
-try:
-	import log4py
-except:
-	print "log4py is needed (see README)"
-	exit(-1)
-
-# Now we can import our module
+# Now we can import our module.
 import fail2ban
 
-# Start the application
-fail2ban.main()
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+# Start the application. Handle all the unhandled exceptions
+try:
+	fail2ban.main()
+except SystemExit:
+	# We called sys.exit(). Nothing wrong so just pass
+	pass
+except Exception, e:
+	(type, value, tb) = sys.exc_info()
+	tbStack = traceback.extract_tb(tb)
+	logSys.error("Fail2Ban got an unhandled exception and died.")
+	logSys.error("Type: " + `type.__name__` + "\n" +
+				 "Value: " + `e.args` + "\n" +
+				 "TB: " + `tbStack`)
+	logging.shutdown()

From e8b4d66c54a49eb14eef42647a0244167152e7f6 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 1 Aug 2005 16:41:33 +0000
Subject: [PATCH 155/549] - Removed log4py dependency

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@166 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 82 ++++++++++++++++++++++++++++-------------------------
 1 file changed, 44 insertions(+), 38 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index 9cab58d3..8eaaeb98 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, sys, getopt, os, string, signal, log4py
+import time, sys, getopt, os, string, signal, logging, logging.handlers
 from ConfigParser import *
 
 from version import version
@@ -35,8 +35,8 @@ from utils.mail import Mail
 from utils.dns import *
 from utils.process import *
 
-# Gets the instance of log4py.
-logSys = log4py.Logger().get_instance()
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
 
 # Global variables
 logFwList = list()
@@ -50,13 +50,13 @@ def dispUsage():
 	print "Fail2Ban v"+version+" reads log file that contains password failure report"
 	print "and bans the corresponding IP addresses using firewall rules."
 	print
-	print "  -b         start fail2ban in background"
-	print "  -d         start fail2ban in debug mode"
+	print "  -b         start in background"
+	print "  -d         start in debug mode"
 	print "  -c <FILE>  read configuration file FILE"
 	print "  -p <FILE>  create PID lock in FILE"
 	print "  -h         display this help message"
 	print "  -i <IP(s)> IP(s) to ignore"
-	print "  -k         kill a currently running Fail2Ban instance"
+	print "  -k         kill a currently running instance"
 	print "  -r <VALUE> allow a max of VALUE password failure"
 	print "  -t <TIME>  ban IP for TIME seconds"
 	print "  -v         verbose. Use twice for greater effect"
@@ -103,6 +103,7 @@ def killApp():
 	# Remove the PID lock
 	removePID(conf["pidlock"])
 	logSys.info("Exiting...")
+	logging.shutdown()
 	sys.exit(0)
 
 def getCmdLineOptions(optList):
@@ -144,7 +145,14 @@ def getCmdLineOptions(optList):
 def main():
 	""" Fail2Ban main function
 	"""
-	logSys.set_formatstring("%T %L %M")
+	
+	# Add the default logging handler
+	stdout = logging.StreamHandler(sys.stdout)
+	logSys.addHandler(stdout)
+	
+	# Default formatter
+	formatter = logging.Formatter('%(asctime)s %(levelname)s %(message)s')
+	stdout.setFormatter(formatter)
 	
 	conf["verbose"] = 0
 	conf["conffile"] = "/etc/fail2ban.conf"
@@ -169,7 +177,7 @@ def main():
 	
 	# Options
 	optionValues = (["bool", "background", False],
-					["str", "logtargets", "STDOUT /var/log/fail2ban.log"],
+					["str", "logtargets", "/var/log/fail2ban.log"],
 					["bool", "debug", False],
 					["str", "pidlock", "/var/run/fail2ban.pid"],
 					["int", "maxretry", 3],
@@ -185,47 +193,45 @@ def main():
 	# Gets command line options
 	getCmdLineOptions(optList)
 
-	# Process some options
-	# Log targets
-	# Bug fix for #1234699
-	os.umask(0077)
-	# Remove all the targets before setting our own
-	logSys.remove_all_targets()
-	for target in conf["logtargets"].split():
-		if target == "STDOUT":
-			logSys.add_target(log4py.TARGET_SYS_STDOUT)
-		elif target == "STDERR":
-			logSys.add_target(log4py.TARGET_SYS_STDERR)
-		elif target == "SYSLOG":
-			logSys.add_target(log4py.TARGET_SYSLOG)
-		else:
-			# Target should be a file
-			try:
-				open(target, "a")
-				logSys.add_target(target)
-			except IOError:
-				logSys.error("Unable to log to " + target)
-	
-	# Check if at least one target exists
-	if len(logSys.get_targets()) == 0:
-		logSys.add_target(log4py.TARGET_SYS_STDOUT)
-		logSys.error("No valid logging target found. Logging to STDOUT")
-	
 	# Verbose level
 	if conf["verbose"]:
 		logSys.warn("Verbose level is "+`conf["verbose"]`)
 		if conf["verbose"] == 1:
-			logSys.set_loglevel(log4py.LOGLEVEL_VERBOSE)
+			logSys.setLevel(logging.VERBOSE)
 		elif conf["verbose"] > 1:
-			logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
+			logSys.setLevel(logging.DEBUG)
 		
 	# Set debug log level
 	if conf["debug"]:
-		logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
-		logSys.set_formatstring(log4py.FMT_DEBUG)
+		logSys.setLevel(logging.DEBUG)
+		formatter = logging.Formatter("%(asctime)s %(levelname)s " +
+									  "[%(filename)s (%(lineno)d)] " +
+									  "%(message)s")
+		stdout.setFormatter(formatter)
 		logSys.warn("DEBUG MODE: FIREWALL COMMANDS ARE _NOT_ EXECUTED BUT " +
 					"ONLY DISPLAYED IN THE LOG MESSAGES")
 
+	# Process some options
+	# Log targets
+	# Bug fix for #1234699
+	os.umask(0077)
+	for target in conf["logtargets"].split():
+		if target == "STDERR":
+			hdlr = logging.StreamHandler(sys.stderr)
+		elif target == "SYSLOG":
+			hdlr = logging.handlers.SysLogHandler()
+		else:
+			# Target should be a file
+			try:
+				open(target, "a")
+				hdlr = logging.FileHandler(target)
+			except IOError:
+				logSys.error("Unable to log to " + target)
+				continue
+		# Set formatter and add handler to logger
+		hdlr.setFormatter(formatter)
+		logSys.addHandler(hdlr)
+
 	# Start Fail2Ban in daemon mode
 	if conf["background"]:
 		retCode = createDaemon()

From d0a00888945a8a0d1d0b75640a22f32722267b81 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 1 Aug 2005 16:58:14 +0000
Subject: [PATCH 156/549] - Redirect stdout to /dev/null

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@167 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/gentoo-initd | 4 ++--
 config/redhat-initd | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/config/gentoo-initd b/config/gentoo-initd
index 11b81e7d..8cab7535 100755
--- a/config/gentoo-initd
+++ b/config/gentoo-initd
@@ -31,13 +31,13 @@ depend() {
 
 start() {
 	ebegin "Starting fail2ban"
-	${FAIL2BAN} -b ${FAIL2BAN_OPTS}
+	${FAIL2BAN} -b ${FAIL2BAN_OPTS} > /dev/null
 	eend $? "Failed to start fail2ban"
 }
 
 stop() {
 	ebegin "Stopping fail2ban"
-	${FAIL2BAN} -k
+	${FAIL2BAN} -k > /dev/null
 	eend $? "Failed to stop fail2ban"
 }
 
diff --git a/config/redhat-initd b/config/redhat-initd
index b1753672..6e885ab5 100644
--- a/config/redhat-initd
+++ b/config/redhat-initd
@@ -28,7 +28,7 @@ RETVAL=0
 
 start() {
     echo -n $"Starting fail2ban: "
-    "${FAIL2BAN}" -b
+    "${FAIL2BAN}" -b > /dev/null
     RETVAL=$?
     echo
 }
@@ -36,7 +36,7 @@ start() {
 stop() {
     if [ -f "${PIDFILE}" ]; then
 	echo -n $"Stopping fail2ban: "
-	"${FAIL2BAN}" -k
+	"${FAIL2BAN}" -k > /dev/null
 	echo
     fi
 }

From 4d0c5f6341786ce29f94785482f72a143af0d95e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 4 Aug 2005 20:48:30 +0000
Subject: [PATCH 157/549] - Added a PID lock file class

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@168 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/pidlock.py | 98 ++++++++++++++++++++++++++++++++++++++++++++++++
 utils/process.py | 35 ++---------------
 2 files changed, 101 insertions(+), 32 deletions(-)
 create mode 100644 utils/pidlock.py

diff --git a/utils/pidlock.py b/utils/pidlock.py
new file mode 100644
index 00000000..6eeb0dde
--- /dev/null
+++ b/utils/pidlock.py
@@ -0,0 +1,98 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os, logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+class PIDLock:
+	""" Manages the PID lock file.
+	
+		The following class shows how to implement the singleton pattern[1] in
+		Python. A singleton is a class that makes sure only one instance of it
+		is ever created. Typically such classes are used to manage resources
+		that by their very nature can only exist once.
+		
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/52558
+	"""
+	
+	class __impl:
+		""" Implementation of the singleton interface """
+
+		def setPath(self, path):
+			""" Set PID lock file path.
+			"""
+			self.path = path
+		
+		def create(self):
+			""" Create PID lock.
+			"""
+			fileHandler = open(self.path, mode='w')
+			pid = os.getpid()
+			fileHandler.write(`pid` + '\n')
+			fileHandler.close()
+			logSys.debug("Created PID lock (" + `pid` + ") in " + self.path)
+		
+		def remove(self):
+			""" Remove PID lock.
+			"""
+			os.remove(self.path)
+			logSys.debug("Removed PID lock " + self.path)
+		
+		def exists(self):
+			""" Returns the current PID if Fail2Ban is running or False
+				if no instance found.
+			"""
+			try:
+				fileHandler = open(self.path)
+				pid = fileHandler.readline()
+				fileHandler.close()
+				return pid
+			except IOError:
+				return False
+
+	# storage for the instance reference
+	__instance = None
+
+	def __init__(self):
+		""" Create singleton instance """
+		# Check whether we already have an instance
+		if PIDLock.__instance is None:
+			# Create and remember instance
+			PIDLock.__instance = PIDLock.__impl()
+
+		# Store instance reference as the only member in the handle
+		self.__dict__['_PIDLock__instance'] = PIDLock.__instance
+
+	def __getattr__(self, attr):
+		""" Delegate access to implementation """
+		return getattr(self.__instance, attr)
+
+	def __setattr__(self, attr, value):
+		""" Delegate access to implementation """
+		return setattr(self.__instance, attr, value)
+	
\ No newline at end of file
diff --git a/utils/process.py b/utils/process.py
index 0b5a0983..03650212 100644
--- a/utils/process.py
+++ b/utils/process.py
@@ -30,10 +30,10 @@ import os, logging, signal
 logSys = logging.getLogger("fail2ban")
 
 def createDaemon():
-	"""Detach a process from the controlling terminal and run it in the
-	background as a daemon.
+	""" Detach a process from the controlling terminal and run it in the
+		background as a daemon.
 	
-	http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
 	"""
 
 	try:
@@ -101,35 +101,6 @@ def createDaemon():
 	os.open("/dev/null", os.O_RDWR)		# standard error (2)
 
 	return True
-	
-def checkForPID(lockfile):
-	""" Checks for running Fail2Ban.
-	
-		Returns the current PID if Fail2Ban is running or False
-		if no instance found.
-	"""
-	try:
-		fileHandler = open(lockfile)
-		pid = fileHandler.readline()
-		fileHandler.close()
-		return pid
-	except IOError:
-		return False
-		
-def createPID(lockfile):
-	""" Creates a PID lock file with the current PID.
-	"""
-	fileHandler = open(lockfile, mode='w')
-	pid = os.getpid()
-	fileHandler.write(`pid`+'\n')
-	fileHandler.close()
-	logSys.debug("Created PID lock ("+`pid`+") in "+lockfile)
-		
-def removePID(lockfile):
-	""" Remove PID lock.
-	"""
-	os.remove(lockfile)
-	logSys.debug("Removed PID lock "+lockfile)
 
 def killPID(pid):
 	""" Kills the process with the given PID using the

From 9761d31f4b26fb215c34d0b5947d852700975e7c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 4 Aug 2005 20:49:00 +0000
Subject: [PATCH 158/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@169 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG b/CHANGELOG
index 1241bd66..5b59ada9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,6 +9,7 @@ Fail2Ban (version 0.5.?)                           2005/??/??
 
 ver. 0.5.? (2005/??/??) - ???
 ----------
+- Better PID lock file handling. Should close #1239562
 - Added man pages
 - Removed log4py dependency. Use logging module instead
 - "maxretry" and "bantime" can be overridden in each section

From 1fcf7612fdac1b32911d77cb834cd70bf8e41afa Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 4 Aug 2005 20:51:14 +0000
Subject: [PATCH 159/549] - Added new PID lock file management

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@170 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/fail2ban b/fail2ban
index f904271d..25777b3b 100755
--- a/fail2ban
+++ b/fail2ban
@@ -31,12 +31,16 @@ import sys, traceback, logging
 # Appends our own modules path.
 sys.path.append("/usr/lib/fail2ban")
 
-# Now we can import our module.
+# Now we can import our modules.
 import fail2ban
+from utils.pidlock import PIDLock
 
-# Gets the instance of the logger.
+# Get the instance of the logger.
 logSys = logging.getLogger("fail2ban")
 
+# Get PID lock file instance
+pidLock = PIDLock()
+
 # Start the application. Handle all the unhandled exceptions
 try:
 	fail2ban.main()
@@ -44,10 +48,13 @@ except SystemExit:
 	# We called sys.exit(). Nothing wrong so just pass
 	pass
 except Exception, e:
+	# Print the exception data
 	(type, value, tb) = sys.exc_info()
 	tbStack = traceback.extract_tb(tb)
 	logSys.error("Fail2Ban got an unhandled exception and died.")
 	logSys.error("Type: " + `type.__name__` + "\n" +
 				 "Value: " + `e.args` + "\n" +
 				 "TB: " + `tbStack`)
+	# Remove the PID lock file. Should close #1239562
+	pidLock.remove()
 	logging.shutdown()

From e93c0db20b432d3a6b7c93d2efeda67acf62a8f5 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 4 Aug 2005 20:52:13 +0000
Subject: [PATCH 160/549] - Added new PID lock file management - Fixed a bug
 with daemon mode and logging

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@171 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 39 +++++++++++++++++++++++----------------
 1 file changed, 23 insertions(+), 16 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index 8eaaeb98..1f573282 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -32,12 +32,16 @@ from firewall.firewall import Firewall
 from logreader.logreader import LogReader
 from confreader.configreader import ConfigReader
 from utils.mail import Mail
+from utils.pidlock import PIDLock
 from utils.dns import *
 from utils.process import *
 
-# Gets the instance of the logger.
+# Get the instance of the logger.
 logSys = logging.getLogger("fail2ban")
 
+# Get PID lock file instance
+pidLock = PIDLock()
+
 # Global variables
 logFwList = list()
 conf = dict()
@@ -101,7 +105,7 @@ def killApp():
 	# Execute global start command
 	executeCmd(conf["cmdend"], conf["debug"])
 	# Remove the PID lock
-	removePID(conf["pidlock"])
+	pidLock.remove()
 	logSys.info("Exiting...")
 	logging.shutdown()
 	sys.exit(0)
@@ -193,6 +197,14 @@ def main():
 	# Gets command line options
 	getCmdLineOptions(optList)
 
+	# Start Fail2Ban in daemon mode
+	if conf["background"]:
+		retCode = createDaemon()
+		signal.signal(signal.SIGTERM, sigTERMhandler)
+		if not retCode:
+			logSys.error("Unable to start daemon")
+			sys.exit(-1)
+
 	# Verbose level
 	if conf["verbose"]:
 		logSys.warn("Verbose level is "+`conf["verbose"]`)
@@ -231,14 +243,9 @@ def main():
 		# Set formatter and add handler to logger
 		hdlr.setFormatter(formatter)
 		logSys.addHandler(hdlr)
-
-	# Start Fail2Ban in daemon mode
-	if conf["background"]:
-		retCode = createDaemon()
-		signal.signal(signal.SIGTERM, sigTERMhandler)
-		if not retCode:
-			logSys.error("Unable to start daemon")
-			sys.exit(-1)
+	
+	# PID lock
+	pidLock.setPath(conf["pidlock"])
 	
 	# Ignores IP list
 	ignoreIPList = conf["ignoreip"].split(' ')
@@ -257,16 +264,16 @@ def main():
 			sys.exit(-1)
 			
 	# Checks that no instance of Fail2Ban is currently running.
-	pid = checkForPID(conf["pidlock"])
+	pid = pidLock.exists()
 	if pid:
 		logSys.error("Fail2Ban already running with PID "+pid)
 		sys.exit(-1)
 	else:
-		createPID(conf["pidlock"])
+		pidLock.create()
 	
-	logSys.debug("ConfFile is "+conf["conffile"])
-	logSys.debug("BanTime is "+`conf["bantime"]`)
-	logSys.debug("retryAllowed is "+`conf["maxretry"]`)
+	logSys.debug("ConfFile is " + conf["conffile"])
+	logSys.debug("BanTime is " + `conf["bantime"]`)
+	logSys.debug("retryAllowed is " + `conf["maxretry"]`)
 	
 	# Options
 	optionValues = (["bool", "enabled", False],
@@ -333,7 +340,7 @@ def main():
 			for element in logFwList:
 				element[1].addIgnoreIP(ip)
 	
-	logSys.info("Fail2Ban v"+version+" is running")
+	logSys.info("Fail2Ban v" + version + " is running")
 	# Execute global start command
 	executeCmd(conf["cmdstart"], conf["debug"])
 	# Execute start command of each section

From a8f98be252a0c01fd6ddd75c9156e52bf9c7e170 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 4 Aug 2005 21:01:12 +0000
Subject: [PATCH 161/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@172 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 1 +
 TODO     | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/MANIFEST b/MANIFEST
index 6a94f9e5..b56a8b73 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -17,6 +17,7 @@ utils/dns.py
 utils/process.py
 utils/mail.py
 utils/strings.py
+utils/pidlock.py
 config/fail2ban.conf.default
 config/gentoo-initd
 config/gentoo-confd
diff --git a/TODO b/TODO
index 9ba78225..5b383282 100644
--- a/TODO
+++ b/TODO
@@ -10,4 +10,3 @@ ToDo
 See Feature Request Tracking System at SourceForge.net
 
 - improve installation process (better prefix support)
-- add better documentation (man page)

From 800115a4226f64ff8c5acf199e945d4a215d125d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 4 Aug 2005 21:03:49 +0000
Subject: [PATCH 162/549] - Fixed a bug in logging level

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@173 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban.py b/fail2ban.py
index 1f573282..7e5bb516 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -209,7 +209,7 @@ def main():
 	if conf["verbose"]:
 		logSys.warn("Verbose level is "+`conf["verbose"]`)
 		if conf["verbose"] == 1:
-			logSys.setLevel(logging.VERBOSE)
+			logSys.setLevel(logging.INFO)
 		elif conf["verbose"] > 1:
 			logSys.setLevel(logging.DEBUG)
 		

From 7e0e005e24a0af5829a3b40e74b54febf24e420c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 6 Aug 2005 15:07:11 +0000
Subject: [PATCH 163/549] - Prepared for 0.5.2

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@174 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  | 4 ++--
 README     | 6 +++---
 version.py | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 5b59ada9..7c477030 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.5.?)                           2005/??/??
+Fail2Ban (version 0.5.2)                           2005/08/06
 =============================================================
 
-ver. 0.5.? (2005/??/??) - ???
+ver. 0.5.2 (2005/08/06) - beta
 ----------
 - Better PID lock file handling. Should close #1239562
 - Added man pages
diff --git a/README b/README
index 96d4ca0e..4997742a 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.5.?)                           2005/??/??
+Fail2Ban (version 0.5.2)                           2005/08/06
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -58,8 +58,8 @@ Require: python-2.3 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.5.1.tar.bz2
-> cd fail2ban-0.5.1
+> tar xvfj fail2ban-0.5.2.tar.bz2
+> cd fail2ban-0.5.2
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The fail2ban
diff --git a/version.py b/version.py
index eadf2ecb..b589afaa 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.5.1-CVS"
+version = "0.5.2"

From 9548edaff0d68d0331b9dc855778e2b5289bb83a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 6 Aug 2005 18:43:11 +0000
Subject: [PATCH 164/549] - Do not exit on exception. Continue and wait for an
 unhandled exception

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@176 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index 0dea9d70..b1acf74a 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -89,7 +89,7 @@ class LogReader:
 			fileHandler = open(self.logPath)
 		except OSError:
 			logSys.error("Unable to open "+self.logPath)
-			sys.exit(-1)
+			
 		return fileHandler
 		
 	def isModified(self):
@@ -99,7 +99,6 @@ class LogReader:
 			self.logStats = os.stat(self.logPath)
 		except OSError:
 			logSys.error("Unable to get stat on "+self.logPath)
-			sys.exit(-1)
 		
 		if self.lastModTime == self.logStats.st_mtime:
 			return False

From d2f3d1c263a6bc8f07229a5870fac3f5a51de1e6 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 6 Aug 2005 18:44:06 +0000
Subject: [PATCH 165/549] - Fixed a bug with "-k"

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@177 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index 7e5bb516..c7702790 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -137,14 +137,7 @@ def getCmdLineOptions(optList):
 		if opt[0] == "-p":
 			conf["pidlock"] = opt[1]
 		if opt[0] == "-k":
-			pid = checkForPID(conf["pidlock"])
-			if pid:
-				killPID(int(pid))
-				logSys.warn("Killed Fail2Ban with PID "+pid)
-				sys.exit(0)
-			else:
-				logSys.error("No running Fail2Ban found")
-				sys.exit(-1)
+			conf["kill"] = True
 
 def main():
 	""" Fail2Ban main function
@@ -196,6 +189,23 @@ def main():
 	
 	# Gets command line options
 	getCmdLineOptions(optList)
+	
+	# PID lock
+	pidLock.setPath(conf["pidlock"])
+	
+	# Now we can kill properly a running instance if needed
+	try:
+		conf["kill"]
+		pid = pidLock.exists()
+		if pid:
+			killPID(int(pid))
+			logSys.warn("Killed Fail2Ban with PID "+pid)
+			sys.exit(0)
+		else:
+			logSys.error("No running Fail2Ban found")
+			sys.exit(-1)
+	except KeyError:
+		pass
 
 	# Start Fail2Ban in daemon mode
 	if conf["background"]:
@@ -244,9 +254,6 @@ def main():
 		hdlr.setFormatter(formatter)
 		logSys.addHandler(hdlr)
 	
-	# PID lock
-	pidLock.setPath(conf["pidlock"])
-	
 	# Ignores IP list
 	ignoreIPList = conf["ignoreip"].split(' ')
 	

From b3a90d749224e46a43afcb5166a39d4abbdec60c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 7 Aug 2005 13:06:56 +0000
Subject: [PATCH 166/549] - Changed mask to 16 - Removed "-i eth0". Match all
 interfaces

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@178 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 45f063a7..5ec5330c 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -45,9 +45,9 @@ bantime = 600
 # Notes.:  space separated list of IP's to be ignored by fail2ban.
 #          You can use CIDR mask in order to specify a range.
 #          Example:  ignoreip = 192.168.0.1/24 123.45.235.65
-# Values:  IP  Default:  192.168.0.0/24
+# Values:  IP  Default:  192.168.0.0/16
 #
-ignoreip = 192.168.0.0/24
+ignoreip = 192.168.0.0/16
 
 # Option:  cmdstart
 # Notes.:  command executed once at the start of Fail2Ban
@@ -145,14 +145,14 @@ logfile = /var/log/httpd/access_log
 # Values:  CMD  Default:
 #
 fwstart = iptables -N fail2ban-http
-          iptables -I INPUT -i eth0 -p tcp --dport http -j fail2ban-http
+          iptables -I INPUT -p tcp --dport http -j fail2ban-http
           iptables -A fail2ban-http -j RETURN
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD  Default:
 #
-fwend = iptables -D INPUT -i eth0 -p tcp --dport http -j fail2ban-http
+fwend = iptables -D INPUT -p tcp --dport http -j fail2ban-http
         iptables -D fail2ban-http -j RETURN
         iptables -X fail2ban-http
 
@@ -164,9 +164,9 @@ fwend = iptables -D INPUT -i eth0 -p tcp --dport http -j fail2ban-http
 #          <failtime>  unix timestamp of the last failure
 #          <bantime>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
 #
-fwban = iptables -I fail2ban-http 1 -i eth0 -s <ip> -j DROP
+fwban = iptables -I fail2ban-http 1 -s <ip> -j DROP
 
 # Option:  fwunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -175,9 +175,9 @@ fwban = iptables -I fail2ban-http 1 -i eth0 -s <ip> -j DROP
 #          <bantime>  unix timestamp of the ban time
 #          <unbantime>  unix timestamp of the unban time
 # Values:  CMD
-# Default: iptables -D INPUT -i eth0 -s <ip> -j DROP
+# Default: iptables -D INPUT -s <ip> -j DROP
 #
-fwunban = iptables -D fail2ban-http -i eth0 -s <ip> -j DROP
+fwunban = iptables -D fail2ban-http -s <ip> -j DROP
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in Apache logfile.
@@ -217,14 +217,14 @@ logfile = /var/log/secure
 # Values:  CMD  Default:
 #
 fwstart = iptables -N fail2ban-ssh
-          iptables -I INPUT -i eth0 -p tcp --dport ssh -j fail2ban-ssh
+          iptables -I INPUT -p tcp --dport ssh -j fail2ban-ssh
           iptables -A fail2ban-ssh -j RETURN
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD  Default:
 #
-fwend = iptables -D INPUT -i eth0 -p tcp --dport ssh -j fail2ban-ssh
+fwend = iptables -D INPUT -p tcp --dport ssh -j fail2ban-ssh
         iptables -D fail2ban-ssh -j RETURN
         iptables -X fail2ban-ssh
 
@@ -236,9 +236,9 @@ fwend = iptables -D INPUT -i eth0 -p tcp --dport ssh -j fail2ban-ssh
 #          <failtime>  unix timestamp of the last failure
 #          <bantime>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -I INPUT 1 -i eth0 -s <ip> -j DROP
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
 #
-fwban = iptables -I fail2ban-ssh 1 -i eth0 -s <ip> -j DROP
+fwban = iptables -I fail2ban-ssh 1 -s <ip> -j DROP
 
 # Option:  fwunbanrule
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -247,9 +247,9 @@ fwban = iptables -I fail2ban-ssh 1 -i eth0 -s <ip> -j DROP
 #          <bantime>  unix timestamp of the ban time
 #          <unbantime>  unix timestamp of the unban time
 # Values:  CMD
-# Default: iptables -D INPUT -i eth0 -s <ip> -j DROP
+# Default: iptables -D INPUT -s <ip> -j DROP
 #
-fwunban = iptables -D fail2ban-ssh -i eth0 -s <ip> -j DROP
+fwunban = iptables -D fail2ban-ssh -s <ip> -j DROP
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in SSH logfile.

From dd27cafee31ac1f502a9b40c7bce438a808df8a3 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 7 Aug 2005 13:08:18 +0000
Subject: [PATCH 167/549] - Added better handling of exception

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@179 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/pidlock.py | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/utils/pidlock.py b/utils/pidlock.py
index 6eeb0dde..c5a4176a 100644
--- a/utils/pidlock.py
+++ b/utils/pidlock.py
@@ -51,17 +51,25 @@ class PIDLock:
 		def create(self):
 			""" Create PID lock.
 			"""
-			fileHandler = open(self.path, mode='w')
-			pid = os.getpid()
-			fileHandler.write(`pid` + '\n')
-			fileHandler.close()
-			logSys.debug("Created PID lock (" + `pid` + ") in " + self.path)
+			try:
+				fileHandler = open(self.path, mode='w')
+				pid = os.getpid()
+				fileHandler.write(`pid` + '\n')
+				fileHandler.close()
+				logSys.debug("Created PID lock (" + `pid` + ") in " + self.path)
+				return True
+			except:
+				logSys.error("Unable to create PID lock " + self.path)
+				return False	
 		
 		def remove(self):
 			""" Remove PID lock.
 			"""
-			os.remove(self.path)
-			logSys.debug("Removed PID lock " + self.path)
+			try:
+				os.remove(self.path)
+				logSys.debug("Removed PID lock " + self.path)
+			except OSError:
+				logSys.error("Unable to remove PID lock " + self.path)
 		
 		def exists(self):
 			""" Returns the current PID if Fail2Ban is running or False

From 38f2c24be1661a8115228e5853440e5d1b7bb022 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 7 Aug 2005 13:10:00 +0000
Subject: [PATCH 168/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@180 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  | 10 +++++++++-
 README     |  9 +++++----
 version.py |  2 +-
 3 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 7c477030..8a0f6433 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,17 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.5.2)                           2005/08/06
+Fail2Ban (version 0.?.?)                           2005/08/??
 =============================================================
 
+ver. 0.?.? (2005/08/??) - ???
+----------
+- Fixed exception handling in PIDLock
+- Removed warning when using "-V" or "-h" with no config
+  file. Thanks to Yaroslav Halchenko
+- Removed "-i eth0" from config file. Thanks to Yaroslav
+  Halchenko
+
 ver. 0.5.2 (2005/08/06) - beta
 ----------
 - Better PID lock file handling. Should close #1239562
diff --git a/README b/README
index 4997742a..908b21bb 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.5.2)                           2005/08/06
+Fail2Ban (version 0.?.?)                           2005/08/??
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -58,8 +58,8 @@ Require: python-2.3 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.5.2.tar.bz2
-> cd fail2ban-0.5.2
+> tar xvfj fail2ban-0.?.?.tar.bz2
+> cd fail2ban-0.?.?
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The fail2ban
@@ -121,7 +121,8 @@ Thanks:
 -------
 
 Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
-Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko
+Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
+Jonathan Kamens
 
 License:
 --------
diff --git a/version.py b/version.py
index b589afaa..b3cc35fd 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.5.2"
+version = "0.5.2-CVS"

From ed46bcdaf2be703b983e8193892ad9846aef80ab Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 7 Aug 2005 13:10:39 +0000
Subject: [PATCH 169/549] - Removed "It needs log4py" from description

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@181 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 setup.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup.py b/setup.py
index a2d4b4bc..a4f096f3 100755
--- a/setup.py
+++ b/setup.py
@@ -36,7 +36,7 @@ Fail2Ban scans log files like /var/log/pwdfail or
 /var/log/apache/error_log and bans IP that makes
 too many password failures. It updates firewall rules
 to reject the IP address or executes user defined
-commands. It needs log4py.'''
+commands.'''
 
 setup(
 	name = "fail2ban",

From 8a1241533f04b473cf70ee38fe94bca127f17a0b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 7 Aug 2005 13:12:15 +0000
Subject: [PATCH 170/549] - Removed warning when using "-V" or "-h" with no
 config file. Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@182 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index c7702790..131914a5 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -114,10 +114,6 @@ def getCmdLineOptions(optList):
 	""" Gets the command line options
 	"""
 	for opt in optList:
-		if opt[0] in ["-h", "--help"]:
- 			dispUsage()
-		if opt[0] in ["-V", "--version"]:
-			dispVersion()
 		if opt[0] == "-v":
 			conf["verbose"] = conf["verbose"] + 1
 		if opt[0] == "-b":
@@ -166,6 +162,10 @@ def main():
 	for opt in optList:
 		if opt[0] == "-c":
 			conf["conffile"] = opt[1]
+		if opt[0] in ["-h", "--help"]:
+ 			dispUsage()
+		if opt[0] in ["-V", "--version"]:
+			dispVersion()
 	
 	# Reads the config file and create a LogReader instance for
 	# each log file to check.
@@ -276,7 +276,10 @@ def main():
 		logSys.error("Fail2Ban already running with PID "+pid)
 		sys.exit(-1)
 	else:
-		pidLock.create()
+		ret = pidLock.create()
+		if not ret:
+			# Unable to create PID lock. Exit
+			sys.exit(-1)
 	
 	logSys.debug("ConfFile is " + conf["conffile"])
 	logSys.debug("BanTime is " + `conf["bantime"]`)

From daf35a353579395982d62bb5278632adc2aeb8d5 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 17 Aug 2005 19:26:14 +0000
Subject: [PATCH 171/549] - Added a warning message if IP address is not valid
 in ignoreip

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@183 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fail2ban.py b/fail2ban.py
index 131914a5..bb9655df 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -349,6 +349,8 @@ def main():
 		if isValidIP(ip):
 			for element in logFwList:
 				element[1].addIgnoreIP(ip)
+		else:
+			logSys.warn(ip + " is not a valid IP address")
 	
 	logSys.info("Fail2Ban v" + version + " is running")
 	# Execute global start command

From c5c90b182a310d5240657bc53319d31f6729d339 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 17 Aug 2005 19:26:49 +0000
Subject: [PATCH 172/549] - Fixed bug #1262345

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@184 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/dns.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/utils/dns.py b/utils/dns.py
index 0dc060a9..8d099753 100644
--- a/utils/dns.py
+++ b/utils/dns.py
@@ -58,8 +58,9 @@ def searchIP(text):
 def isValidIP(str):
 	""" Return true if str is a valid IP
 	"""
+	s = str.split('/', 1)
 	try:
-		socket.inet_aton(str)
+		socket.inet_aton(s[0])
 		return True
 	except socket.error:
 		return False

From 631f2ac352703db3c157b0abb56a45955b921bd5 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 17 Aug 2005 19:34:00 +0000
Subject: [PATCH 173/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@185 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG b/CHANGELOG
index 8a0f6433..cc58d0b5 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,6 +9,7 @@ Fail2Ban (version 0.?.?)                           2005/08/??
 
 ver. 0.?.? (2005/08/??) - ???
 ----------
+- Fixed bug #1262345
 - Fixed exception handling in PIDLock
 - Removed warning when using "-V" or "-h" with no config
   file. Thanks to Yaroslav Halchenko

From cdc7b4b048965367a7827b71b8632c867a305b0c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 5 Sep 2005 21:05:00 +0000
Subject: [PATCH 174/549] - Renamed "maxretry" to "maxfailures" and changed
 default value to 5. Thanks to Stephen Gildea

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@186 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 5ec5330c..13b4539f 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -29,11 +29,11 @@ logtargets = /var/log/fail2ban.log
 #
 pidlock = /var/run/fail2ban.pid
 
-# Option:  maxretry
-# Notes.:  number of retrys before IP gets banned.
-# Values:  NUM  Default:  3
+# Option:  maxfailures
+# Notes.:  number of failures before IP gets banned.
+# Values:  NUM  Default:  5
 #
-maxretry = 3
+maxfailures = 5
 
 # Option:  bantime
 # Notes.:  number of seconds an IP will be banned.

From 54f4a7d2409dde5054ce692300022569db817ccf Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 5 Sep 2005 21:06:15 +0000
Subject: [PATCH 175/549] - Hopefully fixed bug #1256075

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@187 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index b1acf74a..37fe23a9 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -134,11 +134,13 @@ class LogReader:
 		logSys.debug(self.logPath)
 		logFile = self.openLogFile()
 		self.setFilePos(logFile)
-		lastLine = ''
+		lastLine = None
 		for line in logFile:
+			if not self.hasTime(line):
+				# There is no valid time in this line
+				continue
 			lastLine = line
-			failList = self.findFailure(line)
-			for element in failList:
+			for element in self.findFailure(line):
 				ip = element[0]
 				unixTime = element[1]
 				if unixTime < time.time()-self.findTime:
@@ -152,7 +154,8 @@ class LogReader:
 				else:
 					ipList[ip] = (1, unixTime)
 		self.lastPos = logFile.tell()
-		self.lastDate = self.getTime(lastLine)
+		if lastLine:
+			self.lastDate = self.getTime(lastLine)
 		logFile.close()
 		return ipList
 
@@ -175,6 +178,15 @@ class LogReader:
 						failList.append([ip, date])
 		return failList
 	
+	def hasTime(self, line):
+		""" Return true if the line contains a date
+		"""
+		timeMatch = re.search(self.timeregex, line)
+		if timeMatch:
+			return True
+		else:
+			return False
+	
 	def getTime(self, line):
 		""" Gets the time of a log message.
 		"""

From c573432e742519c270cb3c8f9078e5956b5d6bbf Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 5 Sep 2005 21:12:08 +0000
Subject: [PATCH 176/549] - Fixed a bug when overriding "maxfailures" or
 "bantime". Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@188 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index bb9655df..debd2b6b 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -129,7 +129,7 @@ def getCmdLineOptions(optList):
 		if opt[0] == "-i":
 			conf["ignoreip"] = opt[1]
 		if opt[0] == "-r":
-			conf["maxretry"] = int(opt[1])
+			conf["maxfailures"] = int(opt[1])
 		if opt[0] == "-p":
 			conf["pidlock"] = opt[1]
 		if opt[0] == "-k":
@@ -177,7 +177,7 @@ def main():
 					["str", "logtargets", "/var/log/fail2ban.log"],
 					["bool", "debug", False],
 					["str", "pidlock", "/var/run/fail2ban.pid"],
-					["int", "maxretry", 3],
+					["int", "maxfailures", 5],
 					["int", "bantime", 600],
 					["str", "ignoreip", ""],
 					["int", "polltime", 1],
@@ -257,12 +257,6 @@ def main():
 	# Ignores IP list
 	ignoreIPList = conf["ignoreip"].split(' ')
 	
-	# maxretry option
-	maxRetry = conf["maxretry"]
-	
-	# bantime option
-	banTime = conf["bantime"]
-	
 	# Checks for root user. This is necessary because log files
 	# are owned by root and firewall needs root access.
 	if not checkForRoot():
@@ -283,7 +277,7 @@ def main():
 	
 	logSys.debug("ConfFile is " + conf["conffile"])
 	logSys.debug("BanTime is " + `conf["bantime"]`)
-	logSys.debug("retryAllowed is " + `conf["maxretry"]`)
+	logSys.debug("MaxFailure is " + `conf["maxfailures"]`)
 	
 	# Options
 	optionValues = (["bool", "enabled", False],
@@ -308,7 +302,7 @@ def main():
 	# Options
 	optionValues = (["bool", "enabled", False],
 					["str", "logfile", "/dev/null"],
-					["int", "maxretry", None],
+					["int", "maxfailures", None],
 					["int", "bantime", None],
 					["str", "timeregex", ""],
 					["str", "timepattern", ""],
@@ -322,17 +316,21 @@ def main():
 	for t in confReader.getSections():
 		l = confReader.getLogOptions(t, optionValues)
 		if l["enabled"]:
-			# Override maxretry option
-			if not l["maxretry"] == None:
-				maxRetry = l["maxretry"]
+			# Override maxfailures option
+			if not l["maxfailures"] == None:
+				maxFailures = l["maxfailures"]
+			else:
+				maxFailures = conf["maxfailures"]
 			
 			# Override bantime option
 			if not l["bantime"] == None:
 				banTime = l["bantime"]
+			else:
+				banTime = conf["bantime"]
 			
 			# Creates a logreader object
 			lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
-							 l["failregex"], maxRetry, banTime)
+							 l["failregex"], maxFailures, banTime)
 			# Creates a firewall object
 			fObj = Firewall(l["fwban"], l["fwunban"], banTime)
 			# Links them into a list. I'm not really happy

From c1a86f9e187376bf8966920f405fc7dcc1cadbbc Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 5 Sep 2005 21:12:32 +0000
Subject: [PATCH 177/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@189 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 7 +++++++
 README    | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index cc58d0b5..cd159b7b 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,6 +9,13 @@ Fail2Ban (version 0.?.?)                           2005/08/??
 
 ver. 0.?.? (2005/08/??) - ???
 ----------
+- Fixed a bug when overriding "maxfailures" or "bantime".
+  Thanks to Yaroslav Halchenko
+- Added more debug output if an error occurs when sending
+  mail. Thanks to Stephen Gildea
+- Renamed "maxretry" to "maxfailures" and changed default
+  value to 5. Thanks to Stephen Gildea
+- Hopefully fixed bug #1256075
 - Fixed bug #1262345
 - Fixed exception handling in PIDLock
 - Removed warning when using "-V" or "-h" with no config
diff --git a/README b/README
index 908b21bb..4355f743 100644
--- a/README
+++ b/README
@@ -122,7 +122,7 @@ Thanks:
 
 Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
 Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
-Jonathan Kamens
+Jonathan Kamens, Stephen Gildea
 
 License:
 --------

From 830ac2001e48b5cca5835d6a4b05c62914949a6f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 8 Sep 2005 18:05:59 +0000
Subject: [PATCH 178/549] - Added more debug output if an error occurs when
 sending mail. Thanks to Stephen Gildea

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@190 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/mail.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/utils/mail.py b/utils/mail.py
index 5781d89e..239d4e8e 100644
--- a/utils/mail.py
+++ b/utils/mail.py
@@ -64,8 +64,8 @@ class Mail:
 			server.sendmail(self.fromAddr, self.toAddr, mail)
 			logSys.debug("Email sent to " + `self.toAddr`)
 			server.quit()	
-		except Exception:
+		except Exception, e:
 			logSys.error("Unable to send mail to " + self.host + ":" +
 						 `self.port` + " from " + self.fromAddr + " to " +
-						 `self.toAddr`)
+						 `self.toAddr` + ": " + `e` + ": " + `e.args`)
 		
\ No newline at end of file

From d0c70e1535fcb3c43e5fec00fec01cf129b8bf9d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 8 Sep 2005 18:20:51 +0000
Subject: [PATCH 179/549] - Updated for 0.5.3

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@191 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  |  4 ++--
 README     | 11 ++++++-----
 version.py |  2 +-
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index cd159b7b..de0736a0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.?.?)                           2005/08/??
+Fail2Ban (version 0.5.3)                           2005/09/08
 =============================================================
 
-ver. 0.?.? (2005/08/??) - ???
+ver. 0.5.3 (2005/09/08) - beta
 ----------
 - Fixed a bug when overriding "maxfailures" or "bantime".
   Thanks to Yaroslav Halchenko
diff --git a/README b/README
index 4355f743..ba03b945 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.?.?)                           2005/08/??
+Fail2Ban (version 0.5.3)                           2005/09/08
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -58,15 +58,16 @@ Require: python-2.3 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.?.?.tar.bz2
-> cd fail2ban-0.?.?
+> tar xvfj fail2ban-0.5.3.tar.bz2
+> cd fail2ban-0.5.3
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The fail2ban
 executable is placed into /usr/bin.
 
-Gentoo: an ebuild is available on the website.
-Debian: a package is available on the website.
+Gentoo: ebuilds are available on the website.
+Debian: Fail2Ban is in Debian unstable.
+RedHat: packages are available on the website.
 
 Fail2Ban should now be correctly installed. Just type:
 
diff --git a/version.py b/version.py
index b3cc35fd..bb7a2699 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.5.2-CVS"
+version = "0.5.3"

From 10c0307ad51999f51bc546eddccba0c95d0023c2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 8 Sep 2005 18:21:04 +0000
Subject: [PATCH 180/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@193 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/TODO b/TODO
index 5b383282..bfdb1a90 100644
--- a/TODO
+++ b/TODO
@@ -10,3 +10,5 @@ ToDo
 See Feature Request Tracking System at SourceForge.net
 
 - improve installation process (better prefix support)
+- install Fail2ban into /usr/share
+- better configuration files

From eb11caa621de698a5b2c82390d9a6f6b984eecf0 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 11 Sep 2005 15:42:32 +0000
Subject: [PATCH 181/549] Propagated patches introduced by Debian maintainer  
 * Fixed handling of SYSLOG logging target. Now it can log     to any SYSLOG
 target and facility as directed by the     config   * Format of SYSLOG
 entries fixed to look closer to standard   * Fixed errata in
 config/gentoo-confd   * Introduced findtime configuration variable to control
 the     lifetime of caught "failed" log entries

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@195 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                    | 12 ++++++
 config/debian-initd          | 82 +++++++++++++++++++++---------------
 config/fail2ban.conf.default | 24 +++++++++--
 config/gentoo-confd          |  2 +-
 fail2ban.py                  | 72 +++++++++++++++++++++----------
 5 files changed, 130 insertions(+), 62 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index de0736a0..89b01f3b 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,18 @@
 Fail2Ban (version 0.5.3)                           2005/09/08
 =============================================================
 
+ver. ?.?.? (????/??/??) - ?
+----------
+- Propagated patches introduced by Debian maintainer 
+  (Yaroslav Halchenko):
+  * Fixed handling of SYSLOG logging target. Now it can log
+    to any SYSLOG target and facility as directed by the 
+    config
+  * Format of SYSLOG entries fixed to look closer to standard
+  * Fixed errata in config/gentoo-confd
+  * Introduced findtime configuration variable to control the
+    lifetime of caught "failed" log entries
+	
 ver. 0.5.3 (2005/09/08) - beta
 ----------
 - Fixed a bug when overriding "maxfailures" or "bantime".
diff --git a/config/debian-initd b/config/debian-initd
index b3892991..2c5c48d1 100644
--- a/config/debian-initd
+++ b/config/debian-initd
@@ -1,13 +1,14 @@
 #! /bin/sh
 #
-# skeleton	example file to build /etc/init.d/ scripts.
-#		This file should be used to construct scripts for /etc/init.d.
+# Fail2Ban init.d file - to be launched on boot
 #
 #		Written by Miquel van Smoorenburg <miquels@cistron.nl>.
-#		Modified for Debian 
-#		by Ian Murdock <imurdock@gnu.ai.mit.edu>.
+#		Modified for Debian
+#		 by Ian Murdock <imurdock@gnu.ai.mit.edu>.
+#               Adjusted for Fail2Ban
+#                by Yaroslav Halchenko <debian@onerussian.com>.
 #
-# Version:	@(#)skeleton  1.9  26-Feb-2001  miquels@cistron.nl
+# Version:	$Id$
 #
 
 PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
@@ -26,36 +27,47 @@ DAEMON_OPTS=$FAIL2BAN_OPTS
 set -e
 
 case "$1" in
-  start)
-	echo -n "Starting $DESC: "
-        [ -f $PIDFILE ] && [ ! -d /proc/`cat $PIDFILE` ] && rm -f $PIDFILE
-	start-stop-daemon --start --quiet --pidfile /var/run/$NAME.pid \
-	        -b --exec $DAEMON -- $DAEMON_OPTS
-	echo "$NAME."
-	;;
-  stop)
-	echo -n "Stopping $DESC: "
-	start-stop-daemon --stop --quiet --pidfile /var/run/$NAME.pid 
-        rm -f $PIDFILE
-	echo "$NAME."
-	;;
-  restart|force-reload)
-	#
-	#	If the "reload" option is implemented, move the "force-reload"
-	#	option to the "reload" entry above. If not, "force-reload" is
-	#	just the same as "restart".
-	#
-	echo -n "Restarting $DESC: "
-        ( $0 stop )
-	sleep 1
-        $0 start
-	;;
-  *)
-	N=/etc/init.d/$NAME
-	# echo "Usage: $N {start|stop|restart|reload|force-reload}" >&2
-	echo "Usage: $N {start|stop|restart|force-reload}" >&2
-	exit 1
+	start)
+		echo -n "Starting $DESC: "
+		[ -f $PIDFILE ] && [ ! -d /proc/`cat $PIDFILE` ] && rm -f $PIDFILE
+		start-stop-daemon --start --quiet --pidfile $PIDFILE \
+			-b --exec $DAEMON -- $DAEMON_OPTS
+		echo "$NAME."
+		;;
+	stop)
+		echo -n "Stopping $DESC: "
+		start-stop-daemon --stop --quiet --pidfile $PIDFILE
+		echo "$NAME."
+		;;
+	restart|force-reload)
+		echo -n "Restarting $DESC: "
+		( $0 stop )
+		sleep 1
+		$0 start
+		;;
+    status)
+		echo -n "Status of $DESC: "
+		if [ ! -e "$PIDFILE" ]; then
+			echo "$NAME is not running."
+			exit 3
+		fi
+		if [ ! -r "$PIDFILE" ]; then
+			echo "$PIDFILE not readable, status of $NAME unknown."
+			exit 4
+		fi
+		if [ -d /proc/`cat "$PIDFILE"` ]; then
+			echo "$NAME is running."
+			exit 0
+		else
+			echo "$NAME is not running but $PIDFILE exists."
+			exit 1
+		fi
 	;;
+	*)
+		N=/etc/init.d/$NAME
+		echo "Usage: $N {start|stop|restart|force-reload|status}" >&2
+		exit 1
+		;;
 esac
 
-exit 0
\ No newline at end of file
+exit 0
diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 13b4539f..3c86ea53 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -23,6 +23,16 @@ debug = false
 #
 logtargets = /var/log/fail2ban.log
 
+# Option: syslog-target
+# Notes.: where to find syslog facility if logtarget SYSLOG.
+# Values: file(socket) hostname hostname:port Default: /dev/log
+syslog-target = /dev/log
+
+# Option: syslog-facility
+# Notes.: which syslog facility to use if logtarget SYSLOG.
+# Values: NUM Default: 1
+syslog-facility = 1
+
 # Option:  pidlock
 # Notes.:  path of the PID lock file (must be able to write to file).
 # Values:  FILE  Default:  /var/run/fail2ban.pid
@@ -41,6 +51,12 @@ maxfailures = 5
 #
 bantime = 600
 
+# Option:  findtime
+# Notes.:  lifetime in seconds of a "failed" log entry.
+# Values:  NUM  Default:  600
+#
+findtime = 600
+
 # Option:  ignoreip
 # Notes.:  space separated list of IP's to be ignored by fail2ban.
 #          You can use CIDR mask in order to specify a range.
@@ -56,7 +72,7 @@ ignoreip = 192.168.0.0/16
 cmdstart = 
 
 # Option:  cmdend
-# Notes.:  command executed once at the end of Fail2Ban
+# Notes.:  command executed once at the end of Fail2Ban.
 # Values:  CMD  Default:
 #
 cmdend = 
@@ -114,7 +130,7 @@ subject = [Fail2Ban] Banned <ip>
 #          <failures>  number of failures
 #          <failtime>  unix timestamp of the last failure
 #          <br>  new line
-# Values:  TEXT  Default:  
+# Values:  TEXT  Default:
 #
 message = Hi,<br>
           The IP <ip> has just been banned by Fail2Ban after
@@ -181,7 +197,7 @@ fwunban = iptables -D fail2ban-http -s <ip> -j DROP
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in Apache logfile.
-# Values:  [Wed Jan 05 15:08:01 2005]  
+# Values:  [Wed Jan 05 15:08:01 2005]
 # Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
 #
 timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
@@ -253,7 +269,7 @@ fwunban = iptables -D fail2ban-ssh -s <ip> -j DROP
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in SSH logfile.
-# Values:  [Mar  7 17:53:28]  
+# Values:  [Mar  7 17:53:28]
 # Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
 #
 timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
diff --git a/config/gentoo-confd b/config/gentoo-confd
index e156c368..bea9017e 100644
--- a/config/gentoo-confd
+++ b/config/gentoo-confd
@@ -18,6 +18,6 @@
 # 
 # $Revision$
 
-# Command line options for Fail2Ban. Refer to "fail2ban.py -h" for
+# Command line options for Fail2Ban. Refer to "fail2ban -h" for
 # valid options.
 FAIL2BAN_OPTS="-v"
diff --git a/fail2ban.py b/fail2ban.py
index debd2b6b..dafc1ad0 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -15,6 +15,7 @@
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 
 # Author: Cyril Jaquier
+# Modified by: Yaroslav Halchenko (SYSLOG, findtime)
 # 
 # $Revision$
 
@@ -144,7 +145,8 @@ def main():
 	logSys.addHandler(stdout)
 	
 	# Default formatter
-	formatter = logging.Formatter('%(asctime)s %(levelname)s %(message)s')
+	formatterstring='%(levelname)s: %(message)s'
+	formatter = logging.Formatter('%(asctime)s ' + formatterstring)
 	stdout.setFormatter(formatter)
 	
 	conf["verbose"] = 0
@@ -175,10 +177,13 @@ def main():
 	# Options
 	optionValues = (["bool", "background", False],
 					["str", "logtargets", "/var/log/fail2ban.log"],
+					["str", "syslog-target", "/dev/log"],
+					["int", "syslog-facility", 1],
 					["bool", "debug", False],
 					["str", "pidlock", "/var/run/fail2ban.pid"],
 					["int", "maxfailures", 5],
 					["int", "bantime", 600],
+					["int", "findtime", 600],
 					["str", "ignoreip", ""],
 					["int", "polltime", 1],
 					["str", "cmdstart", ""],
@@ -226,9 +231,9 @@ def main():
 	# Set debug log level
 	if conf["debug"]:
 		logSys.setLevel(logging.DEBUG)
-		formatter = logging.Formatter("%(asctime)s %(levelname)s " +
-									  "[%(filename)s (%(lineno)d)] " +
-									  "%(message)s")
+		formatterstring = ('%(levelname)s: [%(filename)s (%(lineno)d)] ' +
+						   '%(message)s')
+		formatter = logging.Formatter("%(asctime)s " + formatterstring)
 		stdout.setFormatter(formatter)
 		logSys.warn("DEBUG MODE: FIREWALL COMMANDS ARE _NOT_ EXECUTED BUT " +
 					"ONLY DISPLAYED IN THE LOG MESSAGES")
@@ -238,10 +243,42 @@ def main():
 	# Bug fix for #1234699
 	os.umask(0077)
 	for target in conf["logtargets"].split():
+		# target formatter 
+		# By default global formatter is taken. Is different for SYSLOG
+		tformatter = formatter
 		if target == "STDERR":
 			hdlr = logging.StreamHandler(sys.stderr)
 		elif target == "SYSLOG":
-			hdlr = logging.handlers.SysLogHandler()
+
+			# SYSLOG target can be either
+			#    a socket (file, so it starts with /)
+			# or hostname
+			# or hostname:port
+			syslogtargets = re.findall("(/[\w/]*)|([^/ ][^: ]*)(:(\d+)){,1}",
+									   conf["syslog-target"])
+			# we are waiting for a single match
+			syslogtargets = syslogtargets[0]
+
+			# assign facility if it was defined
+			if conf["syslog-facility"] < 0:
+				facility = handlers.SysLogHandler.LOG_USER
+			else:
+				facility = conf["syslog-facility"]
+
+			if len(syslogtargets) == 0: # everything default
+				hdlr = logging.handlers.SysLogHandler()
+			else:
+				if not ( syslogtargets[0] == "" ): # got socket
+					syslogtarget = syslogtargets[0]
+				else:		# got hostname and may be a port
+					if syslogtargets[3] == "": # no port specified
+						port = 514
+					else:
+						port = int(syslogtargets[3])
+					syslogtarget = (syslogtargets[1], port)
+				hdlr = logging.handlers.SysLogHandler(syslogtarget, facility)
+			tformatter = logging.Formatter("fail2ban[%(process)d]: " +
+										   formatterstring);
 		else:
 			# Target should be a file
 			try:
@@ -251,12 +288,12 @@ def main():
 				logSys.error("Unable to log to " + target)
 				continue
 		# Set formatter and add handler to logger
-		hdlr.setFormatter(formatter)
+		hdlr.setFormatter(tformatter)
 		logSys.addHandler(hdlr)
 	
 	# Ignores IP list
 	ignoreIPList = conf["ignoreip"].split(' ')
-	
+
 	# Checks for root user. This is necessary because log files
 	# are owned by root and firewall needs root access.
 	if not checkForRoot():
@@ -277,6 +314,7 @@ def main():
 	
 	logSys.debug("ConfFile is " + conf["conffile"])
 	logSys.debug("BanTime is " + `conf["bantime"]`)
+	logSys.debug("FindTime is " + `conf["findtime"]`)
 	logSys.debug("MaxFailure is " + `conf["maxfailures"]`)
 	
 	# Options
@@ -302,8 +340,9 @@ def main():
 	# Options
 	optionValues = (["bool", "enabled", False],
 					["str", "logfile", "/dev/null"],
-					["int", "maxfailures", None],
-					["int", "bantime", None],
+					["int", "maxfailures", conf["maxfailures"]],
+					["int", "bantime", conf["bantime"]],
+					["int", "findtime", conf["findtime"]],
 					["str", "timeregex", ""],
 					["str", "timepattern", ""],
 					["str", "failregex", ""],
@@ -316,23 +355,12 @@ def main():
 	for t in confReader.getSections():
 		l = confReader.getLogOptions(t, optionValues)
 		if l["enabled"]:
-			# Override maxfailures option
-			if not l["maxfailures"] == None:
-				maxFailures = l["maxfailures"]
-			else:
-				maxFailures = conf["maxfailures"]
-			
-			# Override bantime option
-			if not l["bantime"] == None:
-				banTime = l["bantime"]
-			else:
-				banTime = conf["bantime"]
 			
 			# Creates a logreader object
 			lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
-							 l["failregex"], maxFailures, banTime)
+							 l["failregex"], l["maxfailures"], l["findtime"])
 			# Creates a firewall object
-			fObj = Firewall(l["fwban"], l["fwunban"], banTime)
+			fObj = Firewall(l["fwban"], l["fwunban"], l["bantime"])
 			# Links them into a list. I'm not really happy
 			# with this :/
 			logFwList.append([t, lObj, fObj, dict(), l])

From 11d887c603f394143c0846d8ed9f5db001497c76 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 12 Sep 2005 14:41:40 +0000
Subject: [PATCH 182/549] - Formatting

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@196 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 3c86ea53..a8c8f80d 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -23,14 +23,16 @@ debug = false
 #
 logtargets = /var/log/fail2ban.log
 
-# Option: syslog-target
-# Notes.: where to find syslog facility if logtarget SYSLOG.
-# Values: file(socket) hostname hostname:port Default: /dev/log
+# Option:  syslog-target
+# Notes.:  where to find syslog facility if logtarget SYSLOG.
+# Values:  SOCKET HOST HOST:PORT  Default: /dev/log
+#
 syslog-target = /dev/log
 
-# Option: syslog-facility
-# Notes.: which syslog facility to use if logtarget SYSLOG.
-# Values: NUM Default: 1
+# Option:  syslog-facility
+# Notes.:  which syslog facility to use if logtarget SYSLOG.
+# Values:  NUM  Default: 1
+#
 syslog-facility = 1
 
 # Option:  pidlock

From 0d4302c9124bcbd335cc544c1cabd590ef95eaa0 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 12 Sep 2005 14:42:08 +0000
Subject: [PATCH 183/549] - Fixed bug #1286222

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@197 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/mail.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/utils/mail.py b/utils/mail.py
index 239d4e8e..23270335 100644
--- a/utils/mail.py
+++ b/utils/mail.py
@@ -27,6 +27,7 @@ __license__ = "GPL"
 import logging, smtplib
 
 from utils.strings import replaceTag
+from time import strftime, gmtime
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban")
@@ -55,8 +56,10 @@ class Mail:
 		subj = replaceTag(subject, aInfo)
 		msg = replaceTag(message, aInfo)
 		
-		mail = ("From: %s\r\nTo: %s\r\nSubject: %s\r\n\r\n" %
-				 (self.fromAddr, ", ".join(self.toAddr), subj)) + msg
+		mail = ("From: %s\r\nTo: %s\r\nDate: %s\r\nSubject: %s\r\n\r\n" %
+				(self.fromAddr, ", ".join(self.toAddr),
+				strftime("%a, %d %b %Y %H:%M:%S +0000", gmtime()),
+				subj)) + msg
 		
 		try:
 			server = smtplib.SMTP(self.host, self.port)

From cfa8d0a7fe9e7c10c7bfdff2d91fbf4e470ad774 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 12 Sep 2005 14:43:51 +0000
Subject: [PATCH 184/549] - Updated to CVS version

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@198 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.py b/version.py
index bb7a2699..7e4432e1 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.5.3"
+version = "0.5.3-CVS"

From 3ca5a75094f03a058af82ba9239d3d6f30e87fe1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 12 Sep 2005 14:44:07 +0000
Subject: [PATCH 185/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@199 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 3 ++-
 README    | 6 +++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 89b01f3b..5d1e8bd2 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,11 +4,12 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.5.3)                           2005/09/08
+Fail2Ban (version 0.?.?)                           2005/09/??
 =============================================================
 
 ver. ?.?.? (????/??/??) - ?
 ----------
+- Fixed bug #1286222.
 - Propagated patches introduced by Debian maintainer 
   (Yaroslav Halchenko):
   * Fixed handling of SYSLOG logging target. Now it can log
diff --git a/README b/README
index ba03b945..1c0601ef 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.5.3)                           2005/09/08
+Fail2Ban (version 0.?.?)                           2005/09/??
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -58,8 +58,8 @@ Require: python-2.3 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.5.3.tar.bz2
-> cd fail2ban-0.5.3
+> tar xvfj fail2ban-0.?.?.tar.bz2
+> cd fail2ban-0.?.?
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The fail2ban

From c07015129b1782d739bf43afd19f2419ce6ec93a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 13 Sep 2005 20:42:33 +0000
Subject: [PATCH 186/549] - Formatting

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@200 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index dafc1ad0..492b73db 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -249,9 +249,8 @@ def main():
 		if target == "STDERR":
 			hdlr = logging.StreamHandler(sys.stderr)
 		elif target == "SYSLOG":
-
 			# SYSLOG target can be either
-			#    a socket (file, so it starts with /)
+			# a socket (file, so it starts with /)
 			# or hostname
 			# or hostname:port
 			syslogtargets = re.findall("(/[\w/]*)|([^/ ][^: ]*)(:(\d+)){,1}",
@@ -270,7 +269,7 @@ def main():
 			else:
 				if not ( syslogtargets[0] == "" ): # got socket
 					syslogtarget = syslogtargets[0]
-				else:		# got hostname and may be a port
+				else:		# got hostname and maybe a port
 					if syslogtargets[3] == "": # no port specified
 						port = 514
 					else:
@@ -355,7 +354,6 @@ def main():
 	for t in confReader.getSections():
 		l = confReader.getLogOptions(t, optionValues)
 		if l["enabled"]:
-			
 			# Creates a logreader object
 			lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
 							 l["failregex"], l["maxfailures"], l["findtime"])

From 1c3f233475cd4c3fee4dfbb94e575b190298a1bc Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 13 Sep 2005 20:43:00 +0000
Subject: [PATCH 187/549] - Updated for 0.5.4

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@201 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  | 4 ++--
 README     | 6 +++---
 version.py | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 5d1e8bd2..829d346f 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.?.?)                           2005/09/??
+Fail2Ban (version 0.5.4)                           2005/09/13
 =============================================================
 
-ver. ?.?.? (????/??/??) - ?
+ver. 0.5.4 (2005/09/13) - beta
 ----------
 - Fixed bug #1286222.
 - Propagated patches introduced by Debian maintainer 
diff --git a/README b/README
index 1c0601ef..243c194f 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.?.?)                           2005/09/??
+Fail2Ban (version 0.5.4)                           2005/09/13
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -58,8 +58,8 @@ Require: python-2.3 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.?.?.tar.bz2
-> cd fail2ban-0.?.?
+> tar xvfj fail2ban-0.5.4.tar.bz2
+> cd fail2ban-0.5.4
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The fail2ban
diff --git a/version.py b/version.py
index 7e4432e1..87645ea0 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.5.3-CVS"
+version = "0.5.4"

From 840f6cd0520ea842111ebf1b638f96cc5f72f096 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Nov 2005 17:07:47 +0000
Subject: [PATCH 188/549] - Merged FAIL2BAN-0_5 with HEAD

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@216 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                               | 106 +++-
 MANIFEST                                |  12 +-
 README                                  |  70 ++-
 TODO                                    |  22 +-
 config/debian-initd                     |  73 +++
 config/fail2ban.conf.default            | 256 ++++++--
 config/gentoo-confd                     |   2 +-
 config/gentoo-initd                     |   6 +-
 config/redhat-initd                     |   8 +-
 confreader/configreader.py              |  43 +-
 fail2ban                                |  66 ++
 fail2ban.py                             | 790 ++++++++++++------------
 firewall/firewall.py                    | 144 ++++-
 firewall/ipfw.py                        |  72 ---
 firewall/iptables.py                    |  48 --
 log-test/apache                         |  10 +-
 log-test/current                        |   6 +
 logreader/logreader.py                  | 101 +--
 man/fail2ban.8                          |  61 ++
 man/fail2ban.conf.5                     |  20 +
 setup.py                                |  58 +-
 utils/dns.py                            |  33 +-
 utils/mail.py                           |  79 +++
 utils/pidlock.py                        | 109 ++++
 utils/process.py                        | 137 ++++
 firewall/ipfwadm.py => utils/strings.py |  32 +-
 version.py                              |   2 +-
 27 files changed, 1619 insertions(+), 747 deletions(-)
 create mode 100644 config/debian-initd
 create mode 100755 fail2ban
 delete mode 100644 firewall/ipfw.py
 delete mode 100644 firewall/iptables.py
 create mode 100644 man/fail2ban.8
 create mode 100644 man/fail2ban.conf.5
 create mode 100644 utils/mail.py
 create mode 100644 utils/pidlock.py
 create mode 100644 utils/process.py
 rename firewall/ipfwadm.py => utils/strings.py (60%)

diff --git a/CHANGELOG b/CHANGELOG
index a05b6cbd..99e4402e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,15 +4,103 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.?.?)                           ??/??/2005
+Fail2Ban (version 0.6.0)                           2005/11/20
 =============================================================
 
-ver. 0.?.? (??/??/2005) - ???
+ver. 0.6.0 (2005/11/20) - stable
 ----------
+- Propagated patches introduced by Debian maintainer 
+  (Yaroslav Halchenko):
+  * Added an option to report local time (including timezone)
+    or GMT in mail notification.
+
+ver. 0.5.5 (2005/10/26) - beta
+----------
+- Propagated patches introduced by Debian maintainer 
+  (Yaroslav Halchenko):
+  * Introduced fwcheck option to verify consistency of the
+    chains. Implemented automatic restart of fail2ban main
+    function in case check of fwban or fwunban command failed
+    (closes: #329163, #331695). (Introduced patch was further
+    adjusted by upstream author).
+  * Added -f command line parameter for [findtime].
+  * Added a cleanup of firewall rules on emergency shutdown
+    when unknown exception is catched.
+  * Fail2ban should not crash now if a wrong file name is
+    specified in config.
+  * reordered code a bit so that log targets are setup right
+    after background and then only loglevel (verbose, debug)
+    is processed, so the warning could be seen in the logs
+  * Added a keyword <section> in parsing of the subject and
+    the body of an email sent out by fail2ban (closes:
+    #330311)
+
+ver. 0.5.4 (2005/09/13) - beta
+----------
+- Fixed bug #1286222.
+- Propagated patches introduced by Debian maintainer 
+  (Yaroslav Halchenko):
+  * Fixed handling of SYSLOG logging target. Now it can log
+    to any SYSLOG target and facility as directed by the 
+    config
+  * Format of SYSLOG entries fixed to look closer to standard
+  * Fixed errata in config/gentoo-confd
+  * Introduced findtime configuration variable to control the
+    lifetime of caught "failed" log entries
+	
+ver. 0.5.3 (2005/09/08) - beta
+----------
+- Fixed a bug when overriding "maxfailures" or "bantime".
+  Thanks to Yaroslav Halchenko
+- Added more debug output if an error occurs when sending
+  mail. Thanks to Stephen Gildea
+- Renamed "maxretry" to "maxfailures" and changed default
+  value to 5. Thanks to Stephen Gildea
+- Hopefully fixed bug #1256075
+- Fixed bug #1262345
+- Fixed exception handling in PIDLock
+- Removed warning when using "-V" or "-h" with no config
+  file. Thanks to Yaroslav Halchenko
+- Removed "-i eth0" from config file. Thanks to Yaroslav
+  Halchenko
+
+ver. 0.5.2 (2005/08/06) - beta
+----------
+- Better PID lock file handling. Should close #1239562
+- Added man pages
+- Removed log4py dependency. Use logging module instead
+- "maxretry" and "bantime" can be overridden in each section
+- Fixed bug #1246278 (excessive memory usage)
+- Fixed crash on wrong option value in configuration file
+- Changed custom chains to lowercase
+
+ver. 0.5.1 (2005/07/23) - beta
+----------
+- Fixed bugs #1241756, #1239557
+- Added log targets in configuration file. Removed -l option
+- Changed iptables rules in order to create a separated chain
+  for each section
+- Fixed static banList in firewall.py
+- Added an initd script for Debian. Thanks to Yaroslav
+  Halchenko
+- Check for obsolete files after install
+
+ver. 0.5.0 (2005/07/12) - beta
+----------
+- Added support for CIDR mask in ignoreip
+- Added mail notification support
+- Fixed bug #1234699
+- Added tags replacement in rules definition. Should allow a
+  clean solution for Feature Request #1229479
+- Removed "interface" and "firewall" options
+- Added start and end commands in the configuration file.
+  Thanks to Yaroslav Halchenko
+- Added firewall rules definition in the configuration file
+- Cleaned fail2ban.py
 - Added an initd script for RedHat/Fedora. Thanks to Andrey
   G. Grozin
 
-ver. 0.4.1 (06/30/2005) - stable
+ver. 0.4.1 (2005/06/30) - stable
 ----------
 - Fixed textToDNS method which generated wrong matches for
   "rhost=12-xyz...". Thanks to Tom Pike
@@ -21,19 +109,19 @@ ver. 0.4.1 (06/30/2005) - stable
 - Changed default PID lock file location from /tmp to
   /var/run
 
-ver. 0.4.0 (04/24/2005) - stable
+ver. 0.4.0 (2005/04/24) - stable
 ----------
 - Fixed textToDNS which did not recognize strings like
   "12-345-67-890.abcd.mnopqr.xyz"
 
-ver. 0.3.1 (03/31/2005) - beta
+ver. 0.3.1 (2005/03/31) - beta
 ----------
 - Corrected level of messages
 - Added DNS lookup support
 - Improved parsing speed. Only parse the new log messages
 - Added a second verbose level (-vv)
 
-ver. 0.3.0 (02/24/2005) - beta
+ver. 0.3.0 (2005/02/24) - beta
 ----------
 - Re-writting of parts of the code in order to handle several
   log files with different rules
@@ -44,7 +132,7 @@ ver. 0.3.0 (02/24/2005) - beta
 - Added ipfw-start-rule option (thanks to Robert Edeker)
 - Added -k option which kills a currently running Fail2Ban
 
-ver. 0.1.2 (11/21/2004) - beta
+ver. 0.1.2 (2004/11/21) - beta
 ----------
 - Add ipfw and ipfwadm support. The rules are taken from
   BlockIt. Thanks to Robert Edeker
@@ -52,7 +140,7 @@ ver. 0.1.2 (11/21/2004) - beta
   Robert Edeker who reminded me this
 - Small code cleaning
 
-ver. 0.1.1 (10/23/2004) - beta
+ver. 0.1.1 (2004/10/23) - beta
 ----------
 - Add SIGTERM handler in order to exit nicely when in daemon
   mode
@@ -66,6 +154,6 @@ ver. 0.1.1 (10/23/2004) - beta
 - Code documentation
 
 
-ver. 0.1.0 (10/12/2004) - alpha
+ver. 0.1.0 (2004/10/12) - alpha
 ----------
 - Initial release
diff --git a/MANIFEST b/MANIFEST
index 330728f8..b56a8b73 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -4,18 +4,24 @@ TODO
 setup.cfg
 setup.py
 version.py
+fail2ban
 fail2ban.py
 firewall/__init__.py
 firewall/firewall.py
-firewall/iptables.py
-firewall/ipfw.py
-firewall/ipfwadm.py
 logreader/__init__.py
 logreader/logreader.py
 confreader/__init__.py
 confreader/configreader.py
 utils/__init__.py
 utils/dns.py
+utils/process.py
+utils/mail.py
+utils/strings.py
+utils/pidlock.py
 config/fail2ban.conf.default
 config/gentoo-initd
 config/gentoo-confd
+config/redhat-initd
+config/debian-initd
+man/fail2ban.8
+man/fail2ban.conf.5
diff --git a/README b/README
index 7882c60d..915304bb 100644
--- a/README
+++ b/README
@@ -4,14 +4,14 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.4.1)                           06/30/2005
+Fail2Ban (version 0.6.0)                           2005/11/20
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
 that makes too many password failures. It updates firewall
-rules to reject the IP address. Currently iptables, ipfw and
-ipfwadm are supported. Fail2Ban can read multiple log files
-such as sshd or Apache web server ones. It needs log4py.
+rules to reject the IP address. These rules can be defined by
+the user. Fail2Ban can read multiple log files such as sshd
+or Apache web server ones.
 
 This is my first Python program. Moreover, English is not my
 mother tongue...
@@ -36,51 +36,55 @@ tries to find lines which match the failregex. Then it
 retrieves the message time using timeregex and timepattern.
 It finally gets the ip and if it has already done 3 or more
 password failures in the last banTime, the ip is banned for
-banTime using a firewall rule. After banTime, the rule is
-deleted. Notice that if no "plain" ip is available, Fail2Ban
-try to do DNS lookup in order to found one or several ip's to
-ban.
+banTime using a firewall rule. This rule is set by the user
+in the configuration file. Thus, Fail2Ban can be adapted for
+lots of firewall. After banTime, the rule is deleted. Notice
+that if no "plain" ip is available, Fail2Ban try to do DNS
+lookup in order to found one or several ip's to ban.
 
 Sections can be freely added so it is possible to monitor
 several daemons at the same time.
 
 Runs on my server and does its job rather well :-) The idea
 is to make fail2ban usable with daemons and services that
-require a login (sshd, telnetd, ...). It should also support
-others firewalls than iptables.
+require a login (sshd, telnetd, ...) and with different
+firewalls.
 
 
 Installation:
 -------------
 
-Require: python-2.3 (http://www.python.org)
-         log4py-1.1 (http://sourceforge.net/projects/log4py)
+Require: python-2.4 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.4.1.tar.bz2
-> cd fail2ban-0.4.1
+> tar xvfj fail2ban-0.6.0.tar.bz2
+> cd fail2ban-0.6.0
 > python setup.py install
 
-This will install Fail2Ban into /usr/lib/fail2ban. The
-fail2ban.py executable is placed into /usr/bin.
+This will install Fail2Ban into /usr/lib/fail2ban. The fail2ban
+executable is placed into /usr/bin.
 
-For Gentoo users, an ebuild is available on the website.
+Gentoo: ebuilds are available on the website.
+Debian: Fail2Ban is in Debian unstable.
+RedHat: packages are available on the website.
 
 Fail2Ban should now be correctly installed. Just type:
 
-> fail2ban.py -h
+> fail2ban -h
 
 to see if everything is alright. You can configure fail2ban
 with a config file. Copy config/fail2ban.conf.default to
 /etc/fail2ban.conf.
 
-Gentoo users can use the initd script available in config/.
-Copy gentoo-initd to /etc/init.d/fail2ban and gentoo-confd
-to /etc/conf.d/fail2ban. You can start fail2ban and add it
-to your default runlevel:
+You can use the initd script available in config/. Copy
+<dist>-initd to /etc/init.d/fail2ban. Gentoo users must copy
+gentoo-confd to /etc/conf.d/fail2ban. You can start fail2ban:
 
 > /etc/init.d/fail2ban start
+
+Gentoo users can add it to the default runlevel:
+
 > rc-update add fail2ban default
 
 Configuration:
@@ -91,20 +95,18 @@ or using command line options. Command line options override
 the value stored in fail2ban.conf. Here are the command line
 options:
 
-  -b         start fail2ban in background
-  -d         start fail2ban in debug mode
-  -e <INTF>  ban IP on the INTF interface
+  -b         start in background
+  -d         start in debug mode
   -c <FILE>  read configuration file FILE
   -p <FILE>  create PID lock in FILE
   -h         display this help message
   -i <IP(s)> IP(s) to ignore
-  -k         kill a currently running Fail2Ban instance
-  -l <FILE>  log message in FILE
-  -r <VALUE> allow a max of VALUE password failure
-  -t <TIME>  ban IP for TIME seconds
+  -k         kill a currently running instance
+  -r <VALUE> allow a max of VALUE password failure [maxfailures]
+  -t <TIME>  ban IP for TIME seconds [bantime]
+  -f <TIME>  lifetime in seconds of failed entry [findtime]
   -v         verbose. Use twice for greater effect
-  -w <FIWA>  select the firewall to use. Can be iptables,
-             ipfwadm or ipfw
+  -V         print software version
 
 Contact:
 --------
@@ -112,7 +114,7 @@ Contact:
 You need some new features, you found bugs or you just
 appreciate this program, you can contact me at :
 
-Website: http://www.sourceforge.net/projects/fail2ban
+Website: http://fail2ban.sourceforge.net
 
 Cyril Jaquier: <lostcontrol@users.sourceforge.net>
 
@@ -121,8 +123,8 @@ Thanks:
 -------
 
 Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
-Tom Pike, Iain Lea
-
+Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
+Jonathan Kamens, Stephen Gildea
 
 License:
 --------
diff --git a/TODO b/TODO
index 569a127c..d0028108 100644
--- a/TODO
+++ b/TODO
@@ -4,12 +4,20 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-ToDo
+ToDo                                     $Revision$
 =============================================================
 
-- cleanup fail2ban.py
-- improve configuration file and command line options
-  handling
-- improve installation process
-- add init script
-- use FAM (inotify, gamin, ...)
+See Feature Request Tracking System at SourceForge.net
+
+- improve installation process (better prefix support)
+- install Fail2ban into /usr/share
+- better configuration files
+- add a check to see if the time of the log messages is
+  correctly detected (valid regexp)
+- split configuration files in /etc/fail2ban/services.d
+  Example: /etc/fail2ban/services.d/apache
+- template for common services in /etc/fail2ban/scripts.d
+  Example: /etc/fail2ban/scripts.d/apache
+- remove debug mode (root check)
+- better return values in function
+- use more email.Utils in mail.py
diff --git a/config/debian-initd b/config/debian-initd
new file mode 100644
index 00000000..2c5c48d1
--- /dev/null
+++ b/config/debian-initd
@@ -0,0 +1,73 @@
+#! /bin/sh
+#
+# Fail2Ban init.d file - to be launched on boot
+#
+#		Written by Miquel van Smoorenburg <miquels@cistron.nl>.
+#		Modified for Debian
+#		 by Ian Murdock <imurdock@gnu.ai.mit.edu>.
+#               Adjusted for Fail2Ban
+#                by Yaroslav Halchenko <debian@onerussian.com>.
+#
+# Version:	$Id$
+#
+
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+DAEMON=/usr/bin/fail2ban
+NAME=fail2ban
+DESC=fail2ban
+PIDFILE=/var/run/$NAME.pid
+
+test -x $DAEMON || exit 0
+
+# Include fail2ban defaults if available
+if [ -f /etc/default/fail2ban ] ; then
+	. /etc/default/fail2ban
+fi
+DAEMON_OPTS=$FAIL2BAN_OPTS
+set -e
+
+case "$1" in
+	start)
+		echo -n "Starting $DESC: "
+		[ -f $PIDFILE ] && [ ! -d /proc/`cat $PIDFILE` ] && rm -f $PIDFILE
+		start-stop-daemon --start --quiet --pidfile $PIDFILE \
+			-b --exec $DAEMON -- $DAEMON_OPTS
+		echo "$NAME."
+		;;
+	stop)
+		echo -n "Stopping $DESC: "
+		start-stop-daemon --stop --quiet --pidfile $PIDFILE
+		echo "$NAME."
+		;;
+	restart|force-reload)
+		echo -n "Restarting $DESC: "
+		( $0 stop )
+		sleep 1
+		$0 start
+		;;
+    status)
+		echo -n "Status of $DESC: "
+		if [ ! -e "$PIDFILE" ]; then
+			echo "$NAME is not running."
+			exit 3
+		fi
+		if [ ! -r "$PIDFILE" ]; then
+			echo "$PIDFILE not readable, status of $NAME unknown."
+			exit 4
+		fi
+		if [ -d /proc/`cat "$PIDFILE"` ]; then
+			echo "$NAME is running."
+			exit 0
+		else
+			echo "$NAME is not running but $PIDFILE exists."
+			exit 1
+		fi
+	;;
+	*)
+		N=/etc/init.d/$NAME
+		echo "Usage: $N {start|stop|restart|force-reload|status}" >&2
+		exit 1
+		;;
+esac
+
+exit 0
diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 0e547bb4..d841bd7a 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -5,18 +5,6 @@
 # 2005.06.21  modified for readability  Iain Lea  iain@bricbrac.de
 
 [DEFAULT]
-# Option:  firewall
-# Notes.:  select the firewall system to use.
-# Values:  [iptables | ipfwadm | ipfw]  Default:  iptables
-#
-firewall = iptables
-
-# Option:  ipfw-start-rule
-# Notes.:  set first firewall rule number used (only used if firewall = ipfw).
-# Values:  NUM  Default:  100
-#
-ipfw-start-rule = 100
-
 # Option:  background
 # Notes.:  start fail2ban as a daemon. Output is redirect to logfile.
 # Values:  [true | false]  Default:  false
@@ -29,23 +17,35 @@ background = false
 #
 debug = false
 
+# Option:  logtargets
+# Notes.:  log targets. Space separated list of logging targets.
+# Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
+#
+logtargets = /var/log/fail2ban.log
+
+# Option:  syslog-target
+# Notes.:  where to find syslog facility if logtarget SYSLOG.
+# Values:  SOCKET HOST HOST:PORT  Default: /dev/log
+#
+syslog-target = /dev/log
+
+# Option:  syslog-facility
+# Notes.:  which syslog facility to use if logtarget SYSLOG.
+# Values:  NUM  Default: 1
+#
+syslog-facility = 1
+
 # Option:  pidlock
 # Notes.:  path of the PID lock file (must be able to write to file).
 # Values:  FILE  Default:  /var/run/fail2ban.pid
 #
 pidlock = /var/run/fail2ban.pid
 
-# Option:  logfile
-# Notes.:  logfile for logging fail2ban messages.
-# Values:  FILE  Default:  /var/log/fail2ban.log
+# Option:  maxfailures
+# Notes.:  number of failures before IP gets banned.
+# Values:  NUM  Default:  5
 #
-logfile = /var/log/fail2ban.log
-
-# Option:  maxretry
-# Notes.:  number of retrys before IP gets banned.
-# Values:  NUM  Default:  3
-#
-maxretry = 3
+maxfailures = 5
 
 # Option:  bantime
 # Notes.:  number of seconds an IP will be banned.
@@ -53,18 +53,31 @@ maxretry = 3
 #
 bantime = 600
 
-# Option:  ignoreip
-# Notes.:  space separated list of IP's to be ignored by fail2ban
-#          Example:  ignoreip = 192.168.0.1 123.45.235.65
-# Values:  IP  Default:  
+# Option:  findtime
+# Notes.:  lifetime in seconds of a "failed" log entry.
+# Values:  NUM  Default:  600
 #
-ignoreip = 
+findtime = 600
 
-# Option:  interface
-# Notes.:  interface name on which the IP will be banned.
-# Values:  INT  Default:  eth0
+# Option:  ignoreip
+# Notes.:  space separated list of IP's to be ignored by fail2ban.
+#          You can use CIDR mask in order to specify a range.
+#          Example:  ignoreip = 192.168.0.1/24 123.45.235.65
+# Values:  IP  Default:  192.168.0.0/16
 #
-interface = eth0
+ignoreip = 192.168.0.0/16
+
+# Option:  cmdstart
+# Notes.:  command executed once at the start of Fail2Ban
+# Values:  CMD  Default:
+#
+cmdstart = 
+
+# Option:  cmdend
+# Notes.:  command executed once at the end of Fail2Ban.
+# Values:  CMD  Default:
+#
+cmdend = 
 
 # Option:  polltime
 # Notes.:  number of seconds fail2ban sleeps between iterations.
@@ -72,9 +85,89 @@ interface = eth0
 #
 polltime = 1
 
+# Option:  reinittime
+# Notes.:  minimal number of seconds between the re-initialization of
+#          firewalls due to external changes in their rules (see fwcheck)
+# Values:  NUM  Default:  100
+#
+reinittime = 10
+
+# Option:  maxreinits
+# Notes.:  maximal number of re-initialization of firewalls due to external
+#          changes. -1 stays for infinite, so only reinittime is of importance
+# Values:  NUM  Default:  -1
+#
+maxreinits = -1
+
+
+[MAIL]
+# Option:  enabled
+# Notes.:  enable mail notification when banning an IP address.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  host
+# Notes.:  host running the mail server.
+# Values:  STR  Default:  localhost
+#
+host = localhost
+
+# Option:  port
+# Notes.:  port of the mail server.
+# Values:  INT  Default:  25
+#
+port = 25
+
+# Option:  from
+# Notes.:  e-mail address of the sender.
+# Values:  MAIL  Default:  fail2ban
+#
+from = fail2ban
+
+# Option:  to
+# Notes.:  e-mail addresses of the receiver. Addresses are space
+#          separated.
+# Values:  MAIL  Default:  root
+#
+to = root
+
+# Option:  localtime
+# Notes.:  report local time (including timezone) or GMT
+# Values:  [true | false]  Default:  false
+#
+localtime = true
+
+# Option:  subject
+# Notes.:  subject of the e-mail.
+# Tags:    <section> active section (eg ssh, apache, etc)
+#          <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+# Values:  TEXT  Default:  [Fail2Ban] <section>: Banned <ip>
+#
+subject = [Fail2Ban] <section>: Banned <ip>
+
+# Option:  message
+# Notes.:  message of the e-mail.
+# Tags:    <section> active section (eg ssh, apache, etc)
+#          <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <br>  new line
+# Values:  TEXT  Default:
+#
+message = Hi,<br>
+          The IP <ip> has just been banned by Fail2Ban after
+          <failures> attempts against <section>.<br>
+          Regards,<br>
+          Fail2Ban
+
 # You can define a new section for each log file to check for
 # password failure. Each section has to define the following
-# options: logfile, timeregex, timepattern, failregex.
+# options: logfile, fwban, fwunban, timeregex, timepattern,
+# failregex.
+
 
 [Apache]
 # Option:  enabled
@@ -89,10 +182,55 @@ enabled = false
 #
 logfile = /var/log/httpd/access_log
 
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban
+# Values:  CMD  Default:
+#
+fwstart = iptables -N fail2ban-http
+          iptables -I INPUT -p tcp --dport http -j fail2ban-http
+          iptables -A fail2ban-http -j RETURN
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD  Default:
+#
+fwend = iptables -D INPUT -p tcp --dport http -j fail2ban-http
+        iptables -F fail2ban-http
+        iptables -X fail2ban-http
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD  Default:
+#
+fwcheck = iptables -L INPUT | grep -q fail2ban-http
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+fwban = iptables -I fail2ban-http 1 -s <ip> -j DROP
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+fwunban = iptables -D fail2ban-http -s <ip> -j DROP
+
 # Option:  timeregex
 # Notes.:  regex to match timestamp in Apache logfile.
-# Values:  [Wed Jan 05 15:08:01 2005]  
-# Default  \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+# Values:  [Wed Jan 05 15:08:01 2005]
+# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
 #
 timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
 
@@ -109,6 +247,7 @@ timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
 #
 failregex = authentication failure|user .* not found
 
+
 [SSH]
 # Option:  enabled
 # Notes.:  enable monitoring for this section.
@@ -122,10 +261,55 @@ enabled = true
 #
 logfile = /var/log/secure
 
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban
+# Values:  CMD  Default:
+#
+fwstart = iptables -N fail2ban-ssh
+          iptables -I INPUT -p tcp --dport ssh -j fail2ban-ssh
+          iptables -A fail2ban-ssh -j RETURN
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD  Default:
+#
+fwend = iptables -D INPUT -p tcp --dport ssh -j fail2ban-ssh
+        iptables -F fail2ban-ssh
+        iptables -X fail2ban-ssh
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD  Default:
+#
+fwcheck = iptables -L INPUT | grep -q fail2ban-ssh
+
+# Option:  fwbanrule
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+fwban = iptables -I fail2ban-ssh 1 -s <ip> -j DROP
+
+# Option:  fwunbanrule
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+fwunban = iptables -D fail2ban-ssh -s <ip> -j DROP
+
 # Option:  timeregex
 # Notes.:  regex to match timestamp in SSH logfile.
-# Values:  [Mar  7 17:53:28]  
-# Default  \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+# Values:  [Mar  7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
 #
 timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
 
diff --git a/config/gentoo-confd b/config/gentoo-confd
index e156c368..bea9017e 100644
--- a/config/gentoo-confd
+++ b/config/gentoo-confd
@@ -18,6 +18,6 @@
 # 
 # $Revision$
 
-# Command line options for Fail2Ban. Refer to "fail2ban.py -h" for
+# Command line options for Fail2Ban. Refer to "fail2ban -h" for
 # valid options.
 FAIL2BAN_OPTS="-v"
diff --git a/config/gentoo-initd b/config/gentoo-initd
index b6b2a0b1..8cab7535 100755
--- a/config/gentoo-initd
+++ b/config/gentoo-initd
@@ -21,7 +21,7 @@
 
 opts="start stop restart showlog"
 
-FAIL2BAN="/usr/bin/fail2ban.py"
+FAIL2BAN="/usr/bin/fail2ban"
 
 depend() {
 	need net
@@ -31,13 +31,13 @@ depend() {
 
 start() {
 	ebegin "Starting fail2ban"
-	${FAIL2BAN} -b ${FAIL2BAN_OPTS}
+	${FAIL2BAN} -b ${FAIL2BAN_OPTS} > /dev/null
 	eend $? "Failed to start fail2ban"
 }
 
 stop() {
 	ebegin "Stopping fail2ban"
-	${FAIL2BAN} -k
+	${FAIL2BAN} -k > /dev/null
 	eend $? "Failed to stop fail2ban"
 }
 
diff --git a/config/redhat-initd b/config/redhat-initd
index 27369962..6e885ab5 100644
--- a/config/redhat-initd
+++ b/config/redhat-initd
@@ -21,14 +21,14 @@
 [ "${NETWORKING}" = "no" ] && exit 0
 [ -f /etc/fail2ban.conf ] || exit 0
 
-FAIL2BAN="/usr/bin/fail2ban.py"
+FAIL2BAN="/usr/bin/fail2ban"
 PIDFILE="/var/run/fail2ban.pid"
 
 RETVAL=0
 
 start() {
     echo -n $"Starting fail2ban: "
-    "${FAIL2BAN}" -b
+    "${FAIL2BAN}" -b > /dev/null
     RETVAL=$?
     echo
 }
@@ -36,7 +36,7 @@ start() {
 stop() {
     if [ -f "${PIDFILE}" ]; then
 	echo -n $"Stopping fail2ban: "
-	"${FAIL2BAN}" -k
+	"${FAIL2BAN}" -k > /dev/null
 	echo
     fi
 }
@@ -55,7 +55,7 @@ case "$1" in
         stop
         ;;
   status)
-        status fail2ban.py
+        status fail2ban
         RETVAL=$?
         ;;
   reload)
diff --git a/confreader/configreader.py b/confreader/configreader.py
index c3eb271b..150858b5 100644
--- a/confreader/configreader.py
+++ b/confreader/configreader.py
@@ -24,28 +24,22 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
+import logging
+
 from ConfigParser import *
 
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
 class ConfigReader:
 	""" This class allow the handling of the configuration options.
 		The DEFAULT section contains the global information about
 		Fail2Ban. Each other section is for a different log file.
 	"""
-	
-	# Each optionValues entry is composed of an array with:
-	# 0 -> the type of the option
-	# 1 -> the name of the option
-	# 2 -> the default value for the option
-	optionValues = (["bool", "enabled", True],
-					["str", "logfile", "/dev/null"],
-					["str", "timeregex", ""],
-					["str", "timepattern", ""],
-					["str", "failregex", ""])
-	
-	def __init__(self, logSys, confPath):
+
+	def __init__(self, confPath):
 		self.confPath = confPath
 		self.configParser = SafeConfigParser()
-		self.logSys = logSys
 		
 	def openConf(self):
 		""" Opens the configuration file.
@@ -54,16 +48,23 @@ class ConfigReader:
 	
 	def getSections(self):
 		""" Returns all the sections present in the configuration
-			file except the DEFAULT section.
+			file except the DEFAULT and MAIL sections.
 		"""
-		return self.configParser.sections()
-		
-	def getLogOptions(self, sec):
+		sections = self.configParser.sections()
+		sections.remove("MAIL")
+		logSys.debug("Found sections: " + `sections`)
+		return sections
+	
+	# Each optionValues entry is composed of an array with:
+	# 0 -> the type of the option
+	# 1 -> the name of the option
+	# 2 -> the default value for the option
+	def getLogOptions(self, sec, options):
 		""" Gets all the options of a given section. The options
 			are defined in the optionValues list.
 		"""
 		values = dict()
-		for option in self.optionValues:
+		for option in options:
 			try:
 				if option[0] == "bool":
 					v = self.configParser.getboolean(sec, option[1])
@@ -74,7 +75,11 @@ class ConfigReader:
 				
 				values[option[1]] = v
 			except NoOptionError:
-				self.logSys.warn("No '"+option[1]+"' defined in '"+sec+"'")
+				logSys.warn("No '" + option[1] + "' defined in '" + sec + "'")
+				values[option[1]] = option[2]
+			except ValueError:
+				logSys.warn("Wrong value for '" + option[1] + "' in '" + sec +
+							"'. Using default one: '" + `option[2]` + "'")
 				values[option[1]] = option[2]
 		return values
 		
\ No newline at end of file
diff --git a/fail2ban b/fail2ban
new file mode 100755
index 00000000..05213f9e
--- /dev/null
+++ b/fail2ban
@@ -0,0 +1,66 @@
+#!/usr/bin/env python
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import sys, traceback, logging
+
+# Appends our own modules path.
+sys.path.append("/usr/lib/fail2ban")
+
+# Now we can import our modules.
+import fail2ban
+from utils.pidlock import PIDLock
+
+# Get the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+# Get PID lock file instance
+pidLock = PIDLock()
+
+# Start the application. Handle all the unhandled exceptions
+try:
+	fail2ban.main()
+except SystemExit:
+	# We called sys.exit(). Nothing wrong so just pass
+	pass
+except Exception, e:
+	# Print the exception data
+	(type, value, tb) = sys.exc_info()
+	tbStack = traceback.extract_tb(tb)
+	logSys.error("Fail2Ban got an unhandled exception and died.")
+	logSys.error("Type: " + `type.__name__` + "\n" +
+				 "Value: " + `e.args` + "\n" +
+				 "TB: " + `tbStack`)
+	# Try to clean up after ourselves
+	# just for extreme caution - wrapping with try
+	try:
+		fail2ban.restoreFwRules()
+	except Exception:
+		pass
+	# Remove the PID lock file. Should close #1239562
+	pidLock.remove()
+	logging.shutdown()
diff --git a/fail2ban.py b/fail2ban.py
index 5fdfe698..d2e88b3e 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python
-
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -17,6 +15,7 @@
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 
 # Author: Cyril Jaquier
+# Modified by: Yaroslav Halchenko (SYSLOG, findtime)
 # 
 # $Revision$
 
@@ -26,50 +25,58 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, sys, getopt, os, signal, string
+import time, sys, getopt, os, string, signal, logging, logging.handlers, copy
 from ConfigParser import *
 
-# Checks if log4py is present.
-try:
-	import log4py
-except:
-	print "log4py is needed (see README)"
-	sys.exit(-1)
-
-# Appends our own modules path
-sys.path.append('/usr/lib/fail2ban')
-
-from firewall.iptables import Iptables
-from firewall.ipfw import Ipfw
-from firewall.ipfwadm import Ipfwadm
+from version import version
+from firewall.firewall import Firewall
 from logreader.logreader import LogReader
 from confreader.configreader import ConfigReader
-from version import version
+from utils.mail import Mail
+from utils.pidlock import PIDLock
+from utils.dns import *
+from utils.process import *
 
-def usage():
-	print "Usage: fail2ban.py [OPTIONS]"
+# Get the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+# Get PID lock file instance
+pidLock = PIDLock()
+
+# Global variables
+logFwList = list()
+conf = dict()
+
+def dispUsage():
+	""" Prints Fail2Ban command line options and exits
+	"""
+	print "Usage: "+sys.argv[0]+" [OPTIONS]"
 	print
 	print "Fail2Ban v"+version+" reads log file that contains password failure report"
-	print "and bans the corresponding IP address using iptables."
+	print "and bans the corresponding IP addresses using firewall rules."
 	print
-	print "  -b         start fail2ban in background"
-	print "  -d         start fail2ban in debug mode"
-	print "  -e <INTF>  ban IP on the INTF interface"
+	print "  -b         start in background"
+	print "  -d         start in debug mode"
 	print "  -c <FILE>  read configuration file FILE"
 	print "  -p <FILE>  create PID lock in FILE"
 	print "  -h         display this help message"
 	print "  -i <IP(s)> IP(s) to ignore"
-	print "  -k         kill a currently running Fail2Ban instance"
-	print "  -l <FILE>  log message in FILE"
-	print "  -r <VALUE> allow a max of VALUE password failure"
-	print "  -t <TIME>  ban IP for TIME seconds"
+	print "  -k         kill a currently running instance"
+	print "  -r <VALUE> allow a max of VALUE password failure [maxfailures]"
+	print "  -t <TIME>  ban IP for TIME seconds [bantime]"
+	print "  -f <TIME>  lifetime in seconds of failed entry [findtime]"
 	print "  -v         verbose. Use twice for greater effect"
-	print "  -w <FIWA>  select the firewall to use. Can be iptables,"
-	print "             ipfwadm or ipfw"
+	print "  -V         print software version"
 	print
 	print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	sys.exit(0)
 
+def dispVersion():
+	""" Prints Fail2Ban version and exits
+	"""
+	print sys.argv[0]+" "+version
+	sys.exit(0)
+
 def checkForRoot():
 	""" Check for root user.
 	"""
@@ -79,359 +86,249 @@ def checkForRoot():
 	else:
 		return False
 
-def createDaemon():
-	"""Detach a process from the controlling terminal and run it in the
-	background as a daemon.
-	
-	http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
-	"""
-
-	try:
-		# Fork a child process so the parent can exit.  This will return control
-		# to the command line or shell.  This is required so that the new process
-		# is guaranteed not to be a process group leader.  We have this guarantee
-		# because the process GID of the parent is inherited by the child, but
-		# the child gets a new PID, making it impossible for its PID to equal its
-		# PGID.
-		pid = os.fork()
-	except OSError, e:
-		return((e.errno, e.strerror))	 # ERROR (return a tuple)
-
-	if (pid == 0):	   # The first child.
-
-		# Next we call os.setsid() to become the session leader of this new
-		# session.  The process also becomes the process group leader of the
-		# new process group.  Since a controlling terminal is associated with a
-		# session, and this new session has not yet acquired a controlling
-		# terminal our process now has no controlling terminal.  This shouldn't
-		# fail, since we're guaranteed that the child is not a process group
-		# leader.
-		os.setsid()
-	
-		# When the first child terminates, all processes in the second child
-		# are sent a SIGHUP, so it's ignored.
-		signal.signal(signal.SIGHUP, signal.SIG_IGN)
-	
-		try:
-			# Fork a second child to prevent zombies.  Since the first child is
-			# a session leader without a controlling terminal, it's possible for
-			# it to acquire one by opening a terminal in the future.  This second
-			# fork guarantees that the child is no longer a session leader, thus
-			# preventing the daemon from ever acquiring a controlling terminal.
-			pid = os.fork()		# Fork a second child.
-		except OSError, e:
-			return((e.errno, e.strerror))  # ERROR (return a tuple)
-	
-		if (pid == 0):	  # The second child.
-			# Ensure that the daemon doesn't keep any directory in use.  Failure
-			# to do this could make a filesystem unmountable.
-			os.chdir("/")
-			# Give the child complete control over permissions.
-			os.umask(0)
-		else:
-			os._exit(0)	  # Exit parent (the first child) of the second child.
-	else:
-		os._exit(0)		 # Exit parent of the first child.
-
-	# Close all open files.  Try the system configuration variable, SC_OPEN_MAX,
-	# for the maximum number of open files to close.  If it doesn't exist, use
-	# the default value (configurable).
-	try:
-		maxfd = os.sysconf("SC_OPEN_MAX")
-	except (AttributeError, ValueError):
-		maxfd = 256	   # default maximum
-
-	for fd in range(0, maxfd):
-		try:
-			os.close(fd)
-		except OSError:   # ERROR (ignore)
-			pass
-
-	# Redirect the standard file descriptors to /dev/null.
-   	os.open("/dev/null", os.O_RDONLY)	# standard input (0)
-	os.open("/dev/null", os.O_RDWR)		# standard output (1)
-	os.open("/dev/null", os.O_RDWR)		# standard error (2)
-
-	return True
-
 def sigTERMhandler(signum, frame):
 	""" Handles the TERM signal when in daemon mode in order to
 		exit properly.
 	"""
 	logSys.debug("Signal handler called with sig "+`signum`)
-	killApp()
+	killApp()	
+
+def setFwMustCheck(value):
+	""" Set the mustCheck value of the firewalls (True/False)
+	"""
+	for element in logFwList:
+		element[2].setMustCheck(value)
+
+def initializeFwRules():
+	""" Initializes firewalls by running cmdstart and then
+	    fwstart for each section
+	"""
+	# Execute global start command
+	executeCmd(conf["cmdstart"], conf["debug"])
+	# Execute start command of each section
+	for element in logFwList:
+		element[2].initialize(conf["debug"])
+
+def reBan():
+	""" For each section asks the Firewall to reban known IPs
+	"""
+	for element in logFwList:
+		element[2].reBan(conf["debug"])
+
+def restoreFwRules():
+	""" Flush the ban list
+	"""
+	logSys.warn("Restoring firewall rules...")
+	try:
+		for element in logFwList:
+			# Execute end command of each section
+			element[2].restore(conf["debug"])
+		# Execute global end command
+		executeCmd(conf["cmdend"], conf["debug"])
+	except ExternalError:
+		# nothing bad really - we can survive :-)
+		pass
 
 def killApp():
 	""" Flush the ban list, remove the PID lock file and exit
 		nicely.
 	"""
-	logSys.warn("Restoring firewall rules...")
-	fireWall.flushBanList(conf["debug"])
-	removePID(conf["pidlock"])
+	# Restore Fw rules
+	restoreFwRules()
+	# Remove the PID lock
+	pidLock.remove()
 	logSys.info("Exiting...")
+	logging.shutdown()
 	sys.exit(0)
-	
-def checkForPID(lockfile):
-	""" Checks for running Fail2Ban.
-	
-		Returns the current PID if Fail2Ban is running or False
-		if no instance found.
-	"""
-	try:
-		fileHandler = open(lockfile)
-		pid = fileHandler.readline()
-		return pid
-	except IOError:
-		return False
-		
-def createPID(lockfile):
-	""" Creates a PID lock file with the current PID.
-	"""
-	fileHandler = open(lockfile, mode='w')
-	pid = os.getpid()
-	fileHandler.write(`pid`+'\n')
-	fileHandler.close()
-	logSys.debug("Created PID lock ("+`pid`+") in "+lockfile)
-		
-def removePID(lockfile):
-	""" Remove PID lock.
-	"""
-	os.remove(lockfile)
-	logSys.debug("Removed PID lock "+lockfile)
 
-def killPID(pid):
-	""" Kills the process with the given PID using the
-		INT signal (same effect as <ctrl>+<c>).
+def getCmdLineOptions(optList):
+	""" Gets the command line options
 	"""
-	try:
-		return os.kill(pid, 2)
-	except OSError:
-		logSys.error("Can not kill process " + `pid` + ". Please check that " +
-					"Fail2Ban is not running and remove the file " +
-					"'/tmp/fail2ban.pid'")
-
-if __name__ == "__main__":
-	
-	# Gets an instance of log4py.
-	logSys = log4py.Logger().get_instance()
-	logSys.set_formatstring("%T %L %M")
-	
-	conf = dict()
-	conf["verbose"] = 0
-	conf["background"] = False
-	conf["debug"] = False
-	conf["conffile"] = "/etc/fail2ban.conf"
-	conf["pidlock"] = "/var/run/fail2ban.pid"
-	conf["logging"] = False
-	conf["logfile"] = "/var/log/fail2ban.log"
-	conf["maxretry"] = 3
-	conf["bantime"] = 600
-	conf["ignoreip"] = ''
-	conf["interface"] = "eth0"
-	conf["firewall"] = "iptables"
-	conf["ipfw-start-rule"] = 0
-	conf["polltime"] = 1
-	
-	# Reads the command line options.
-	try:
-		optList, args = getopt.getopt(sys.argv[1:], 'hvbdkc:l:t:i:r:e:w:p:')
-	except getopt.GetoptError:
-		usage()
-	
-	# Pre-parsing of command line options for the -c option
 	for opt in optList:
-		if opt[0] == "-c":
-			conf["conffile"] = opt[1]
-	
-	# Config file
-	configParser = SafeConfigParser()
-	configParser.read(conf["conffile"])
-	
-	# background
-	try:
-		conf["background"] = configParser.getboolean("DEFAULT", "background")
-	except ValueError:
-		logSys.warn("background option should be a boolean")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("background option not in config file")
-		logSys.warn("Using default value")
-
-	# debug
-	try:
-		conf["debug"] = configParser.getboolean("DEFAULT", "debug")
-	except ValueError:
-		logSys.warn("debug option should be a boolean")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("debug option not in config file")
-		logSys.warn("Using default value")
-
-	# logfile
-	try:
-		conf["logfile"] = configParser.get("DEFAULT", "logfile")
-	except ValueError:
-		logSys.warn("logfile option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("logfile option not in config file")
-		logSys.warn("Using default value")
-		
-	# pidlock
-	try:
-		conf["pidlock"] = configParser.get("DEFAULT", "pidlock")
-	except ValueError:
-		logSys.warn("pidlock option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("pidlock option not in config file")
-		logSys.warn("Using default value")
-		
-	# maxretry
-	try:
-		conf["maxretry"] = configParser.getint("DEFAULT", "maxretry")
-	except ValueError:
-		logSys.warn("maxretry option should be an integer")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("maxretry option not in config file")
-		logSys.warn("Using default value")
-
-	# bantime
-	try:
-		conf["bantime"] = configParser.getint("DEFAULT", "bantime")
-	except ValueError:
-		logSys.warn("bantime option should be an integer")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("bantime option not in config file")
-		logSys.warn("Using default value")
-
-	# ignoreip
-	try:
-		conf["ignoreip"] = configParser.get("DEFAULT", "ignoreip")
-	except ValueError:
-		logSys.warn("ignoreip option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("ignoreip option not in config file")
-		logSys.warn("Using default value")
-		
-	# interface
-	try:
-		conf["interface"] = configParser.get("DEFAULT", "interface")
-	except ValueError:
-		logSys.warn("interface option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("interface option not in config file")
-		logSys.warn("Using default value")
-		
-	# firewall
-	try:
-		conf["firewall"] = configParser.get("DEFAULT", "firewall")
-	except ValueError:
-		logSys.warn("firewall option should be a string")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("firewall option not in config file")
-		logSys.warn("Using default value")
-	
-	# ipfw-start-rule
-	try:
-		conf["ipfw-start-rule"] = configParser.getint("DEFAULT",
-													"ipfw-start-rule")
-	except ValueError:
-		logSys.warn("ipfw-start-rule option should be an integer")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("ipfw-start-rule option not in config file")
-		logSys.warn("Using default value")
-
-	# polltime
-	try:
-		conf["polltime"] = configParser.getint("DEFAULT", "polltime")
-	except ValueError:
-		logSys.warn("polltime option should be an integer")
-		logSys.warn("Using default value")
-	except NoOptionError:
-		logSys.warn("polltime option not in config file")
-		logSys.warn("Using default value")
-	
-	for opt in optList:
-		if opt[0] == "-h":
-			usage()
 		if opt[0] == "-v":
 			conf["verbose"] = conf["verbose"] + 1
 		if opt[0] == "-b":
 			conf["background"] = True
 		if opt[0] == "-d":
 			conf["debug"] = True
-		if opt[0] == "-e":
-			conf["interface"] = opt[1]
-		if opt[0] == "-l":
-			conf["logging"] = True
-			conf["logfile"] = opt[1]
 		if opt[0] == "-t":
 			try:
 				conf["bantime"] = int(opt[1])
 			except ValueError:
 				logSys.warn("banTime must be an integer")
 				logSys.warn("Using default value")
+		if opt[0] == "-f":
+			try:
+				conf["findtime"] = int(opt[1])
+			except ValueError:
+				logSys.warn("findTime must be an integer")
+				logSys.warn("Using default value")
 		if opt[0] == "-i":
 			conf["ignoreip"] = opt[1]
 		if opt[0] == "-r":
-			conf["retrymax"] = int(opt[1])
-		if opt[0] == "-w":
-			conf["firewall"] = opt[1]
+			conf["maxfailures"] = int(opt[1])
 		if opt[0] == "-p":
 			conf["pidlock"] = opt[1]
 		if opt[0] == "-k":
-			pid = checkForPID(conf["pidlock"])
-			if pid:
-				killPID(int(pid))
-				logSys.warn("Killed Fail2Ban with PID "+pid)
-				sys.exit(0)
-			else:
-				logSys.error("No running Fail2Ban found")
-				sys.exit(-1)
+			conf["kill"] = True
+
+def main():
+	""" Fail2Ban main function
+	"""
+	
+	# Add the default logging handler
+	stdout = logging.StreamHandler(sys.stdout)
+	logSys.addHandler(stdout)
+	
+	# Default formatter
+	formatterstring='%(levelname)s: %(message)s'
+	formatter = logging.Formatter('%(asctime)s ' + formatterstring)
+	stdout.setFormatter(formatter)
+	
+	conf["kill"] = False
+	conf["verbose"] = 0
+	conf["conffile"] = "/etc/fail2ban.conf"
+	
+	# Reads the command line options.
+	try:
+		cmdOpts = 'hvVbdkc:t:i:r:p:'
+		cmdLongOpts = ['help','version']
+		optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
+	except getopt.GetoptError:
+		dispUsage()
+	
+	# Pre-parsing of command line options for the -c option
+	for opt in optList:
+		if opt[0] == "-c":
+			conf["conffile"] = opt[1]
+		if opt[0] in ["-h", "--help"]:
+ 			dispUsage()
+		if opt[0] in ["-V", "--version"]:
+			dispVersion()
+	
+	# Reads the config file and create a LogReader instance for
+	# each log file to check.
+	confReader = ConfigReader(conf["conffile"]);
+	confReader.openConf()
+	
+	# Options
+	optionValues = (["bool", "background", False],
+					["str", "logtargets", "/var/log/fail2ban.log"],
+					["str", "syslog-target", "/dev/log"],
+					["int", "syslog-facility", 1],
+					["bool", "debug", False],
+					["str", "pidlock", "/var/run/fail2ban.pid"],
+					["int", "maxfailures", 5],
+					["int", "bantime", 600],
+					["int", "findtime", 600],
+					["str", "ignoreip", ""],
+					["int", "polltime", 1],
+					["str", "cmdstart", ""],
+					["str", "cmdend", ""],
+					["int", "reinittime", 100],
+					["int", "maxreinits", 100])
+	
+	# Gets global configuration options
+	conf.update(confReader.getLogOptions("DEFAULT", optionValues))
+	
+	# Gets command line options
+	getCmdLineOptions(optList)
+	
+	# PID lock
+	pidLock.setPath(conf["pidlock"])
+	
+	# Now we can kill properly a running instance if needed
+	if conf["kill"]:
+		pid = pidLock.exists()
+		if pid:
+			killPID(int(pid))
+			logSys.warn("Killed Fail2Ban with PID "+pid)
+			sys.exit(0)
+		else:
+			logSys.error("No running Fail2Ban found")
+			sys.exit(-1)
+
+	# Start Fail2Ban in daemon mode
+	if conf["background"]:
+		retCode = createDaemon()
+		signal.signal(signal.SIGTERM, sigTERMhandler)
+		if not retCode:
+			logSys.error("Unable to start daemon")
+			sys.exit(-1)
 
 	# Process some options
-	for c in conf:
-		if c == "verbose":
-			logSys.warn("Verbose level is "+`conf[c]`)
-			if conf[c] == 1:
-				logSys.set_loglevel(log4py.LOGLEVEL_VERBOSE)
-			elif conf[c] > 1:
-				logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
-		elif c == "debug" and conf[c]:
-			logSys.set_loglevel(log4py.LOGLEVEL_DEBUG)
-			logSys.set_formatstring(log4py.FMT_DEBUG)
-		elif c == "background" and conf[c]:
-			retCode = createDaemon()
-			signal.signal(signal.SIGTERM, sigTERMhandler)
-			logSys.set_target(conf["logfile"])
-			if not retCode:
-				logSys.error("Unable to start daemon")
-				sys.exit(-1)
-		elif c == "logging" and conf[c]:
-			try:
-				open(conf["logfile"], "a")
-				logSys.set_target(conf["logfile"])
-			except IOError:
-				logSys.warn("Unable to log to "+conf["logfile"])
-				logSys.warn("Using default output for logging")
-		elif c == "ignoreip":
-			ignoreIPList = conf[c].split(' ')
-		elif c == "firewall":
-			conf[c] = string.lower(conf[c])
-			if conf[c] == "ipfw":
-				fireWallName = "Ipfw"
-			elif conf[c] == "ipfwadm":
-				fireWallName = "Ipfwadm"
+	# First setup Log targets
+	# Bug fix for #1234699
+	os.umask(0077)
+	for target in conf["logtargets"].split():
+		# target formatter 
+		# By default global formatter is taken. Is different for SYSLOG
+		tformatter = formatter
+		if target == "STDERR":
+			hdlr = logging.StreamHandler(sys.stderr)
+		elif target == "SYSLOG":
+			# SYSLOG target can be either
+			# a socket (file, so it starts with /)
+			# or hostname
+			# or hostname:port
+			syslogtargets = re.findall("(/[\w/]*)|([^/ ][^: ]*)(:(\d+)){,1}",
+									   conf["syslog-target"])
+			# we are waiting for a single match
+			syslogtargets = syslogtargets[0]
+
+			# assign facility if it was defined
+			if conf["syslog-facility"] < 0:
+				facility = handlers.SysLogHandler.LOG_USER
 			else:
-				fireWallName = "Iptables"
+				facility = conf["syslog-facility"]
+
+			if len(syslogtargets) == 0: # everything default
+				hdlr = logging.handlers.SysLogHandler()
+			else:
+				if not ( syslogtargets[0] == "" ): # got socket
+					syslogtarget = syslogtargets[0]
+				else:		# got hostname and maybe a port
+					if syslogtargets[3] == "": # no port specified
+						port = 514
+					else:
+						port = int(syslogtargets[3])
+					syslogtarget = (syslogtargets[1], port)
+				hdlr = logging.handlers.SysLogHandler(syslogtarget, facility)
+			tformatter = logging.Formatter("fail2ban[%(process)d]: " +
+										   formatterstring);
+		else:
+			# Target should be a file
+			try:
+				open(target, "a")
+				hdlr = logging.FileHandler(target)
+			except IOError:
+				logSys.error("Unable to log to " + target)
+				continue
+		# Set formatter and add handler to logger
+		hdlr.setFormatter(tformatter)
+		logSys.addHandler(hdlr)
 	
+	# Verbose level
+	if conf["verbose"]:
+		logSys.warn("Verbose level is "+`conf["verbose"]`)
+		if conf["verbose"] == 1:
+			logSys.setLevel(logging.INFO)
+		elif conf["verbose"] > 1:
+			logSys.setLevel(logging.DEBUG)
+		
+	# Set debug log level
+	if conf["debug"]:
+		logSys.setLevel(logging.DEBUG)
+		formatterstring = ('%(levelname)s: [%(filename)s (%(lineno)d)] ' +
+						   '%(message)s')
+		formatter = logging.Formatter("%(asctime)s " + formatterstring)
+		stdout.setFormatter(formatter)
+		logSys.warn("DEBUG MODE: FIREWALL COMMANDS ARE _NOT_ EXECUTED BUT " +
+					"ONLY DISPLAYED IN THE LOG MESSAGES")
+	
+	# Ignores IP list
+	ignoreIPList = conf["ignoreip"].split(' ')
+
 	# Checks for root user. This is necessary because log files
 	# are owned by root and firewall needs root access.
 	if not checkForRoot():
@@ -440,51 +337,93 @@ if __name__ == "__main__":
 			sys.exit(-1)
 			
 	# Checks that no instance of Fail2Ban is currently running.
-	pid = checkForPID(conf["pidlock"])
+	pid = pidLock.exists()
 	if pid:
 		logSys.error("Fail2Ban already running with PID "+pid)
 		sys.exit(-1)
 	else:
-		createPID(conf["pidlock"])
+		ret = pidLock.create()
+		if not ret:
+			# Unable to create PID lock. Exit
+			sys.exit(-1)
 	
-	logSys.debug("ConfFile is "+conf["conffile"])
-	logSys.debug("BanTime is "+`conf["bantime"]`)
-	logSys.debug("retryAllowed is "+`conf["maxretry"]`)
+	logSys.debug("ConfFile is " + conf["conffile"])
+	logSys.debug("BanTime is " + `conf["bantime"]`)
+	logSys.debug("FindTime is " + `conf["findtime"]`)
+	logSys.debug("MaxFailure is " + `conf["maxfailures"]`)
 	
-	# Reads the config file and create a LogReader instance for
-	# each log file to check.
-	confReader = ConfigReader(logSys, conf["conffile"]);
-	confReader.openConf()
-	logList = list()
+	# Options
+	optionValues = (["bool", "enabled", False],
+					["str", "host", "localhost"],
+					["int", "port", "25"],
+					["str", "from", "root"],
+					["str", "to", "root"],
+					["bool", "localtime", False],
+					["str", "subject", "[Fail2Ban] Banned <ip>"],
+					["str", "message", "Fail2Ban notification"])
+	
+	# Gets global configuration options
+	mailConf = confReader.getLogOptions("MAIL", optionValues)
+	
+	# Create mailer if enabled
+	if mailConf["enabled"]:
+		logSys.debug("Mail enabled")
+		mail = Mail(mailConf["host"], mailConf["port"])
+		mail.setFromAddr(mailConf["from"])
+		mail.setToAddr(mailConf["to"])
+		mail.setLocalTimeFlag(mailConf["localtime"])
+		logSys.debug("to: " + mailConf["to"] + " from: " + mailConf["from"])
+	
+	# Options
+	optionValues = (["bool", "enabled", False],
+					["str", "logfile", "/dev/null"],
+					["int", "maxfailures", conf["maxfailures"]],
+					["int", "bantime", conf["bantime"]],
+					["int", "findtime", conf["findtime"]],
+					["str", "timeregex", ""],
+					["str", "timepattern", ""],
+					["str", "failregex", ""],
+					["str", "fwstart", ""],
+					["str", "fwend", ""],
+					["str", "fwban", ""],
+					["str", "fwunban", ""],
+					["str", "fwcheck", ""])
+	
+	logSys.info("Fail2Ban v" + version + " is running")
+	
+	# Gets the options of each sections
 	for t in confReader.getSections():
-		l = confReader.getLogOptions(t)
+		l = confReader.getLogOptions(t, optionValues)
 		if l["enabled"]:
-			lObj = LogReader(logSys, l["logfile"], l["timeregex"],
-							l["timepattern"], l["failregex"], conf["bantime"])
-			lObj.setName(t)
-			logList.append(lObj)
-	
-	# Creates one instance of Iptables (thanks to Pyhton dynamic
-	# features).
-	fireWallObj = eval(fireWallName)
-	fireWall = fireWallObj(conf["bantime"], logSys, conf["interface"])
-	
-	# IPFW needs rules number. The configuration option "ipfw-start-rule"
-	# defines the first rule number used by Fail2Ban.
-	if fireWallName == "Ipfw":
-		fireWall.setCrtRuleNbr(conf["ipfw-start-rule"])
+			# Creates a logreader object
+			lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
+							 l["failregex"], l["maxfailures"], l["findtime"])
+			# Creates a firewall object
+			fObj = Firewall(l["fwstart"], l["fwend"], l["fwban"], l["fwunban"],
+							l["fwcheck"], l["bantime"])
+			# "Name" the firewall
+			fObj.setSection(t)
+			# Links them into a list. I'm not really happy
+			# with this :/
+			logFwList.append([t, lObj, fObj, dict(), l])
 	
 	# We add 127.0.0.1 to the ignore list has we do not want
 	# to be ban ourself.
-	for element in logList:
-		element.addIgnoreIP("127.0.0.1")
+	for element in logFwList:
+		element[1].addIgnoreIP("127.0.0.1")
 	while len(ignoreIPList) > 0:
 		ip = ignoreIPList.pop()
-		for element in logList:
-			element.addIgnoreIP(ip)
+		# Bug fix for #1239557
+		if isValidIP(ip):
+			for element in logFwList:
+				element[1].addIgnoreIP(ip)
+		else:
+			logSys.warn(ip + " is not a valid IP address")
 	
-	logSys.info("Fail2Ban v"+version+" is running")
-	failListFull = dict()
+	initializeFwRules()
+	# try to reinit once if it fails immediately
+	lastReinitTime = time.time() - conf["reinittime"] - 1
+	reinits = 0
 	# Main loop
 	while True:
 		try:
@@ -493,14 +432,15 @@ if __name__ == "__main__":
 			
 			# Checks if some IP have to be remove from ban
 			# list.
-			fireWall.checkForUnBan(conf["debug"])
-			
+			for element in logFwList:
+				element[2].checkForUnBan(conf["debug"])
+
 			# If the log file has not been modified since the
 			# last time, we sleep for 1 second. This is active
 			# polling so not very effective.
 			modList = list()
-			for element in logList:
-				if element.isModified():
+			for element in logFwList:
+				if element[1].isModified():
 					modList.append(element)
 			
 			if len(modList) == 0:
@@ -509,43 +449,73 @@ if __name__ == "__main__":
 			
 			# Gets the failure list from the log file. For a given IP,
 			# takes only the service which has the most password failures.
-			failList = dict()
 			for element in modList:
-				e = element.getFailures()
+				e = element[1].getFailures()
 				for key in e.iterkeys():
-					if failList.has_key(key):
-						if failList[key][0] < e[key][0]:
-							failList[key] = (e[key][0], e[key][1], element)
+					if element[3].has_key(key):
+						element[3][key] = (element[3][key][0] + e[key][0],
+											e[key][1])
 					else:
-						failList[key] = (e[key][0], e[key][1], element)
-				
-			# Add the last log failures to the global failure list.
-			for key in failList.iterkeys():
-				if failListFull.has_key(key):
-					failListFull[key] = (failListFull[key][0] + 1,
-										failList[key][1], failList[key][2])
-				else:
-					failListFull[key] = failList[key]
+						element[3][key] = (e[key][0], e[key][1])
 			
 			# Remove the oldest failure attempts from the global list.
-			unixTime = time.time()
-			failListFullTemp = failListFull.copy()
-			for key in failListFullTemp.iterkeys():
-				failTime = failListFullTemp[key][2].getFindTime()
-				if failListFullTemp[key][1] < unixTime - failTime:
-					del failListFull[key]
-			
 			# We iterate the failure list and ban IP that make
 			# *retryAllowed* login failures.
-			failListFullTemp = failListFull.copy()
-			for key in failListFullTemp.iterkeys():
-				element = failListFullTemp[key]
-				if element[0] >= conf["maxretry"]:
-					logSys.info(element[2].getName()+": "+key+" has "+
-								`element[0]`+" login failure(s). Banned.")
-					fireWall.addBanIP(key, conf["debug"])
-					del failListFull[key]
-			
+			unixTime = time.time()
+			for element in logFwList:
+				fails = element[3].copy()
+				findTime = element[1].getFindTime()
+				for attempt in fails:
+					failTime = fails[attempt][1]
+					if failTime < unixTime - findTime:
+						del element[3][attempt]
+					elif fails[attempt][0] >= element[1].getMaxRetry():
+						aInfo = {"section": element[0],
+								 "ip": attempt,
+								 "failures": element[3][attempt][0],
+								 "failtime": failTime}
+						logSys.info(element[0] + ": " + aInfo["ip"] +
+									" has " + `aInfo["failures"]` +
+									" login failure(s). Banned.")
+						element[2].addBanIP(aInfo, conf["debug"])
+						# Send a mail notification
+						if 'mail' in locals():
+							mail.sendmail(mailConf["subject"],
+										  mailConf["message"], aInfo)
+						del element[3][attempt]
+		except ExternalError, e:
+			# Something wrong while dealing with Iptables.
+			# May be chain got removed?
+			reinits += 1
+			logSys.error(e)
+			if ((unixTime - lastReinitTime > conf["reinittime"]) and
+				((conf["maxreinits"] < 0) or (reinits < conf["maxreinits"]))):
+				logSys.warn("#%d reinitialization of firewalls"%reinits)
+				lastReinitTime = unixTime
+			else:
+				logSys.error("Exiting: reinits follow too often, or too many " +
+							 "reinit attempts")
+				killApp()
+			# We already failed runCheck so disable it until
+			# restoring a safe state
+			setFwMustCheck(False)
+			# save firewalls to keep a list of IPs for rebanning
+			logFwListCopy = copy.deepcopy(logFwList)
+			try:
+				# restore as much as possible
+				restoreFwRules()
+				# reinitialize all the chains
+				initializeFwRules()
+				# restore the lists of baned IPs
+				logFwList.__init__(logFwListCopy)
+				# reBan known IPs
+				reBan()
+				# Now we can enable the runCheck test again
+				setFwMustCheck(True)
+			except ExternalError:
+				raise ExternalError("Big Oops happened: situation is out of " +
+									"control. Something is wrong with your " +
+									"setup. Please check your settings")
 		except KeyboardInterrupt:
 			# When the user press <ctrl>+<c> we exit nicely.
 			killApp()
diff --git a/firewall/firewall.py b/firewall/firewall.py
index a62a85ff..e50184bd 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -24,54 +24,130 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, os
+import time, os, logging, re
+
+from utils.process import executeCmd
+from utils.strings import replaceTag
+# unfortunately but I have to bring ExternalError in especially for
+# flushBanList: if one of IPs got flushed manually outside or something, we
+# might endup with not "full" flush unless we handle exception within the loop
+from utils.process import ExternalError
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
 
 class Firewall:
 	""" Manages the ban list and executes the command that ban
 		the IP.
 	"""
 	
-	banList = dict()
-	
-	def __init__(self, banTime, logSys, interface):
+	def __init__(self, startRule, endRule, banRule, unBanRule, checkRule,
+				 banTime):
+		self.banRule = banRule
+		self.unBanRule = unBanRule
+		self.checkRule = checkRule
+		self.startRule = startRule
+		self.endRule = endRule
 		self.banTime = banTime
-		self.logSys = logSys
-		self.interface = interface
+		self.banList = dict()
+		self.section = ""
+		self.mustCheck = True
+
+	def setSection(self, section):
+		""" Set optional section name for clarify of logging
+		"""
+		self.section = section
+		
+	def getMustCheck(self):
+		""" Return true if the runCheck test is executed
+		"""
+		return self.mustCheck
 	
-	def addBanIP(self, ip, debug):
+	def setMustCheck(self, value):
+		""" Enable or disable the execution of runCheck test
+		"""
+		self.mustCheck = value
+
+  	def initialize(self, debug):
+		logSys.debug("%s: Initialize firewall rules"%self.section)
+  		executeCmd(self.startRule, debug)
+
+	def restore(self, debug):
+		logSys.debug("%s: Restore firewall rules"%self.section)
+		try:
+			self.flushBanList(debug)
+			executeCmd(self.endRule, debug)
+		except ExternalError:
+			pass
+
+	def addBanIP(self, aInfo, debug):
 		""" Bans an IP.
 		"""
+		ip = aInfo["ip"]
 		if not self.inBanList(ip):
-			self.logSys.warn("Ban "+ip)
-			self.banList[ip] = time.time()
-			self.__executeCmd(self.banIP(ip), debug)
+			crtTime = time.time()
+			logSys.warn("%s: Ban "%self.section + ip)
+			self.banList[ip] = crtTime
+			aInfo["bantime"] = crtTime
+			self.runCheck(debug)
+			cmd = self.banIP(aInfo)
+			if executeCmd(cmd, debug):
+				raise ExternalError("Firewall: execution of fwban command " +
+									"'%s' failed"%cmd)
 		else:
-			self.logSys.error(ip+" already in ban list")
+			self.runCheck(debug)
+			logSys.error("%s: "%self.section+ip+" already in ban list")
 	
-	def delBanIP(self, ip, debug):
+	def delBanIP(self, aInfo, debug):
 		""" Unban an IP.
 		"""
+		ip = aInfo["ip"]
 		if self.inBanList(ip):
-			self.logSys.warn("Unban "+ip)
+			logSys.warn("%s: Unban "%self.section + ip)
 			del self.banList[ip]
-			self.__executeCmd(self.unBanIP(ip), debug)
+			self.runCheck(debug)
+			executeCmd(self.unBanIP(aInfo), debug)
 		else:
-			self.logSys.error(ip+" not in ban list")
+			logSys.error("%s: "%self.section+ip+" not in ban list")
+
+	def reBan(self, debug):
+		""" Re-Bans known IPs.
+			TODO: implement "failures" and "failtime"
+		"""
+		for ip in self.banList:
+			aInfo = {"ip": ip,
+					 "bantime":self.banList[ip]}
+			logSys.warn("%s: ReBan "%self.section + ip)
+			# next piece is similar to the on in addBanIp
+			# so might be one more function will not hurt
+			self.runCheck(debug)
+			executeCmd(self.banIP(aInfo), debug)
 	
 	def inBanList(self, ip):
 		""" Checks if IP is in ban list.
 		"""
 		return self.banList.has_key(ip)
-	
+
+	def runCheck(self, debug):
+		""" Runs fwcheck command and throws an exception if it returns non-0
+			result
+		"""
+		if self.mustCheck:
+			executeCmd(self.checkRule, debug)
+		else:
+			return None
+
 	def checkForUnBan(self, debug):
 		""" Check for IP to remove from ban list.
 		"""
 		banListTemp = self.banList.copy()
 		for element in banListTemp.iteritems():
-			ip = element[0]
 			btime = element[1]
 			if btime < time.time()-self.banTime:
-				self.delBanIP(ip, debug)
+				aInfo = {"ip": element[0],
+						 "bantime": btime,
+						 "unbantime": time.time()}
+				self.delBanIP(aInfo, debug)
 	
 	def flushBanList(self, debug):
 		""" Flushes the ban list and of course the firewall rules.
@@ -79,18 +155,28 @@ class Firewall:
 		"""
 		banListTemp = self.banList.copy()
 		for element in banListTemp.iteritems():
-			ip = element[0]
-			self.delBanIP(ip, debug)
-	
-	def __executeCmd(self, cmd, debug):
-		""" Executes an OS command.
+			aInfo = {"ip": element[0],
+					 "bantime": element[1],
+					 "unbantime": time.time()}
+			try:
+				self.delBanIP(aInfo, debug)
+			except ExternalError:
+				# we must let it fail here in the loop, or we don't
+				# flush properly
+				pass
+			
+	def banIP(self, aInfo):
+		""" Returns query to ban IP.
 		"""
-		self.logSys.debug(cmd)
-		if not debug:
-			return os.system(cmd)
-		else:
-			return None
-		
+		query = replaceTag(self.banRule, aInfo)
+		return query
+	
+	def unBanIP(self, aInfo):
+		""" Returns query to unban IP.
+		"""
+		query = replaceTag(self.unBanRule, aInfo)
+		return query
+	
 	def viewBanList(self):
 		""" Prints the ban list on screen. Usefull for debugging.
 		"""
diff --git a/firewall/ipfw.py b/firewall/ipfw.py
deleted file mode 100644
index 41fbc29b..00000000
--- a/firewall/ipfw.py
+++ /dev/null
@@ -1,72 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import os
-
-from firewall import Firewall
-
-class Ipfw(Firewall):
-	""" This class contains specific methods and variables for the
-		iptables firewall. Must implements the 'abstracts' methods
-		banIP(ip) and unBanIP(ip).
-		
-		Must adds abstract methods definition:
-		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
-	"""
-	
-	crtRuleNbr = 0
-	
-	def getCrtRuleNbr(self):
-		""" Gets the current rule number.
-		"""
-		return self.crtRuleNbr
-		
-	def setCrtRuleNbr(self, value):
-		""" Sets the current rule number.
-		"""
-		self.crtRuleNbr = value
-	
-	def banIP(self, ip):
-		""" Returns query to ban IP.
-		"""
-		query = "ipfw -q add "+`self.crtRuleNbr`+" deny ip from "+ip+" to any"
-		self.crtRuleNbr = self.crtRuleNbr + 1
-		return query
-	
-	def unBanIP(self, ip):
-		""" Returns query to unban IP.
-		"""
-		ruleNbr = str(self.__findRuleNumber(ip))
-		query = "ipfw -q delete "+ruleNbr
-		return query
-		
-	def __findRuleNumber(self, ip):
-		""" Uses shell commands in order to find the rule
-			number we want to delete.
-		"""
-		output = os.popen("ipfw list|grep \"from "+ip+" to\"|awk '{print $1}'",
-						  "r");
-		return output.read()
diff --git a/firewall/iptables.py b/firewall/iptables.py
deleted file mode 100644
index 7b78c69c..00000000
--- a/firewall/iptables.py
+++ /dev/null
@@ -1,48 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-from firewall import Firewall
-
-class Iptables(Firewall):
-	""" This class contains specific methods and variables for the
-		iptables firewall. Must implements the 'abstracts' methods
-		banIP(ip) and unBanIP(ip).
-		
-		Must adds abstract methods definition:
-		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
-	"""
-	
-	def banIP(self, ip):
-		""" Returns query to ban IP.
-		"""
-		query = "iptables -I INPUT 1 -i "+self.interface+" -s "+ip+" -j DROP"
-		return query
-	
-	def unBanIP(self, ip):
-		""" Returns query to unban IP.
-		"""
-		query = "iptables -D INPUT -i "+self.interface+" -s "+ip+" -j DROP"
-		return query
diff --git a/log-test/apache b/log-test/apache
index 35248fd2..227f8df9 100644
--- a/log-test/apache
+++ b/log-test/apache
@@ -1,3 +1,4 @@
+[Wed Mar 31 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
 [Mon Jan 03 05:02:15 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
 [Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
 [Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
@@ -98,5 +99,10 @@
 [Wed Jan 05 15:14:24 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
 [Wed Jan 05 15:14:29 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
 [Wed Jan 05 15:14:34 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Mar 05 15:08:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 05 15:09:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
\ No newline at end of file
+[Wed Mar 10 15:08:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 10 15:09:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 10 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
+[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
\ No newline at end of file
diff --git a/log-test/current b/log-test/current
index d4b9f00a..18258689 100644
--- a/log-test/current
+++ b/log-test/current
@@ -3,3 +3,9 @@ Jan  7 17:53:26 [sshd] (pam_unix) authentication failure; logname= uid=0 euid=0
 Mar  7 17:53:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
 Mar  7 17:55:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
 Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from www.google.ch
+Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from www.google.ch
diff --git a/logreader/logreader.py b/logreader/logreader.py
index 4778b3ba..1876a395 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -24,39 +24,37 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import os, sys, time, re
+import os, sys, time, re, logging
 
 from utils.dns import *
 
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
 class LogReader:
 	""" Reads a log file and reports information about IP that make password
 		failure, bad user or anything else that is considered as doubtful login
 		attempt.	
 	"""
 	
-	def __init__(self, logSys, logPath, timeregex, timepattern, failregex,
-		findTime = 3600):
+	def __init__(self, logPath, timeregex, timepattern, failregex,
+				  maxRetry, findTime):
 		self.logPath = logPath
+		self.maxRetry = maxRetry
 		self.timeregex = timeregex
 		self.timepattern = timepattern
 		self.failregex = failregex
 		self.findTime = findTime
 		self.ignoreIpList = []
 		self.lastModTime = 0
-		self.logSys = logSys
 		self.lastPos = 0
 		self.lastDate = 0
 		self.logStats = None
-		
-	def setName(self, name):
-		""" Sets the name of the log reader.
+	
+	def getMaxRetry(self):
+		""" Gets the maximum number of failures
 		"""
-		self.name = name
-		
-	def getName(self):
-		""" Gets the name of the log reader.
-		"""
-		return self.name
+		return self.maxRetry
 	
 	def getFindTime(self):
 		""" Gets the find time.
@@ -66,13 +64,23 @@ class LogReader:
 	def addIgnoreIP(self, ip):
 		""" Adds an IP to the ignore list.
 		"""
-		self.logSys.debug("Add "+ip+" to ignore list")
+		logSys.debug("Add "+ip+" to ignore list")
 		self.ignoreIpList.append(ip)
 		
 	def inIgnoreIPList(self, ip):
 		""" Checks if IP is in the ignore list.
 		"""
-		return ip in self.ignoreIpList
+		for i in self.ignoreIpList:
+			s = i.split('/', 1)
+			# IP address without CIDR mask
+			if len(s) == 1:
+				s.insert(1, '32')
+			s[1] = long(s[1])
+			a = cidr(s[0], s[1])
+			b = cidr(ip, s[1])
+			if a == b:
+				return True
+		return False
 	
 	def openLogFile(self):
 		""" Opens the log file specified on init.
@@ -80,8 +88,8 @@ class LogReader:
 		try:
 			fileHandler = open(self.logPath)
 		except OSError:
-			self.logSys.error("Unable to open "+self.logPath)
-			sys.exit(-1)
+			logSys.error("Unable to open "+self.logPath)
+			
 		return fileHandler
 		
 	def isModified(self):
@@ -89,16 +97,15 @@ class LogReader:
 		"""
 		try:
 			self.logStats = os.stat(self.logPath)
+			if self.lastModTime == self.logStats.st_mtime:
+				return False
+			else:
+				logSys.debug(self.logPath+" has been modified")
+				self.lastModTime = self.logStats.st_mtime
+				return True
 		except OSError:
-			self.logSys.error("Unable to get stat on "+self.logPath)
-			sys.exit(-1)
-		
-		if self.lastModTime == self.logStats.st_mtime:
+			logSys.error("Unable to get stat on "+self.logPath)
 			return False
-		else:
-			self.logSys.debug(self.logPath+" has been modified")
-			self.lastModTime = self.logStats.st_mtime
-			return True
 	
 	def setFilePos(self, file):
 		""" Sets the file position. We must take care of log file rotation
@@ -107,13 +114,13 @@ class LogReader:
 		"""
 		line = file.readline()
 		if self.lastDate < self.getTime(line):
-			self.logSys.debug("Date " + `self.lastDate` + " is " +
-							"smaller than " + `self.getTime(line)`)
-			self.logSys.debug("Log rotation detected for " + self.logPath)
+			logSys.debug("Date " + `self.lastDate` + " is " + "smaller than " +
+							`self.getTime(line)`)
+			logSys.debug("Log rotation detected for " + self.logPath)
 			self.lastPos = 0
 		
-		self.logSys.debug("Setting file position to " + `self.lastPos` + " for "
-						+ self.logPath)
+		logSys.debug("Setting file position to " + `self.lastPos` + " for " +
+						self.logPath)
 		file.seek(self.lastPos)
 	
 	def getFailures(self):
@@ -124,28 +131,31 @@ class LogReader:
 			and the latest failure time.
 		"""
 		ipList = dict()
-		self.logSys.debug(self.logPath)
+		logSys.debug(self.logPath)
 		logFile = self.openLogFile()
 		self.setFilePos(logFile)
-		lastLine = ''
-		for line in logFile.readlines():
+		lastLine = None
+		for line in logFile:
+			if not self.hasTime(line):
+				# There is no valid time in this line
+				continue
 			lastLine = line
-			failList = self.findFailure(line)
-			for element in failList:
+			for element in self.findFailure(line):
 				ip = element[0]
 				unixTime = element[1]
 				if unixTime < time.time()-self.findTime:
 					break
 				if self.inIgnoreIPList(ip):
-					self.logSys.debug("Ignore "+ip)
+					logSys.debug("Ignore "+ip)
 					continue
-				self.logSys.debug("Found "+ip)
+				logSys.debug("Found "+ip)
 				if ipList.has_key(ip):
 					ipList[ip] = (ipList[ip][0]+1, unixTime)
 				else:
 					ipList[ip] = (1, unixTime)
 		self.lastPos = logFile.tell()
-		self.lastDate = self.getTime(lastLine)
+		if lastLine:
+			self.lastDate = self.getTime(lastLine)
 		logFile.close()
 		return ipList
 
@@ -168,6 +178,15 @@ class LogReader:
 						failList.append([ip, date])
 		return failList
 	
+	def hasTime(self, line):
+		""" Return true if the line contains a date
+		"""
+		timeMatch = re.search(self.timeregex, line)
+		if timeMatch:
+			return True
+		else:
+			return False
+	
 	def getTime(self, line):
 		""" Gets the time of a log message.
 		"""
@@ -184,6 +203,12 @@ class LogReader:
 		"""
 		date = list(time.strptime(value, self.timepattern))
 		if date[0] < 2000:
+			# There is probably no year field in the logs
 			date[0] = time.gmtime()[0]
+			# Bug fix for #1241756
+			# If the date is greater than the current time, we suppose
+			# that the log is not from this year but from the year before
+			if time.mktime(date) > time.time():
+				date[0] -= 1
 		unixTime = time.mktime(date)
 		return unixTime
diff --git a/man/fail2ban.8 b/man/fail2ban.8
new file mode 100644
index 00000000..c43b71ec
--- /dev/null
+++ b/man/fail2ban.8
@@ -0,0 +1,61 @@
+.\" 
+.TH "FAIL2BAN" "8" "July 2005" "Cyril Jaquier" "System administration tools"
+.SH "NAME"
+fail2ban \- bans IP that makes too many password failures
+.SH "SYNOPSIS"
+.B fail2ban
+[\fIOPTIONS\fR]
+.SH "DESCRIPTION"
+\fBFail2Ban\fR reads log file that contains password failure report
+and bans the corresponding IP addresses using firewall rules. It updates
+firewall rules to reject the IP address.
+.SH "OPTIONS"
+.TP 
+\fB\-b\fR
+start in background
+.TP 
+\fB\-d\fR
+start in debug mode. Commands are NOT executed but only displayed
+.TP 
+\fB\-c\fR \fIFILE\fR
+read configuration file \fIFILE\fR
+.TP 
+\fB\-p\fR \fIFILE\fR
+create PID lock in \fIFILE\fR
+.TP 
+\fB\-h, \-\-help\fR
+display this help message
+.TP 
+\fB\-i\fR \fIIP\fR
+\fIIP\fR(s) to ignore
+.TP 
+\fB\-k\fR
+kill a currently running Fail2Ban instance
+.TP 
+\fB\-r\fR \fIVALUE\fR
+allow a max of \fIVALUE\fR password failure [maxfailures]
+.TP 
+\fB\-t\fR \fITIME\fR
+ban IP for \fITIME\fR seconds [bantime]
+.TP 
+\fB\-f\fR \fITIME\fR
+lifetime in seconds of failed entry [findtime]
+.TP 
+\fB\-v\fR
+verbose. Use twice for greater effect
+.TP 
+\fB\-V, \-\-version\fR
+print software version
+.SH "FILES"
+.I /etc/fail2ban.conf
+.RS
+The configuration file. See \fBfail2ban.conf\fR(5) for further details.
+.SH "REPORTING BUGS"
+Please report bugs at http://sourceforge.net/projects/fail2ban/
+via bug tracker
+.SH "AUTHOR"
+Cyril Jaquier <lostcontrol@users.sourceforge.net>
+.SH "SEE ALSO"
+.TP 
+See
+.BR "http://fail2ban.sourceforge.net/".
diff --git a/man/fail2ban.conf.5 b/man/fail2ban.conf.5
new file mode 100644
index 00000000..91328a35
--- /dev/null
+++ b/man/fail2ban.conf.5
@@ -0,0 +1,20 @@
+.\" 
+.TH "FAIL2BAN.CONF" "5" "July 2005" "Cyril Jaquier" "System administration tools"
+.SH "NAME"
+fail2ban.conf \- configuration data for fail2ban
+.SH "DESCRIPTION"
+\fB/etc/fail2ban.conf\fR contains data about the general configuration of fail2ban, the mail notification and services to monitor.
+.SH "VARIABLES"
+Please look at the file itself
+.SH "FILES"
+.I /etc/fail2ban.conf
+.SH "REPORTING BUGS"
+Please report bugs at http://sourceforge.net/projects/fail2ban/
+via bug tracker
+.SH "AUTHOR"
+Cyril Jaquier <lostcontrol@users.sourceforge.net>
+.SH "SEE ALSO"
+.BR fail2ban (8)
+.TP 
+See
+.BR "http://fail2ban.sourceforge.net/".
diff --git a/setup.py b/setup.py
index eee601bc..a4f096f3 100755
--- a/setup.py
+++ b/setup.py
@@ -28,15 +28,55 @@ __license__ = "GPL"
 
 from distutils.core import setup
 from version import version
+from os.path import isfile, join
+from sys import exit, argv
+
+longdesc = '''
+Fail2Ban scans log files like /var/log/pwdfail or
+/var/log/apache/error_log and bans IP that makes
+too many password failures. It updates firewall rules
+to reject the IP address or executes user defined
+commands.'''
 
 setup(
-        name = "fail2ban",
-        version = version,
-        description = "Ban IPs that make too many password failure",
-        author = "Cyril Jaquier",
-        author_email = "lostcontrol@users.sourceforge.net",
-        url = "http://www.sourceforge.net/projects/fail2ban",
-        scripts = ['fail2ban.py'],
-        py_modules = ['version'],
-        packages = ['firewall', 'logreader', 'confreader', 'utils']
+	name = "fail2ban",
+	version = version,
+	description = "Ban IPs that make too many password failure",
+	long_description = longdesc,
+	author = "Cyril Jaquier",
+	author_email = "lostcontrol@users.sourceforge.net",
+	url = "http://fail2ban.sourceforge.net",
+	license = "GPL",
+	platforms = "Posix",
+	scripts = ['fail2ban'],
+	py_modules = ['fail2ban', 'version'],
+	packages = ['firewall', 'logreader', 'confreader', 'utils']
 )
+
+# Do some checks after installation
+# Search for obsolete files.
+obsoleteFiles = []
+elements = {"/usr/bin/": ["fail2ban.py"],
+			"/usr/lib/fail2ban/firewall/": ["iptables.py", "ipfwadm.py",
+											"ipfw.py"]}
+for dir in elements:
+	for f in elements[dir]:
+		path = join(dir, f)
+		if isfile(path):
+			obsoleteFiles.append(path)
+if obsoleteFiles:
+	print
+	print "Obsolete files from previous Fail2Ban versions were found on " \
+		  "your system."
+	print "Please delete them:"
+	print
+	for f in obsoleteFiles:
+		print "\t" + f
+	print
+
+# Update config file
+if argv[1] == "install":
+	print
+	print "Please do not forget to update your configuration file."
+	print "Use config/fail2ban.conf.default as example."
+	print
diff --git a/utils/dns.py b/utils/dns.py
index ce629d69..8d099753 100644
--- a/utils/dns.py
+++ b/utils/dns.py
@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import os, re, socket
+import os, re, socket, struct
 
 def dnsToIp(dns):
 	""" Convert a DNS into an IP address using the Python socket module.
@@ -55,6 +55,16 @@ def searchIP(text):
 	else:
 		return []
 
+def isValidIP(str):
+	""" Return true if str is a valid IP
+	"""
+	s = str.split('/', 1)
+	try:
+		socket.inet_aton(s[0])
+		return True
+	except socket.error:
+		return False
+
 def textToIp(text):
 	""" Return the IP of DNS found in a given text.
 	"""
@@ -62,7 +72,8 @@ def textToIp(text):
 	# Search for plain IP
 	plainIP = searchIP(text)
 	for element in plainIP:
-		ipList.append(element)
+		if isValidIP(element):
+			ipList.append(element)
 	if not ipList:
 		# Try to get IP from possible DNS
 		dnsList = textToDns(text)
@@ -71,3 +82,21 @@ def textToIp(text):
 			for e in dns:
 				ipList.append(e)
 	return ipList
+
+def cidr(i, n):
+	""" Convert an IP address string with a CIDR mask into a 32-bit
+		integer.
+	"""
+	# 32-bit IPv4 address mask
+	MASK = 0xFFFFFFFFL
+	return ~(MASK >> n) & MASK & addr2bin(i)
+
+def addr2bin(str):
+	""" Convert a string IPv4 address into an unsigned integer.
+	"""
+	return struct.unpack("!L", socket.inet_aton(str))[0]
+
+def bin2addr(addr):
+	""" Convert a numeric IPv4 address into string n.n.n.n form.
+	"""
+	return socket.inet_ntoa(struct.pack("!L", addr))
diff --git a/utils/mail.py b/utils/mail.py
new file mode 100644
index 00000000..8a244d4f
--- /dev/null
+++ b/utils/mail.py
@@ -0,0 +1,79 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging, smtplib, email.Utils
+
+from utils.strings import replaceTag
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+class Mail:
+	""" Mailer class
+	"""
+	
+	def __init__(self, host, port = 25):
+		self.host = host
+		self.port = port
+		self.localTimeFlag = False
+		
+	def setFromAddr(self, fromAddr):
+		""" Set from: address
+		"""
+		self.fromAddr = fromAddr
+	
+	def setToAddr(self, toAddr):
+		""" Set to: address
+		"""
+		self.toAddr = toAddr.split()
+
+	def setLocalTimeFlag(self, localTimeFlag):
+		""" Set to: address
+		"""
+		self.localTimeFlag = localTimeFlag
+
+	def sendmail(self, subject, message, aInfo):
+		""" Send an email using smtplib
+		"""
+		subj = replaceTag(subject, aInfo)
+		msg = replaceTag(message, aInfo)
+		
+		mail = ("From: %s\r\nTo: %s\r\nDate: %s\r\nSubject: %s\r\n\r\n" %
+				(self.fromAddr, ", ".join(self.toAddr),
+				email.Utils.formatdate(localtime = self.localTimeFlag),
+				subj)) + msg
+		
+		try:
+			server = smtplib.SMTP(self.host, self.port)
+			#server.set_debuglevel(1)
+			server.sendmail(self.fromAddr, self.toAddr, mail)
+			logSys.debug("Email sent to " + `self.toAddr`)
+			server.quit()	
+		except Exception, e:
+			logSys.error("Unable to send mail to " + self.host + ":" +
+						 `self.port` + " from " + self.fromAddr + " to " +
+						 `self.toAddr` + ": " + `e` + ": " + `e.args`)
+		
diff --git a/utils/pidlock.py b/utils/pidlock.py
new file mode 100644
index 00000000..4659dfb3
--- /dev/null
+++ b/utils/pidlock.py
@@ -0,0 +1,109 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os, logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+class PIDLock:
+	""" Manages the PID lock file.
+	
+		The following class shows how to implement the singleton pattern[1] in
+		Python. A singleton is a class that makes sure only one instance of it
+		is ever created. Typically such classes are used to manage resources
+		that by their very nature can only exist once.
+		
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/52558
+	"""
+	
+	class __impl:
+		""" Implementation of the singleton interface """
+
+		def setPath(self, path):
+			""" Set PID lock file path.
+			"""
+			self.path = path
+		
+		def create(self):
+			""" Create PID lock.
+			"""
+			try:
+				fileHandler = open(self.path, mode='w')
+				pid = os.getpid()
+				fileHandler.write(`pid` + '\n')
+				fileHandler.close()
+				logSys.debug("Created PID lock (" + `pid` + ") in " + self.path)
+				return True
+			except:
+				logSys.error("Unable to create PID lock " + self.path)
+				return False	
+		
+		def remove(self):
+			""" Remove PID lock.
+			"""
+			try:
+				os.remove(self.path)
+				logSys.debug("Removed PID lock " + self.path)
+			except OSError:
+				logSys.error("Unable to remove PID lock " + self.path)
+			except AttributeError:
+				# AttributeError if self.path wasn't specified yet
+				logSys.debug("PID lock not removed because not defined yet")
+		
+		def exists(self):
+			""" Returns the current PID if Fail2Ban is running or False
+				if no instance found.
+			"""
+			try:
+				fileHandler = open(self.path)
+				pid = fileHandler.readline()
+				fileHandler.close()
+				return pid
+			except IOError:
+				return False
+
+	# storage for the instance reference
+	__instance = None
+
+	def __init__(self):
+		""" Create singleton instance """
+		# Check whether we already have an instance
+		if PIDLock.__instance is None:
+			# Create and remember instance
+			PIDLock.__instance = PIDLock.__impl()
+
+		# Store instance reference as the only member in the handle
+		self.__dict__['_PIDLock__instance'] = PIDLock.__instance
+
+	def __getattr__(self, attr):
+		""" Delegate access to implementation """
+		return getattr(self.__instance, attr)
+
+	def __setattr__(self, attr, value):
+		""" Delegate access to implementation """
+		return setattr(self.__instance, attr, value)
+	
\ No newline at end of file
diff --git a/utils/process.py b/utils/process.py
new file mode 100644
index 00000000..b310f090
--- /dev/null
+++ b/utils/process.py
@@ -0,0 +1,137 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os, logging, signal
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+class ExternalError(UserWarning):
+	""" Exception to warn about failed fwcheck or fwban command
+	"""
+	pass
+
+def createDaemon():
+	""" Detach a process from the controlling terminal and run it in the
+		background as a daemon.
+	
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
+	"""
+
+	try:
+		# Fork a child process so the parent can exit.  This will return control
+		# to the command line or shell.  This is required so that the new process
+		# is guaranteed not to be a process group leader.  We have this guarantee
+		# because the process GID of the parent is inherited by the child, but
+		# the child gets a new PID, making it impossible for its PID to equal its
+		# PGID.
+		pid = os.fork()
+	except OSError, e:
+		return((e.errno, e.strerror))	 # ERROR (return a tuple)
+
+	if (pid == 0):	   # The first child.
+
+		# Next we call os.setsid() to become the session leader of this new
+		# session.  The process also becomes the process group leader of the
+		# new process group.  Since a controlling terminal is associated with a
+		# session, and this new session has not yet acquired a controlling
+		# terminal our process now has no controlling terminal.  This shouldn't
+		# fail, since we're guaranteed that the child is not a process group
+		# leader.
+		os.setsid()
+	
+		# When the first child terminates, all processes in the second child
+		# are sent a SIGHUP, so it's ignored.
+		signal.signal(signal.SIGHUP, signal.SIG_IGN)
+	
+		try:
+			# Fork a second child to prevent zombies.  Since the first child is
+			# a session leader without a controlling terminal, it's possible for
+			# it to acquire one by opening a terminal in the future.  This second
+			# fork guarantees that the child is no longer a session leader, thus
+			# preventing the daemon from ever acquiring a controlling terminal.
+			pid = os.fork()		# Fork a second child.
+		except OSError, e:
+			return((e.errno, e.strerror))  # ERROR (return a tuple)
+	
+		if (pid == 0):	  # The second child.
+			# Ensure that the daemon doesn't keep any directory in use.  Failure
+			# to do this could make a filesystem unmountable.
+			os.chdir("/")
+		else:
+			os._exit(0)	  # Exit parent (the first child) of the second child.
+	else:
+		os._exit(0)		 # Exit parent of the first child.
+
+	# Close all open files.  Try the system configuration variable, SC_OPEN_MAX,
+	# for the maximum number of open files to close.  If it doesn't exist, use
+	# the default value (configurable).
+	try:
+		maxfd = os.sysconf("SC_OPEN_MAX")
+	except (AttributeError, ValueError):
+		maxfd = 256	   # default maximum
+
+	for fd in range(0, maxfd):
+		try:
+			os.close(fd)
+		except OSError:   # ERROR (ignore)
+			pass
+
+	# Redirect the standard file descriptors to /dev/null.
+   	os.open("/dev/null", os.O_RDONLY)	# standard input (0)
+	os.open("/dev/null", os.O_RDWR)		# standard output (1)
+	os.open("/dev/null", os.O_RDWR)		# standard error (2)
+
+	return True
+
+def killPID(pid):
+	""" Kills the process with the given PID using the
+		INT signal (same effect as <ctrl>+<c>).
+	"""
+	try:
+		return os.kill(pid, 2)
+	except OSError:
+		logSys.error("Can not kill process " + `pid` + ". Please check that " +
+					"Fail2Ban is not running and remove the file " +
+					"'/tmp/fail2ban.pid'")
+		return False
+
+def executeCmd(cmd, debug):
+	""" Executes an OS command.
+	"""
+	if cmd == "":
+		logSys.debug("Nothing to do")
+		return None
+	
+	logSys.debug(cmd)
+	if not debug:
+		retval = os.system(cmd)
+		if not retval == 0:
+			logSys.error("'" + cmd + "' returned " + `retval`)
+			raise ExternalError("Execution of command '%s' failed" % cmd)
+		return retval
+	else:
+		return None
diff --git a/firewall/ipfwadm.py b/utils/strings.py
similarity index 60%
rename from firewall/ipfwadm.py
rename to utils/strings.py
index cfdccbd8..6ed7ece8 100644
--- a/firewall/ipfwadm.py
+++ b/utils/strings.py
@@ -24,25 +24,17 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from firewall import Firewall
+import logging
 
-class Ipfwadm(Firewall):
-	""" This class contains specific methods and variables for the
-		iptables firewall. Must implements the 'abstracts' methods
-		banIP(ip) and unBanIP(ip).
-		
-		Must adds abstract methods definition:
-		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/266468
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+def replaceTag(query, aInfo):
+	""" Replace tags in query
 	"""
-	
-	def banIP(self, ip):
-		""" Returns query to ban IP.
-		"""
-		query = "ipfwadm -I -a deny -W "+self.interface+" -S "+ip
-		return query
-	
-	def unBanIP(self, ip):
-		""" Returns query to unban IP.
-		"""
-		query = "ipfwadm -I -d deny -W "+self.interface+" -S "+ip
-		return query
+	string = query
+	for tag in aInfo:
+		string = string.replace('<'+tag+'>', `aInfo[tag]`)
+	# New line
+	string = string.replace('<br>', '\n')
+	return string
diff --git a/version.py b/version.py
index 3d2fe563..794dd43b 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.4.1"
+version = "0.6.0"

From af827330b27556f3188d4e5bf674611bebab24b5 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 16 Dec 2005 23:43:46 +0000
Subject: [PATCH 189/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@218 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 99e4402e..d1abc53d 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,15 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.6.0)                           2005/11/20
+Fail2Ban (version 0.6.?)                           200?/??/??
 =============================================================
 
+ver. 0.6.? (200?/??/??) - ???
+----------
+- Added permanent banning. Set banTime to a negative value to
+  enable this feature (-1 is perfect). Thanks to Mannone
+- Fixed locale bug. Thanks to Fernando José
+
 ver. 0.6.0 (2005/11/20) - stable
 ----------
 - Propagated patches introduced by Debian maintainer 

From 52e7a267564dc594587f55be087b5682e1e21406 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 16 Dec 2005 23:44:06 +0000
Subject: [PATCH 190/549] - Updated to CVS version

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@219 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.py b/version.py
index 794dd43b..07149645 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.6.0"
+version = "0.6.0-CVS"

From cd38dddd0039c656c3e6f51eaf0c0c4226e406fc Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 16 Dec 2005 23:44:34 +0000
Subject: [PATCH 191/549] =?UTF-8?q?-=20Fixed=20locale=20bug.=20Thanks=20to?=
 =?UTF-8?q?=20Fernando=20Jos=EF=BF=BD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@220 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/fail2ban b/fail2ban
index 05213f9e..9b0d4866 100755
--- a/fail2ban
+++ b/fail2ban
@@ -26,7 +26,14 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import sys, traceback, logging
+import sys, traceback, logging, locale
+
+# Set the locale with the user's default setting
+try:
+	locale.setlocale(locale.LC_ALL, '')
+except Exception:
+	print "Unable to set locale to " + `locale.getdefaultlocale()`
+	sys.exit(-1)
 
 # Appends our own modules path.
 sys.path.append("/usr/lib/fail2ban")
@@ -41,8 +48,9 @@ logSys = logging.getLogger("fail2ban")
 # Get PID lock file instance
 pidLock = PIDLock()
 
-# Start the application. Handle all the unhandled exceptions
+# Handle all the unhandled exceptions
 try:
+	# Start the application
 	fail2ban.main()
 except SystemExit:
 	# We called sys.exit(). Nothing wrong so just pass

From 716e0840fc6810880c3402f22ce450feda528b27 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 16 Dec 2005 23:47:03 +0000
Subject: [PATCH 192/549] - Removed unneeded semicolon

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@221 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban.py b/fail2ban.py
index d2e88b3e..bd4048bc 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -208,7 +208,7 @@ def main():
 	
 	# Reads the config file and create a LogReader instance for
 	# each log file to check.
-	confReader = ConfigReader(conf["conffile"]);
+	confReader = ConfigReader(conf["conffile"])
 	confReader.openConf()
 	
 	# Options

From 15806fc3daf0ca6f5660eb944f1d991ec4534c4a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 16 Dec 2005 23:48:52 +0000
Subject: [PATCH 193/549] - Added permanent banning feature

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@222 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default |  3 ++-
 firewall/firewall.py         | 12 ++++++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index d841bd7a..a5b69b06 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -48,7 +48,8 @@ pidlock = /var/run/fail2ban.pid
 maxfailures = 5
 
 # Option:  bantime
-# Notes.:  number of seconds an IP will be banned.
+# Notes.:  number of seconds an IP will be banned. If set to a negative
+#          value, IP will never be unbanned (permanent banning).
 # Values:  NUM  Default:  600
 #
 bantime = 600
diff --git a/firewall/firewall.py b/firewall/firewall.py
index e50184bd..ebba2545 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -86,7 +86,11 @@ class Firewall:
 		ip = aInfo["ip"]
 		if not self.inBanList(ip):
 			crtTime = time.time()
-			logSys.warn("%s: Ban "%self.section + ip)
+			if self.banTime < 0:
+				banMsg = "Ban (permanent)"
+			else:
+				banMsg = "Ban (%d s)"%self.banTime
+			logSys.warn("%s: %s "%(self.section, banMsg) + ip)
 			self.banList[ip] = crtTime
 			aInfo["bantime"] = crtTime
 			self.runCheck(debug)
@@ -138,8 +142,12 @@ class Firewall:
 			return None
 
 	def checkForUnBan(self, debug):
-		""" Check for IP to remove from ban list.
+		""" Check for IP to remove from ban list. If banTime is smaller than
+			zero, IP will be never removed.
 		"""
+		if self.banTime < 0:
+			# Permanent banning
+			return
 		banListTemp = self.banList.copy()
 		for element in banListTemp.iteritems():
 			btime = element[1]

From 9cd787c50e6818ec78444ff3561a1d789e685971 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 16 Dec 2005 23:50:59 +0000
Subject: [PATCH 194/549] - Fixed crash when time format does not match data

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@223 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index 1876a395..5ae2ff27 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -201,7 +201,12 @@ class LogReader:
 			Pattern should describe the date construction of
 			value.
 		"""
-		date = list(time.strptime(value, self.timepattern))
+		try:
+			date = list(time.strptime(value, self.timepattern))
+		except ValueError, e:
+			logSys.error(e)
+			logSys.error("Please check the format and your locale settings.")
+			return None
 		if date[0] < 2000:
 			# There is probably no year field in the logs
 			date[0] = time.gmtime()[0]

From 7494fe283b56a33a25a56479c217e628be35d6aa Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 16 Dec 2005 23:51:59 +0000
Subject: [PATCH 195/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@224 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG b/CHANGELOG
index d1abc53d..40b8c137 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -12,6 +12,7 @@ ver. 0.6.? (200?/??/??) - ???
 - Added permanent banning. Set banTime to a negative value to
   enable this feature (-1 is perfect). Thanks to Mannone
 - Fixed locale bug. Thanks to Fernando José
+- Fixed crash when time format does not match data
 
 ver. 0.6.0 (2005/11/20) - stable
 ----------

From 3eb0ca0ee5011a1660c9e55a2f6575b2fcaae897 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 27 Dec 2005 15:09:50 +0000
Subject: [PATCH 196/549] propagated fix for the path bug. Thanks to Nick
 Craig-Wood

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@225 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 3 +++
 fail2ban  | 5 +++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 40b8c137..54bf066a 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -13,6 +13,9 @@ ver. 0.6.? (200?/??/??) - ???
   enable this feature (-1 is perfect). Thanks to Mannone
 - Fixed locale bug. Thanks to Fernando José
 - Fixed crash when time format does not match data
+- Propagated patch from Debian to fix fail2ban search path 
+  addition to the path search list: now it is added first. 
+  Thanks to Nick Craig-Wood
 
 ver. 0.6.0 (2005/11/20) - stable
 ----------
diff --git a/fail2ban b/fail2ban
index 9b0d4866..5eace8bd 100755
--- a/fail2ban
+++ b/fail2ban
@@ -35,8 +35,9 @@ except Exception:
 	print "Unable to set locale to " + `locale.getdefaultlocale()`
 	sys.exit(-1)
 
-# Appends our own modules path.
-sys.path.append("/usr/lib/fail2ban")
+# Inserts our own modules path first in the list
+# fix for bug #343821
+sys.path.insert(1, "/usr/lib/fail2ban")
 
 # Now we can import our modules.
 import fail2ban

From be26cd5b751a16af9f2b61b2da202ba26753a5b1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 3 Jan 2006 15:11:57 +0000
Subject: [PATCH 197/549] - Removed debug option - Added SMTP authentification
 support - Added TAI64N support

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@226 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.default | 31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index a5b69b06..96337fcd 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -11,12 +11,6 @@
 #
 background = false
 
-# Option:  debug
-# Notes.:  enable debug mode. More verbose output and bypass root user test.
-# Values:  [true | false]  Default:  false
-#
-debug = false
-
 # Option:  logtargets
 # Notes.:  log targets. Space separated list of logging targets.
 # Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
@@ -120,6 +114,19 @@ host = localhost
 #
 port = 25
 
+# Option:  user
+# Notes.:  the username for smtp-server if authentification is required.
+#          if user is empty, no authentification is done.
+# Values:  STR  Default:  
+#
+user = 
+
+# Option:  password
+# Notes.:  the smtp-user's password if authentification is required.
+# Values:  STR  Default:  
+#
+password = 
+
 # Option:  from
 # Notes.:  e-mail address of the sender.
 # Values:  MAIL  Default:  fail2ban
@@ -229,7 +236,8 @@ fwban = iptables -I fail2ban-http 1 -s <ip> -j DROP
 fwunban = iptables -D fail2ban-http -s <ip> -j DROP
 
 # Option:  timeregex
-# Notes.:  regex to match timestamp in Apache logfile.
+# Notes.:  regex to match timestamp in Apache logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
 # Values:  [Wed Jan 05 15:08:01 2005]
 # Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
 #
@@ -237,7 +245,8 @@ timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
 
 # Option:  timepattern
 # Notes.:  format used in "timeregex" fields definition. Note that '%' must be
-#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
 # Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
 #
 timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
@@ -308,7 +317,8 @@ fwban = iptables -I fail2ban-ssh 1 -s <ip> -j DROP
 fwunban = iptables -D fail2ban-ssh -s <ip> -j DROP
 
 # Option:  timeregex
-# Notes.:  regex to match timestamp in SSH logfile.
+# Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
 # Values:  [Mar  7 17:53:28]
 # Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
 #
@@ -316,7 +326,8 @@ timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
 
 # Option:  timepattern
 # Notes.:  format used in "timeregex" fields definition. Note that '%' must be
-#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
 # Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
 #
 timepattern = %%b %%d %%H:%%M:%%S

From fb07353aeb14a5f09ae7769ea092f8e220af5b2e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 3 Jan 2006 15:13:04 +0000
Subject: [PATCH 198/549] - Added TAI64N support

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@227 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 logreader/logreader.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/logreader/logreader.py b/logreader/logreader.py
index 5ae2ff27..72043e4d 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -202,7 +202,13 @@ class LogReader:
 			value.
 		"""
 		try:
-			date = list(time.strptime(value, self.timepattern))
+			# Check if the parsed value is in TAI64N format
+			if not self.timepattern.lower() == "tai64n":
+				date = list(time.strptime(value, self.timepattern))
+			else:
+				# extract part of format which represents seconds since epoch
+				seconds_since_epoch = value[2:17]
+				date = list(time.gmtime(int(seconds_since_epoch, 16)))
 		except ValueError, e:
 			logSys.error(e)
 			logSys.error("Please check the format and your locale settings.")

From 85f1d74d85a392f2f6bbc96ad852d54a5260d8eb Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 3 Jan 2006 15:13:24 +0000
Subject: [PATCH 199/549] - Removed debug option

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@228 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 man/fail2ban.8 | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/man/fail2ban.8 b/man/fail2ban.8
index c43b71ec..1c2e4f73 100644
--- a/man/fail2ban.8
+++ b/man/fail2ban.8
@@ -14,9 +14,6 @@ firewall rules to reject the IP address.
 \fB\-b\fR
 start in background
 .TP 
-\fB\-d\fR
-start in debug mode. Commands are NOT executed but only displayed
-.TP 
 \fB\-c\fR \fIFILE\fR
 read configuration file \fIFILE\fR
 .TP 

From 6386c9e5809af60f713b42406eb7e4d4c33151be Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 3 Jan 2006 15:13:41 +0000
Subject: [PATCH 200/549] - Added SMTP authentification support

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@229 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 utils/mail.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/utils/mail.py b/utils/mail.py
index 8a244d4f..9a89896e 100644
--- a/utils/mail.py
+++ b/utils/mail.py
@@ -44,6 +44,16 @@ class Mail:
 		""" Set from: address
 		"""
 		self.fromAddr = fromAddr
+
+	def setUser(self, user):
+		""" Set smtpuser
+		"""
+		self.user = user
+
+	def setPassword(self, password):
+		""" Set smtppassword
+		"""
+		self.password = password
 	
 	def setToAddr(self, toAddr):
 		""" Set to: address
@@ -69,6 +79,8 @@ class Mail:
 		try:
 			server = smtplib.SMTP(self.host, self.port)
 			#server.set_debuglevel(1)
+			if not self.user == '':
+				server.login(self.user, self.password)
 			server.sendmail(self.fromAddr, self.toAddr, mail)
 			logSys.debug("Email sent to " + `self.toAddr`)
 			server.quit()	

From 79318b35495725e20d4e34e3e1ebeec67a112132 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 3 Jan 2006 15:14:27 +0000
Subject: [PATCH 201/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@230 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 7 +++++++
 README    | 8 ++++----
 TODO      | 3 +++
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 54bf066a..3c37789d 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -16,6 +16,13 @@ ver. 0.6.? (200?/??/??) - ???
 - Propagated patch from Debian to fix fail2ban search path 
   addition to the path search list: now it is added first. 
   Thanks to Nick Craig-Wood
+- Added SMTP authentification for mail notification. Thanks
+  to Markus Hoffmann
+- Removed debug mode as it is confusing for people
+- Added parsing of timestamp in TAI64N format (#1275325).
+  Thanks to Mark Edgington
+- Added patch #1382936 (Default formatted syslog logging).
+  Thanks to Patrick Börjesson
 
 ver. 0.6.0 (2005/11/20) - stable
 ----------
diff --git a/README b/README
index 915304bb..0c241a8a 100644
--- a/README
+++ b/README
@@ -62,8 +62,8 @@ To install, just do:
 > cd fail2ban-0.6.0
 > python setup.py install
 
-This will install Fail2Ban into /usr/lib/fail2ban. The fail2ban
-executable is placed into /usr/bin.
+This will install Fail2Ban into /usr/lib/fail2ban. The
+fail2ban executable is placed into /usr/bin.
 
 Gentoo: ebuilds are available on the website.
 Debian: Fail2Ban is in Debian unstable.
@@ -96,7 +96,6 @@ the value stored in fail2ban.conf. Here are the command line
 options:
 
   -b         start in background
-  -d         start in debug mode
   -c <FILE>  read configuration file FILE
   -p <FILE>  create PID lock in FILE
   -h         display this help message
@@ -124,7 +123,8 @@ Thanks:
 
 Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
 Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
-Jonathan Kamens, Stephen Gildea
+Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
+Edgington, Patrick Börjesson
 
 License:
 --------
diff --git a/TODO b/TODO
index d0028108..190a84cb 100644
--- a/TODO
+++ b/TODO
@@ -21,3 +21,6 @@ See Feature Request Tracking System at SourceForge.net
 - remove debug mode (root check)
 - better return values in function
 - use more email.Utils in mail.py
+- add gettext support
+- send an email when fail2ban is running
+- use Gentoo Portage style for scripts

From 1044b82e128fefa83c480587a01fe49498b2350b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 3 Jan 2006 15:16:22 +0000
Subject: [PATCH 202/549] - Removed debug option - Added SMTP authentification
 support - Changed syslog output to a more standard format

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@231 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/fail2ban.py b/fail2ban.py
index bd4048bc..f192f5b5 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -56,7 +56,6 @@ def dispUsage():
 	print "and bans the corresponding IP addresses using firewall rules."
 	print
 	print "  -b         start in background"
-	print "  -d         start in debug mode"
 	print "  -c <FILE>  read configuration file FILE"
 	print "  -p <FILE>  create PID lock in FILE"
 	print "  -h         display this help message"
@@ -186,6 +185,7 @@ def main():
 	stdout.setFormatter(formatter)
 	
 	conf["kill"] = False
+	conf["debug"] = False
 	conf["verbose"] = 0
 	conf["conffile"] = "/etc/fail2ban.conf"
 	
@@ -216,7 +216,6 @@ def main():
 					["str", "logtargets", "/var/log/fail2ban.log"],
 					["str", "syslog-target", "/dev/log"],
 					["int", "syslog-facility", 1],
-					["bool", "debug", False],
 					["str", "pidlock", "/var/run/fail2ban.pid"],
 					["int", "maxfailures", 5],
 					["int", "bantime", 600],
@@ -294,8 +293,8 @@ def main():
 						port = int(syslogtargets[3])
 					syslogtarget = (syslogtargets[1], port)
 				hdlr = logging.handlers.SysLogHandler(syslogtarget, facility)
-			tformatter = logging.Formatter("fail2ban[%(process)d]: " +
-										   formatterstring);
+			tformatter = logging.Formatter("%(asctime)s %(name)s " +
+										    formatterstring, "%b %e %T");
 		else:
 			# Target should be a file
 			try:
@@ -315,14 +314,14 @@ def main():
 			logSys.setLevel(logging.INFO)
 		elif conf["verbose"] > 1:
 			logSys.setLevel(logging.DEBUG)
-		
-	# Set debug log level
-	if conf["debug"]:
-		logSys.setLevel(logging.DEBUG)
-		formatterstring = ('%(levelname)s: [%(filename)s (%(lineno)d)] ' +
+		if conf["verbose"] > 2:
+			formatterstring = ('%(levelname)s: [%(filename)s (%(lineno)d)] ' +
 						   '%(message)s')
-		formatter = logging.Formatter("%(asctime)s " + formatterstring)
-		stdout.setFormatter(formatter)
+			formatter = logging.Formatter("%(asctime)s " + formatterstring)
+			stdout.setFormatter(formatter)
+	
+	# Debug mode. Should only be used by developers
+	if conf["debug"]:
 		logSys.warn("DEBUG MODE: FIREWALL COMMANDS ARE _NOT_ EXECUTED BUT " +
 					"ONLY DISPLAYED IN THE LOG MESSAGES")
 	
@@ -358,6 +357,8 @@ def main():
 					["int", "port", "25"],
 					["str", "from", "root"],
 					["str", "to", "root"],
+					["str", "user", ''],
+					["str", "password", ''],
 					["bool", "localtime", False],
 					["str", "subject", "[Fail2Ban] Banned <ip>"],
 					["str", "message", "Fail2Ban notification"])
@@ -370,6 +371,8 @@ def main():
 		logSys.debug("Mail enabled")
 		mail = Mail(mailConf["host"], mailConf["port"])
 		mail.setFromAddr(mailConf["from"])
+		mail.setUser(mailConf["user"])
+		mail.setPassword(mailConf["password"])
 		mail.setToAddr(mailConf["to"])
 		mail.setLocalTimeFlag(mailConf["localtime"])
 		logSys.debug("to: " + mailConf["to"] + " from: " + mailConf["from"])

From 3e86a8204b5c836bc8ded6e4f5c012cf97ee4014 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 12 Jan 2006 16:20:00 +0000
Subject: [PATCH 203/549] - Removed 192.168.0.0/16 from ignoreip

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@232 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                    | 2 ++
 config/fail2ban.conf.default | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 3c37789d..42c371a7 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -23,6 +23,8 @@ ver. 0.6.? (200?/??/??) - ???
   Thanks to Mark Edgington
 - Added patch #1382936 (Default formatted syslog logging).
   Thanks to Patrick Börjesson
+- Removed 192.168.0.0/16 from ignoreip. Attacks could also
+  come from the local network.
 
 ver. 0.6.0 (2005/11/20) - stable
 ----------
diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 96337fcd..ad28e1f9 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -58,9 +58,9 @@ findtime = 600
 # Notes.:  space separated list of IP's to be ignored by fail2ban.
 #          You can use CIDR mask in order to specify a range.
 #          Example:  ignoreip = 192.168.0.1/24 123.45.235.65
-# Values:  IP  Default:  192.168.0.0/16
+# Values:  IP  Default:  
 #
-ignoreip = 192.168.0.0/16
+ignoreip = 
 
 # Option:  cmdstart
 # Notes.:  command executed once at the start of Fail2Ban

From de7acd4d6cfba925b45b2e29fab39075cfe02e81 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 22 Jan 2006 11:07:22 +0000
Subject: [PATCH 204/549] - Added support for shorewall and hosts.deny -
 Renamed fail2ban.conf.default to fail2ban.conf.iptables

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@233 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.hostsdeny                | 287 ++++++++++++++++++
 ...an.conf.default => fail2ban.conf.iptables} | 157 +++++-----
 config/fail2ban.conf.shorewall                | 281 +++++++++++++++++
 3 files changed, 638 insertions(+), 87 deletions(-)
 create mode 100644 config/fail2ban.conf.hostsdeny
 rename config/{fail2ban.conf.default => fail2ban.conf.iptables} (79%)
 create mode 100644 config/fail2ban.conf.shorewall

diff --git a/config/fail2ban.conf.hostsdeny b/config/fail2ban.conf.hostsdeny
new file mode 100644
index 00000000..693d28a9
--- /dev/null
+++ b/config/fail2ban.conf.hostsdeny
@@ -0,0 +1,287 @@
+# Fail2Ban configuration file
+#
+# $Revision$
+#
+# 2005.06.21  modified for readability  Iain Lea  iain@bricbrac.de
+
+[DEFAULT]
+# Option:  background
+# Notes.:  start fail2ban as a daemon. Output is redirect to logfile.
+# Values:  [true | false]  Default:  false
+#
+background = false
+
+# Option:  logtargets
+# Notes.:  log targets. Space separated list of logging targets.
+# Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
+#
+logtargets = /var/log/fail2ban.log
+
+# Option:  syslog-target
+# Notes.:  where to find syslog facility if logtarget SYSLOG.
+# Values:  SOCKET HOST HOST:PORT  Default: /dev/log
+#
+syslog-target = /dev/log
+
+# Option:  syslog-facility
+# Notes.:  which syslog facility to use if logtarget SYSLOG.
+# Values:  NUM  Default: 1
+#
+syslog-facility = 1
+
+# Option:  pidlock
+# Notes.:  path of the PID lock file (must be able to write to file).
+# Values:  FILE  Default:  /var/run/fail2ban.pid
+#
+pidlock = /var/run/fail2ban.pid
+
+# Option:  maxfailures
+# Notes.:  number of failures before IP gets banned.
+# Values:  NUM  Default:  5
+#
+maxfailures = 5
+
+# Option:  bantime
+# Notes.:  number of seconds an IP will be banned. If set to a negative
+#          value, IP will never be unbanned (permanent banning).
+# Values:  NUM  Default:  600
+#
+bantime = 600
+
+# Option:  findtime
+# Notes.:  lifetime in seconds of a "failed" log entry.
+# Values:  NUM  Default:  600
+#
+findtime = 600
+
+# Option:  ignoreip
+# Notes.:  space separated list of IP's to be ignored by fail2ban.
+#          You can use CIDR mask in order to specify a range.
+#          Example:  ignoreip = 192.168.0.1/24 123.45.235.65
+# Values:  IP  Default:  
+#
+ignoreip = 
+
+# Option:  cmdstart
+# Notes.:  command executed once at the start of Fail2Ban
+# Values:  CMD  Default:
+#
+cmdstart = 
+
+# Option:  cmdend
+# Notes.:  command executed once at the end of Fail2Ban.
+# Values:  CMD  Default:
+#
+cmdend = 
+
+# Option:  polltime
+# Notes.:  number of seconds fail2ban sleeps between iterations.
+# Values:  NUM  Default:  1
+#
+polltime = 1
+
+# Option:  reinittime
+# Notes.:  minimal number of seconds between the re-initialization of
+#          firewalls due to external changes in their rules (see fwcheck)
+# Values:  NUM  Default:  100
+#
+reinittime = 10
+
+# Option:  maxreinits
+# Notes.:  maximal number of re-initialization of firewalls due to external
+#          changes. -1 stays for infinite, so only reinittime is of importance
+# Values:  NUM  Default:  -1
+#
+maxreinits = -1
+
+# NOTE: Interpolations
+#
+# fwstart, as well as fwend, fwcheck, fwban, fwunban, use interpolations
+# so %(__name__)s  will be substituted by a name of each section
+# (unless the option is overriden in a section).
+# If you are going to use interpolations in your setup, please make
+# sure that you specified options port and protocol (which also has
+# an option in DEFAULT).
+#
+
+# Option:  hostsdeny
+# Notes.:  hosts.deny file path.
+# Values:  STR  Default:  /etc/hosts.deny
+#
+hostsdeny = /etc/hosts.deny
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+fwban = IP=<ip> && echo "ALL: $IP" >> %(hostsdeny)s
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+fwunban = IP=<ip> && sed -i.old s/ALL:\ $IP// %(hostsdeny)s
+
+[MAIL]
+# Option:  enabled
+# Notes.:  enable mail notification when banning an IP address.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  host
+# Notes.:  host running the mail server.
+# Values:  STR  Default:  localhost
+#
+host = localhost
+
+# Option:  port
+# Notes.:  port of the mail server.
+# Values:  INT  Default:  25
+#
+port = 25
+
+# Option:  user
+# Notes.:  the username for smtp-server if authentification is required.
+#          if user is empty, no authentification is done.
+# Values:  STR  Default:  
+#
+user = 
+
+# Option:  password
+# Notes.:  the smtp-user's password if authentification is required.
+# Values:  STR  Default:  
+#
+password = 
+
+# Option:  from
+# Notes.:  e-mail address of the sender.
+# Values:  MAIL  Default:  fail2ban
+#
+from = fail2ban
+
+# Option:  to
+# Notes.:  e-mail addresses of the receiver. Addresses are space
+#          separated.
+# Values:  MAIL  Default:  root
+#
+to = root
+
+# Option:  localtime
+# Notes.:  report local time (including timezone) or GMT
+# Values:  [true | false]  Default:  false
+#
+localtime = true
+
+# Option:  subject
+# Notes.:  subject of the e-mail.
+# Tags:    <section> active section (eg ssh, apache, etc)
+#          <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+# Values:  TEXT  Default:  [Fail2Ban] <section>: Banned <ip>
+#
+subject = [Fail2Ban] <section>: Banned <ip>
+
+# Option:  message
+# Notes.:  message of the e-mail.
+# Tags:    <section> active section (eg ssh, apache, etc)
+#          <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <br>  new line
+# Values:  TEXT  Default:
+#
+message = Hi,<br>
+          The IP <ip> has just been banned by Fail2Ban after
+          <failures> attempts against <section>.<br>
+          Regards,<br>
+          Fail2Ban
+
+# You can define a new section for each log file to check for
+# password failure. Each section has to define the following
+# options: logfile, fwban, fwunban, timeregex, timepattern,
+# failregex.
+
+
+[Apache]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/httpd/access_log
+#
+logfile = /var/log/httpd/access_log
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in Apache logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
+# Values:  [Wed Jan 05 15:08:01 2005]
+# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+#
+timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
+# Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
+#
+timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile.
+# Values:  TEXT  Default:  authentication failure|user .* not found
+#
+failregex = authentication failure|user .* not found
+
+
+[SSH]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  true
+#
+enabled = true
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/secure
+#
+logfile = /var/log/secure
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
+# Values:  [Mar  7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
+# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile.
+# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
+#
+failregex = Authentication failure|Failed password|Invalid user
diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.iptables
similarity index 79%
rename from config/fail2ban.conf.default
rename to config/fail2ban.conf.iptables
index ad28e1f9..4cf103b5 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.iptables
@@ -94,6 +94,66 @@ reinittime = 10
 #
 maxreinits = -1
 
+# NOTE: Interpolations
+#
+# fwstart, as well as fwend, fwcheck, fwban, fwunban, use interpolations
+# so %(__name__)s  will be substituted by a name of each section
+# (unless the option is overriden in a section).
+# If you are going to use interpolations in your setup, please make
+# sure that you specified options port and protocol (which also has
+# an option in DEFAULT).
+#
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD  Default:
+#
+fwstart = iptables -N fail2ban-%(__name__)s
+          iptables -A fail2ban-%(__name__)s -j RETURN
+          iptables -I INPUT -p %(protocol)s --dport %(port)s -j fail2ban-%(__name__)s
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD  Default:
+#
+fwend = iptables -D INPUT -p %(protocol)s --dport %(port)s -j fail2ban-%(__name__)s
+        iptables -F fail2ban-%(__name__)s
+        iptables -X fail2ban-%(__name__)s
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD  Default:
+#
+fwcheck = iptables -L INPUT | grep -q fail2ban-%(__name__)s
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+fwban = iptables -I fail2ban-%(__name__)s 1 -s <ip> -j DROP
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+fwunban = iptables -D fail2ban-%(__name__)s -s <ip> -j DROP
 
 [MAIL]
 # Option:  enabled
@@ -190,50 +250,11 @@ enabled = false
 #
 logfile = /var/log/httpd/access_log
 
-# Option:  fwstart
-# Notes.:  command executed once at the start of Fail2Ban
-# Values:  CMD  Default:
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
 #
-fwstart = iptables -N fail2ban-http
-          iptables -I INPUT -p tcp --dport http -j fail2ban-http
-          iptables -A fail2ban-http -j RETURN
-
-# Option:  fwend
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
-#
-fwend = iptables -D INPUT -p tcp --dport http -j fail2ban-http
-        iptables -F fail2ban-http
-        iptables -X fail2ban-http
-
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
-#
-fwcheck = iptables -L INPUT | grep -q fail2ban-http
-
-# Option:  fwban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
-# Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
-#
-fwban = iptables -I fail2ban-http 1 -s <ip> -j DROP
-
-# Option:  fwunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
-# Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
-#
-fwunban = iptables -D fail2ban-http -s <ip> -j DROP
+port = http
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in Apache logfile. For TAI64N format,
@@ -269,52 +290,14 @@ enabled = true
 # Notes.:  logfile to monitor.
 # Values:  FILE  Default:  /var/log/secure
 #
-logfile = /var/log/secure
+#logfile = /var/log/secure
+logfile = /home/cyril/workspace/fail2ban-stable/log-test/test
 
-# Option:  fwstart
-# Notes.:  command executed once at the start of Fail2Ban
-# Values:  CMD  Default:
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
 #
-fwstart = iptables -N fail2ban-ssh
-          iptables -I INPUT -p tcp --dport ssh -j fail2ban-ssh
-          iptables -A fail2ban-ssh -j RETURN
-
-# Option:  fwend
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
-#
-fwend = iptables -D INPUT -p tcp --dport ssh -j fail2ban-ssh
-        iptables -F fail2ban-ssh
-        iptables -X fail2ban-ssh
-
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
-#
-fwcheck = iptables -L INPUT | grep -q fail2ban-ssh
-
-# Option:  fwbanrule
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
-# Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
-#
-fwban = iptables -I fail2ban-ssh 1 -s <ip> -j DROP
-
-# Option:  fwunbanrule
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
-# Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
-#
-fwunban = iptables -D fail2ban-ssh -s <ip> -j DROP
+port = ssh
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
diff --git a/config/fail2ban.conf.shorewall b/config/fail2ban.conf.shorewall
new file mode 100644
index 00000000..570017fd
--- /dev/null
+++ b/config/fail2ban.conf.shorewall
@@ -0,0 +1,281 @@
+# Fail2Ban configuration file
+#
+# $Revision$
+#
+# 2005.06.21  modified for readability  Iain Lea  iain@bricbrac.de
+
+[DEFAULT]
+# Option:  background
+# Notes.:  start fail2ban as a daemon. Output is redirect to logfile.
+# Values:  [true | false]  Default:  false
+#
+background = false
+
+# Option:  logtargets
+# Notes.:  log targets. Space separated list of logging targets.
+# Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
+#
+logtargets = /var/log/fail2ban.log
+
+# Option:  syslog-target
+# Notes.:  where to find syslog facility if logtarget SYSLOG.
+# Values:  SOCKET HOST HOST:PORT  Default: /dev/log
+#
+syslog-target = /dev/log
+
+# Option:  syslog-facility
+# Notes.:  which syslog facility to use if logtarget SYSLOG.
+# Values:  NUM  Default: 1
+#
+syslog-facility = 1
+
+# Option:  pidlock
+# Notes.:  path of the PID lock file (must be able to write to file).
+# Values:  FILE  Default:  /var/run/fail2ban.pid
+#
+pidlock = /var/run/fail2ban.pid
+
+# Option:  maxfailures
+# Notes.:  number of failures before IP gets banned.
+# Values:  NUM  Default:  5
+#
+maxfailures = 5
+
+# Option:  bantime
+# Notes.:  number of seconds an IP will be banned. If set to a negative
+#          value, IP will never be unbanned (permanent banning).
+# Values:  NUM  Default:  600
+#
+bantime = 600
+
+# Option:  findtime
+# Notes.:  lifetime in seconds of a "failed" log entry.
+# Values:  NUM  Default:  600
+#
+findtime = 600
+
+# Option:  ignoreip
+# Notes.:  space separated list of IP's to be ignored by fail2ban.
+#          You can use CIDR mask in order to specify a range.
+#          Example:  ignoreip = 192.168.0.1/24 123.45.235.65
+# Values:  IP  Default:  
+#
+ignoreip = 
+
+# Option:  cmdstart
+# Notes.:  command executed once at the start of Fail2Ban
+# Values:  CMD  Default:
+#
+cmdstart = 
+
+# Option:  cmdend
+# Notes.:  command executed once at the end of Fail2Ban.
+# Values:  CMD  Default:
+#
+cmdend = 
+
+# Option:  polltime
+# Notes.:  number of seconds fail2ban sleeps between iterations.
+# Values:  NUM  Default:  1
+#
+polltime = 1
+
+# Option:  reinittime
+# Notes.:  minimal number of seconds between the re-initialization of
+#          firewalls due to external changes in their rules (see fwcheck)
+# Values:  NUM  Default:  100
+#
+reinittime = 10
+
+# Option:  maxreinits
+# Notes.:  maximal number of re-initialization of firewalls due to external
+#          changes. -1 stays for infinite, so only reinittime is of importance
+# Values:  NUM  Default:  -1
+#
+maxreinits = -1
+
+# NOTE: Interpolations
+#
+# fwstart, as well as fwend, fwcheck, fwban, fwunban, use interpolations
+# so %(__name__)s  will be substituted by a name of each section
+# (unless the option is overriden in a section).
+# If you are going to use interpolations in your setup, please make
+# sure that you specified options port and protocol (which also has
+# an option in DEFAULT).
+#
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+fwban = shorewall drop <ip>
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+fwunban = shorewall allow <ip>
+
+[MAIL]
+# Option:  enabled
+# Notes.:  enable mail notification when banning an IP address.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  host
+# Notes.:  host running the mail server.
+# Values:  STR  Default:  localhost
+#
+host = localhost
+
+# Option:  port
+# Notes.:  port of the mail server.
+# Values:  INT  Default:  25
+#
+port = 25
+
+# Option:  user
+# Notes.:  the username for smtp-server if authentification is required.
+#          if user is empty, no authentification is done.
+# Values:  STR  Default:  
+#
+user = 
+
+# Option:  password
+# Notes.:  the smtp-user's password if authentification is required.
+# Values:  STR  Default:  
+#
+password = 
+
+# Option:  from
+# Notes.:  e-mail address of the sender.
+# Values:  MAIL  Default:  fail2ban
+#
+from = fail2ban
+
+# Option:  to
+# Notes.:  e-mail addresses of the receiver. Addresses are space
+#          separated.
+# Values:  MAIL  Default:  root
+#
+to = root
+
+# Option:  localtime
+# Notes.:  report local time (including timezone) or GMT
+# Values:  [true | false]  Default:  false
+#
+localtime = true
+
+# Option:  subject
+# Notes.:  subject of the e-mail.
+# Tags:    <section> active section (eg ssh, apache, etc)
+#          <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+# Values:  TEXT  Default:  [Fail2Ban] <section>: Banned <ip>
+#
+subject = [Fail2Ban] <section>: Banned <ip>
+
+# Option:  message
+# Notes.:  message of the e-mail.
+# Tags:    <section> active section (eg ssh, apache, etc)
+#          <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <br>  new line
+# Values:  TEXT  Default:
+#
+message = Hi,<br>
+          The IP <ip> has just been banned by Fail2Ban after
+          <failures> attempts against <section>.<br>
+          Regards,<br>
+          Fail2Ban
+
+# You can define a new section for each log file to check for
+# password failure. Each section has to define the following
+# options: logfile, fwban, fwunban, timeregex, timepattern,
+# failregex.
+
+
+[Apache]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/httpd/access_log
+#
+logfile = /var/log/httpd/access_log
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in Apache logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
+# Values:  [Wed Jan 05 15:08:01 2005]
+# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+#
+timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
+# Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
+#
+timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile.
+# Values:  TEXT  Default:  authentication failure|user .* not found
+#
+failregex = authentication failure|user .* not found
+
+
+[SSH]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  true
+#
+enabled = true
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/secure
+#
+logfile = /var/log/secure
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
+# Values:  [Mar  7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
+# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile.
+# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
+#
+failregex = Authentication failure|Failed password|Invalid user

From ad4280d50690d9611af3cb38ed336713d51d638a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 22 Jan 2006 11:08:42 +0000
Subject: [PATCH 205/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@234 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 12 ++++++++++++
 MANIFEST  |  4 +++-
 README    |  2 +-
 setup.py  |  2 +-
 4 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 42c371a7..5ad5abfe 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -25,6 +25,18 @@ ver. 0.6.? (200?/??/??) - ???
   Thanks to Patrick Börjesson
 - Removed 192.168.0.0/16 from ignoreip. Attacks could also
   come from the local network.
+- Robust startup: if iptables module does not get fully
+  initialized after startup of fail2ban, fail2ban will do
+  "maxreinit" attempts to initialize its own firewall. It
+  will sleep between attempts for "polltime" number of
+  seconds (closes Debian: #334272). Thanks to Yaroslav
+  Halchenko
+- Added "interpolations" in fail2ban.conf. This is provided
+  by the ConfigParser module. Old configuration files still
+  work. Thanks to Yaroslav Halchenko
+- Added initial support for hosts.deny and shorewall. Need
+  more testing. Please test. Thanks to kojiro from Gentoo
+  forum for hosts.deny support
 
 ver. 0.6.0 (2005/11/20) - stable
 ----------
diff --git a/MANIFEST b/MANIFEST
index b56a8b73..22731947 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -18,7 +18,9 @@ utils/process.py
 utils/mail.py
 utils/strings.py
 utils/pidlock.py
-config/fail2ban.conf.default
+config/fail2ban.conf.iptables
+config/fail2ban.conf.shorewall
+config/fail2ban.conf.hostsdeny
 config/gentoo-initd
 config/gentoo-confd
 config/redhat-initd
diff --git a/README b/README
index 0c241a8a..0b149723 100644
--- a/README
+++ b/README
@@ -124,7 +124,7 @@ Thanks:
 Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
 Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
 Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
-Edgington, Patrick Börjesson
+Edgington, Patrick Börjesson, kojiro
 
 License:
 --------
diff --git a/setup.py b/setup.py
index a4f096f3..99b7f024 100755
--- a/setup.py
+++ b/setup.py
@@ -78,5 +78,5 @@ if obsoleteFiles:
 if argv[1] == "install":
 	print
 	print "Please do not forget to update your configuration file."
-	print "Use config/fail2ban.conf.default as example."
+	print "Use config/fail2ban.conf.* as example."
 	print

From d29648d4defb5760f7325b24150d16a937ef4da1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 22 Jan 2006 11:10:29 +0000
Subject: [PATCH 206/549] - Added a more robust firewall initialization loop.
 Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@235 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban.py | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/fail2ban.py b/fail2ban.py
index f192f5b5..1ab2ab90 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -423,7 +423,25 @@ def main():
 		else:
 			logSys.warn(ip + " is not a valid IP address")
 	
-	initializeFwRules()
+	# Startup loop -- necessary to avoid crash if it takes time for iptables
+	# to startup. To avoid introduction of new config options, reusing
+	# maxreinits and polltime.
+	reinits = 0
+	while True:
+		try:
+			initializeFwRules()
+			break
+		except ExternalError, e:
+			reinits += 1
+			logSys.warn(e)
+			if conf["maxreinits"] < 0 or (reinits < conf["maxreinits"]):
+				logSys.warn("#%d attempt to initialize the firewalls" % reinits)
+			else:
+				logSys.error("Exiting: Too many attempts to initialize the " +
+							 "firewall")
+				killApp()
+			time.sleep(conf["polltime"])
+
 	# try to reinit once if it fails immediately
 	lastReinitTime = time.time() - conf["reinittime"] - 1
 	reinits = 0

From 054d18dd28d64c8cefd032d0e7110471425e3221 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 10 Feb 2006 10:26:16 +0000
Subject: [PATCH 207/549] - Updated with ideas for 0.7

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@236 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 57 insertions(+), 11 deletions(-)

diff --git a/TODO b/TODO
index 190a84cb..6abfc5c1 100644
--- a/TODO
+++ b/TODO
@@ -4,23 +4,69 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-ToDo                                     $Revision$
+ToDo                                         $Revision$
 =============================================================
 
 See Feature Request Tracking System at SourceForge.net
 
 - improve installation process (better prefix support)
-- install Fail2ban into /usr/share
+
+- improve documentation and website
+
 - better configuration files
+
 - add a check to see if the time of the log messages is
   correctly detected (valid regexp)
-- split configuration files in /etc/fail2ban/services.d
-  Example: /etc/fail2ban/services.d/apache
-- template for common services in /etc/fail2ban/scripts.d
-  Example: /etc/fail2ban/scripts.d/apache
-- remove debug mode (root check)
-- better return values in function
-- use more email.Utils in mail.py
-- add gettext support
-- send an email when fail2ban is running
+
 - use Gentoo Portage style for scripts
+  - split configuration files in /etc/fail2ban/services.d
+    Example: /etc/fail2ban/services.d/apache
+  - template for common services in /etc/fail2ban/scripts.d
+    Example: /etc/fail2ban/scripts.d/apache
+
+- remove debug mode (root check)
+
+- better return values in function
+
+- use more email.Utils in mail.py
+
+- add gettext support
+
+- send an email when fail2ban is running
+
+- add multithreading. Python threading is not really
+  efficient. However, fail2ban could benefit of it. We could
+  use threads like this:
+  - one thread which check for host to unban.
+  - one thread per file to watch. This will allow things like
+    different polling time for each file.
+  <srv> is read-only (we only read log files) thus no locks
+  are required. However, <meth> is read-write and must take
+  care of concurrency in case of multithreading.
+
+- add FAM/Gamin support. Should be quite efficient with
+  threading. Take care that handle_one_event() release the
+  Python lock.
+
+- add a test framework. We could use unittest which is in
+  Python since 2.1. It should be possible to run all tests
+  automatically.
+
+- add client/server using socket. Something similar to
+  gdesklets. DBUS seems to be designed for desktop use.
+  - fail2ban start -> start the daemon.
+  - fail2ban stop -> stop the daemon.
+  - fail2ban add <srv> <meth> -> add <srv> monitoring with
+    <meth> ban method (iptables, hosts.deny, etc).
+  - fail2ban del <srv> -> remove <srv> monitoring.
+  - fail2ban status <srv> -> query current fail2ban status.
+    Should return infos like a ban counter. Could be graph
+    with rrdtool.
+  - fail2ban pause <srv> -> suspend monitoring.
+  - fail2ban resume <srv> -> resume monitoring.
+  - fail2ban list -> list available services.
+  - fail2ban flush <srv> -> flush the <srv> ban list.
+  
+- remove PID file.
+
+- remove most of the command lines options if possible.

From 7e24b948bf7f3257db8ee6ed503436f83a870d5f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 11 Feb 2006 15:29:32 +0000
Subject: [PATCH 208/549] - Added vsftpd support. Thanks to zugeschmiert

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@237 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf.hostsdeny | 40 ++++++++++++++++++++++++++++++++++
 config/fail2ban.conf.iptables  | 40 ++++++++++++++++++++++++++++++++++
 config/fail2ban.conf.shorewall | 33 ++++++++++++++++++++++++++++
 3 files changed, 113 insertions(+)

diff --git a/config/fail2ban.conf.hostsdeny b/config/fail2ban.conf.hostsdeny
index 693d28a9..05c9d582 100644
--- a/config/fail2ban.conf.hostsdeny
+++ b/config/fail2ban.conf.hostsdeny
@@ -251,6 +251,46 @@ timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
 failregex = authentication failure|user .* not found
 
 
+[VSFTPD]
+# Option: enabled
+# Notes.: enable monitoring for this section.
+# Values: [true | false] Default: false
+#
+enabled = false
+
+# Option: logfile
+# Notes.: logfile to monitor.
+# Values: FILE Default: /var/log/secure
+#
+logfile = /var/log/vsftpd.log
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ftp
+
+# Option: timeregex
+# Notes.: regex to match timestamp in VSFTPD logfile.
+# Values: [Mar 7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option: timepattern
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT Default: Authentication failure|Failed password|Invalid user
+#
+failregex = FAIL LOGIN
+
+
 [SSH]
 # Option:  enabled
 # Notes.:  enable monitoring for this section.
diff --git a/config/fail2ban.conf.iptables b/config/fail2ban.conf.iptables
index 4cf103b5..46da5466 100644
--- a/config/fail2ban.conf.iptables
+++ b/config/fail2ban.conf.iptables
@@ -279,6 +279,46 @@ timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
 failregex = authentication failure|user .* not found
 
 
+[VSFTPD]
+# Option: enabled
+# Notes.: enable monitoring for this section.
+# Values: [true | false] Default: false
+#
+enabled = false
+
+# Option: logfile
+# Notes.: logfile to monitor.
+# Values: FILE Default: /var/log/secure
+#
+logfile = /var/log/vsftpd.log
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ftp
+
+# Option: timeregex
+# Notes.: regex to match timestamp in VSFTPD logfile.
+# Values: [Mar 7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option: timepattern
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT Default: Authentication failure|Failed password|Invalid user
+#
+failregex = FAIL LOGIN
+
+
 [SSH]
 # Option:  enabled
 # Notes.:  enable monitoring for this section.
diff --git a/config/fail2ban.conf.shorewall b/config/fail2ban.conf.shorewall
index 570017fd..2cb0fc46 100644
--- a/config/fail2ban.conf.shorewall
+++ b/config/fail2ban.conf.shorewall
@@ -244,6 +244,39 @@ timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
 #
 failregex = authentication failure|user .* not found
 
+[VSFTPD]
+# Option: enabled
+# Notes.: enable monitoring for this section.
+# Values: [true | false] Default: false
+#
+enabled = false
+
+# Option: logfile
+# Notes.: logfile to monitor.
+# Values: FILE Default: /var/log/secure
+#
+logfile = /var/log/vsftpd.log
+
+# Option: timeregex
+# Notes.: regex to match timestamp in VSFTPD logfile.
+# Values: [Mar 7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option: timepattern
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT Default: Authentication failure|Failed password|Invalid user
+#
+failregex = FAIL LOGIN
+
 
 [SSH]
 # Option:  enabled

From dfb6f637539244e3f9204db7ad41250326c7f1ed Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 11 Feb 2006 15:30:04 +0000
Subject: [PATCH 209/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@238 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG |  1 +
 README    | 15 ++++++++++++---
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 5ad5abfe..2290b1e7 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -37,6 +37,7 @@ ver. 0.6.? (200?/??/??) - ???
 - Added initial support for hosts.deny and shorewall. Need
   more testing. Please test. Thanks to kojiro from Gentoo
   forum for hosts.deny support
+- Added support for vsftpd. Thanks to zugeschmiert
 
 ver. 0.6.0 (2005/11/20) - stable
 ----------
diff --git a/README b/README
index 0b149723..397c0814 100644
--- a/README
+++ b/README
@@ -74,8 +74,17 @@ Fail2Ban should now be correctly installed. Just type:
 > fail2ban -h
 
 to see if everything is alright. You can configure fail2ban
-with a config file. Copy config/fail2ban.conf.default to
-/etc/fail2ban.conf.
+with a config file. Different kind of configuration files are
+available:
+
+iptables:   copy config/fail2ban.conf.iptables to
+            /etc/fail2ban.conf
+hosts.deny: copy config/fail2ban.conf.hostsdeny to
+            /etc/fail2ban.conf
+shorewall:  copy config/fail2ban.conf.shorewall to
+            /etc/fail2ban.conf
+
+Do not forget to edit fail2ban.conf to meet your needs.
 
 You can use the initd script available in config/. Copy
 <dist>-initd to /etc/init.d/fail2ban. Gentoo users must copy
@@ -124,7 +133,7 @@ Thanks:
 Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
 Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
 Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
-Edgington, Patrick Börjesson, kojiro
+Edgington, Patrick Börjesson, kojiro, zugeschmiert
 
 License:
 --------

From 83ea17fd245b339939df2803f404f42f6b6bf739 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 12 Feb 2006 12:30:39 +0000
Subject: [PATCH 210/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@239 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/TODO b/TODO
index 6abfc5c1..a480b6c6 100644
--- a/TODO
+++ b/TODO
@@ -11,7 +11,9 @@ See Feature Request Tracking System at SourceForge.net
 
 - improve installation process (better prefix support)
 
-- improve documentation and website
+- improve documentation and website for user
+
+- use Doxygen
 
 - better configuration files
 
@@ -70,3 +72,8 @@ See Feature Request Tracking System at SourceForge.net
 - remove PID file.
 
 - remove most of the command lines options if possible.
+
+- add the possibility to specify wildcard in log files.
+  Example: logfile = /var/log/apache2/access-*.log
+  Should we start one thread per file or just one thread per
+  serivce?

From 293f077d7b3e4dc958a12e2346dbc251f4641c4d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 12 Feb 2006 18:15:44 +0000
Subject: [PATCH 211/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@240 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/TODO b/TODO
index a480b6c6..e9058a9b 100644
--- a/TODO
+++ b/TODO
@@ -77,3 +77,6 @@ See Feature Request Tracking System at SourceForge.net
   Example: logfile = /var/log/apache2/access-*.log
   Should we start one thread per file or just one thread per
   serivce?
+
+- optionally read failure patterns from file. If one regex
+  matches, consider it as a breaking in attempt.

From b659cb2c2ab36d752c2fd38d258fcd0ea7847ef0 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 13 Feb 2006 21:37:44 +0000
Subject: [PATCH 212/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@241 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/TODO b/TODO
index e9058a9b..048f7381 100644
--- a/TODO
+++ b/TODO
@@ -20,11 +20,18 @@ See Feature Request Tracking System at SourceForge.net
 - add a check to see if the time of the log messages is
   correctly detected (valid regexp)
 
-- use Gentoo Portage style for scripts
+- use Gentoo Portage style for scripts.
+  - banning engines script in /etc/fail2ban/scripts.d
+    Example: /etc/fail2ban/scripts.d/iptables
+    Will be mostly bash scripting which is more "user
+    friendly".
   - split configuration files in /etc/fail2ban/services.d
+    for log files
     Example: /etc/fail2ban/services.d/apache
-  - template for common services in /etc/fail2ban/scripts.d
-    Example: /etc/fail2ban/scripts.d/apache
+    Mainly regular expressions.
+  - template for common regex in /etc/fail2ban/templates.d
+    Example: /etc/fail2ban/templates.d/date
+    Mainly regular expressions.
 
 - remove debug mode (root check)
 
@@ -32,7 +39,8 @@ See Feature Request Tracking System at SourceForge.net
 
 - use more email.Utils in mail.py
 
-- add gettext support
+- add gettext support. Is this really needed for a server
+  utility?
 
 - send an email when fail2ban is running
 
@@ -78,5 +86,8 @@ See Feature Request Tracking System at SourceForge.net
   Should we start one thread per file or just one thread per
   serivce?
 
-- optionally read failure patterns from file. If one regex
-  matches, consider it as a breaking in attempt.
+- autodetect date format in log file. Match the most popular
+  format and sort them using the hit ratio. Should avoid
+  user problem with regex and not have a big impact on perfs.
+
+- restart automatically the daemon if an exception occurs.

From cbc18112bfc7d2242cfb0e5ca12fa724ba4add9f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 21 Feb 2006 12:46:58 +0000
Subject: [PATCH 213/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@242 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/TODO b/TODO
index 048f7381..5e7b6347 100644
--- a/TODO
+++ b/TODO
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-ToDo                                         $Revision$
+ToDo                                        $Revision$
 =============================================================
 
 See Feature Request Tracking System at SourceForge.net
@@ -15,6 +15,8 @@ See Feature Request Tracking System at SourceForge.net
 
 - use Doxygen
 
+- use PyLint to check the code
+
 - better configuration files
 
 - add a check to see if the time of the log messages is

From 97aa913e243eacb8b93610d4ef6954d89c01a5eb Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 15 Mar 2006 23:07:12 +0000
Subject: [PATCH 214/549] - Updated for 0.6.1

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@243 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  | 4 ++--
 README     | 6 +++---
 version.py | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 2290b1e7..fd74f7ce 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.6.?)                           200?/??/??
+Fail2Ban (version 0.6.1)                           2006/03/16
 =============================================================
 
-ver. 0.6.? (200?/??/??) - ???
+ver. 0.6.1 (2006/03/16) - stable
 ----------
 - Added permanent banning. Set banTime to a negative value to
   enable this feature (-1 is perfect). Thanks to Mannone
diff --git a/README b/README
index 397c0814..c7878a59 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.6.0)                           2005/11/20
+Fail2Ban (version 0.6.1)                           2006/03/16
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -58,8 +58,8 @@ Require: python-2.4 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.6.0.tar.bz2
-> cd fail2ban-0.6.0
+> tar xvfj fail2ban-0.6.1.tar.bz2
+> cd fail2ban-0.6.1
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The
diff --git a/version.py b/version.py
index 07149645..80f0c7a8 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.6.0-CVS"
+version = "0.6.1"

From ea1948eff40953b4590858698ced9f6b4c3733f8 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 26 Jun 2006 20:05:00 +0000
Subject: [PATCH 215/549] - Initial commit of the new development release 0.7

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@249 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO                                   |   97 +-
 {confreader => client}/__init__.py     |    6 +-
 client/actionreader.py                 |   80 ++
 {confreader => client}/configreader.py |   79 +-
 client/configurator.py                 |   68 ++
 client/csocket.py                      |   54 ++
 client/fail2banreader.py               |   51 +
 client/filterreader.py                 |   80 ++
 client/jailreader.py                   |   84 ++
 client/jailsreader.py                  |   73 ++
 config/action.d/dummy.conf             |   52 +
 config/action.d/iptables.conf          |   55 ++
 config/debian-initd                    |   73 --
 config/fail2ban.conf                   |    4 +
 config/fail2ban.conf.hostsdeny         |  327 -------
 config/fail2ban.conf.iptables          |  362 -------
 config/fail2ban.conf.shorewall         |  314 ------
 config/fail2ban.local                  |    4 +
 config/filter.d/apache-auth.conf       |    0
 config/filter.d/sshd.conf              |   32 +
 config/gentoo-confd                    |   23 -
 config/gentoo-initd                    |   50 -
 config/jail.conf                       |   21 +
 config/redhat-initd                    |   78 --
 doc/Doxyfile                           | 1237 ++++++++++++++++++++++++
 fail2ban                               |   75 --
 fail2ban-client                        |  236 +++++
 fail2ban-server                        |  122 +++
 fail2ban-testcases                     |   61 ++
 fail2ban.py                            |  542 -----------
 firewall/firewall.py                   |  192 ----
 kill-server                            |    2 +
 log-test/apache                        |  108 ---
 log-test/current                       |   11 -
 log-test/test                          |  432 ---------
 logreader/logreader.py                 |  225 -----
 man/fail2ban.8                         |   58 --
 man/fail2ban.conf.5                    |   20 -
 {logreader => server}/__init__.py      |    6 +-
 server/action.py                       |  281 ++++++
 server/banmanager.py                   |  184 ++++
 server/banticket.py                    |   50 +
 server/faildata.py                     |   53 +
 server/failmanager.py                  |  106 ++
 version.py => server/failticket.py     |   18 +-
 server/filter.py                       |  452 +++++++++
 server/jail.py                         |   95 ++
 server/jailthread.py                   |  114 +++
 server/server.py                       |  291 ++++++
 server/ssocket.py                      |  103 ++
 server/ticket.py                       |   49 +
 server/transmitter.py                  |  182 ++++
 setup.cfg                              |    5 -
 setup.py                               |   82 --
 {firewall => testcases}/__init__.py    |    6 +-
 testcases/banmanagertestcase.py        |   56 ++
 testcases/failmanagertestcase.py       |   79 ++
 testcases/files/testcase01.log         |   18 +
 testcases/files/testcase02.log         |   10 +
 testcases/filtertestcase.py            |   98 ++
 testcases/servertestcase.py            |  127 +++
 utils/process.py                       |   37 +-
 62 files changed, 4734 insertions(+), 3156 deletions(-)
 rename {confreader => client}/__init__.py (88%)
 create mode 100644 client/actionreader.py
 rename {confreader => client}/configreader.py (54%)
 create mode 100644 client/configurator.py
 create mode 100644 client/csocket.py
 create mode 100644 client/fail2banreader.py
 create mode 100644 client/filterreader.py
 create mode 100644 client/jailreader.py
 create mode 100644 client/jailsreader.py
 create mode 100644 config/action.d/dummy.conf
 create mode 100644 config/action.d/iptables.conf
 delete mode 100644 config/debian-initd
 create mode 100644 config/fail2ban.conf
 delete mode 100644 config/fail2ban.conf.hostsdeny
 delete mode 100644 config/fail2ban.conf.iptables
 delete mode 100644 config/fail2ban.conf.shorewall
 create mode 100644 config/fail2ban.local
 create mode 100644 config/filter.d/apache-auth.conf
 create mode 100644 config/filter.d/sshd.conf
 delete mode 100644 config/gentoo-confd
 delete mode 100755 config/gentoo-initd
 create mode 100644 config/jail.conf
 delete mode 100644 config/redhat-initd
 create mode 100644 doc/Doxyfile
 delete mode 100755 fail2ban
 create mode 100755 fail2ban-client
 create mode 100755 fail2ban-server
 create mode 100755 fail2ban-testcases
 delete mode 100755 fail2ban.py
 delete mode 100644 firewall/firewall.py
 create mode 100755 kill-server
 delete mode 100644 log-test/apache
 delete mode 100644 log-test/current
 delete mode 100644 log-test/test
 delete mode 100644 logreader/logreader.py
 delete mode 100644 man/fail2ban.8
 delete mode 100644 man/fail2ban.conf.5
 rename {logreader => server}/__init__.py (88%)
 create mode 100644 server/action.py
 create mode 100644 server/banmanager.py
 create mode 100644 server/banticket.py
 create mode 100644 server/faildata.py
 create mode 100644 server/failmanager.py
 rename version.py => server/failticket.py (73%)
 create mode 100644 server/filter.py
 create mode 100644 server/jail.py
 create mode 100644 server/jailthread.py
 create mode 100644 server/server.py
 create mode 100644 server/ssocket.py
 create mode 100644 server/ticket.py
 create mode 100644 server/transmitter.py
 delete mode 100644 setup.cfg
 delete mode 100755 setup.py
 rename {firewall => testcases}/__init__.py (88%)
 create mode 100644 testcases/banmanagertestcase.py
 create mode 100644 testcases/failmanagertestcase.py
 create mode 100644 testcases/files/testcase01.log
 create mode 100644 testcases/files/testcase02.log
 create mode 100644 testcases/filtertestcase.py
 create mode 100644 testcases/servertestcase.py

diff --git a/TODO b/TODO
index 5e7b6347..7c388e85 100644
--- a/TODO
+++ b/TODO
@@ -1,95 +1,2 @@
-               __      _ _ ___ _               
-              / _|__ _(_) |_  ) |__  __ _ _ _  
-             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
-             |_| \__,_|_|_/___|_.__/\__,_|_||_|
-
-=============================================================
-ToDo                                        $Revision$
-=============================================================
-
-See Feature Request Tracking System at SourceForge.net
-
-- improve installation process (better prefix support)
-
-- improve documentation and website for user
-
-- use Doxygen
-
-- use PyLint to check the code
-
-- better configuration files
-
-- add a check to see if the time of the log messages is
-  correctly detected (valid regexp)
-
-- use Gentoo Portage style for scripts.
-  - banning engines script in /etc/fail2ban/scripts.d
-    Example: /etc/fail2ban/scripts.d/iptables
-    Will be mostly bash scripting which is more "user
-    friendly".
-  - split configuration files in /etc/fail2ban/services.d
-    for log files
-    Example: /etc/fail2ban/services.d/apache
-    Mainly regular expressions.
-  - template for common regex in /etc/fail2ban/templates.d
-    Example: /etc/fail2ban/templates.d/date
-    Mainly regular expressions.
-
-- remove debug mode (root check)
-
-- better return values in function
-
-- use more email.Utils in mail.py
-
-- add gettext support. Is this really needed for a server
-  utility?
-
-- send an email when fail2ban is running
-
-- add multithreading. Python threading is not really
-  efficient. However, fail2ban could benefit of it. We could
-  use threads like this:
-  - one thread which check for host to unban.
-  - one thread per file to watch. This will allow things like
-    different polling time for each file.
-  <srv> is read-only (we only read log files) thus no locks
-  are required. However, <meth> is read-write and must take
-  care of concurrency in case of multithreading.
-
-- add FAM/Gamin support. Should be quite efficient with
-  threading. Take care that handle_one_event() release the
-  Python lock.
-
-- add a test framework. We could use unittest which is in
-  Python since 2.1. It should be possible to run all tests
-  automatically.
-
-- add client/server using socket. Something similar to
-  gdesklets. DBUS seems to be designed for desktop use.
-  - fail2ban start -> start the daemon.
-  - fail2ban stop -> stop the daemon.
-  - fail2ban add <srv> <meth> -> add <srv> monitoring with
-    <meth> ban method (iptables, hosts.deny, etc).
-  - fail2ban del <srv> -> remove <srv> monitoring.
-  - fail2ban status <srv> -> query current fail2ban status.
-    Should return infos like a ban counter. Could be graph
-    with rrdtool.
-  - fail2ban pause <srv> -> suspend monitoring.
-  - fail2ban resume <srv> -> resume monitoring.
-  - fail2ban list -> list available services.
-  - fail2ban flush <srv> -> flush the <srv> ban list.
-  
-- remove PID file.
-
-- remove most of the command lines options if possible.
-
-- add the possibility to specify wildcard in log files.
-  Example: logfile = /var/log/apache2/access-*.log
-  Should we start one thread per file or just one thread per
-  serivce?
-
-- autodetect date format in log file. Match the most popular
-  format and sort them using the hit ratio. Should avoid
-  user problem with regex and not have a big impact on perfs.
-
-- restart automatically the daemon if an exception occurs.
+- Don't close socket after a send
+- Multiple actions !!!
\ No newline at end of file
diff --git a/confreader/__init__.py b/client/__init__.py
similarity index 88%
rename from confreader/__init__.py
rename to client/__init__.py
index 76dba873..60ef5531 100644
--- a/confreader/__init__.py
+++ b/client/__init__.py
@@ -16,10 +16,10 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.1 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
\ No newline at end of file
diff --git a/client/actionreader.py b/client/actionreader.py
new file mode 100644
index 00000000..5486b90e
--- /dev/null
+++ b/client/actionreader.py
@@ -0,0 +1,80 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.6 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.6 $"
+__date__ = "$Date: 2005/11/20 17:07:47 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+from configreader import ConfigReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class ActionReader(ConfigReader):
+	
+	def __init__(self, file, name):
+		ConfigReader.__init__(self)
+		self.file = file
+		self.name = name
+	
+	def setFile(self, file):
+		self.file = file
+	
+	def getFile(self):
+		return self.file
+	
+	def setName(self, name):
+		self.name = name
+	
+	def getName(self):
+		return self.name
+	
+	def read(self):
+		ConfigReader.read(self, "action.d/" + self.file)
+	
+	def getOptions(self, pOpts):
+		opts = [["string", "bantime", "600"],
+				["string", "actionstart", ""],
+				["string", "actionstop", ""],
+				["string", "actioncheck", ""],
+				["string", "actionban", ""],
+				["string", "actionunban", ""]]
+		self.opts = ConfigReader.getOptions(self, "DEFAULT", opts, pOpts)
+	
+	def convert(self):
+		stream = list()
+		for opt in self.opts:
+			if opt == "bantime":
+				stream.append(["set", self.name, "bantime", self.opts[opt]])
+			elif opt == "actionstart":
+				stream.append(["set", self.name, "actionstart", self.opts[opt]])
+			elif opt == "actionstop":
+				stream.append(["set", self.name, "actionstop", self.opts[opt]])
+			elif opt == "actioncheck":
+				stream.append(["set", self.name, "actioncheck", self.opts[opt]])
+			elif opt == "actionban":
+				stream.append(["set", self.name, "actionban", self.opts[opt]])
+			elif opt == "actionunban":
+				stream.append(["set", self.name, "actionunban", self.opts[opt]])
+		return stream
+		
\ No newline at end of file
diff --git a/confreader/configreader.py b/client/configreader.py
similarity index 54%
rename from confreader/configreader.py
rename to client/configreader.py
index 150858b5..27b56fd2 100644
--- a/confreader/configreader.py
+++ b/client/configreader.py
@@ -16,70 +16,73 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.6 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.6 $"
+__date__ = "$Date: 2005/11/20 17:07:47 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 import logging
-
 from ConfigParser import *
 
 # Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban")
+logSys = logging.getLogger("fail2ban.client.config")
 
-class ConfigReader:
-	""" This class allow the handling of the configuration options.
-		The DEFAULT section contains the global information about
-		Fail2Ban. Each other section is for a different log file.
-	"""
-
-	def __init__(self, confPath):
-		self.confPath = confPath
-		self.configParser = SafeConfigParser()
+class ConfigReader(SafeConfigParser):
+	
+	basedir = "/etc/fail2ban/"
+	
+	def __init__(self):
+		SafeConfigParser.__init__(self)
+		self.opts = None
+	
+	@staticmethod
+	def setBaseDir(dir):
+		global basedir
+		path = dir.rstrip('/')
+		basedir = path + '/'
 		
-	def openConf(self):
-		""" Opens the configuration file.
-		"""
-		self.configParser.read(self.confPath)
+	@staticmethod
+	def getBaseDir():
+		global basedir
+		return basedir
 	
-	def getSections(self):
-		""" Returns all the sections present in the configuration
-			file except the DEFAULT and MAIL sections.
-		"""
-		sections = self.configParser.sections()
-		sections.remove("MAIL")
-		logSys.debug("Found sections: " + `sections`)
-		return sections
+	def read(self, filename):
+		global basedir
+		basename = basedir + filename
+		logSys.debug("Reading " + basename)
+		SafeConfigParser.read(self, [basename + ".conf", basename + ".local"])
 	
+	##
+	# Read the options.
+	#
+	# Read the given option in the configuration file. Default values
+	# are used...
 	# Each optionValues entry is composed of an array with:
 	# 0 -> the type of the option
 	# 1 -> the name of the option
 	# 2 -> the default value for the option
-	def getLogOptions(self, sec, options):
-		""" Gets all the options of a given section. The options
-			are defined in the optionValues list.
-		"""
+	def getOptions(self, sec, options, pOptions = None):
 		values = dict()
 		for option in options:
 			try:
 				if option[0] == "bool":
-					v = self.configParser.getboolean(sec, option[1])
+					v = self.getboolean(sec, option[1])
 				elif option[0] == "int":
-					v = self.configParser.getint(sec, option[1])
+					v = self.getint(sec, option[1])
 				else:
-					v = self.configParser.get(sec, option[1])
-				
+					v = self.get(sec, option[1])
+				if not pOptions == None and option[1] in pOptions:
+					continue
 				values[option[1]] = v
 			except NoOptionError:
-				logSys.warn("No '" + option[1] + "' defined in '" + sec + "'")
-				values[option[1]] = option[2]
+				if not option[2] == None:
+					logSys.warn("No '" + option[1] + "' defined in '" + sec + "'")
+					values[option[1]] = option[2]
 			except ValueError:
 				logSys.warn("Wrong value for '" + option[1] + "' in '" + sec +
 							"'. Using default one: '" + `option[2]` + "'")
 				values[option[1]] = option[2]
-		return values
-		
\ No newline at end of file
+		return values
\ No newline at end of file
diff --git a/client/configurator.py b/client/configurator.py
new file mode 100644
index 00000000..9ceed3d2
--- /dev/null
+++ b/client/configurator.py
@@ -0,0 +1,68 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.6 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.6 $"
+__date__ = "$Date: 2005/11/20 17:07:47 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+from configreader import ConfigReader
+from fail2banreader import Fail2banReader
+from jailsreader import JailsReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class Configurator:
+	
+	def __init__(self):
+		self.settings = dict()
+		self.streams = dict()
+		self.fail2ban = Fail2banReader()
+		self.jails = JailsReader()
+	
+	def setBaseDir(self, dir):
+		ConfigReader.setBaseDir(dir)
+	
+	def getBaseDir(self):
+		return ConfigReader.getBaseDir()
+	
+	def readAll(self):
+		self.fail2ban.read()
+		self.jails.read()
+	
+	def getAllOptions(self):
+		self.settings["general"] = self.fail2ban.getOptions()
+		self.settings["jails"] = self.jails.getOptions()
+		
+	def convertToProtocol(self):
+		self.streams["general"] = self.fail2ban.convert()
+		self.streams["jails"] = self.jails.convert()
+	
+	def getConfigStream(self):
+		cmds = list()
+		for opt in self.streams["general"]:
+			cmds.append(opt)
+		for opt in self.streams["jails"]:
+			cmds.append(opt)
+		return cmds
+	
\ No newline at end of file
diff --git a/client/csocket.py b/client/csocket.py
new file mode 100644
index 00000000..4e07fa0d
--- /dev/null
+++ b/client/csocket.py
@@ -0,0 +1,54 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import socket, pickle
+
+class CSocket:
+	
+	def __init__(self):
+		self.socketFile = "/tmp/fail2ban.sock"
+		# Create an INET, STREAMing socket
+		#self.csock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+		self.csock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+		#self.csock.connect(("localhost", 2222))
+		self.csock.connect(self.socketFile)
+	
+	def send(self, msg):
+		# Convert every list member to string
+		obj = pickle.dumps(map(str, msg))
+		self.csock.send(obj + "<F2B_END_COMMAND>")
+		ret = self.receive(self.csock)
+		self.csock.close()
+		return ret
+	
+	def receive(self, socket):
+		msg = ''
+		while msg.rfind("<F2B_END_COMMAND>") == -1:
+			chunk = socket.recv(6)
+			if chunk == '':
+				raise RuntimeError, "socket connection broken"
+			msg = msg + chunk
+		return pickle.loads(msg)
diff --git a/client/fail2banreader.py b/client/fail2banreader.py
new file mode 100644
index 00000000..a99c3001
--- /dev/null
+++ b/client/fail2banreader.py
@@ -0,0 +1,51 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.6 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.6 $"
+__date__ = "$Date: 2005/11/20 17:07:47 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+from configreader import ConfigReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class Fail2banReader(ConfigReader):
+	
+	def __init__(self):
+		ConfigReader.__init__(self)
+	
+	def read(self):
+		ConfigReader.read(self, "fail2ban")
+	
+	def getOptions(self):
+		opts = [["int", "loglevel", 1]]
+		self.opts = ConfigReader.getOptions(self, "DEFAULT", opts)
+	
+	def convert(self):
+		stream = list()
+		for opt in self.opts:
+			if opt == "loglevel":
+				stream.append(["set", "loglevel", self.opts[opt]])
+		return stream
+	
\ No newline at end of file
diff --git a/client/filterreader.py b/client/filterreader.py
new file mode 100644
index 00000000..79f517b8
--- /dev/null
+++ b/client/filterreader.py
@@ -0,0 +1,80 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.6 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.6 $"
+__date__ = "$Date: 2005/11/20 17:07:47 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+from configreader import ConfigReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class FilterReader(ConfigReader):
+	
+	def __init__(self, file, name):
+		ConfigReader.__init__(self)
+		self.file = file
+		self.name = name
+	
+	def setFile(self, file):
+		self.file = file
+	
+	def getFile(self):
+		return self.file
+	
+	def setName(self, name):
+		self.name = name
+	
+	def getName(self):
+		return self.name
+	
+	def read(self):
+		ConfigReader.read(self, "filter.d/" + self.file)
+	
+	def getOptions(self, pOpts):
+		opts = [["string", "logpath", "/var/log/sshd.log"],
+				["string", "timeregex", ""],
+				["string", "timepattern", ""],
+				["string", "failregex", ""],
+				["int", "maxtime", 600],
+				["int", "maxretry", 3]]
+		self.opts = ConfigReader.getOptions(self, "DEFAULT", opts, pOpts)
+	
+	def convert(self):
+		stream = list()
+		for opt in self.opts:
+			if opt == "logpath":
+				stream.append(["set", self.name, "logpath", self.opts[opt]])
+			elif opt == "timeregex":
+				stream.append(["set", self.name, "timeregex", self.opts[opt]])
+			elif opt == "timepattern":
+				stream.append(["set", self.name, "timepattern", self.opts[opt]])
+			elif opt == "failregex":
+				stream.append(["set", self.name, "failregex", self.opts[opt]])
+			elif opt == "maxtime":
+				stream.append(["set", self.name, "maxtime", self.opts[opt]])
+			elif opt == "maxretry":
+				stream.append(["set", self.name, "maxretry", self.opts[opt]])
+		return stream
+		
\ No newline at end of file
diff --git a/client/jailreader.py b/client/jailreader.py
new file mode 100644
index 00000000..b839172c
--- /dev/null
+++ b/client/jailreader.py
@@ -0,0 +1,84 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.6 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.6 $"
+__date__ = "$Date: 2005/11/20 17:07:47 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+from configreader import ConfigReader
+from filterreader import FilterReader
+from actionreader import ActionReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class JailReader(ConfigReader):
+	
+	def __init__(self, name):
+		ConfigReader.__init__(self)
+		self.name = name
+		self.filter = None
+		self.action = None
+	
+	def setName(self, value):
+		self.name = value
+	
+	def getName(self):
+		return self.name
+	
+	def read(self):
+		ConfigReader.read(self, "jail")
+	
+	def isEnabled(self):
+		return self.opts["enabled"]
+	
+	def getOptions(self):
+		opts = [["bool", "enabled", "false"],
+				["int", "maxretry", None],
+				["int", "bantime", None],
+				["string", "filter", ""],
+				["string", "action", ""]]
+		self.opts = ConfigReader.getOptions(self, self.name, opts)
+		
+		if self.isEnabled():
+			# Read filter
+			self.filter = FilterReader(self.opts["filter"], self.name)
+			self.filter.read()
+			self.filter.getOptions(self.opts)
+			
+			# Read action
+			self.action = ActionReader(self.opts["action"], self.name)
+			self.action.read()
+			self.action.getOptions(self.opts)
+	
+	def convert(self):
+		stream = [["add", self.name]]
+		for opt in self.opts:
+			if opt == "maxretry":
+				stream.append(["set", self.name, "maxretry", self.opts[opt]])
+			elif opt == "bantime":
+				stream.append(["set", self.name, "bantime", self.opts[opt]])
+		stream.extend(self.filter.convert())
+		stream.extend(self.action.convert())
+		return stream
+	
\ No newline at end of file
diff --git a/client/jailsreader.py b/client/jailsreader.py
new file mode 100644
index 00000000..b092cf21
--- /dev/null
+++ b/client/jailsreader.py
@@ -0,0 +1,73 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.6 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.6 $"
+__date__ = "$Date: 2005/11/20 17:07:47 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+from configreader import ConfigReader
+from jailreader import JailReader
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+class JailsReader(ConfigReader):
+	
+	def __init__(self):
+		ConfigReader.__init__(self)
+		self.jails = list()
+	
+	def read(self):
+		ConfigReader.read(self, "jail")
+	
+	def getOptions(self):
+		opts = []
+		self.opts = ConfigReader.getOptions(self, "DEFAULT", opts)
+
+		for sec in self.sections():
+			jail = JailReader(sec)
+			jail.read()
+			jail.getOptions()
+			if jail.isEnabled():
+				# We only add enabled jails
+				self.jails.append(jail)
+	
+	def getFilterOptions(self, file):
+		filter = FilterReader(file)
+		filter.read()
+		return filter.getOptions()
+	
+	def convert(self):
+		stream = list()
+		for opt in self.opts:
+			if opt == "":
+				stream.append([])
+		# Convert jails
+		for jail in self.jails:
+			stream.extend(jail.convert())
+		# Start jails
+		for jail in self.jails:
+			stream.append(["start", jail.getName()])
+		
+		return stream
+		
\ No newline at end of file
diff --git a/config/action.d/dummy.conf b/config/action.d/dummy.conf
new file mode 100644
index 00000000..1be6253b
--- /dev/null
+++ b/config/action.d/dummy.conf
@@ -0,0 +1,52 @@
+[DEFAULT]
+
+bantime = 1234
+
+name = temporary
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD  Default:
+#
+actionstart = touch /tmp/fail2ban.dummy
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD  Default:
+#
+actionstop = rm /tmp/fail2ban.dummy
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD  Default:
+#
+actioncheck = 
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+actionban = echo "+<ip>" >> /tmp/fail2ban.dummy
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+actionunban = echo "-<ip>" >> /tmp/fail2ban.dummy
diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf
new file mode 100644
index 00000000..2da845f4
--- /dev/null
+++ b/config/action.d/iptables.conf
@@ -0,0 +1,55 @@
+[DEFAULT]
+
+name = temporary
+port = 22
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD  Default:
+#
+actionstart = iptables -N fail2ban-%(name)s
+              iptables -A fail2ban-%(name)s -j RETURN
+              iptables -I INPUT -p %(protocol)s --dport %(port)s -j fail2ban-%(name)s
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD  Default:
+#
+actionstop = iptables -D INPUT -p %(protocol)s --dport %(port)s -j fail2ban-%(name)s
+             iptables -F fail2ban-%(name)s
+             iptables -X fail2ban-%(name)s
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD  Default:
+#
+actioncheck = iptables -L INPUT | grep -q fail2ban-%(name)s
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+actionban = iptables -I fail2ban-%(name)s 1 -s <ip> -j DROP
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+actionunban = iptables -D fail2ban-%(name)s -s <ip> -j DROP
diff --git a/config/debian-initd b/config/debian-initd
deleted file mode 100644
index 2c5c48d1..00000000
--- a/config/debian-initd
+++ /dev/null
@@ -1,73 +0,0 @@
-#! /bin/sh
-#
-# Fail2Ban init.d file - to be launched on boot
-#
-#		Written by Miquel van Smoorenburg <miquels@cistron.nl>.
-#		Modified for Debian
-#		 by Ian Murdock <imurdock@gnu.ai.mit.edu>.
-#               Adjusted for Fail2Ban
-#                by Yaroslav Halchenko <debian@onerussian.com>.
-#
-# Version:	$Id$
-#
-
-PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
-DAEMON=/usr/bin/fail2ban
-NAME=fail2ban
-DESC=fail2ban
-PIDFILE=/var/run/$NAME.pid
-
-test -x $DAEMON || exit 0
-
-# Include fail2ban defaults if available
-if [ -f /etc/default/fail2ban ] ; then
-	. /etc/default/fail2ban
-fi
-DAEMON_OPTS=$FAIL2BAN_OPTS
-set -e
-
-case "$1" in
-	start)
-		echo -n "Starting $DESC: "
-		[ -f $PIDFILE ] && [ ! -d /proc/`cat $PIDFILE` ] && rm -f $PIDFILE
-		start-stop-daemon --start --quiet --pidfile $PIDFILE \
-			-b --exec $DAEMON -- $DAEMON_OPTS
-		echo "$NAME."
-		;;
-	stop)
-		echo -n "Stopping $DESC: "
-		start-stop-daemon --stop --quiet --pidfile $PIDFILE
-		echo "$NAME."
-		;;
-	restart|force-reload)
-		echo -n "Restarting $DESC: "
-		( $0 stop )
-		sleep 1
-		$0 start
-		;;
-    status)
-		echo -n "Status of $DESC: "
-		if [ ! -e "$PIDFILE" ]; then
-			echo "$NAME is not running."
-			exit 3
-		fi
-		if [ ! -r "$PIDFILE" ]; then
-			echo "$PIDFILE not readable, status of $NAME unknown."
-			exit 4
-		fi
-		if [ -d /proc/`cat "$PIDFILE"` ]; then
-			echo "$NAME is running."
-			exit 0
-		else
-			echo "$NAME is not running but $PIDFILE exists."
-			exit 1
-		fi
-	;;
-	*)
-		N=/etc/init.d/$NAME
-		echo "Usage: $N {start|stop|restart|force-reload|status}" >&2
-		exit 1
-		;;
-esac
-
-exit 0
diff --git a/config/fail2ban.conf b/config/fail2ban.conf
new file mode 100644
index 00000000..32a33411
--- /dev/null
+++ b/config/fail2ban.conf
@@ -0,0 +1,4 @@
+[DEFAULT]
+
+loglevel = 4
+
diff --git a/config/fail2ban.conf.hostsdeny b/config/fail2ban.conf.hostsdeny
deleted file mode 100644
index 05c9d582..00000000
--- a/config/fail2ban.conf.hostsdeny
+++ /dev/null
@@ -1,327 +0,0 @@
-# Fail2Ban configuration file
-#
-# $Revision$
-#
-# 2005.06.21  modified for readability  Iain Lea  iain@bricbrac.de
-
-[DEFAULT]
-# Option:  background
-# Notes.:  start fail2ban as a daemon. Output is redirect to logfile.
-# Values:  [true | false]  Default:  false
-#
-background = false
-
-# Option:  logtargets
-# Notes.:  log targets. Space separated list of logging targets.
-# Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
-#
-logtargets = /var/log/fail2ban.log
-
-# Option:  syslog-target
-# Notes.:  where to find syslog facility if logtarget SYSLOG.
-# Values:  SOCKET HOST HOST:PORT  Default: /dev/log
-#
-syslog-target = /dev/log
-
-# Option:  syslog-facility
-# Notes.:  which syslog facility to use if logtarget SYSLOG.
-# Values:  NUM  Default: 1
-#
-syslog-facility = 1
-
-# Option:  pidlock
-# Notes.:  path of the PID lock file (must be able to write to file).
-# Values:  FILE  Default:  /var/run/fail2ban.pid
-#
-pidlock = /var/run/fail2ban.pid
-
-# Option:  maxfailures
-# Notes.:  number of failures before IP gets banned.
-# Values:  NUM  Default:  5
-#
-maxfailures = 5
-
-# Option:  bantime
-# Notes.:  number of seconds an IP will be banned. If set to a negative
-#          value, IP will never be unbanned (permanent banning).
-# Values:  NUM  Default:  600
-#
-bantime = 600
-
-# Option:  findtime
-# Notes.:  lifetime in seconds of a "failed" log entry.
-# Values:  NUM  Default:  600
-#
-findtime = 600
-
-# Option:  ignoreip
-# Notes.:  space separated list of IP's to be ignored by fail2ban.
-#          You can use CIDR mask in order to specify a range.
-#          Example:  ignoreip = 192.168.0.1/24 123.45.235.65
-# Values:  IP  Default:  
-#
-ignoreip = 
-
-# Option:  cmdstart
-# Notes.:  command executed once at the start of Fail2Ban
-# Values:  CMD  Default:
-#
-cmdstart = 
-
-# Option:  cmdend
-# Notes.:  command executed once at the end of Fail2Ban.
-# Values:  CMD  Default:
-#
-cmdend = 
-
-# Option:  polltime
-# Notes.:  number of seconds fail2ban sleeps between iterations.
-# Values:  NUM  Default:  1
-#
-polltime = 1
-
-# Option:  reinittime
-# Notes.:  minimal number of seconds between the re-initialization of
-#          firewalls due to external changes in their rules (see fwcheck)
-# Values:  NUM  Default:  100
-#
-reinittime = 10
-
-# Option:  maxreinits
-# Notes.:  maximal number of re-initialization of firewalls due to external
-#          changes. -1 stays for infinite, so only reinittime is of importance
-# Values:  NUM  Default:  -1
-#
-maxreinits = -1
-
-# NOTE: Interpolations
-#
-# fwstart, as well as fwend, fwcheck, fwban, fwunban, use interpolations
-# so %(__name__)s  will be substituted by a name of each section
-# (unless the option is overriden in a section).
-# If you are going to use interpolations in your setup, please make
-# sure that you specified options port and protocol (which also has
-# an option in DEFAULT).
-#
-
-# Option:  hostsdeny
-# Notes.:  hosts.deny file path.
-# Values:  STR  Default:  /etc/hosts.deny
-#
-hostsdeny = /etc/hosts.deny
-
-# Option:  fwban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
-# Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
-#
-fwban = IP=<ip> && echo "ALL: $IP" >> %(hostsdeny)s
-
-# Option:  fwunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
-# Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
-#
-fwunban = IP=<ip> && sed -i.old s/ALL:\ $IP// %(hostsdeny)s
-
-[MAIL]
-# Option:  enabled
-# Notes.:  enable mail notification when banning an IP address.
-# Values:  [true | false]  Default:  false
-#
-enabled = false
-
-# Option:  host
-# Notes.:  host running the mail server.
-# Values:  STR  Default:  localhost
-#
-host = localhost
-
-# Option:  port
-# Notes.:  port of the mail server.
-# Values:  INT  Default:  25
-#
-port = 25
-
-# Option:  user
-# Notes.:  the username for smtp-server if authentification is required.
-#          if user is empty, no authentification is done.
-# Values:  STR  Default:  
-#
-user = 
-
-# Option:  password
-# Notes.:  the smtp-user's password if authentification is required.
-# Values:  STR  Default:  
-#
-password = 
-
-# Option:  from
-# Notes.:  e-mail address of the sender.
-# Values:  MAIL  Default:  fail2ban
-#
-from = fail2ban
-
-# Option:  to
-# Notes.:  e-mail addresses of the receiver. Addresses are space
-#          separated.
-# Values:  MAIL  Default:  root
-#
-to = root
-
-# Option:  localtime
-# Notes.:  report local time (including timezone) or GMT
-# Values:  [true | false]  Default:  false
-#
-localtime = true
-
-# Option:  subject
-# Notes.:  subject of the e-mail.
-# Tags:    <section> active section (eg ssh, apache, etc)
-#          <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-# Values:  TEXT  Default:  [Fail2Ban] <section>: Banned <ip>
-#
-subject = [Fail2Ban] <section>: Banned <ip>
-
-# Option:  message
-# Notes.:  message of the e-mail.
-# Tags:    <section> active section (eg ssh, apache, etc)
-#          <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <br>  new line
-# Values:  TEXT  Default:
-#
-message = Hi,<br>
-          The IP <ip> has just been banned by Fail2Ban after
-          <failures> attempts against <section>.<br>
-          Regards,<br>
-          Fail2Ban
-
-# You can define a new section for each log file to check for
-# password failure. Each section has to define the following
-# options: logfile, fwban, fwunban, timeregex, timepattern,
-# failregex.
-
-
-[Apache]
-# Option:  enabled
-# Notes.:  enable monitoring for this section.
-# Values:  [true | false]  Default:  false
-#
-enabled = false
-
-# Option:  logfile
-# Notes.:  logfile to monitor.
-# Values:  FILE  Default:  /var/log/httpd/access_log
-#
-logfile = /var/log/httpd/access_log
-
-# Option:  timeregex
-# Notes.:  regex to match timestamp in Apache logfile. For TAI64N format,
-#          use timeregex = @[0-9a-f]{24}
-# Values:  [Wed Jan 05 15:08:01 2005]
-# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
-#
-timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
-
-# Option:  timepattern
-# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
-#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
-#          For TAI64N format, use timepattern = tai64n
-# Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
-#
-timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
-
-# Option:  failregex
-# Notes.:  regex to match the password failure messages in the logfile.
-# Values:  TEXT  Default:  authentication failure|user .* not found
-#
-failregex = authentication failure|user .* not found
-
-
-[VSFTPD]
-# Option: enabled
-# Notes.: enable monitoring for this section.
-# Values: [true | false] Default: false
-#
-enabled = false
-
-# Option: logfile
-# Notes.: logfile to monitor.
-# Values: FILE Default: /var/log/secure
-#
-logfile = /var/log/vsftpd.log
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ftp
-
-# Option: timeregex
-# Notes.: regex to match timestamp in VSFTPD logfile.
-# Values: [Mar 7 17:53:28]
-# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-#
-timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-
-# Option: timepattern
-# Notes.: format used in "timeregex" fields definition. Note that '%' must be
-# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
-# Values: TEXT Default: %%b %%d %%H:%%M:%%S
-#
-timepattern = %%b %%d %%H:%%M:%%S
-
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile.
-# Values: TEXT Default: Authentication failure|Failed password|Invalid user
-#
-failregex = FAIL LOGIN
-
-
-[SSH]
-# Option:  enabled
-# Notes.:  enable monitoring for this section.
-# Values:  [true | false]  Default:  true
-#
-enabled = true
-
-# Option:  logfile
-# Notes.:  logfile to monitor.
-# Values:  FILE  Default:  /var/log/secure
-#
-logfile = /var/log/secure
-
-# Option:  timeregex
-# Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
-#          use timeregex = @[0-9a-f]{24}
-# Values:  [Mar  7 17:53:28]
-# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-#
-timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-
-# Option:  timepattern
-# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
-#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
-#          For TAI64N format, use timepattern = tai64n
-# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
-#
-timepattern = %%b %%d %%H:%%M:%%S
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile.
-# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
-#
-failregex = Authentication failure|Failed password|Invalid user
diff --git a/config/fail2ban.conf.iptables b/config/fail2ban.conf.iptables
deleted file mode 100644
index 46da5466..00000000
--- a/config/fail2ban.conf.iptables
+++ /dev/null
@@ -1,362 +0,0 @@
-# Fail2Ban configuration file
-#
-# $Revision$
-#
-# 2005.06.21  modified for readability  Iain Lea  iain@bricbrac.de
-
-[DEFAULT]
-# Option:  background
-# Notes.:  start fail2ban as a daemon. Output is redirect to logfile.
-# Values:  [true | false]  Default:  false
-#
-background = false
-
-# Option:  logtargets
-# Notes.:  log targets. Space separated list of logging targets.
-# Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
-#
-logtargets = /var/log/fail2ban.log
-
-# Option:  syslog-target
-# Notes.:  where to find syslog facility if logtarget SYSLOG.
-# Values:  SOCKET HOST HOST:PORT  Default: /dev/log
-#
-syslog-target = /dev/log
-
-# Option:  syslog-facility
-# Notes.:  which syslog facility to use if logtarget SYSLOG.
-# Values:  NUM  Default: 1
-#
-syslog-facility = 1
-
-# Option:  pidlock
-# Notes.:  path of the PID lock file (must be able to write to file).
-# Values:  FILE  Default:  /var/run/fail2ban.pid
-#
-pidlock = /var/run/fail2ban.pid
-
-# Option:  maxfailures
-# Notes.:  number of failures before IP gets banned.
-# Values:  NUM  Default:  5
-#
-maxfailures = 5
-
-# Option:  bantime
-# Notes.:  number of seconds an IP will be banned. If set to a negative
-#          value, IP will never be unbanned (permanent banning).
-# Values:  NUM  Default:  600
-#
-bantime = 600
-
-# Option:  findtime
-# Notes.:  lifetime in seconds of a "failed" log entry.
-# Values:  NUM  Default:  600
-#
-findtime = 600
-
-# Option:  ignoreip
-# Notes.:  space separated list of IP's to be ignored by fail2ban.
-#          You can use CIDR mask in order to specify a range.
-#          Example:  ignoreip = 192.168.0.1/24 123.45.235.65
-# Values:  IP  Default:  
-#
-ignoreip = 
-
-# Option:  cmdstart
-# Notes.:  command executed once at the start of Fail2Ban
-# Values:  CMD  Default:
-#
-cmdstart = 
-
-# Option:  cmdend
-# Notes.:  command executed once at the end of Fail2Ban.
-# Values:  CMD  Default:
-#
-cmdend = 
-
-# Option:  polltime
-# Notes.:  number of seconds fail2ban sleeps between iterations.
-# Values:  NUM  Default:  1
-#
-polltime = 1
-
-# Option:  reinittime
-# Notes.:  minimal number of seconds between the re-initialization of
-#          firewalls due to external changes in their rules (see fwcheck)
-# Values:  NUM  Default:  100
-#
-reinittime = 10
-
-# Option:  maxreinits
-# Notes.:  maximal number of re-initialization of firewalls due to external
-#          changes. -1 stays for infinite, so only reinittime is of importance
-# Values:  NUM  Default:  -1
-#
-maxreinits = -1
-
-# NOTE: Interpolations
-#
-# fwstart, as well as fwend, fwcheck, fwban, fwunban, use interpolations
-# so %(__name__)s  will be substituted by a name of each section
-# (unless the option is overriden in a section).
-# If you are going to use interpolations in your setup, please make
-# sure that you specified options port and protocol (which also has
-# an option in DEFAULT).
-#
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  fwstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD  Default:
-#
-fwstart = iptables -N fail2ban-%(__name__)s
-          iptables -A fail2ban-%(__name__)s -j RETURN
-          iptables -I INPUT -p %(protocol)s --dport %(port)s -j fail2ban-%(__name__)s
-
-# Option:  fwend
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
-#
-fwend = iptables -D INPUT -p %(protocol)s --dport %(port)s -j fail2ban-%(__name__)s
-        iptables -F fail2ban-%(__name__)s
-        iptables -X fail2ban-%(__name__)s
-
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
-#
-fwcheck = iptables -L INPUT | grep -q fail2ban-%(__name__)s
-
-# Option:  fwban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
-# Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
-#
-fwban = iptables -I fail2ban-%(__name__)s 1 -s <ip> -j DROP
-
-# Option:  fwunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
-# Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
-#
-fwunban = iptables -D fail2ban-%(__name__)s -s <ip> -j DROP
-
-[MAIL]
-# Option:  enabled
-# Notes.:  enable mail notification when banning an IP address.
-# Values:  [true | false]  Default:  false
-#
-enabled = false
-
-# Option:  host
-# Notes.:  host running the mail server.
-# Values:  STR  Default:  localhost
-#
-host = localhost
-
-# Option:  port
-# Notes.:  port of the mail server.
-# Values:  INT  Default:  25
-#
-port = 25
-
-# Option:  user
-# Notes.:  the username for smtp-server if authentification is required.
-#          if user is empty, no authentification is done.
-# Values:  STR  Default:  
-#
-user = 
-
-# Option:  password
-# Notes.:  the smtp-user's password if authentification is required.
-# Values:  STR  Default:  
-#
-password = 
-
-# Option:  from
-# Notes.:  e-mail address of the sender.
-# Values:  MAIL  Default:  fail2ban
-#
-from = fail2ban
-
-# Option:  to
-# Notes.:  e-mail addresses of the receiver. Addresses are space
-#          separated.
-# Values:  MAIL  Default:  root
-#
-to = root
-
-# Option:  localtime
-# Notes.:  report local time (including timezone) or GMT
-# Values:  [true | false]  Default:  false
-#
-localtime = true
-
-# Option:  subject
-# Notes.:  subject of the e-mail.
-# Tags:    <section> active section (eg ssh, apache, etc)
-#          <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-# Values:  TEXT  Default:  [Fail2Ban] <section>: Banned <ip>
-#
-subject = [Fail2Ban] <section>: Banned <ip>
-
-# Option:  message
-# Notes.:  message of the e-mail.
-# Tags:    <section> active section (eg ssh, apache, etc)
-#          <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <br>  new line
-# Values:  TEXT  Default:
-#
-message = Hi,<br>
-          The IP <ip> has just been banned by Fail2Ban after
-          <failures> attempts against <section>.<br>
-          Regards,<br>
-          Fail2Ban
-
-# You can define a new section for each log file to check for
-# password failure. Each section has to define the following
-# options: logfile, fwban, fwunban, timeregex, timepattern,
-# failregex.
-
-
-[Apache]
-# Option:  enabled
-# Notes.:  enable monitoring for this section.
-# Values:  [true | false]  Default:  false
-#
-enabled = false
-
-# Option:  logfile
-# Notes.:  logfile to monitor.
-# Values:  FILE  Default:  /var/log/httpd/access_log
-#
-logfile = /var/log/httpd/access_log
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = http
-
-# Option:  timeregex
-# Notes.:  regex to match timestamp in Apache logfile. For TAI64N format,
-#          use timeregex = @[0-9a-f]{24}
-# Values:  [Wed Jan 05 15:08:01 2005]
-# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
-#
-timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
-
-# Option:  timepattern
-# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
-#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
-#          For TAI64N format, use timepattern = tai64n
-# Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
-#
-timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
-
-# Option:  failregex
-# Notes.:  regex to match the password failure messages in the logfile.
-# Values:  TEXT  Default:  authentication failure|user .* not found
-#
-failregex = authentication failure|user .* not found
-
-
-[VSFTPD]
-# Option: enabled
-# Notes.: enable monitoring for this section.
-# Values: [true | false] Default: false
-#
-enabled = false
-
-# Option: logfile
-# Notes.: logfile to monitor.
-# Values: FILE Default: /var/log/secure
-#
-logfile = /var/log/vsftpd.log
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ftp
-
-# Option: timeregex
-# Notes.: regex to match timestamp in VSFTPD logfile.
-# Values: [Mar 7 17:53:28]
-# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-#
-timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-
-# Option: timepattern
-# Notes.: format used in "timeregex" fields definition. Note that '%' must be
-# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
-# Values: TEXT Default: %%b %%d %%H:%%M:%%S
-#
-timepattern = %%b %%d %%H:%%M:%%S
-
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile.
-# Values: TEXT Default: Authentication failure|Failed password|Invalid user
-#
-failregex = FAIL LOGIN
-
-
-[SSH]
-# Option:  enabled
-# Notes.:  enable monitoring for this section.
-# Values:  [true | false]  Default:  true
-#
-enabled = true
-
-# Option:  logfile
-# Notes.:  logfile to monitor.
-# Values:  FILE  Default:  /var/log/secure
-#
-#logfile = /var/log/secure
-logfile = /home/cyril/workspace/fail2ban-stable/log-test/test
-
-# Option:  port
-# Notes.:  specifies port to monitor
-# Values:  [ NUM | STRING ]  Default:
-#
-port = ssh
-
-# Option:  timeregex
-# Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
-#          use timeregex = @[0-9a-f]{24}
-# Values:  [Mar  7 17:53:28]
-# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-#
-timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-
-# Option:  timepattern
-# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
-#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
-#          For TAI64N format, use timepattern = tai64n
-# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
-#
-timepattern = %%b %%d %%H:%%M:%%S
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile.
-# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
-#
-failregex = Authentication failure|Failed password|Invalid user
diff --git a/config/fail2ban.conf.shorewall b/config/fail2ban.conf.shorewall
deleted file mode 100644
index 2cb0fc46..00000000
--- a/config/fail2ban.conf.shorewall
+++ /dev/null
@@ -1,314 +0,0 @@
-# Fail2Ban configuration file
-#
-# $Revision$
-#
-# 2005.06.21  modified for readability  Iain Lea  iain@bricbrac.de
-
-[DEFAULT]
-# Option:  background
-# Notes.:  start fail2ban as a daemon. Output is redirect to logfile.
-# Values:  [true | false]  Default:  false
-#
-background = false
-
-# Option:  logtargets
-# Notes.:  log targets. Space separated list of logging targets.
-# Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
-#
-logtargets = /var/log/fail2ban.log
-
-# Option:  syslog-target
-# Notes.:  where to find syslog facility if logtarget SYSLOG.
-# Values:  SOCKET HOST HOST:PORT  Default: /dev/log
-#
-syslog-target = /dev/log
-
-# Option:  syslog-facility
-# Notes.:  which syslog facility to use if logtarget SYSLOG.
-# Values:  NUM  Default: 1
-#
-syslog-facility = 1
-
-# Option:  pidlock
-# Notes.:  path of the PID lock file (must be able to write to file).
-# Values:  FILE  Default:  /var/run/fail2ban.pid
-#
-pidlock = /var/run/fail2ban.pid
-
-# Option:  maxfailures
-# Notes.:  number of failures before IP gets banned.
-# Values:  NUM  Default:  5
-#
-maxfailures = 5
-
-# Option:  bantime
-# Notes.:  number of seconds an IP will be banned. If set to a negative
-#          value, IP will never be unbanned (permanent banning).
-# Values:  NUM  Default:  600
-#
-bantime = 600
-
-# Option:  findtime
-# Notes.:  lifetime in seconds of a "failed" log entry.
-# Values:  NUM  Default:  600
-#
-findtime = 600
-
-# Option:  ignoreip
-# Notes.:  space separated list of IP's to be ignored by fail2ban.
-#          You can use CIDR mask in order to specify a range.
-#          Example:  ignoreip = 192.168.0.1/24 123.45.235.65
-# Values:  IP  Default:  
-#
-ignoreip = 
-
-# Option:  cmdstart
-# Notes.:  command executed once at the start of Fail2Ban
-# Values:  CMD  Default:
-#
-cmdstart = 
-
-# Option:  cmdend
-# Notes.:  command executed once at the end of Fail2Ban.
-# Values:  CMD  Default:
-#
-cmdend = 
-
-# Option:  polltime
-# Notes.:  number of seconds fail2ban sleeps between iterations.
-# Values:  NUM  Default:  1
-#
-polltime = 1
-
-# Option:  reinittime
-# Notes.:  minimal number of seconds between the re-initialization of
-#          firewalls due to external changes in their rules (see fwcheck)
-# Values:  NUM  Default:  100
-#
-reinittime = 10
-
-# Option:  maxreinits
-# Notes.:  maximal number of re-initialization of firewalls due to external
-#          changes. -1 stays for infinite, so only reinittime is of importance
-# Values:  NUM  Default:  -1
-#
-maxreinits = -1
-
-# NOTE: Interpolations
-#
-# fwstart, as well as fwend, fwcheck, fwban, fwunban, use interpolations
-# so %(__name__)s  will be substituted by a name of each section
-# (unless the option is overriden in a section).
-# If you are going to use interpolations in your setup, please make
-# sure that you specified options port and protocol (which also has
-# an option in DEFAULT).
-#
-
-# Option:  fwban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
-# Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
-#
-fwban = shorewall drop <ip>
-
-# Option:  fwunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
-# Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
-#
-fwunban = shorewall allow <ip>
-
-[MAIL]
-# Option:  enabled
-# Notes.:  enable mail notification when banning an IP address.
-# Values:  [true | false]  Default:  false
-#
-enabled = false
-
-# Option:  host
-# Notes.:  host running the mail server.
-# Values:  STR  Default:  localhost
-#
-host = localhost
-
-# Option:  port
-# Notes.:  port of the mail server.
-# Values:  INT  Default:  25
-#
-port = 25
-
-# Option:  user
-# Notes.:  the username for smtp-server if authentification is required.
-#          if user is empty, no authentification is done.
-# Values:  STR  Default:  
-#
-user = 
-
-# Option:  password
-# Notes.:  the smtp-user's password if authentification is required.
-# Values:  STR  Default:  
-#
-password = 
-
-# Option:  from
-# Notes.:  e-mail address of the sender.
-# Values:  MAIL  Default:  fail2ban
-#
-from = fail2ban
-
-# Option:  to
-# Notes.:  e-mail addresses of the receiver. Addresses are space
-#          separated.
-# Values:  MAIL  Default:  root
-#
-to = root
-
-# Option:  localtime
-# Notes.:  report local time (including timezone) or GMT
-# Values:  [true | false]  Default:  false
-#
-localtime = true
-
-# Option:  subject
-# Notes.:  subject of the e-mail.
-# Tags:    <section> active section (eg ssh, apache, etc)
-#          <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-# Values:  TEXT  Default:  [Fail2Ban] <section>: Banned <ip>
-#
-subject = [Fail2Ban] <section>: Banned <ip>
-
-# Option:  message
-# Notes.:  message of the e-mail.
-# Tags:    <section> active section (eg ssh, apache, etc)
-#          <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <br>  new line
-# Values:  TEXT  Default:
-#
-message = Hi,<br>
-          The IP <ip> has just been banned by Fail2Ban after
-          <failures> attempts against <section>.<br>
-          Regards,<br>
-          Fail2Ban
-
-# You can define a new section for each log file to check for
-# password failure. Each section has to define the following
-# options: logfile, fwban, fwunban, timeregex, timepattern,
-# failregex.
-
-
-[Apache]
-# Option:  enabled
-# Notes.:  enable monitoring for this section.
-# Values:  [true | false]  Default:  false
-#
-enabled = false
-
-# Option:  logfile
-# Notes.:  logfile to monitor.
-# Values:  FILE  Default:  /var/log/httpd/access_log
-#
-logfile = /var/log/httpd/access_log
-
-# Option:  timeregex
-# Notes.:  regex to match timestamp in Apache logfile. For TAI64N format,
-#          use timeregex = @[0-9a-f]{24}
-# Values:  [Wed Jan 05 15:08:01 2005]
-# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
-#
-timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
-
-# Option:  timepattern
-# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
-#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
-#          For TAI64N format, use timepattern = tai64n
-# Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
-#
-timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
-
-# Option:  failregex
-# Notes.:  regex to match the password failure messages in the logfile.
-# Values:  TEXT  Default:  authentication failure|user .* not found
-#
-failregex = authentication failure|user .* not found
-
-[VSFTPD]
-# Option: enabled
-# Notes.: enable monitoring for this section.
-# Values: [true | false] Default: false
-#
-enabled = false
-
-# Option: logfile
-# Notes.: logfile to monitor.
-# Values: FILE Default: /var/log/secure
-#
-logfile = /var/log/vsftpd.log
-
-# Option: timeregex
-# Notes.: regex to match timestamp in VSFTPD logfile.
-# Values: [Mar 7 17:53:28]
-# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-#
-timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-
-# Option: timepattern
-# Notes.: format used in "timeregex" fields definition. Note that '%' must be
-# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
-# Values: TEXT Default: %%b %%d %%H:%%M:%%S
-#
-timepattern = %%b %%d %%H:%%M:%%S
-
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile.
-# Values: TEXT Default: Authentication failure|Failed password|Invalid user
-#
-failregex = FAIL LOGIN
-
-
-[SSH]
-# Option:  enabled
-# Notes.:  enable monitoring for this section.
-# Values:  [true | false]  Default:  true
-#
-enabled = true
-
-# Option:  logfile
-# Notes.:  logfile to monitor.
-# Values:  FILE  Default:  /var/log/secure
-#
-logfile = /var/log/secure
-
-# Option:  timeregex
-# Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
-#          use timeregex = @[0-9a-f]{24}
-# Values:  [Mar  7 17:53:28]
-# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-#
-timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-
-# Option:  timepattern
-# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
-#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
-#          For TAI64N format, use timepattern = tai64n
-# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
-#
-timepattern = %%b %%d %%H:%%M:%%S
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile.
-# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
-#
-failregex = Authentication failure|Failed password|Invalid user
diff --git a/config/fail2ban.local b/config/fail2ban.local
new file mode 100644
index 00000000..12b8a6f5
--- /dev/null
+++ b/config/fail2ban.local
@@ -0,0 +1,4 @@
+[DEFAULT]
+
+test = 4567
+prout = fuck you
diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
new file mode 100644
index 00000000..e69de29b
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
new file mode 100644
index 00000000..7d2a007a
--- /dev/null
+++ b/config/filter.d/sshd.conf
@@ -0,0 +1,32 @@
+[DEFAULT]
+
+maxretry = 22
+
+# Option:  logpath
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/secure
+#
+logpath = testcases/files/testcase01.log
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
+# Values:  [Mar  7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
+# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile.
+# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
+#
+failregex = Authentication failure|Failed password|Invalid user
+
diff --git a/config/gentoo-confd b/config/gentoo-confd
deleted file mode 100644
index bea9017e..00000000
--- a/config/gentoo-confd
+++ /dev/null
@@ -1,23 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-#
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-# Command line options for Fail2Ban. Refer to "fail2ban -h" for
-# valid options.
-FAIL2BAN_OPTS="-v"
diff --git a/config/gentoo-initd b/config/gentoo-initd
deleted file mode 100755
index 8cab7535..00000000
--- a/config/gentoo-initd
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/sbin/runscript
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-#
-# Author: Sireyessire, Cyril Jaquier
-# 
-# $Revision$
-
-opts="start stop restart showlog"
-
-FAIL2BAN="/usr/bin/fail2ban"
-
-depend() {
-	need net
-	need logger
-	after iptables
-}
-
-start() {
-	ebegin "Starting fail2ban"
-	${FAIL2BAN} -b ${FAIL2BAN_OPTS} > /dev/null
-	eend $? "Failed to start fail2ban"
-}
-
-stop() {
-	ebegin "Stopping fail2ban"
-	${FAIL2BAN} -k > /dev/null
-	eend $? "Failed to stop fail2ban"
-}
-
-zap() {
-	rm /var/run/fail2ban.pid
-}
-
-showlog(){
-	less /var/log/fail2ban.log
-}
diff --git a/config/jail.conf b/config/jail.conf
new file mode 100644
index 00000000..66853517
--- /dev/null
+++ b/config/jail.conf
@@ -0,0 +1,21 @@
+[dummy]
+
+enabled = true
+filter = sshd
+action = dummy
+maxretry = 2
+#bantime = 10
+
+[SSH]
+
+enabled = false
+filter = sshd
+action = iptables
+bantime = 10
+
+[Apache-error]
+
+enabled = false
+filter = apache-error
+action = hostdeny
+
diff --git a/config/redhat-initd b/config/redhat-initd
deleted file mode 100644
index 6e885ab5..00000000
--- a/config/redhat-initd
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/bin/bash
-#
-# fail2ban
-#
-# chkconfig: 345 91 9
-# description: if many unsuccessfull login attempts from some ip address \
-#              during a short period happen, this address is banned \
-#              by the firewall
-#
-# Author: Andrey G. Grozin
-# 
-# $Revision$
-
-# Source function library.
-. /etc/init.d/functions
-
-# Get config.
-. /etc/sysconfig/network
-
-# Check that networking is up.
-[ "${NETWORKING}" = "no" ] && exit 0
-[ -f /etc/fail2ban.conf ] || exit 0
-
-FAIL2BAN="/usr/bin/fail2ban"
-PIDFILE="/var/run/fail2ban.pid"
-
-RETVAL=0
-
-start() {
-    echo -n $"Starting fail2ban: "
-    "${FAIL2BAN}" -b > /dev/null
-    RETVAL=$?
-    echo
-}
-
-stop() {
-    if [ -f "${PIDFILE}" ]; then
-	echo -n $"Stopping fail2ban: "
-	"${FAIL2BAN}" -k > /dev/null
-	echo
-    fi
-}
-
-restart() {
-    stop
-    start
-}
-
-# See how we were called.
-case "$1" in
-  start)
-        start
-        ;;
-  stop)
-        stop
-        ;;
-  status)
-        status fail2ban
-        RETVAL=$?
-        ;;
-  reload)
-        restart
-        ;;
-  restart)
-        restart
-        ;;
-  condrestart)
-        if [ -f "${PIDFILE}" ]; then
-            restart
-        fi
-        ;;
-  *)
-        echo $"Usage: $0 {start|stop|status|restart|condrestart}"
-        exit 1
-        ;;
-esac
-
-exit $RETVAL
diff --git a/doc/Doxyfile b/doc/Doxyfile
new file mode 100644
index 00000000..39a9beae
--- /dev/null
+++ b/doc/Doxyfile
@@ -0,0 +1,1237 @@
+# Doxyfile 1.4.6
+
+# This file describes the settings to be used by the documentation system
+# doxygen (www.doxygen.org) for a project
+#
+# All text after a hash (#) is considered a comment and will be ignored
+# The format is:
+#       TAG = value [value, ...]
+# For lists items can also be appended using:
+#       TAG += value [value, ...]
+# Values that contain spaces should be placed between quotes (" ")
+
+#---------------------------------------------------------------------------
+# Project related configuration options
+#---------------------------------------------------------------------------
+
+# The PROJECT_NAME tag is a single word (or a sequence of words surrounded 
+# by quotes) that should identify the project.
+
+PROJECT_NAME           = Fail2Ban
+
+# The PROJECT_NUMBER tag can be used to enter a project or revision number. 
+# This could be handy for archiving the generated documentation or 
+# if some version control system is used.
+
+PROJECT_NUMBER         = 0.7
+
+# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) 
+# base path where the generated documentation will be put. 
+# If a relative path is entered, it will be relative to the location 
+# where doxygen was started. If left blank the current directory will be used.
+
+OUTPUT_DIRECTORY       = 
+
+# If the CREATE_SUBDIRS tag is set to YES, then doxygen will create 
+# 4096 sub-directories (in 2 levels) under the output directory of each output 
+# format and will distribute the generated files over these directories. 
+# Enabling this option can be useful when feeding doxygen a huge amount of 
+# source files, where putting all generated files in the same directory would 
+# otherwise cause performance problems for the file system.
+
+CREATE_SUBDIRS         = NO
+
+# The OUTPUT_LANGUAGE tag is used to specify the language in which all 
+# documentation generated by doxygen is written. Doxygen will use this 
+# information to generate all constant output in the proper language. 
+# The default language is English, other supported languages are: 
+# Brazilian, Catalan, Chinese, Chinese-Traditional, Croatian, Czech, Danish, 
+# Dutch, Finnish, French, German, Greek, Hungarian, Italian, Japanese, 
+# Japanese-en (Japanese with English messages), Korean, Korean-en, Norwegian, 
+# Polish, Portuguese, Romanian, Russian, Serbian, Slovak, Slovene, Spanish, 
+# Swedish, and Ukrainian.
+
+OUTPUT_LANGUAGE        = English
+
+# This tag can be used to specify the encoding used in the generated output. 
+# The encoding is not always determined by the language that is chosen, 
+# but also whether or not the output is meant for Windows or non-Windows users. 
+# In case there is a difference, setting the USE_WINDOWS_ENCODING tag to YES 
+# forces the Windows encoding (this is the default for the Windows binary), 
+# whereas setting the tag to NO uses a Unix-style encoding (the default for 
+# all platforms other than Windows).
+
+USE_WINDOWS_ENCODING   = NO
+
+# If the BRIEF_MEMBER_DESC tag is set to YES (the default) Doxygen will 
+# include brief member descriptions after the members that are listed in 
+# the file and class documentation (similar to JavaDoc). 
+# Set to NO to disable this.
+
+BRIEF_MEMBER_DESC      = YES
+
+# If the REPEAT_BRIEF tag is set to YES (the default) Doxygen will prepend 
+# the brief description of a member or function before the detailed description. 
+# Note: if both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the 
+# brief descriptions will be completely suppressed.
+
+REPEAT_BRIEF           = YES
+
+# This tag implements a quasi-intelligent brief description abbreviator 
+# that is used to form the text in various listings. Each string 
+# in this list, if found as the leading text of the brief description, will be 
+# stripped from the text and the result after processing the whole list, is 
+# used as the annotated text. Otherwise, the brief description is used as-is. 
+# If left blank, the following values are used ("$name" is automatically 
+# replaced with the name of the entity): "The $name class" "The $name widget" 
+# "The $name file" "is" "provides" "specifies" "contains" 
+# "represents" "a" "an" "the"
+
+ABBREVIATE_BRIEF       = 
+
+# If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then 
+# Doxygen will generate a detailed section even if there is only a brief 
+# description.
+
+ALWAYS_DETAILED_SEC    = NO
+
+# If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all 
+# inherited members of a class in the documentation of that class as if those 
+# members were ordinary class members. Constructors, destructors and assignment 
+# operators of the base classes will not be shown.
+
+INLINE_INHERITED_MEMB  = NO
+
+# If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full 
+# path before files name in the file list and in the header files. If set 
+# to NO the shortest path that makes the file name unique will be used.
+
+FULL_PATH_NAMES        = NO
+
+# If the FULL_PATH_NAMES tag is set to YES then the STRIP_FROM_PATH tag 
+# can be used to strip a user-defined part of the path. Stripping is 
+# only done if one of the specified strings matches the left-hand part of 
+# the path. The tag can be used to show relative paths in the file list. 
+# If left blank the directory from which doxygen is run is used as the 
+# path to strip.
+
+STRIP_FROM_PATH        = 
+
+# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of 
+# the path mentioned in the documentation of a class, which tells 
+# the reader which header file to include in order to use a class. 
+# If left blank only the name of the header file containing the class 
+# definition is used. Otherwise one should specify the include paths that 
+# are normally passed to the compiler using the -I flag.
+
+STRIP_FROM_INC_PATH    = 
+
+# If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter 
+# (but less readable) file names. This can be useful is your file systems 
+# doesn't support long names like on DOS, Mac, or CD-ROM.
+
+SHORT_NAMES            = NO
+
+# If the JAVADOC_AUTOBRIEF tag is set to YES then Doxygen 
+# will interpret the first line (until the first dot) of a JavaDoc-style 
+# comment as the brief description. If set to NO, the JavaDoc 
+# comments will behave just like the Qt-style comments (thus requiring an 
+# explicit @brief command for a brief description.
+
+JAVADOC_AUTOBRIEF      = NO
+
+# The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make Doxygen 
+# treat a multi-line C++ special comment block (i.e. a block of //! or /// 
+# comments) as a brief description. This used to be the default behaviour. 
+# The new default is to treat a multi-line C++ comment block as a detailed 
+# description. Set this tag to YES if you prefer the old behaviour instead.
+
+MULTILINE_CPP_IS_BRIEF = NO
+
+# If the DETAILS_AT_TOP tag is set to YES then Doxygen 
+# will output the detailed description near the top, like JavaDoc.
+# If set to NO, the detailed description appears after the member 
+# documentation.
+
+DETAILS_AT_TOP         = NO
+
+# If the INHERIT_DOCS tag is set to YES (the default) then an undocumented 
+# member inherits the documentation from any documented member that it 
+# re-implements.
+
+INHERIT_DOCS           = YES
+
+# If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce 
+# a new page for each member. If set to NO, the documentation of a member will 
+# be part of the file/class/namespace that contains it.
+
+SEPARATE_MEMBER_PAGES  = NO
+
+# The TAB_SIZE tag can be used to set the number of spaces in a tab. 
+# Doxygen uses this value to replace tabs by spaces in code fragments.
+
+TAB_SIZE               = 4
+
+# This tag can be used to specify a number of aliases that acts 
+# as commands in the documentation. An alias has the form "name=value". 
+# For example adding "sideeffect=\par Side Effects:\n" will allow you to 
+# put the command \sideeffect (or @sideeffect) in the documentation, which 
+# will result in a user-defined paragraph with heading "Side Effects:". 
+# You can put \n's in the value part of an alias to insert newlines.
+
+ALIASES                = 
+
+# Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C 
+# sources only. Doxygen will then generate output that is more tailored for C. 
+# For instance, some of the names that are used will be different. The list 
+# of all members will be omitted, etc.
+
+OPTIMIZE_OUTPUT_FOR_C  = NO
+
+# Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java 
+# sources only. Doxygen will then generate output that is more tailored for Java. 
+# For instance, namespaces will be presented as packages, qualified scopes 
+# will look different, etc.
+
+OPTIMIZE_OUTPUT_JAVA   = YES
+
+# If you use STL classes (i.e. std::string, std::vector, etc.) but do not want to 
+# include (a tag file for) the STL sources as input, then you should 
+# set this tag to YES in order to let doxygen match functions declarations and 
+# definitions whose arguments contain STL classes (e.g. func(std::string); v.s. 
+# func(std::string) {}). This also make the inheritance and collaboration 
+# diagrams that involve STL classes more complete and accurate.
+
+BUILTIN_STL_SUPPORT    = NO
+
+# If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC 
+# tag is set to YES, then doxygen will reuse the documentation of the first 
+# member in the group (if any) for the other members of the group. By default 
+# all members of a group must be documented explicitly.
+
+DISTRIBUTE_GROUP_DOC   = NO
+
+# Set the SUBGROUPING tag to YES (the default) to allow class member groups of 
+# the same type (for instance a group of public functions) to be put as a 
+# subgroup of that type (e.g. under the Public Functions section). Set it to 
+# NO to prevent subgrouping. Alternatively, this can be done per class using 
+# the \nosubgrouping command.
+
+SUBGROUPING            = YES
+
+#---------------------------------------------------------------------------
+# Build related configuration options
+#---------------------------------------------------------------------------
+
+# If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in 
+# documentation are documented, even if no documentation was available. 
+# Private class members and static file members will be hidden unless 
+# the EXTRACT_PRIVATE and EXTRACT_STATIC tags are set to YES
+
+EXTRACT_ALL            = YES
+
+# If the EXTRACT_PRIVATE tag is set to YES all private members of a class 
+# will be included in the documentation.
+
+EXTRACT_PRIVATE        = YES
+
+# If the EXTRACT_STATIC tag is set to YES all static members of a file 
+# will be included in the documentation.
+
+EXTRACT_STATIC         = YES
+
+# If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs) 
+# defined locally in source files will be included in the documentation. 
+# If set to NO only classes defined in header files are included.
+
+EXTRACT_LOCAL_CLASSES  = YES
+
+# This flag is only useful for Objective-C code. When set to YES local 
+# methods, which are defined in the implementation section but not in 
+# the interface are included in the documentation. 
+# If set to NO (the default) only methods in the interface are included.
+
+EXTRACT_LOCAL_METHODS  = NO
+
+# If the HIDE_UNDOC_MEMBERS tag is set to YES, Doxygen will hide all 
+# undocumented members of documented classes, files or namespaces. 
+# If set to NO (the default) these members will be included in the 
+# various overviews, but no documentation section is generated. 
+# This option has no effect if EXTRACT_ALL is enabled.
+
+HIDE_UNDOC_MEMBERS     = NO
+
+# If the HIDE_UNDOC_CLASSES tag is set to YES, Doxygen will hide all 
+# undocumented classes that are normally visible in the class hierarchy. 
+# If set to NO (the default) these classes will be included in the various 
+# overviews. This option has no effect if EXTRACT_ALL is enabled.
+
+HIDE_UNDOC_CLASSES     = NO
+
+# If the HIDE_FRIEND_COMPOUNDS tag is set to YES, Doxygen will hide all 
+# friend (class|struct|union) declarations. 
+# If set to NO (the default) these declarations will be included in the 
+# documentation.
+
+HIDE_FRIEND_COMPOUNDS  = NO
+
+# If the HIDE_IN_BODY_DOCS tag is set to YES, Doxygen will hide any 
+# documentation blocks found inside the body of a function. 
+# If set to NO (the default) these blocks will be appended to the 
+# function's detailed documentation block.
+
+HIDE_IN_BODY_DOCS      = NO
+
+# The INTERNAL_DOCS tag determines if documentation 
+# that is typed after a \internal command is included. If the tag is set 
+# to NO (the default) then the documentation will be excluded. 
+# Set it to YES to include the internal documentation.
+
+INTERNAL_DOCS          = NO
+
+# If the CASE_SENSE_NAMES tag is set to NO then Doxygen will only generate 
+# file names in lower-case letters. If set to YES upper-case letters are also 
+# allowed. This is useful if you have classes or files whose names only differ 
+# in case and if your file system supports case sensitive file names. Windows 
+# and Mac users are advised to set this option to NO.
+
+CASE_SENSE_NAMES       = YES
+
+# If the HIDE_SCOPE_NAMES tag is set to NO (the default) then Doxygen 
+# will show members with their full class and namespace scopes in the 
+# documentation. If set to YES the scope will be hidden.
+
+HIDE_SCOPE_NAMES       = NO
+
+# If the SHOW_INCLUDE_FILES tag is set to YES (the default) then Doxygen 
+# will put a list of the files that are included by a file in the documentation 
+# of that file.
+
+SHOW_INCLUDE_FILES     = YES
+
+# If the INLINE_INFO tag is set to YES (the default) then a tag [inline] 
+# is inserted in the documentation for inline members.
+
+INLINE_INFO            = YES
+
+# If the SORT_MEMBER_DOCS tag is set to YES (the default) then doxygen 
+# will sort the (detailed) documentation of file and class members 
+# alphabetically by member name. If set to NO the members will appear in 
+# declaration order.
+
+SORT_MEMBER_DOCS       = YES
+
+# If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the 
+# brief documentation of file, namespace and class members alphabetically 
+# by member name. If set to NO (the default) the members will appear in 
+# declaration order.
+
+SORT_BRIEF_DOCS        = YES
+
+# If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be 
+# sorted by fully-qualified names, including namespaces. If set to 
+# NO (the default), the class list will be sorted only by class name, 
+# not including the namespace part. 
+# Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES.
+# Note: This option applies only to the class list, not to the 
+# alphabetical list.
+
+SORT_BY_SCOPE_NAME     = YES
+
+# The GENERATE_TODOLIST tag can be used to enable (YES) or 
+# disable (NO) the todo list. This list is created by putting \todo 
+# commands in the documentation.
+
+GENERATE_TODOLIST      = YES
+
+# The GENERATE_TESTLIST tag can be used to enable (YES) or 
+# disable (NO) the test list. This list is created by putting \test 
+# commands in the documentation.
+
+GENERATE_TESTLIST      = YES
+
+# The GENERATE_BUGLIST tag can be used to enable (YES) or 
+# disable (NO) the bug list. This list is created by putting \bug 
+# commands in the documentation.
+
+GENERATE_BUGLIST       = YES
+
+# The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or 
+# disable (NO) the deprecated list. This list is created by putting 
+# \deprecated commands in the documentation.
+
+GENERATE_DEPRECATEDLIST= YES
+
+# The ENABLED_SECTIONS tag can be used to enable conditional 
+# documentation sections, marked by \if sectionname ... \endif.
+
+ENABLED_SECTIONS       = 
+
+# The MAX_INITIALIZER_LINES tag determines the maximum number of lines 
+# the initial value of a variable or define consists of for it to appear in 
+# the documentation. If the initializer consists of more lines than specified 
+# here it will be hidden. Use a value of 0 to hide initializers completely. 
+# The appearance of the initializer of individual variables and defines in the 
+# documentation can be controlled using \showinitializer or \hideinitializer 
+# command in the documentation regardless of this setting.
+
+MAX_INITIALIZER_LINES  = 30
+
+# Set the SHOW_USED_FILES tag to NO to disable the list of files generated 
+# at the bottom of the documentation of classes and structs. If set to YES the 
+# list will mention the files that were used to generate the documentation.
+
+SHOW_USED_FILES        = YES
+
+# If the sources in your project are distributed over multiple directories 
+# then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy 
+# in the documentation. The default is NO.
+
+SHOW_DIRECTORIES       = NO
+
+# The FILE_VERSION_FILTER tag can be used to specify a program or script that 
+# doxygen should invoke to get the current version for each file (typically from the 
+# version control system). Doxygen will invoke the program by executing (via 
+# popen()) the command <command> <input-file>, where <command> is the value of 
+# the FILE_VERSION_FILTER tag, and <input-file> is the name of an input file 
+# provided by doxygen. Whatever the program writes to standard output 
+# is used as the file version. See the manual for examples.
+
+FILE_VERSION_FILTER    = 
+
+#---------------------------------------------------------------------------
+# configuration options related to warning and progress messages
+#---------------------------------------------------------------------------
+
+# The QUIET tag can be used to turn on/off the messages that are generated 
+# by doxygen. Possible values are YES and NO. If left blank NO is used.
+
+QUIET                  = NO
+
+# The WARNINGS tag can be used to turn on/off the warning messages that are 
+# generated by doxygen. Possible values are YES and NO. If left blank 
+# NO is used.
+
+WARNINGS               = YES
+
+# If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings 
+# for undocumented members. If EXTRACT_ALL is set to YES then this flag will 
+# automatically be disabled.
+
+WARN_IF_UNDOCUMENTED   = YES
+
+# If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for 
+# potential errors in the documentation, such as not documenting some 
+# parameters in a documented function, or documenting parameters that 
+# don't exist or using markup commands wrongly.
+
+WARN_IF_DOC_ERROR      = YES
+
+# This WARN_NO_PARAMDOC option can be abled to get warnings for 
+# functions that are documented, but have no documentation for their parameters 
+# or return value. If set to NO (the default) doxygen will only warn about 
+# wrong or incomplete parameter documentation, but not about the absence of 
+# documentation.
+
+WARN_NO_PARAMDOC       = NO
+
+# The WARN_FORMAT tag determines the format of the warning messages that 
+# doxygen can produce. The string should contain the $file, $line, and $text 
+# tags, which will be replaced by the file and line number from which the 
+# warning originated and the warning text. Optionally the format may contain 
+# $version, which will be replaced by the version of the file (if it could 
+# be obtained via FILE_VERSION_FILTER)
+
+WARN_FORMAT            = "$file:$line: $text"
+
+# The WARN_LOGFILE tag can be used to specify a file to which warning 
+# and error messages should be written. If left blank the output is written 
+# to stderr.
+
+WARN_LOGFILE           = 
+
+#---------------------------------------------------------------------------
+# configuration options related to the input files
+#---------------------------------------------------------------------------
+
+# The INPUT tag can be used to specify the files and/or directories that contain 
+# documented source files. You may enter file names like "myfile.cpp" or 
+# directories like "/usr/src/myproject". Separate the files or directories 
+# with spaces.
+
+INPUT                  = ../server ../client ../testcases ../utils ../
+
+# If the value of the INPUT tag contains directories, you can use the 
+# FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp 
+# and *.h) to filter out the source-files in the directories. If left 
+# blank the following patterns are tested: 
+# *.c *.cc *.cxx *.cpp *.c++ *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh *.hxx 
+# *.hpp *.h++ *.idl *.odl *.cs *.php *.php3 *.inc *.m *.mm *.py
+
+FILE_PATTERNS          = *.py 
+
+# The RECURSIVE tag can be used to turn specify whether or not subdirectories 
+# should be searched for input files as well. Possible values are YES and NO. 
+# If left blank NO is used.
+
+RECURSIVE              = NO
+
+# The EXCLUDE tag can be used to specify files and/or directories that should 
+# excluded from the INPUT source files. This way you can easily exclude a 
+# subdirectory from a directory tree whose root is specified with the INPUT tag.
+
+EXCLUDE                = 
+
+# The EXCLUDE_SYMLINKS tag can be used select whether or not files or 
+# directories that are symbolic links (a Unix filesystem feature) are excluded 
+# from the input.
+
+EXCLUDE_SYMLINKS       = NO
+
+# If the value of the INPUT tag contains directories, you can use the 
+# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude 
+# certain files from those directories. Note that the wildcards are matched 
+# against the file with absolute path, so to exclude all test directories 
+# for example use the pattern */test/*
+
+EXCLUDE_PATTERNS       = 
+
+# The EXAMPLE_PATH tag can be used to specify one or more files or 
+# directories that contain example code fragments that are included (see 
+# the \include command).
+
+EXAMPLE_PATH           = 
+
+# If the value of the EXAMPLE_PATH tag contains directories, you can use the 
+# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp 
+# and *.h) to filter out the source-files in the directories. If left 
+# blank all files are included.
+
+EXAMPLE_PATTERNS       = 
+
+# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be 
+# searched for input files to be used with the \include or \dontinclude 
+# commands irrespective of the value of the RECURSIVE tag. 
+# Possible values are YES and NO. If left blank NO is used.
+
+EXAMPLE_RECURSIVE      = NO
+
+# The IMAGE_PATH tag can be used to specify one or more files or 
+# directories that contain image that are included in the documentation (see 
+# the \image command).
+
+IMAGE_PATH             = 
+
+# The INPUT_FILTER tag can be used to specify a program that doxygen should 
+# invoke to filter for each input file. Doxygen will invoke the filter program 
+# by executing (via popen()) the command <filter> <input-file>, where <filter> 
+# is the value of the INPUT_FILTER tag, and <input-file> is the name of an 
+# input file. Doxygen will then use the output that the filter program writes 
+# to standard output.  If FILTER_PATTERNS is specified, this tag will be 
+# ignored.
+
+INPUT_FILTER           = 
+
+# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern 
+# basis.  Doxygen will compare the file name with each pattern and apply the 
+# filter if there is a match.  The filters are a list of the form: 
+# pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further 
+# info on how filters are used. If FILTER_PATTERNS is empty, INPUT_FILTER 
+# is applied to all files.
+
+FILTER_PATTERNS        = 
+
+# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using 
+# INPUT_FILTER) will be used to filter the input files when producing source 
+# files to browse (i.e. when SOURCE_BROWSER is set to YES).
+
+FILTER_SOURCE_FILES    = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to source browsing
+#---------------------------------------------------------------------------
+
+# If the SOURCE_BROWSER tag is set to YES then a list of source files will 
+# be generated. Documented entities will be cross-referenced with these sources. 
+# Note: To get rid of all source code in the generated output, make sure also 
+# VERBATIM_HEADERS is set to NO.
+
+SOURCE_BROWSER         = YES
+
+# Setting the INLINE_SOURCES tag to YES will include the body 
+# of functions and classes directly in the documentation.
+
+INLINE_SOURCES         = NO
+
+# Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct 
+# doxygen to hide any special comment blocks from generated source code 
+# fragments. Normal C and C++ comments will always remain visible.
+
+STRIP_CODE_COMMENTS    = YES
+
+# If the REFERENCED_BY_RELATION tag is set to YES (the default) 
+# then for each documented function all documented 
+# functions referencing it will be listed.
+
+REFERENCED_BY_RELATION = YES
+
+# If the REFERENCES_RELATION tag is set to YES (the default) 
+# then for each documented function all documented entities 
+# called/used by that function will be listed.
+
+REFERENCES_RELATION    = YES
+
+# If the USE_HTAGS tag is set to YES then the references to source code 
+# will point to the HTML generated by the htags(1) tool instead of doxygen 
+# built-in source browser. The htags tool is part of GNU's global source 
+# tagging system (see http://www.gnu.org/software/global/global.html). You 
+# will need version 4.8.6 or higher.
+
+USE_HTAGS              = NO
+
+# If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen 
+# will generate a verbatim copy of the header file for each class for 
+# which an include is specified. Set to NO to disable this.
+
+VERBATIM_HEADERS       = YES
+
+#---------------------------------------------------------------------------
+# configuration options related to the alphabetical class index
+#---------------------------------------------------------------------------
+
+# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index 
+# of all compounds will be generated. Enable this if the project 
+# contains a lot of classes, structs, unions or interfaces.
+
+ALPHABETICAL_INDEX     = NO
+
+# If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then 
+# the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns 
+# in which this list will be split (can be a number in the range [1..20])
+
+COLS_IN_ALPHA_INDEX    = 5
+
+# In case all classes in a project start with a common prefix, all 
+# classes will be put under the same header in the alphabetical index. 
+# The IGNORE_PREFIX tag can be used to specify one or more prefixes that 
+# should be ignored while generating the index headers.
+
+IGNORE_PREFIX          = 
+
+#---------------------------------------------------------------------------
+# configuration options related to the HTML output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_HTML tag is set to YES (the default) Doxygen will 
+# generate HTML output.
+
+GENERATE_HTML          = YES
+
+# The HTML_OUTPUT tag is used to specify where the HTML docs will be put. 
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be 
+# put in front of it. If left blank `html' will be used as the default path.
+
+HTML_OUTPUT            = html
+
+# The HTML_FILE_EXTENSION tag can be used to specify the file extension for 
+# each generated HTML page (for example: .htm,.php,.asp). If it is left blank 
+# doxygen will generate files with .html extension.
+
+HTML_FILE_EXTENSION    = .html
+
+# The HTML_HEADER tag can be used to specify a personal HTML header for 
+# each generated HTML page. If it is left blank doxygen will generate a 
+# standard header.
+
+HTML_HEADER            = 
+
+# The HTML_FOOTER tag can be used to specify a personal HTML footer for 
+# each generated HTML page. If it is left blank doxygen will generate a 
+# standard footer.
+
+HTML_FOOTER            = 
+
+# The HTML_STYLESHEET tag can be used to specify a user-defined cascading 
+# style sheet that is used by each HTML page. It can be used to 
+# fine-tune the look of the HTML output. If the tag is left blank doxygen 
+# will generate a default style sheet. Note that doxygen will try to copy 
+# the style sheet file to the HTML output directory, so don't put your own 
+# stylesheet in the HTML output directory as well, or it will be erased!
+
+HTML_STYLESHEET        = 
+
+# If the HTML_ALIGN_MEMBERS tag is set to YES, the members of classes, 
+# files or namespaces will be aligned in HTML using tables. If set to 
+# NO a bullet list will be used.
+
+HTML_ALIGN_MEMBERS     = YES
+
+# If the GENERATE_HTMLHELP tag is set to YES, additional index files 
+# will be generated that can be used as input for tools like the 
+# Microsoft HTML help workshop to generate a compressed HTML help file (.chm) 
+# of the generated HTML documentation.
+
+GENERATE_HTMLHELP      = NO
+
+# If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can 
+# be used to specify the file name of the resulting .chm file. You 
+# can add a path in front of the file if the result should not be 
+# written to the html output directory.
+
+CHM_FILE               = 
+
+# If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can 
+# be used to specify the location (absolute path including file name) of 
+# the HTML help compiler (hhc.exe). If non-empty doxygen will try to run 
+# the HTML help compiler on the generated index.hhp.
+
+HHC_LOCATION           = 
+
+# If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag 
+# controls if a separate .chi index file is generated (YES) or that 
+# it should be included in the master .chm file (NO).
+
+GENERATE_CHI           = NO
+
+# If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag 
+# controls whether a binary table of contents is generated (YES) or a 
+# normal table of contents (NO) in the .chm file.
+
+BINARY_TOC             = NO
+
+# The TOC_EXPAND flag can be set to YES to add extra items for group members 
+# to the contents of the HTML help documentation and to the tree view.
+
+TOC_EXPAND             = NO
+
+# The DISABLE_INDEX tag can be used to turn on/off the condensed index at 
+# top of each HTML page. The value NO (the default) enables the index and 
+# the value YES disables it.
+
+DISABLE_INDEX          = NO
+
+# This tag can be used to set the number of enum values (range [1..20]) 
+# that doxygen will group on one line in the generated HTML documentation.
+
+ENUM_VALUES_PER_LINE   = 4
+
+# If the GENERATE_TREEVIEW tag is set to YES, a side panel will be
+# generated containing a tree-like index structure (just like the one that 
+# is generated for HTML Help). For this to work a browser that supports 
+# JavaScript, DHTML, CSS and frames is required (for instance Mozilla 1.0+, 
+# Netscape 6.0+, Internet explorer 5.0+, or Konqueror). Windows users are 
+# probably better off using the HTML help feature.
+
+GENERATE_TREEVIEW      = NO
+
+# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be 
+# used to set the initial width (in pixels) of the frame in which the tree 
+# is shown.
+
+TREEVIEW_WIDTH         = 250
+
+#---------------------------------------------------------------------------
+# configuration options related to the LaTeX output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_LATEX tag is set to YES (the default) Doxygen will 
+# generate Latex output.
+
+GENERATE_LATEX         = NO
+
+# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put. 
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be 
+# put in front of it. If left blank `latex' will be used as the default path.
+
+LATEX_OUTPUT           = latex
+
+# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be 
+# invoked. If left blank `latex' will be used as the default command name.
+
+LATEX_CMD_NAME         = latex
+
+# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to 
+# generate index for LaTeX. If left blank `makeindex' will be used as the 
+# default command name.
+
+MAKEINDEX_CMD_NAME     = makeindex
+
+# If the COMPACT_LATEX tag is set to YES Doxygen generates more compact 
+# LaTeX documents. This may be useful for small projects and may help to 
+# save some trees in general.
+
+COMPACT_LATEX          = NO
+
+# The PAPER_TYPE tag can be used to set the paper type that is used 
+# by the printer. Possible values are: a4, a4wide, letter, legal and 
+# executive. If left blank a4wide will be used.
+
+PAPER_TYPE             = a4wide
+
+# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX 
+# packages that should be included in the LaTeX output.
+
+EXTRA_PACKAGES         = 
+
+# The LATEX_HEADER tag can be used to specify a personal LaTeX header for 
+# the generated latex document. The header should contain everything until 
+# the first chapter. If it is left blank doxygen will generate a 
+# standard header. Notice: only use this tag if you know what you are doing!
+
+LATEX_HEADER           = 
+
+# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated 
+# is prepared for conversion to pdf (using ps2pdf). The pdf file will 
+# contain links (just like the HTML output) instead of page references 
+# This makes the output suitable for online browsing using a pdf viewer.
+
+PDF_HYPERLINKS         = NO
+
+# If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of 
+# plain latex in the generated Makefile. Set this option to YES to get a 
+# higher quality PDF documentation.
+
+USE_PDFLATEX           = NO
+
+# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode. 
+# command to the generated LaTeX files. This will instruct LaTeX to keep 
+# running if errors occur, instead of asking the user for help. 
+# This option is also used when generating formulas in HTML.
+
+LATEX_BATCHMODE        = NO
+
+# If LATEX_HIDE_INDICES is set to YES then doxygen will not 
+# include the index chapters (such as File Index, Compound Index, etc.) 
+# in the output.
+
+LATEX_HIDE_INDICES     = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the RTF output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output 
+# The RTF output is optimized for Word 97 and may not look very pretty with 
+# other RTF readers or editors.
+
+GENERATE_RTF           = NO
+
+# The RTF_OUTPUT tag is used to specify where the RTF docs will be put. 
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be 
+# put in front of it. If left blank `rtf' will be used as the default path.
+
+RTF_OUTPUT             = rtf
+
+# If the COMPACT_RTF tag is set to YES Doxygen generates more compact 
+# RTF documents. This may be useful for small projects and may help to 
+# save some trees in general.
+
+COMPACT_RTF            = NO
+
+# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated 
+# will contain hyperlink fields. The RTF file will 
+# contain links (just like the HTML output) instead of page references. 
+# This makes the output suitable for online browsing using WORD or other 
+# programs which support those fields. 
+# Note: wordpad (write) and others do not support links.
+
+RTF_HYPERLINKS         = NO
+
+# Load stylesheet definitions from file. Syntax is similar to doxygen's 
+# config file, i.e. a series of assignments. You only have to provide 
+# replacements, missing definitions are set to their default value.
+
+RTF_STYLESHEET_FILE    = 
+
+# Set optional variables used in the generation of an rtf document. 
+# Syntax is similar to doxygen's config file.
+
+RTF_EXTENSIONS_FILE    = 
+
+#---------------------------------------------------------------------------
+# configuration options related to the man page output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_MAN tag is set to YES (the default) Doxygen will 
+# generate man pages
+
+GENERATE_MAN           = NO
+
+# The MAN_OUTPUT tag is used to specify where the man pages will be put. 
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be 
+# put in front of it. If left blank `man' will be used as the default path.
+
+MAN_OUTPUT             = man
+
+# The MAN_EXTENSION tag determines the extension that is added to 
+# the generated man pages (default is the subroutine's section .3)
+
+MAN_EXTENSION          = .3
+
+# If the MAN_LINKS tag is set to YES and Doxygen generates man output, 
+# then it will generate one additional man file for each entity 
+# documented in the real man page(s). These additional files 
+# only source the real man page, but without them the man command 
+# would be unable to find the correct page. The default is NO.
+
+MAN_LINKS              = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the XML output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_XML tag is set to YES Doxygen will 
+# generate an XML file that captures the structure of 
+# the code including all documentation.
+
+GENERATE_XML           = NO
+
+# The XML_OUTPUT tag is used to specify where the XML pages will be put. 
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be 
+# put in front of it. If left blank `xml' will be used as the default path.
+
+XML_OUTPUT             = xml
+
+# The XML_SCHEMA tag can be used to specify an XML schema, 
+# which can be used by a validating XML parser to check the 
+# syntax of the XML files.
+
+XML_SCHEMA             = 
+
+# The XML_DTD tag can be used to specify an XML DTD, 
+# which can be used by a validating XML parser to check the 
+# syntax of the XML files.
+
+XML_DTD                = 
+
+# If the XML_PROGRAMLISTING tag is set to YES Doxygen will 
+# dump the program listings (including syntax highlighting 
+# and cross-referencing information) to the XML output. Note that 
+# enabling this will significantly increase the size of the XML output.
+
+XML_PROGRAMLISTING     = YES
+
+#---------------------------------------------------------------------------
+# configuration options for the AutoGen Definitions output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will 
+# generate an AutoGen Definitions (see autogen.sf.net) file 
+# that captures the structure of the code including all 
+# documentation. Note that this feature is still experimental 
+# and incomplete at the moment.
+
+GENERATE_AUTOGEN_DEF   = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the Perl module output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_PERLMOD tag is set to YES Doxygen will 
+# generate a Perl module file that captures the structure of 
+# the code including all documentation. Note that this 
+# feature is still experimental and incomplete at the 
+# moment.
+
+GENERATE_PERLMOD       = NO
+
+# If the PERLMOD_LATEX tag is set to YES Doxygen will generate 
+# the necessary Makefile rules, Perl scripts and LaTeX code to be able 
+# to generate PDF and DVI output from the Perl module output.
+
+PERLMOD_LATEX          = NO
+
+# If the PERLMOD_PRETTY tag is set to YES the Perl module output will be 
+# nicely formatted so it can be parsed by a human reader.  This is useful 
+# if you want to understand what is going on.  On the other hand, if this 
+# tag is set to NO the size of the Perl module output will be much smaller 
+# and Perl will parse it just the same.
+
+PERLMOD_PRETTY         = YES
+
+# The names of the make variables in the generated doxyrules.make file 
+# are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX. 
+# This is useful so different doxyrules.make files included by the same 
+# Makefile don't overwrite each other's variables.
+
+PERLMOD_MAKEVAR_PREFIX = 
+
+#---------------------------------------------------------------------------
+# Configuration options related to the preprocessor   
+#---------------------------------------------------------------------------
+
+# If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will 
+# evaluate all C-preprocessor directives found in the sources and include 
+# files.
+
+ENABLE_PREPROCESSING   = YES
+
+# If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro 
+# names in the source code. If set to NO (the default) only conditional 
+# compilation will be performed. Macro expansion can be done in a controlled 
+# way by setting EXPAND_ONLY_PREDEF to YES.
+
+MACRO_EXPANSION        = NO
+
+# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES 
+# then the macro expansion is limited to the macros specified with the 
+# PREDEFINED and EXPAND_AS_DEFINED tags.
+
+EXPAND_ONLY_PREDEF     = NO
+
+# If the SEARCH_INCLUDES tag is set to YES (the default) the includes files 
+# in the INCLUDE_PATH (see below) will be search if a #include is found.
+
+SEARCH_INCLUDES        = YES
+
+# The INCLUDE_PATH tag can be used to specify one or more directories that 
+# contain include files that are not input files but should be processed by 
+# the preprocessor.
+
+INCLUDE_PATH           = 
+
+# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard 
+# patterns (like *.h and *.hpp) to filter out the header-files in the 
+# directories. If left blank, the patterns specified with FILE_PATTERNS will 
+# be used.
+
+INCLUDE_FILE_PATTERNS  = 
+
+# The PREDEFINED tag can be used to specify one or more macro names that 
+# are defined before the preprocessor is started (similar to the -D option of 
+# gcc). The argument of the tag is a list of macros of the form: name 
+# or name=definition (no spaces). If the definition and the = are 
+# omitted =1 is assumed. To prevent a macro definition from being 
+# undefined via #undef or recursively expanded use the := operator 
+# instead of the = operator.
+
+PREDEFINED             = 
+
+# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then 
+# this tag can be used to specify a list of macro names that should be expanded. 
+# The macro definition that is found in the sources will be used. 
+# Use the PREDEFINED tag if you want to use a different macro definition.
+
+EXPAND_AS_DEFINED      = 
+
+# If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then 
+# doxygen's preprocessor will remove all function-like macros that are alone 
+# on a line, have an all uppercase name, and do not end with a semicolon. Such 
+# function macros are typically used for boiler-plate code, and will confuse 
+# the parser if not removed.
+
+SKIP_FUNCTION_MACROS   = YES
+
+#---------------------------------------------------------------------------
+# Configuration::additions related to external references   
+#---------------------------------------------------------------------------
+
+# The TAGFILES option can be used to specify one or more tagfiles. 
+# Optionally an initial location of the external documentation 
+# can be added for each tagfile. The format of a tag file without 
+# this location is as follows: 
+#   TAGFILES = file1 file2 ... 
+# Adding location for the tag files is done as follows: 
+#   TAGFILES = file1=loc1 "file2 = loc2" ... 
+# where "loc1" and "loc2" can be relative or absolute paths or 
+# URLs. If a location is present for each tag, the installdox tool 
+# does not have to be run to correct the links.
+# Note that each tag file must have a unique name
+# (where the name does NOT include the path)
+# If a tag file is not located in the directory in which doxygen 
+# is run, you must also specify the path to the tagfile here.
+
+TAGFILES               = 
+
+# When a file name is specified after GENERATE_TAGFILE, doxygen will create 
+# a tag file that is based on the input files it reads.
+
+GENERATE_TAGFILE       = 
+
+# If the ALLEXTERNALS tag is set to YES all external classes will be listed 
+# in the class index. If set to NO only the inherited external classes 
+# will be listed.
+
+ALLEXTERNALS           = NO
+
+# If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed 
+# in the modules index. If set to NO, only the current project's groups will 
+# be listed.
+
+EXTERNAL_GROUPS        = YES
+
+# The PERL_PATH should be the absolute path and name of the perl script 
+# interpreter (i.e. the result of `which perl').
+
+PERL_PATH              = /usr/bin/perl
+
+#---------------------------------------------------------------------------
+# Configuration options related to the dot tool   
+#---------------------------------------------------------------------------
+
+# If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will 
+# generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base 
+# or super classes. Setting the tag to NO turns the diagrams off. Note that 
+# this option is superseded by the HAVE_DOT option below. This is only a 
+# fallback. It is recommended to install and use dot, since it yields more 
+# powerful graphs.
+
+CLASS_DIAGRAMS         = YES
+
+# If set to YES, the inheritance and collaboration graphs will hide 
+# inheritance and usage relations if the target is undocumented 
+# or is not a class.
+
+HIDE_UNDOC_RELATIONS   = YES
+
+# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is 
+# available from the path. This tool is part of Graphviz, a graph visualization 
+# toolkit from AT&T and Lucent Bell Labs. The other options in this section 
+# have no effect if this option is set to NO (the default)
+
+HAVE_DOT               = YES
+
+# If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen 
+# will generate a graph for each documented class showing the direct and 
+# indirect inheritance relations. Setting this tag to YES will force the 
+# the CLASS_DIAGRAMS tag to NO.
+
+CLASS_GRAPH            = YES
+
+# If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen 
+# will generate a graph for each documented class showing the direct and 
+# indirect implementation dependencies (inheritance, containment, and 
+# class references variables) of the class with other documented classes.
+
+COLLABORATION_GRAPH    = YES
+
+# If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen 
+# will generate a graph for groups, showing the direct groups dependencies
+
+GROUP_GRAPHS           = YES
+
+# If the UML_LOOK tag is set to YES doxygen will generate inheritance and 
+# collaboration diagrams in a style similar to the OMG's Unified Modeling 
+# Language.
+
+UML_LOOK               = NO
+
+# If set to YES, the inheritance and collaboration graphs will show the 
+# relations between templates and their instances.
+
+TEMPLATE_RELATIONS     = NO
+
+# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT 
+# tags are set to YES then doxygen will generate a graph for each documented 
+# file showing the direct and indirect include dependencies of the file with 
+# other documented files.
+
+INCLUDE_GRAPH          = YES
+
+# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and 
+# HAVE_DOT tags are set to YES then doxygen will generate a graph for each 
+# documented header file showing the documented files that directly or 
+# indirectly include this file.
+
+INCLUDED_BY_GRAPH      = YES
+
+# If the CALL_GRAPH and HAVE_DOT tags are set to YES then doxygen will 
+# generate a call dependency graph for every global function or class method. 
+# Note that enabling this option will significantly increase the time of a run. 
+# So in most cases it will be better to enable call graphs for selected 
+# functions only using the \callgraph command.
+
+CALL_GRAPH             = NO
+
+# If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen 
+# will graphical hierarchy of all classes instead of a textual one.
+
+GRAPHICAL_HIERARCHY    = YES
+
+# If the DIRECTORY_GRAPH, SHOW_DIRECTORIES and HAVE_DOT tags are set to YES 
+# then doxygen will show the dependencies a directory has on other directories 
+# in a graphical way. The dependency relations are determined by the #include
+# relations between the files in the directories.
+
+DIRECTORY_GRAPH        = YES
+
+# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images 
+# generated by dot. Possible values are png, jpg, or gif
+# If left blank png will be used.
+
+DOT_IMAGE_FORMAT       = png
+
+# The tag DOT_PATH can be used to specify the path where the dot tool can be 
+# found. If left blank, it is assumed the dot tool can be found in the path.
+
+DOT_PATH               = 
+
+# The DOTFILE_DIRS tag can be used to specify one or more directories that 
+# contain dot files that are included in the documentation (see the 
+# \dotfile command).
+
+DOTFILE_DIRS           = 
+
+# The MAX_DOT_GRAPH_WIDTH tag can be used to set the maximum allowed width 
+# (in pixels) of the graphs generated by dot. If a graph becomes larger than 
+# this value, doxygen will try to truncate the graph, so that it fits within 
+# the specified constraint. Beware that most browsers cannot cope with very 
+# large images.
+
+MAX_DOT_GRAPH_WIDTH    = 1024
+
+# The MAX_DOT_GRAPH_HEIGHT tag can be used to set the maximum allows height 
+# (in pixels) of the graphs generated by dot. If a graph becomes larger than 
+# this value, doxygen will try to truncate the graph, so that it fits within 
+# the specified constraint. Beware that most browsers cannot cope with very 
+# large images.
+
+MAX_DOT_GRAPH_HEIGHT   = 1024
+
+# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the 
+# graphs generated by dot. A depth value of 3 means that only nodes reachable 
+# from the root by following a path via at most 3 edges will be shown. Nodes 
+# that lay further from the root node will be omitted. Note that setting this 
+# option to 1 or 2 may greatly reduce the computation time needed for large 
+# code bases. Also note that a graph may be further truncated if the graph's 
+# image dimensions are not sufficient to fit the graph (see MAX_DOT_GRAPH_WIDTH 
+# and MAX_DOT_GRAPH_HEIGHT). If 0 is used for the depth value (the default), 
+# the graph is not depth-constrained.
+
+MAX_DOT_GRAPH_DEPTH    = 0
+
+# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent 
+# background. This is disabled by default, which results in a white background. 
+# Warning: Depending on the platform used, enabling this option may lead to 
+# badly anti-aliased labels on the edges of a graph (i.e. they become hard to 
+# read).
+
+DOT_TRANSPARENT        = NO
+
+# Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output 
+# files in one run (i.e. multiple -o and -T options on the command line). This 
+# makes dot run faster, but since only newer versions of dot (>1.8.10) 
+# support this, this feature is disabled by default.
+
+DOT_MULTI_TARGETS      = YES
+
+# If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will 
+# generate a legend page explaining the meaning of the various boxes and 
+# arrows in the dot generated graphs.
+
+GENERATE_LEGEND        = YES
+
+# If the DOT_CLEANUP tag is set to YES (the default) Doxygen will 
+# remove the intermediate dot files that are used to generate 
+# the various graphs.
+
+DOT_CLEANUP            = YES
+
+#---------------------------------------------------------------------------
+# Configuration::additions related to the search engine   
+#---------------------------------------------------------------------------
+
+# The SEARCHENGINE tag specifies whether or not a search engine should be 
+# used. If set to NO the values of all tags below this one will be ignored.
+
+SEARCHENGINE           = NO
diff --git a/fail2ban b/fail2ban
deleted file mode 100755
index 5eace8bd..00000000
--- a/fail2ban
+++ /dev/null
@@ -1,75 +0,0 @@
-#!/usr/bin/env python
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import sys, traceback, logging, locale
-
-# Set the locale with the user's default setting
-try:
-	locale.setlocale(locale.LC_ALL, '')
-except Exception:
-	print "Unable to set locale to " + `locale.getdefaultlocale()`
-	sys.exit(-1)
-
-# Inserts our own modules path first in the list
-# fix for bug #343821
-sys.path.insert(1, "/usr/lib/fail2ban")
-
-# Now we can import our modules.
-import fail2ban
-from utils.pidlock import PIDLock
-
-# Get the instance of the logger.
-logSys = logging.getLogger("fail2ban")
-
-# Get PID lock file instance
-pidLock = PIDLock()
-
-# Handle all the unhandled exceptions
-try:
-	# Start the application
-	fail2ban.main()
-except SystemExit:
-	# We called sys.exit(). Nothing wrong so just pass
-	pass
-except Exception, e:
-	# Print the exception data
-	(type, value, tb) = sys.exc_info()
-	tbStack = traceback.extract_tb(tb)
-	logSys.error("Fail2Ban got an unhandled exception and died.")
-	logSys.error("Type: " + `type.__name__` + "\n" +
-				 "Value: " + `e.args` + "\n" +
-				 "TB: " + `tbStack`)
-	# Try to clean up after ourselves
-	# just for extreme caution - wrapping with try
-	try:
-		fail2ban.restoreFwRules()
-	except Exception:
-		pass
-	# Remove the PID lock file. Should close #1239562
-	pidLock.remove()
-	logging.shutdown()
diff --git a/fail2ban-client b/fail2ban-client
new file mode 100755
index 00000000..fa395b6e
--- /dev/null
+++ b/fail2ban-client
@@ -0,0 +1,236 @@
+#!/usr/bin/env python
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import sys, string, os, pickle, re, logging, getopt, time
+
+# Inserts our own modules path first in the list
+# fix for bug #343821
+sys.path.insert(1, "/usr/lib/fail2ban")
+
+# Now we can import our modules
+from client.csocket import CSocket
+from client.configurator import Configurator
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client")
+
+##
+#
+# @todo This class needs cleanup.
+
+class Fail2banClient:
+
+	def __init__(self):
+		self.argv = None
+		self.stream = None
+		self.conf = dict()
+		self.conf["cmdfile"] = None
+		self.conf["background"] = True
+		self.conf["dump"] = False
+	
+	def dispUsage(self):
+		""" Prints Fail2Ban command line options and exits
+		"""
+		print "Usage: "+self.argv[0]+" [OPTIONS] <COMMAND>"
+		print
+		print "Fail2Ban v0.7 reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
+		print "  -b         start in background"
+		print "  -f         start in foreground"
+		print "  -c <DIR>   configuration directory"
+		print "  -s <FILE>  read command file"
+		print "  -d         dump configuration"
+		print "  -h         display this help message"
+		print
+		print "Report bugs to <lostcontrol@users.sourceforge.net>"
+		sys.exit(0)
+	
+	def getCmdLineOptions(self, optList):
+		""" Gets the command line options
+		"""
+		for opt in optList:
+			if opt[0] == "-d":
+				self.conf["dump"] = True
+			if opt[0] == "-b":
+				self.conf["background"] = True
+			if opt[0] == "-f":
+				self.conf["background"] = False
+			if opt[0] == "-s":
+				self.conf["cmdfile"] = opt[1]
+			if opt[0] in ["-h", "--help"]:
+	 			self.dispUsage()
+	
+	def ping(self):
+		return self.processCmd([["ping"]])
+	
+	@staticmethod
+	def processCmd(cmd):
+		for c in cmd:
+			try:
+				client = CSocket()
+			except Exception, e:
+				logSys.error(e)
+				logSys.error("Arrggh... Start the server first")
+				return False
+			ret = client.send(c)
+			if ret[0] == 0:
+				logSys.info("OK : " + `ret[1]`)
+			else:
+				logSys.info("NOK: " + `ret[1].args`)
+				return False
+		return True
+		
+	##
+	# Process a command line.
+	#
+	# Process one command line and exit.
+	# @param cmd the command line
+
+	def processCommand(self, cmd):
+		if self.conf["dump"]:
+			self.readConfig()
+			self.dumpConfig(self.stream)
+			return True
+		
+		if len(sys.argv) < 2:
+			logSys.error("Add some options...")
+			return False
+		
+		if cmd[0] == "start" and len(cmd) == 1:
+			self.readConfig()
+			self.startServer(self.conf["background"])
+			# Configure the server
+			self.processCmd(self.stream)
+		else:
+			try:
+				client = CSocket()
+				ret = client.send(cmd)
+				if ret[0] == 0:
+					logSys.info("OK : " + `ret[1]`)
+					return True
+				else:
+					logSys.info("NOK: " + `ret[1].args`)
+					return False
+			except SystemExit, e:
+				return True
+			except Exception, e:
+				logSys.error(e)
+				logSys.error("Arrggh... Start the server first")
+				return False
+	
+	##
+	# Process a script file.
+	#
+	# Read each line of the file and execute the command. Lines which
+	# start with '#' are ignored.
+	# @bug The splitting of the command is wrong and awful.
+	# @param file the path of the script file
+	
+	def processFile(self, file):
+		try:
+			handler = open(file)
+		except IOError:
+			logSys.fatal("Unable to open " + file)
+			return False
+		for line in handler:
+			l = line.strip()
+			if l.find('#') != 0:
+				s = re.split("\s+", l, 3)
+				j = list()
+				for i in s:
+					j.append(i.strip("'"))
+				self.processCommand(j)
+		return True
+	
+	##
+	# Start Fail2Ban server.
+	#
+	# Start the Fail2ban server in daemon mode.
+	
+	def startServer(self, background = True):
+		args = list()
+		args.append("fail2ban-server")
+		if background:
+			args.append("-b")
+		else:
+			args.append("-f")
+		
+		pid = os.fork()
+		if pid == 0:
+			os.execv("fail2ban-server", args)
+		else:
+			# Wait for the server to start
+			while not self.ping():
+				time.sleep(0.1)
+	
+	def start(self, argv):
+		# Command line options
+		self.argv = argv
+		
+		# Reads the command line options.
+		try:
+			cmdOpts = 'bfhc:s:d'
+			cmdLongOpts = ['help']
+			optList, args = getopt.getopt(self.argv[1:], cmdOpts, cmdLongOpts)
+		except getopt.GetoptError:
+			self.dispUsage()
+			
+		self.getCmdLineOptions(optList)
+		
+		logSys.setLevel(logging.DEBUG)
+		# Add the default logging handler
+		stdout = logging.StreamHandler(sys.stdout)
+		# set a format which is simpler for console use
+		formatter = logging.Formatter('%(name)-16s: %(levelname)-6s %(message)s')
+		# tell the handler to use this format
+		stdout.setFormatter(formatter)
+		logSys.addHandler(stdout)
+
+		if self.conf["cmdfile"] == None:
+			self.processCommand(args)
+		else:
+			self.processFile(self.conf["cmdfile"])
+
+	def readConfig(self):
+		# Read the configuration
+		cfg = Configurator()
+		cfg.setBaseDir("config")
+		cfg.readAll()
+		cfg.getAllOptions()
+		cfg.convertToProtocol()
+		self.stream = cfg.getConfigStream()
+	
+	@staticmethod
+	def dumpConfig(cmd):
+		for c in cmd:
+			print c
+		return True
+
+if __name__ == "__main__":
+	client = Fail2banClient()
+	client.start(sys.argv)
diff --git a/fail2ban-server b/fail2ban-server
new file mode 100755
index 00000000..1d8ece42
--- /dev/null
+++ b/fail2ban-server
@@ -0,0 +1,122 @@
+#!/usr/bin/env python
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from server.server import Server
+from utils.process import *
+import locale, getopt, logging, sys
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+##
+# \mainpage Fail2Ban
+#
+# \section Introduction
+#
+# Fail2ban is designed to protect your server against brute force attacks.
+# Its first goal was to protect a SSH server.
+
+class Fail2banServer:
+	
+	def __init__(self):
+		self.server = None
+		self.argv = None
+		self.conf = dict()
+		self.conf["background"] = True
+	
+	def dispUsage(self):
+		""" Prints Fail2Ban command line options and exits
+		"""
+		print "Usage: "+self.argv[0]+" [OPTIONS]"
+		print
+		print "Fail2Ban v0.7 reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print
+		print "  -b         start in background"
+		print "  -f         start in foreground"
+		print "  -h         display this help message"
+		print
+		print "Report bugs to <lostcontrol@users.sourceforge.net>"
+		sys.exit(0)
+	
+	def getCmdLineOptions(self, optList):
+		""" Gets the command line options
+		"""
+		for opt in optList:
+			if opt[0] == "-b":
+				self.conf["background"] = True
+			if opt[0] == "-f":
+				self.conf["background"] = False
+			if opt[0] in ["-h", "--help"]:
+	 			self.dispUsage()
+	
+	#def sigTERMhandler(signum, frame):
+	#	""" Handles the TERM signal when in daemon mode in order to
+	#		exit properly.
+	#	"""
+	#	logSys.debug("Signal handler called with sig "+`signum`)
+	#	server.quit()
+	
+	def start(self, argv):
+		# Command line options
+		self.argv = argv
+		
+		# Reads the command line options.
+		try:
+			cmdOpts = 'bfh'
+			cmdLongOpts = ['help']
+			optList, args = getopt.getopt(self.argv[1:], cmdOpts, cmdLongOpts)
+		except getopt.GetoptError:
+			self.dispUsage()
+			
+		self.getCmdLineOptions(optList)
+		
+		# Add the default logging handler
+		stdout = logging.StreamHandler(sys.stdout)
+		# set a format which is simpler for console use
+		formatter = logging.Formatter('%(name)-16s: %(levelname)-6s %(message)s')
+		# tell the handler to use this format
+		stdout.setFormatter(formatter)
+		logSys.addHandler(stdout)
+		
+		if self.conf["background"]:
+			retCode = createDaemon()
+			#signal.signal(signal.SIGTERM, sigTERMhandler)
+			if not retCode:
+				logSys.error("Unable to start daemon")
+				sys.exit(-1)
+		
+		try:
+			self.server = Server()
+			self.server.start()
+		except Exception, e:
+			print e
+			self.server.quit()
+		
+if __name__ == "__main__":
+	server = Fail2banServer()
+	server.start(sys.argv)
diff --git a/fail2ban-testcases b/fail2ban-testcases
new file mode 100755
index 00000000..3c427fe9
--- /dev/null
+++ b/fail2ban-testcases
@@ -0,0 +1,61 @@
+#!/usr/bin/env python
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+
+import unittest, logging, sys
+
+from testcases import filtertestcase
+from testcases import servertestcase
+from testcases import failmanagertestcase
+from testcases import banmanagertestcase
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+# Add the default logging handler
+stdout = logging.StreamHandler(sys.stdout)
+logSys.addHandler(stdout)
+logSys.setLevel(logging.FATAL)
+
+print "Fail2ban test suite. Please wait..."
+
+tests = unittest.TestSuite()
+
+# Filter
+tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
+tests.addTest(unittest.makeSuite(filtertestcase.LogFile))
+tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
+# Server
+#tests.addTest(unittest.makeSuite(servertestcase.StartStop))
+#tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
+# FailManager
+tests.addTest(unittest.makeSuite(failmanagertestcase.AddFailure))
+# BanManager
+tests.addTest(unittest.makeSuite(banmanagertestcase.AddFailure))
+
+# Tests runner
+testRunner = unittest.TextTestRunner()
+testRunner.run(tests)
diff --git a/fail2ban.py b/fail2ban.py
deleted file mode 100755
index 1ab2ab90..00000000
--- a/fail2ban.py
+++ /dev/null
@@ -1,542 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# Modified by: Yaroslav Halchenko (SYSLOG, findtime)
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import time, sys, getopt, os, string, signal, logging, logging.handlers, copy
-from ConfigParser import *
-
-from version import version
-from firewall.firewall import Firewall
-from logreader.logreader import LogReader
-from confreader.configreader import ConfigReader
-from utils.mail import Mail
-from utils.pidlock import PIDLock
-from utils.dns import *
-from utils.process import *
-
-# Get the instance of the logger.
-logSys = logging.getLogger("fail2ban")
-
-# Get PID lock file instance
-pidLock = PIDLock()
-
-# Global variables
-logFwList = list()
-conf = dict()
-
-def dispUsage():
-	""" Prints Fail2Ban command line options and exits
-	"""
-	print "Usage: "+sys.argv[0]+" [OPTIONS]"
-	print
-	print "Fail2Ban v"+version+" reads log file that contains password failure report"
-	print "and bans the corresponding IP addresses using firewall rules."
-	print
-	print "  -b         start in background"
-	print "  -c <FILE>  read configuration file FILE"
-	print "  -p <FILE>  create PID lock in FILE"
-	print "  -h         display this help message"
-	print "  -i <IP(s)> IP(s) to ignore"
-	print "  -k         kill a currently running instance"
-	print "  -r <VALUE> allow a max of VALUE password failure [maxfailures]"
-	print "  -t <TIME>  ban IP for TIME seconds [bantime]"
-	print "  -f <TIME>  lifetime in seconds of failed entry [findtime]"
-	print "  -v         verbose. Use twice for greater effect"
-	print "  -V         print software version"
-	print
-	print "Report bugs to <lostcontrol@users.sourceforge.net>"
-	sys.exit(0)
-
-def dispVersion():
-	""" Prints Fail2Ban version and exits
-	"""
-	print sys.argv[0]+" "+version
-	sys.exit(0)
-
-def checkForRoot():
-	""" Check for root user.
-	"""
-	uid = `os.getuid()`
-	if uid == '0':
-		return True
-	else:
-		return False
-
-def sigTERMhandler(signum, frame):
-	""" Handles the TERM signal when in daemon mode in order to
-		exit properly.
-	"""
-	logSys.debug("Signal handler called with sig "+`signum`)
-	killApp()	
-
-def setFwMustCheck(value):
-	""" Set the mustCheck value of the firewalls (True/False)
-	"""
-	for element in logFwList:
-		element[2].setMustCheck(value)
-
-def initializeFwRules():
-	""" Initializes firewalls by running cmdstart and then
-	    fwstart for each section
-	"""
-	# Execute global start command
-	executeCmd(conf["cmdstart"], conf["debug"])
-	# Execute start command of each section
-	for element in logFwList:
-		element[2].initialize(conf["debug"])
-
-def reBan():
-	""" For each section asks the Firewall to reban known IPs
-	"""
-	for element in logFwList:
-		element[2].reBan(conf["debug"])
-
-def restoreFwRules():
-	""" Flush the ban list
-	"""
-	logSys.warn("Restoring firewall rules...")
-	try:
-		for element in logFwList:
-			# Execute end command of each section
-			element[2].restore(conf["debug"])
-		# Execute global end command
-		executeCmd(conf["cmdend"], conf["debug"])
-	except ExternalError:
-		# nothing bad really - we can survive :-)
-		pass
-
-def killApp():
-	""" Flush the ban list, remove the PID lock file and exit
-		nicely.
-	"""
-	# Restore Fw rules
-	restoreFwRules()
-	# Remove the PID lock
-	pidLock.remove()
-	logSys.info("Exiting...")
-	logging.shutdown()
-	sys.exit(0)
-
-def getCmdLineOptions(optList):
-	""" Gets the command line options
-	"""
-	for opt in optList:
-		if opt[0] == "-v":
-			conf["verbose"] = conf["verbose"] + 1
-		if opt[0] == "-b":
-			conf["background"] = True
-		if opt[0] == "-d":
-			conf["debug"] = True
-		if opt[0] == "-t":
-			try:
-				conf["bantime"] = int(opt[1])
-			except ValueError:
-				logSys.warn("banTime must be an integer")
-				logSys.warn("Using default value")
-		if opt[0] == "-f":
-			try:
-				conf["findtime"] = int(opt[1])
-			except ValueError:
-				logSys.warn("findTime must be an integer")
-				logSys.warn("Using default value")
-		if opt[0] == "-i":
-			conf["ignoreip"] = opt[1]
-		if opt[0] == "-r":
-			conf["maxfailures"] = int(opt[1])
-		if opt[0] == "-p":
-			conf["pidlock"] = opt[1]
-		if opt[0] == "-k":
-			conf["kill"] = True
-
-def main():
-	""" Fail2Ban main function
-	"""
-	
-	# Add the default logging handler
-	stdout = logging.StreamHandler(sys.stdout)
-	logSys.addHandler(stdout)
-	
-	# Default formatter
-	formatterstring='%(levelname)s: %(message)s'
-	formatter = logging.Formatter('%(asctime)s ' + formatterstring)
-	stdout.setFormatter(formatter)
-	
-	conf["kill"] = False
-	conf["debug"] = False
-	conf["verbose"] = 0
-	conf["conffile"] = "/etc/fail2ban.conf"
-	
-	# Reads the command line options.
-	try:
-		cmdOpts = 'hvVbdkc:t:i:r:p:'
-		cmdLongOpts = ['help','version']
-		optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
-	except getopt.GetoptError:
-		dispUsage()
-	
-	# Pre-parsing of command line options for the -c option
-	for opt in optList:
-		if opt[0] == "-c":
-			conf["conffile"] = opt[1]
-		if opt[0] in ["-h", "--help"]:
- 			dispUsage()
-		if opt[0] in ["-V", "--version"]:
-			dispVersion()
-	
-	# Reads the config file and create a LogReader instance for
-	# each log file to check.
-	confReader = ConfigReader(conf["conffile"])
-	confReader.openConf()
-	
-	# Options
-	optionValues = (["bool", "background", False],
-					["str", "logtargets", "/var/log/fail2ban.log"],
-					["str", "syslog-target", "/dev/log"],
-					["int", "syslog-facility", 1],
-					["str", "pidlock", "/var/run/fail2ban.pid"],
-					["int", "maxfailures", 5],
-					["int", "bantime", 600],
-					["int", "findtime", 600],
-					["str", "ignoreip", ""],
-					["int", "polltime", 1],
-					["str", "cmdstart", ""],
-					["str", "cmdend", ""],
-					["int", "reinittime", 100],
-					["int", "maxreinits", 100])
-	
-	# Gets global configuration options
-	conf.update(confReader.getLogOptions("DEFAULT", optionValues))
-	
-	# Gets command line options
-	getCmdLineOptions(optList)
-	
-	# PID lock
-	pidLock.setPath(conf["pidlock"])
-	
-	# Now we can kill properly a running instance if needed
-	if conf["kill"]:
-		pid = pidLock.exists()
-		if pid:
-			killPID(int(pid))
-			logSys.warn("Killed Fail2Ban with PID "+pid)
-			sys.exit(0)
-		else:
-			logSys.error("No running Fail2Ban found")
-			sys.exit(-1)
-
-	# Start Fail2Ban in daemon mode
-	if conf["background"]:
-		retCode = createDaemon()
-		signal.signal(signal.SIGTERM, sigTERMhandler)
-		if not retCode:
-			logSys.error("Unable to start daemon")
-			sys.exit(-1)
-
-	# Process some options
-	# First setup Log targets
-	# Bug fix for #1234699
-	os.umask(0077)
-	for target in conf["logtargets"].split():
-		# target formatter 
-		# By default global formatter is taken. Is different for SYSLOG
-		tformatter = formatter
-		if target == "STDERR":
-			hdlr = logging.StreamHandler(sys.stderr)
-		elif target == "SYSLOG":
-			# SYSLOG target can be either
-			# a socket (file, so it starts with /)
-			# or hostname
-			# or hostname:port
-			syslogtargets = re.findall("(/[\w/]*)|([^/ ][^: ]*)(:(\d+)){,1}",
-									   conf["syslog-target"])
-			# we are waiting for a single match
-			syslogtargets = syslogtargets[0]
-
-			# assign facility if it was defined
-			if conf["syslog-facility"] < 0:
-				facility = handlers.SysLogHandler.LOG_USER
-			else:
-				facility = conf["syslog-facility"]
-
-			if len(syslogtargets) == 0: # everything default
-				hdlr = logging.handlers.SysLogHandler()
-			else:
-				if not ( syslogtargets[0] == "" ): # got socket
-					syslogtarget = syslogtargets[0]
-				else:		# got hostname and maybe a port
-					if syslogtargets[3] == "": # no port specified
-						port = 514
-					else:
-						port = int(syslogtargets[3])
-					syslogtarget = (syslogtargets[1], port)
-				hdlr = logging.handlers.SysLogHandler(syslogtarget, facility)
-			tformatter = logging.Formatter("%(asctime)s %(name)s " +
-										    formatterstring, "%b %e %T");
-		else:
-			# Target should be a file
-			try:
-				open(target, "a")
-				hdlr = logging.FileHandler(target)
-			except IOError:
-				logSys.error("Unable to log to " + target)
-				continue
-		# Set formatter and add handler to logger
-		hdlr.setFormatter(tformatter)
-		logSys.addHandler(hdlr)
-	
-	# Verbose level
-	if conf["verbose"]:
-		logSys.warn("Verbose level is "+`conf["verbose"]`)
-		if conf["verbose"] == 1:
-			logSys.setLevel(logging.INFO)
-		elif conf["verbose"] > 1:
-			logSys.setLevel(logging.DEBUG)
-		if conf["verbose"] > 2:
-			formatterstring = ('%(levelname)s: [%(filename)s (%(lineno)d)] ' +
-						   '%(message)s')
-			formatter = logging.Formatter("%(asctime)s " + formatterstring)
-			stdout.setFormatter(formatter)
-	
-	# Debug mode. Should only be used by developers
-	if conf["debug"]:
-		logSys.warn("DEBUG MODE: FIREWALL COMMANDS ARE _NOT_ EXECUTED BUT " +
-					"ONLY DISPLAYED IN THE LOG MESSAGES")
-	
-	# Ignores IP list
-	ignoreIPList = conf["ignoreip"].split(' ')
-
-	# Checks for root user. This is necessary because log files
-	# are owned by root and firewall needs root access.
-	if not checkForRoot():
-		logSys.error("You must be root")
-		if not conf["debug"]:
-			sys.exit(-1)
-			
-	# Checks that no instance of Fail2Ban is currently running.
-	pid = pidLock.exists()
-	if pid:
-		logSys.error("Fail2Ban already running with PID "+pid)
-		sys.exit(-1)
-	else:
-		ret = pidLock.create()
-		if not ret:
-			# Unable to create PID lock. Exit
-			sys.exit(-1)
-	
-	logSys.debug("ConfFile is " + conf["conffile"])
-	logSys.debug("BanTime is " + `conf["bantime"]`)
-	logSys.debug("FindTime is " + `conf["findtime"]`)
-	logSys.debug("MaxFailure is " + `conf["maxfailures"]`)
-	
-	# Options
-	optionValues = (["bool", "enabled", False],
-					["str", "host", "localhost"],
-					["int", "port", "25"],
-					["str", "from", "root"],
-					["str", "to", "root"],
-					["str", "user", ''],
-					["str", "password", ''],
-					["bool", "localtime", False],
-					["str", "subject", "[Fail2Ban] Banned <ip>"],
-					["str", "message", "Fail2Ban notification"])
-	
-	# Gets global configuration options
-	mailConf = confReader.getLogOptions("MAIL", optionValues)
-	
-	# Create mailer if enabled
-	if mailConf["enabled"]:
-		logSys.debug("Mail enabled")
-		mail = Mail(mailConf["host"], mailConf["port"])
-		mail.setFromAddr(mailConf["from"])
-		mail.setUser(mailConf["user"])
-		mail.setPassword(mailConf["password"])
-		mail.setToAddr(mailConf["to"])
-		mail.setLocalTimeFlag(mailConf["localtime"])
-		logSys.debug("to: " + mailConf["to"] + " from: " + mailConf["from"])
-	
-	# Options
-	optionValues = (["bool", "enabled", False],
-					["str", "logfile", "/dev/null"],
-					["int", "maxfailures", conf["maxfailures"]],
-					["int", "bantime", conf["bantime"]],
-					["int", "findtime", conf["findtime"]],
-					["str", "timeregex", ""],
-					["str", "timepattern", ""],
-					["str", "failregex", ""],
-					["str", "fwstart", ""],
-					["str", "fwend", ""],
-					["str", "fwban", ""],
-					["str", "fwunban", ""],
-					["str", "fwcheck", ""])
-	
-	logSys.info("Fail2Ban v" + version + " is running")
-	
-	# Gets the options of each sections
-	for t in confReader.getSections():
-		l = confReader.getLogOptions(t, optionValues)
-		if l["enabled"]:
-			# Creates a logreader object
-			lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
-							 l["failregex"], l["maxfailures"], l["findtime"])
-			# Creates a firewall object
-			fObj = Firewall(l["fwstart"], l["fwend"], l["fwban"], l["fwunban"],
-							l["fwcheck"], l["bantime"])
-			# "Name" the firewall
-			fObj.setSection(t)
-			# Links them into a list. I'm not really happy
-			# with this :/
-			logFwList.append([t, lObj, fObj, dict(), l])
-	
-	# We add 127.0.0.1 to the ignore list has we do not want
-	# to be ban ourself.
-	for element in logFwList:
-		element[1].addIgnoreIP("127.0.0.1")
-	while len(ignoreIPList) > 0:
-		ip = ignoreIPList.pop()
-		# Bug fix for #1239557
-		if isValidIP(ip):
-			for element in logFwList:
-				element[1].addIgnoreIP(ip)
-		else:
-			logSys.warn(ip + " is not a valid IP address")
-	
-	# Startup loop -- necessary to avoid crash if it takes time for iptables
-	# to startup. To avoid introduction of new config options, reusing
-	# maxreinits and polltime.
-	reinits = 0
-	while True:
-		try:
-			initializeFwRules()
-			break
-		except ExternalError, e:
-			reinits += 1
-			logSys.warn(e)
-			if conf["maxreinits"] < 0 or (reinits < conf["maxreinits"]):
-				logSys.warn("#%d attempt to initialize the firewalls" % reinits)
-			else:
-				logSys.error("Exiting: Too many attempts to initialize the " +
-							 "firewall")
-				killApp()
-			time.sleep(conf["polltime"])
-
-	# try to reinit once if it fails immediately
-	lastReinitTime = time.time() - conf["reinittime"] - 1
-	reinits = 0
-	# Main loop
-	while True:
-		try:
-			sys.stdout.flush()
-			sys.stderr.flush()
-			
-			# Checks if some IP have to be remove from ban
-			# list.
-			for element in logFwList:
-				element[2].checkForUnBan(conf["debug"])
-
-			# If the log file has not been modified since the
-			# last time, we sleep for 1 second. This is active
-			# polling so not very effective.
-			modList = list()
-			for element in logFwList:
-				if element[1].isModified():
-					modList.append(element)
-			
-			if len(modList) == 0:
-				time.sleep(conf["polltime"])
-				continue
-			
-			# Gets the failure list from the log file. For a given IP,
-			# takes only the service which has the most password failures.
-			for element in modList:
-				e = element[1].getFailures()
-				for key in e.iterkeys():
-					if element[3].has_key(key):
-						element[3][key] = (element[3][key][0] + e[key][0],
-											e[key][1])
-					else:
-						element[3][key] = (e[key][0], e[key][1])
-			
-			# Remove the oldest failure attempts from the global list.
-			# We iterate the failure list and ban IP that make
-			# *retryAllowed* login failures.
-			unixTime = time.time()
-			for element in logFwList:
-				fails = element[3].copy()
-				findTime = element[1].getFindTime()
-				for attempt in fails:
-					failTime = fails[attempt][1]
-					if failTime < unixTime - findTime:
-						del element[3][attempt]
-					elif fails[attempt][0] >= element[1].getMaxRetry():
-						aInfo = {"section": element[0],
-								 "ip": attempt,
-								 "failures": element[3][attempt][0],
-								 "failtime": failTime}
-						logSys.info(element[0] + ": " + aInfo["ip"] +
-									" has " + `aInfo["failures"]` +
-									" login failure(s). Banned.")
-						element[2].addBanIP(aInfo, conf["debug"])
-						# Send a mail notification
-						if 'mail' in locals():
-							mail.sendmail(mailConf["subject"],
-										  mailConf["message"], aInfo)
-						del element[3][attempt]
-		except ExternalError, e:
-			# Something wrong while dealing with Iptables.
-			# May be chain got removed?
-			reinits += 1
-			logSys.error(e)
-			if ((unixTime - lastReinitTime > conf["reinittime"]) and
-				((conf["maxreinits"] < 0) or (reinits < conf["maxreinits"]))):
-				logSys.warn("#%d reinitialization of firewalls"%reinits)
-				lastReinitTime = unixTime
-			else:
-				logSys.error("Exiting: reinits follow too often, or too many " +
-							 "reinit attempts")
-				killApp()
-			# We already failed runCheck so disable it until
-			# restoring a safe state
-			setFwMustCheck(False)
-			# save firewalls to keep a list of IPs for rebanning
-			logFwListCopy = copy.deepcopy(logFwList)
-			try:
-				# restore as much as possible
-				restoreFwRules()
-				# reinitialize all the chains
-				initializeFwRules()
-				# restore the lists of baned IPs
-				logFwList.__init__(logFwListCopy)
-				# reBan known IPs
-				reBan()
-				# Now we can enable the runCheck test again
-				setFwMustCheck(True)
-			except ExternalError:
-				raise ExternalError("Big Oops happened: situation is out of " +
-									"control. Something is wrong with your " +
-									"setup. Please check your settings")
-		except KeyboardInterrupt:
-			# When the user press <ctrl>+<c> we exit nicely.
-			killApp()
diff --git a/firewall/firewall.py b/firewall/firewall.py
deleted file mode 100644
index ebba2545..00000000
--- a/firewall/firewall.py
+++ /dev/null
@@ -1,192 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import time, os, logging, re
-
-from utils.process import executeCmd
-from utils.strings import replaceTag
-# unfortunately but I have to bring ExternalError in especially for
-# flushBanList: if one of IPs got flushed manually outside or something, we
-# might endup with not "full" flush unless we handle exception within the loop
-from utils.process import ExternalError
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban")
-
-class Firewall:
-	""" Manages the ban list and executes the command that ban
-		the IP.
-	"""
-	
-	def __init__(self, startRule, endRule, banRule, unBanRule, checkRule,
-				 banTime):
-		self.banRule = banRule
-		self.unBanRule = unBanRule
-		self.checkRule = checkRule
-		self.startRule = startRule
-		self.endRule = endRule
-		self.banTime = banTime
-		self.banList = dict()
-		self.section = ""
-		self.mustCheck = True
-
-	def setSection(self, section):
-		""" Set optional section name for clarify of logging
-		"""
-		self.section = section
-		
-	def getMustCheck(self):
-		""" Return true if the runCheck test is executed
-		"""
-		return self.mustCheck
-	
-	def setMustCheck(self, value):
-		""" Enable or disable the execution of runCheck test
-		"""
-		self.mustCheck = value
-
-  	def initialize(self, debug):
-		logSys.debug("%s: Initialize firewall rules"%self.section)
-  		executeCmd(self.startRule, debug)
-
-	def restore(self, debug):
-		logSys.debug("%s: Restore firewall rules"%self.section)
-		try:
-			self.flushBanList(debug)
-			executeCmd(self.endRule, debug)
-		except ExternalError:
-			pass
-
-	def addBanIP(self, aInfo, debug):
-		""" Bans an IP.
-		"""
-		ip = aInfo["ip"]
-		if not self.inBanList(ip):
-			crtTime = time.time()
-			if self.banTime < 0:
-				banMsg = "Ban (permanent)"
-			else:
-				banMsg = "Ban (%d s)"%self.banTime
-			logSys.warn("%s: %s "%(self.section, banMsg) + ip)
-			self.banList[ip] = crtTime
-			aInfo["bantime"] = crtTime
-			self.runCheck(debug)
-			cmd = self.banIP(aInfo)
-			if executeCmd(cmd, debug):
-				raise ExternalError("Firewall: execution of fwban command " +
-									"'%s' failed"%cmd)
-		else:
-			self.runCheck(debug)
-			logSys.error("%s: "%self.section+ip+" already in ban list")
-	
-	def delBanIP(self, aInfo, debug):
-		""" Unban an IP.
-		"""
-		ip = aInfo["ip"]
-		if self.inBanList(ip):
-			logSys.warn("%s: Unban "%self.section + ip)
-			del self.banList[ip]
-			self.runCheck(debug)
-			executeCmd(self.unBanIP(aInfo), debug)
-		else:
-			logSys.error("%s: "%self.section+ip+" not in ban list")
-
-	def reBan(self, debug):
-		""" Re-Bans known IPs.
-			TODO: implement "failures" and "failtime"
-		"""
-		for ip in self.banList:
-			aInfo = {"ip": ip,
-					 "bantime":self.banList[ip]}
-			logSys.warn("%s: ReBan "%self.section + ip)
-			# next piece is similar to the on in addBanIp
-			# so might be one more function will not hurt
-			self.runCheck(debug)
-			executeCmd(self.banIP(aInfo), debug)
-	
-	def inBanList(self, ip):
-		""" Checks if IP is in ban list.
-		"""
-		return self.banList.has_key(ip)
-
-	def runCheck(self, debug):
-		""" Runs fwcheck command and throws an exception if it returns non-0
-			result
-		"""
-		if self.mustCheck:
-			executeCmd(self.checkRule, debug)
-		else:
-			return None
-
-	def checkForUnBan(self, debug):
-		""" Check for IP to remove from ban list. If banTime is smaller than
-			zero, IP will be never removed.
-		"""
-		if self.banTime < 0:
-			# Permanent banning
-			return
-		banListTemp = self.banList.copy()
-		for element in banListTemp.iteritems():
-			btime = element[1]
-			if btime < time.time()-self.banTime:
-				aInfo = {"ip": element[0],
-						 "bantime": btime,
-						 "unbantime": time.time()}
-				self.delBanIP(aInfo, debug)
-	
-	def flushBanList(self, debug):
-		""" Flushes the ban list and of course the firewall rules.
-			Called when fail2ban exits.
-		"""
-		banListTemp = self.banList.copy()
-		for element in banListTemp.iteritems():
-			aInfo = {"ip": element[0],
-					 "bantime": element[1],
-					 "unbantime": time.time()}
-			try:
-				self.delBanIP(aInfo, debug)
-			except ExternalError:
-				# we must let it fail here in the loop, or we don't
-				# flush properly
-				pass
-			
-	def banIP(self, aInfo):
-		""" Returns query to ban IP.
-		"""
-		query = replaceTag(self.banRule, aInfo)
-		return query
-	
-	def unBanIP(self, aInfo):
-		""" Returns query to unban IP.
-		"""
-		query = replaceTag(self.unBanRule, aInfo)
-		return query
-	
-	def viewBanList(self):
-		""" Prints the ban list on screen. Usefull for debugging.
-		"""
-		for element in self.banList.iteritems():
-			print element
diff --git a/kill-server b/kill-server
new file mode 100755
index 00000000..0e6a26db
--- /dev/null
+++ b/kill-server
@@ -0,0 +1,2 @@
+#!/bin/bash
+kill `ps ax|grep fail2ban|grep -v grep|awk '{print $1}'`
diff --git a/log-test/apache b/log-test/apache
deleted file mode 100644
index 227f8df9..00000000
--- a/log-test/apache
+++ /dev/null
@@ -1,108 +0,0 @@
-[Wed Mar 31 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Mon Jan 03 05:02:15 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:21 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/\xe0
-[Mon Jan 03 05:02:23 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msdac
-[Mon Jan 03 05:02:23 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msdac
-[Mon Jan 03 05:02:24 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/PBServer
-[Mon Jan 03 05:02:24 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/PBServer
-[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/Rpc
-[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/Rpc
-[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/samples
-[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/samples
-[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts..\xc1\x9c..
-[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:32 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:32 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:34 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:34 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:39 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:39 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 11:08:29 2005] [error] [client 128.178.150.127] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Mon Jan 03 20:08:52 2005] [error] [client 83.76.202.195] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:19:50 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:19:55 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:01 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:05 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:08 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:12 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:16 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:22 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:26 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:28 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:38 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 20:54:59 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 20:55:04 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 20:55:29 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 21:34:29 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 21:34:32 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 00:17:41 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 00:18:03 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 00:18:12 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:24:38 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:24:40 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:24:46 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:24:48 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:25:58 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:26:34 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:26:37 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 10:13:02 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 10:13:07 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 10:13:10 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 10:17:07 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:41:40 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:41:45 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:41:47 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:41:51 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:55:30 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:03:44 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:03:48 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:03:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:03:57 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:06:45 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Mar 05 15:07:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Jan 05 15:08:01 2005] [error] [client 192.168.0.128] user  not found: /phpinfo
-[Wed Jan 05 15:10:45 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/css/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
-[Wed Jan 05 15:10:45 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/images/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
-[Wed Jan 05 15:10:45 2005] [error] [client 192.168.0.128] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:11:09 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 05 15:11:10 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 06 15:11:11 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 06 15:11:13 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 06 15:11:14 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 05 15:11:15 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/css/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
-[Wed Jan 05 15:11:15 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/images/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
-[Wed Jan 05 15:11:15 2005] [error] [client 192.168.0.128] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:12:32 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:48 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:51 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:54 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:56 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:59 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:14:20 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:14:24 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:14:29 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:14:34 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Mar 10 15:08:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 10 15:09:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 10 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
\ No newline at end of file
diff --git a/log-test/current b/log-test/current
deleted file mode 100644
index 18258689..00000000
--- a/log-test/current
+++ /dev/null
@@ -1,11 +0,0 @@
-Jan  7 17:53:15 [sshd] (pam_unix) 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.220.137.36  user=kevin
-Jan  7 17:53:26 [sshd] (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.220.137.36  user=kevin
-Mar  7 17:53:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
-Mar  7 17:55:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from www.google.ch
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from www.google.ch
diff --git a/log-test/test b/log-test/test
deleted file mode 100644
index d370ca46..00000000
--- a/log-test/test
+++ /dev/null
@@ -1,432 +0,0 @@
-Sep 28 13:18:43 [sshd] Failed password for illegal user test from 211.112.229.69 port 59506 ssh2
-Sep 28 13:18:45 [sshd] Failed password for illegal user guest from 211.112.229.69 port 59584 ssh2
-Sep 28 13:18:48 [sshd] Failed password for illegal user admin from 211.112.229.69 port 59668 ssh2
-Sep 28 13:18:51 [sshd] Failed password for illegal user admin from 211.112.229.69 port 59746 ssh2
-Sep 28 13:18:54 [sshd] Failed password for illegal user user from 211.112.229.69 port 59809 ssh2
-Sep 28 13:18:57 [sshd] Failed password for illegal user root from 211.112.229.69 port 59881 ssh2
-Sep 28 13:19:00 [sshd] Failed password for illegal user root from 211.112.229.69 port 59944 ssh2
-Sep 28 13:19:03 [sshd] Failed password for illegal user root from 211.112.229.69 port 59999 ssh2
-Sep 28 13:19:06 [sshd] Failed password for illegal user test from 211.112.229.69 port 60055 ssh2
-Sep 28 21:05:25 [sshd(pam_unix)] authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.128.local.home  user=cyril
-Sep 28 21:05:27 [sshd] error: PAM: Authentication failure for cyril from 192.168.0.128.local.home
-Sep 29 03:45:18 [sshd] Failed password for illegal user nobody from 203.198.168.66 port 55927 ssh2
-Sep 29 03:45:21 [sshd] Failed password for illegal user patrick from 203.198.168.66 port 55973 ssh2
-Sep 29 03:45:23 [sshd] Failed password for illegal user patrick from 203.198.168.66 port 56010 ssh2
-Sep 29 03:45:26 [sshd] Failed password for illegal user root from 203.198.168.66 port 56060 ssh2
-Sep 29 03:45:29 [sshd] Failed password for illegal user root from 203.198.168.66 port 56107 ssh2
-Sep 29 03:45:32 [sshd] Failed password for illegal user root from 203.198.168.66 port 56152 ssh2
-Sep 29 03:45:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 56200 ssh2
-Sep 29 03:45:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 56243 ssh2
-Sep 29 03:45:40 [sshd] Failed password for illegal user rolo from 203.198.168.66 port 56288 ssh2
-Sep 29 03:45:43 [sshd] Failed password for illegal user iceuser from 203.198.168.66 port 56333 ssh2
-Sep 29 03:45:46 [sshd] Failed password for illegal user horde from 203.198.168.66 port 56379 ssh2
-Sep 29 03:45:48 [sshd] Failed password for illegal user cyrus from 203.198.168.66 port 56425 ssh2
-Sep 29 03:45:52 [sshd] Failed password for illegal user www from 203.198.168.66 port 56470 ssh2
-Sep 29 03:45:55 [sshd] Failed password for illegal user wwwrun from 203.198.168.66 port 56534 ssh2
-Sep 29 03:45:58 [sshd] Failed password for illegal user matt from 203.198.168.66 port 56572 ssh2
-Sep 29 03:46:01 [sshd] Failed password for illegal user test from 203.198.168.66 port 56616 ssh2
-Sep 29 03:46:03 [sshd] Failed password for illegal user test from 203.198.168.66 port 56660 ssh2
-Sep 29 03:46:06 [sshd] Failed password for illegal user test from 203.198.168.66 port 56704 ssh2
-Sep 29 03:46:09 [sshd] Failed password for illegal user test from 203.198.168.66 port 56752 ssh2
-Sep 29 03:46:12 [sshd] Failed password for illegal user www-data from 203.198.168.66 port 56795 ssh2
-Sep 29 03:46:15 [sshd] Failed password for illegal user mysql from 203.198.168.66 port 56839 ssh2
-Sep 29 03:46:17 [sshd] Failed password for illegal user operator from 203.198.168.66 port 56882 ssh2
-Sep 29 03:46:20 [sshd] Failed password for illegal user adm from 203.198.168.66 port 56929 ssh2
-Sep 29 03:46:23 [sshd] Failed password for illegal user apache from 203.198.168.66 port 56971 ssh2
-Sep 29 03:46:26 [sshd] Failed password for illegal user irc from 203.198.168.66 port 57011 ssh2
-Sep 29 03:46:29 [sshd] Failed password for illegal user irc from 203.198.168.66 port 57060 ssh2
-Sep 29 03:46:31 [sshd] Failed password for illegal user adm from 203.198.168.66 port 57100 ssh2
-Sep 29 03:46:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 57148 ssh2
-Sep 29 03:46:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 57194 ssh2
-Sep 29 03:46:40 [sshd] Failed password for illegal user root from 203.198.168.66 port 57236 ssh2
-Sep 29 03:46:43 [sshd] Failed password for illegal user jane from 203.198.168.66 port 57281 ssh2
-Sep 29 03:46:45 [sshd] Failed password for illegal user pamela from 203.198.168.66 port 57328 ssh2
-Sep 29 03:46:48 [sshd] Failed password for illegal user root from 203.198.168.66 port 57372 ssh2
-Sep 29 03:46:51 [sshd] Failed password for illegal user root from 203.198.168.66 port 57418 ssh2
-Sep 29 03:46:54 [sshd] Failed password for illegal user root from 203.198.168.66 port 57463 ssh2
-Sep 29 03:46:57 [sshd] Failed password for illegal user root from 203.198.168.66 port 57506 ssh2
-Sep 29 03:46:59 [sshd] Failed password for illegal user root from 203.198.168.66 port 57549 ssh2
-Sep 29 03:47:02 [sshd] Failed password for illegal user cosmin from 203.198.168.66 port 57594 ssh2
-Sep 29 03:47:05 [sshd] Failed password for illegal user root from 203.198.168.66 port 57637 ssh2
-Sep 29 03:47:08 [sshd] Failed password for illegal user root from 203.198.168.66 port 57689 ssh2
-Sep 29 03:47:11 [sshd] Failed password for illegal user root from 203.198.168.66 port 57730 ssh2
-Sep 29 03:47:13 [sshd] Failed password for illegal user root from 203.198.168.66 port 57774 ssh2
-Sep 29 03:47:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 57820 ssh2
-Sep 29 03:47:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 57866 ssh2
-Sep 29 03:47:22 [sshd] Failed password for illegal user root from 203.198.168.66 port 57901 ssh2
-Sep 29 03:47:25 [sshd] Failed password for illegal user root from 203.198.168.66 port 57944 ssh2
-Sep 29 03:47:27 [sshd] Failed password for illegal user root from 203.198.168.66 port 57990 ssh2
-Sep 29 03:47:31 [sshd] Failed password for illegal user root from 203.198.168.66 port 58031 ssh2
-Sep 29 03:47:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 58098 ssh2
-Sep 29 03:47:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 58137 ssh2
-Sep 29 03:47:40 [sshd] Failed password for illegal user root from 203.198.168.66 port 58183 ssh2
-Sep 29 03:47:42 [sshd] Failed password for illegal user root from 203.198.168.66 port 58228 ssh2
-Sep 29 03:47:45 [sshd] Failed password for illegal user root from 203.198.168.66 port 58273 ssh2
-Sep 29 03:47:48 [sshd] Failed password for illegal user root from 203.198.168.66 port 58314 ssh2
-Sep 29 03:47:51 [sshd] Failed password for illegal user root from 203.198.168.66 port 58358 ssh2
-Sep 29 03:47:54 [sshd] Failed password for illegal user root from 203.198.168.66 port 58401 ssh2
-Sep 29 03:47:56 [sshd] Failed password for illegal user root from 203.198.168.66 port 58443 ssh2
-Sep 29 03:47:59 [sshd] Failed password for illegal user root from 203.198.168.66 port 58484 ssh2
-Sep 29 03:48:02 [sshd] Failed password for illegal user root from 203.198.168.66 port 58528 ssh2
-Sep 29 03:48:05 [sshd] Failed password for illegal user root from 203.198.168.66 port 58574 ssh2
-Sep 29 03:48:07 [sshd] Failed password for illegal user root from 203.198.168.66 port 58613 ssh2
-Sep 29 03:48:10 [sshd] Failed password for illegal user root from 203.198.168.66 port 58662 ssh2
-Sep 29 03:48:13 [sshd] Failed password for illegal user root from 203.198.168.66 port 58703 ssh2
-Sep 29 03:48:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 58748 ssh2
-Sep 29 03:48:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 58792 ssh2
-Sep 29 03:48:21 [sshd] Failed password for illegal user root from 203.198.168.66 port 58839 ssh2
-Sep 29 03:48:24 [sshd] Failed password for illegal user root from 203.198.168.66 port 58880 ssh2
-Sep 29 03:48:27 [sshd] Failed password for illegal user root from 203.198.168.66 port 58926 ssh2
-Sep 29 03:48:30 [sshd] Failed password for illegal user root from 203.198.168.66 port 58967 ssh2
-Sep 29 03:48:33 [sshd] Failed password for illegal user root from 203.198.168.66 port 59012 ssh2
-Sep 29 03:48:35 [sshd] Failed password for illegal user root from 203.198.168.66 port 59052 ssh2
-Sep 29 03:48:38 [sshd] Failed password for illegal user root from 203.198.168.66 port 59095 ssh2
-Sep 29 03:48:41 [sshd] Failed password for illegal user root from 203.198.168.66 port 59140 ssh2
-Sep 29 03:48:44 [sshd] Failed password for illegal user root from 203.198.168.66 port 59182 ssh2
-Sep 29 03:48:47 [sshd] Failed password for illegal user cip52 from 203.198.168.66 port 59222 ssh2
-Sep 29 03:48:49 [sshd] Failed password for illegal user cip51 from 203.198.168.66 port 59264 ssh2
-Sep 29 03:48:52 [sshd] Failed password for illegal user root from 203.198.168.66 port 59309 ssh2
-Sep 29 03:48:55 [sshd] Failed password for illegal user noc from 203.198.168.66 port 59351 ssh2
-Sep 29 03:48:58 [sshd] Failed password for illegal user root from 203.198.168.66 port 59395 ssh2
-Sep 29 03:49:01 [sshd] Failed password for illegal user root from 203.198.168.66 port 59432 ssh2
-Sep 29 03:49:04 [sshd] Failed password for illegal user root from 203.198.168.66 port 59479 ssh2
-Sep 29 03:49:07 [sshd] Failed password for illegal user root from 203.198.168.66 port 59951 ssh2
-Sep 29 03:49:11 [sshd] Failed password for illegal user webmaster from 203.198.168.66 port 60006 ssh2
-Sep 29 03:49:14 [sshd] Failed password for illegal user data from 203.198.168.66 port 60463 ssh2
-Sep 29 03:49:17 [sshd] Failed password for illegal user user from 203.198.168.66 port 60880 ssh2
-Sep 29 03:49:20 [sshd] Failed password for illegal user user from 203.198.168.66 port 60947 ssh2
-Sep 29 03:49:23 [sshd] Failed password for illegal user user from 203.198.168.66 port 33137 ssh2
-Sep 29 03:49:26 [sshd] Failed password for illegal user web from 203.198.168.66 port 33572 ssh2
-Sep 29 03:49:31 [sshd] Failed password for illegal user web from 203.198.168.66 port 33630 ssh2
-Sep 29 03:49:34 [sshd] Failed password for illegal user oracle from 203.198.168.66 port 34129 ssh2
-Sep 29 03:49:39 [sshd] Failed password for illegal user sybase from 203.198.168.66 port 34558 ssh2
-Sep 29 03:49:42 [sshd] Failed password for illegal user master from 203.198.168.66 port 35018 ssh2
-Sep 29 03:49:45 [sshd] Failed password for illegal user account from 203.198.168.66 port 35095 ssh2
-Sep 29 03:49:48 [sshd] Failed password for illegal user backup from 203.198.168.66 port 35506 ssh2
-Sep 29 03:49:51 [sshd] Failed password for illegal user server from 203.198.168.66 port 35935 ssh2
-Sep 29 03:49:54 [sshd] Failed password for illegal user adam from 203.198.168.66 port 36016 ssh2
-Sep 29 03:49:57 [sshd] Failed password for illegal user alan from 203.198.168.66 port 36399 ssh2
-Sep 29 03:49:59 [sshd] Failed password for illegal user frank from 203.198.168.66 port 36488 ssh2
-Sep 29 03:50:04 [sshd] Failed password for illegal user george from 203.198.168.66 port 36876 ssh2
-Sep 29 03:50:07 [sshd] Failed password for illegal user henry from 203.198.168.66 port 37333 ssh2
-Sep 29 03:50:11 [sshd] Failed password for illegal user john from 203.198.168.66 port 37423 ssh2
-Sep 29 03:50:14 [sshd] Failed password for illegal user root from 203.198.168.66 port 37837 ssh2
-Sep 29 03:50:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 38210 ssh2
-Sep 29 03:50:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 38286 ssh2
-Sep 29 03:50:22 [sshd] Failed password for illegal user root from 203.198.168.66 port 38653 ssh2
-Sep 29 03:50:26 [sshd] Failed password for illegal user root from 203.198.168.66 port 38749 ssh2
-Sep 29 03:50:29 [sshd] Failed password for illegal user test from 203.198.168.66 port 39162 ssh2
-Sep 29 10:19:26 [sshd] Failed password for illegal user test from 24.19.0.105 port 3765 ssh2
-Sep 29 10:19:32 [sshd] Failed password for illegal user guest from 24.19.0.105 port 3846 ssh2
-Sep 29 10:19:39 [sshd] Failed password for illegal user admin from 24.19.0.105 port 3929 ssh2
-Sep 29 10:19:45 [sshd] Failed password for illegal user admin from 24.19.0.105 port 3992 ssh2
-Sep 29 10:19:49 [sshd] Failed password for illegal user user from 24.19.0.105 port 4057 ssh2
-Sep 29 10:19:54 [sshd] Failed password for illegal user root from 24.19.0.105 port 4115 ssh2
-Sep 29 10:19:58 [sshd] Failed password for illegal user root from 24.19.0.105 port 4170 ssh2
-Sep 29 10:20:01 [sshd] Failed password for illegal user root from 24.19.0.105 port 4202 ssh2
-Sep 29 10:20:04 [sshd] Failed password for illegal user test from 24.19.0.105 port 4242 ssh2
-Oct  1 15:53:46 [sshd] Failed password for illegal user test from 210.51.173.75 port 40940 ssh2
-Oct  1 15:53:53 [sshd] Failed password for illegal user guest from 210.51.173.75 port 41196 ssh2
-Oct  1 15:53:59 [sshd] Failed password for illegal user admin from 210.51.173.75 port 41480 ssh2
-Oct  1 15:54:05 [sshd] Failed password for illegal user admin from 210.51.173.75 port 41738 ssh2
-Oct  1 15:54:12 [sshd] Failed password for illegal user user from 210.51.173.75 port 42036 ssh2
-Oct  1 15:54:18 [sshd] Failed password for illegal user root from 210.51.173.75 port 42393 ssh2
-Oct  1 15:54:24 [sshd] Failed password for illegal user root from 210.51.173.75 port 42721 ssh2
-Oct  1 15:54:30 [sshd] Failed password for illegal user root from 210.51.173.75 port 42984 ssh2
-Oct  1 15:54:36 [sshd] Failed password for illegal user test from 210.51.173.75 port 43299 ssh2
-Oct  2 20:24:36 [sshd] Failed password for illegal user test from 220.64.223.249 port 2460 ssh2
-Oct  2 20:24:39 [sshd] Failed password for illegal user guest from 220.64.223.249 port 2527 ssh2
-Oct  2 20:24:42 [sshd] Failed password for illegal user admin from 220.64.223.249 port 2584 ssh2
-Oct  2 20:24:45 [sshd] Failed password for illegal user admin from 220.64.223.249 port 2645 ssh2
-Oct  2 20:24:48 [sshd] Failed password for illegal user user from 220.64.223.249 port 2708 ssh2
-Oct  2 20:24:51 [sshd] Failed password for illegal user root from 220.64.223.249 port 2794 ssh2
-Oct  2 20:24:54 [sshd] Failed password for illegal user root from 220.64.223.249 port 2868 ssh2
-Oct  2 20:24:58 [sshd] Failed password for illegal user root from 220.64.223.249 port 2931 ssh2
-Oct  2 20:25:01 [sshd] Failed password for illegal user test from 220.64.223.249 port 2994 ssh2
-Oct  3 02:17:47 [sshd] Failed password for illegal user nobody from 216.65.197.170 port 54324 ssh2
-Oct  3 02:17:48 [sshd] Failed password for illegal user patrick from 216.65.197.170 port 54491 ssh2
-Oct  3 02:17:50 [sshd] Failed password for illegal user patrick from 216.65.197.170 port 54669 ssh2
-Oct  3 02:17:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 54845 ssh2
-Oct  3 02:17:53 [sshd] Failed password for illegal user root from 216.65.197.170 port 55021 ssh2
-Oct  3 02:17:55 [sshd] Failed password for illegal user root from 216.65.197.170 port 55201 ssh2
-Oct  3 02:17:57 [sshd] Failed password for illegal user root from 216.65.197.170 port 55381 ssh2
-Oct  3 02:17:59 [sshd] Failed password for illegal user root from 216.65.197.170 port 55553 ssh2
-Oct  3 02:18:00 [sshd] Failed password for illegal user rolo from 216.65.197.170 port 55730 ssh2
-Oct  3 02:18:02 [sshd] Failed password for illegal user iceuser from 216.65.197.170 port 55892 ssh2
-Oct  3 02:18:04 [sshd] Failed password for illegal user horde from 216.65.197.170 port 56054 ssh2
-Oct  3 02:18:05 [sshd] Failed password for illegal user cyrus from 216.65.197.170 port 56231 ssh2
-Oct  3 02:18:07 [sshd] Failed password for illegal user www from 216.65.197.170 port 56412 ssh2
-Oct  3 02:18:09 [sshd] Failed password for illegal user wwwrun from 216.65.197.170 port 56594 ssh2
-Oct  3 02:18:11 [sshd] Failed password for illegal user matt from 216.65.197.170 port 56755 ssh2
-Oct  3 02:18:12 [sshd] Failed password for illegal user test from 216.65.197.170 port 56928 ssh2
-Oct  3 02:18:14 [sshd] Failed password for illegal user test from 216.65.197.170 port 57112 ssh2
-Oct  3 02:18:16 [sshd] Failed password for illegal user test from 216.65.197.170 port 57292 ssh2
-Oct  3 02:18:17 [sshd] Failed password for illegal user test from 216.65.197.170 port 57465 ssh2
-Oct  3 02:18:19 [sshd] Failed password for illegal user www-data from 216.65.197.170 port 57631 ssh2
-Oct  3 02:18:21 [sshd] Failed password for illegal user mysql from 216.65.197.170 port 57802 ssh2
-Oct  3 02:18:22 [sshd] Failed password for illegal user operator from 216.65.197.170 port 57989 ssh2
-Oct  3 02:18:24 [sshd] Failed password for illegal user adm from 216.65.197.170 port 58151 ssh2
-Oct  3 02:18:26 [sshd] Failed password for illegal user apache from 216.65.197.170 port 58319 ssh2
-Oct  3 02:18:28 [sshd] Failed password for illegal user irc from 216.65.197.170 port 58492 ssh2
-Oct  3 02:18:29 [sshd] Failed password for illegal user irc from 216.65.197.170 port 58662 ssh2
-Oct  3 02:18:31 [sshd] Failed password for illegal user adm from 216.65.197.170 port 58818 ssh2
-Oct  3 02:18:33 [sshd] Failed password for illegal user root from 216.65.197.170 port 58976 ssh2
-Oct  3 02:18:34 [sshd] Failed password for illegal user root from 216.65.197.170 port 59147 ssh2
-Oct  3 02:18:36 [sshd] Failed password for illegal user root from 216.65.197.170 port 59306 ssh2
-Oct  3 02:18:38 [sshd] Failed password for illegal user jane from 216.65.197.170 port 59474 ssh2
-Oct  3 02:18:40 [sshd] Failed password for illegal user pamela from 216.65.197.170 port 59644 ssh2
-Oct  3 02:18:41 [sshd] Failed password for illegal user root from 216.65.197.170 port 59797 ssh2
-Oct  3 02:18:43 [sshd] Failed password for illegal user root from 216.65.197.170 port 59963 ssh2
-Oct  3 02:18:45 [sshd] Failed password for illegal user root from 216.65.197.170 port 60139 ssh2
-Oct  3 02:18:47 [sshd] Failed password for illegal user root from 216.65.197.170 port 60308 ssh2
-Oct  3 02:18:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 60479 ssh2
-Oct  3 02:18:50 [sshd] Failed password for illegal user cosmin from 216.65.197.170 port 60654 ssh2
-Oct  3 02:18:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 60830 ssh2
-Oct  3 02:18:54 [sshd] Failed password for illegal user root from 216.65.197.170 port 60992 ssh2
-Oct  3 02:18:55 [sshd] Failed password for illegal user root from 216.65.197.170 port 32945 ssh2
-Oct  3 02:18:58 [sshd] Failed password for illegal user root from 216.65.197.170 port 33101 ssh2
-Oct  3 02:18:59 [sshd] Failed password for illegal user root from 216.65.197.170 port 33343 ssh2
-Oct  3 02:19:02 [sshd] Failed password for illegal user root from 216.65.197.170 port 33501 ssh2
-Oct  3 02:19:03 [sshd] Failed password for illegal user root from 216.65.197.170 port 33733 ssh2
-Oct  3 02:19:05 [sshd] Failed password for illegal user root from 216.65.197.170 port 33892 ssh2
-Oct  3 02:19:07 [sshd] Failed password for illegal user root from 216.65.197.170 port 34066 ssh2
-Oct  3 02:19:08 [sshd] Failed password for illegal user root from 216.65.197.170 port 34212 ssh2
-Oct  3 02:19:10 [sshd] Failed password for illegal user root from 216.65.197.170 port 34376 ssh2
-Oct  3 02:19:12 [sshd] Failed password for illegal user root from 216.65.197.170 port 34535 ssh2
-Oct  3 02:19:14 [sshd] Failed password for illegal user root from 216.65.197.170 port 34704 ssh2
-Oct  3 02:19:16 [sshd] Failed password for illegal user root from 216.65.197.170 port 34853 ssh2
-Oct  3 02:19:18 [sshd] Failed password for illegal user root from 216.65.197.170 port 35092 ssh2
-Oct  3 02:19:19 [sshd] Failed password for illegal user root from 216.65.197.170 port 35261 ssh2
-Oct  3 02:19:21 [sshd] Failed password for illegal user root from 216.65.197.170 port 35425 ssh2
-Oct  3 02:19:23 [sshd] Failed password for illegal user root from 216.65.197.170 port 35583 ssh2
-Oct  3 02:19:24 [sshd] Failed password for illegal user root from 216.65.197.170 port 35753 ssh2
-Oct  3 02:19:26 [sshd] Failed password for illegal user root from 216.65.197.170 port 35901 ssh2
-Oct  3 02:19:28 [sshd] Failed password for illegal user root from 216.65.197.170 port 36068 ssh2
-Oct  3 02:19:30 [sshd] Failed password for illegal user root from 216.65.197.170 port 36227 ssh2
-Oct  3 02:19:33 [sshd] Failed password for illegal user root from 216.65.197.170 port 36453 ssh2
-Oct  3 02:19:34 [sshd] Failed password for illegal user root from 216.65.197.170 port 36673 ssh2
-Oct  3 02:19:36 [sshd] Failed password for illegal user root from 216.65.197.170 port 36823 ssh2
-Oct  3 02:19:38 [sshd] Failed password for illegal user root from 216.65.197.170 port 36981 ssh2
-Oct  3 02:19:39 [sshd] Failed password for illegal user root from 216.65.197.170 port 37152 ssh2
-Oct  3 02:19:41 [sshd] Failed password for illegal user root from 216.65.197.170 port 37310 ssh2
-Oct  3 02:19:43 [sshd] Failed password for illegal user root from 216.65.197.170 port 37484 ssh2
-Oct  3 02:19:45 [sshd] Failed password for illegal user root from 216.65.197.170 port 37644 ssh2
-Oct  3 02:19:46 [sshd] Failed password for illegal user root from 216.65.197.170 port 37827 ssh2
-Oct  3 02:19:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 37989 ssh2
-Oct  3 02:19:50 [sshd] Failed password for illegal user root from 216.65.197.170 port 38163 ssh2
-Oct  3 02:19:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 38329 ssh2
-Oct  3 02:19:54 [sshd] Failed password for illegal user root from 216.65.197.170 port 38559 ssh2
-Oct  3 02:19:56 [sshd] Failed password for illegal user root from 216.65.197.170 port 38735 ssh2
-Oct  3 02:19:58 [sshd] Failed password for illegal user cip52 from 216.65.197.170 port 38893 ssh2
-Oct  3 02:20:00 [sshd] Failed password for illegal user cip51 from 216.65.197.170 port 39109 ssh2
-Oct  3 02:20:01 [sshd] Failed password for illegal user root from 216.65.197.170 port 39282 ssh2
-Oct  3 02:20:03 [sshd] Failed password for illegal user noc from 216.65.197.170 port 39448 ssh2
-Oct  3 02:20:05 [sshd] Failed password for illegal user root from 216.65.197.170 port 39621 ssh2
-Oct  3 02:20:06 [sshd] Failed password for illegal user root from 216.65.197.170 port 39781 ssh2
-Oct  3 02:20:08 [sshd] Failed password for illegal user root from 216.65.197.170 port 39958 ssh2
-Oct  3 02:20:10 [sshd] Failed password for illegal user root from 216.65.197.170 port 40125 ssh2
-Oct  3 02:20:12 [sshd] Failed password for illegal user webmaster from 216.65.197.170 port 40316 ssh2
-Oct  3 02:20:13 [sshd] Failed password for illegal user data from 216.65.197.170 port 40473 ssh2
-Oct  3 02:20:15 [sshd] Failed password for illegal user user from 216.65.197.170 port 40645 ssh2
-Oct  3 02:20:17 [sshd] Failed password for illegal user user from 216.65.197.170 port 40800 ssh2
-Oct  3 02:20:19 [sshd] Failed password for illegal user user from 216.65.197.170 port 40965 ssh2
-Oct  3 02:20:20 [sshd] Failed password for illegal user web from 216.65.197.170 port 41120 ssh2
-Oct  3 02:20:22 [sshd] Failed password for illegal user web from 216.65.197.170 port 41300 ssh2
-Oct  3 02:20:24 [sshd] Failed password for illegal user oracle from 216.65.197.170 port 41468 ssh2
-Oct  3 02:20:25 [sshd] Failed password for illegal user sybase from 216.65.197.170 port 41642 ssh2
-Oct  3 02:20:27 [sshd] Failed password for illegal user master from 216.65.197.170 port 41809 ssh2
-Oct  3 02:20:29 [sshd] Failed password for illegal user account from 216.65.197.170 port 41987 ssh2
-Oct  3 02:20:31 [sshd] Failed password for illegal user backup from 216.65.197.170 port 42143 ssh2
-Oct  3 02:20:32 [sshd] Failed password for illegal user server from 216.65.197.170 port 42316 ssh2
-Oct  3 02:20:34 [sshd] Failed password for illegal user adam from 216.65.197.170 port 42481 ssh2
-Oct  3 02:20:36 [sshd] Failed password for illegal user alan from 216.65.197.170 port 42647 ssh2
-Oct  3 02:20:37 [sshd] Failed password for illegal user frank from 216.65.197.170 port 42817 ssh2
-Oct  3 02:20:39 [sshd] Failed password for illegal user george from 216.65.197.170 port 42993 ssh2
-Oct  3 02:20:41 [sshd] Failed password for illegal user henry from 216.65.197.170 port 43170 ssh2
-Oct  3 02:20:43 [sshd] Failed password for illegal user john from 216.65.197.170 port 43319 ssh2
-Oct  3 02:20:44 [sshd] Failed password for illegal user root from 216.65.197.170 port 43504 ssh2
-Oct  3 02:20:46 [sshd] Failed password for illegal user root from 216.65.197.170 port 43664 ssh2
-Oct  3 02:20:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 43844 ssh2
-Oct  3 02:20:49 [sshd] Failed password for illegal user root from 216.65.197.170 port 44008 ssh2
-Oct  3 02:20:51 [sshd] Failed password for illegal user root from 216.65.197.170 port 44182 ssh2
-Oct  3 02:20:53 [sshd] Failed password for illegal user test from 216.65.197.170 port 44338 ssh2
-Oct  3 06:37:34 [sshd] Failed password for illegal user nobody from 217.56.33.194 port 1969 ssh2
-Oct  3 06:37:36 [sshd] Failed password for illegal user patrick from 217.56.33.194 port 2002 ssh2
-Oct  3 06:37:37 [sshd] Failed password for illegal user patrick from 217.56.33.194 port 2039 ssh2
-Oct  3 06:37:38 [sshd] Failed password for illegal user root from 217.56.33.194 port 2070 ssh2
-Oct  3 06:37:40 [sshd] Failed password for illegal user root from 217.56.33.194 port 2109 ssh2
-Oct  3 06:37:41 [sshd] Failed password for illegal user root from 217.56.33.194 port 2142 ssh2
-Oct  3 06:37:42 [sshd] Failed password for illegal user root from 217.56.33.194 port 2173 ssh2
-Oct  3 06:37:44 [sshd] Failed password for illegal user root from 217.56.33.194 port 2211 ssh2
-Oct  3 06:37:45 [sshd] Failed password for illegal user rolo from 217.56.33.194 port 2244 ssh2
-Oct  3 06:37:46 [sshd] Failed password for illegal user iceuser from 217.56.33.194 port 2272 ssh2
-Oct  3 06:37:48 [sshd] Failed password for illegal user horde from 217.56.33.194 port 2305 ssh2
-Oct  3 06:37:49 [sshd] Failed password for illegal user cyrus from 217.56.33.194 port 2337 ssh2
-Oct  3 06:37:50 [sshd] Failed password for illegal user www from 217.56.33.194 port 2373 ssh2
-Oct  3 06:37:52 [sshd] Failed password for illegal user wwwrun from 217.56.33.194 port 2407 ssh2
-Oct  3 06:37:53 [sshd] Failed password for illegal user matt from 217.56.33.194 port 2439 ssh2
-Oct  3 06:37:55 [sshd] Failed password for illegal user test from 217.56.33.194 port 2466 ssh2
-Oct  3 06:37:56 [sshd] Failed password for illegal user test from 217.56.33.194 port 2501 ssh2
-Oct  3 06:37:57 [sshd] Failed password for illegal user test from 217.56.33.194 port 2533 ssh2
-Oct  3 06:37:59 [sshd] Failed password for illegal user test from 217.56.33.194 port 2567 ssh2
-Oct  3 06:38:00 [sshd] Failed password for illegal user www-data from 217.56.33.194 port 2605 ssh2
-Oct  3 06:38:01 [sshd] Failed password for illegal user mysql from 217.56.33.194 port 2635 ssh2
-Oct  3 06:38:03 [sshd] Failed password for illegal user operator from 217.56.33.194 port 2667 ssh2
-Oct  3 06:38:04 [sshd] Failed password for illegal user adm from 217.56.33.194 port 2697 ssh2
-Oct  3 06:38:05 [sshd] Failed password for illegal user apache from 217.56.33.194 port 2733 ssh2
-Oct  3 06:38:07 [sshd] Failed password for illegal user irc from 217.56.33.194 port 2768 ssh2
-Oct  3 06:38:08 [sshd] Failed password for illegal user irc from 217.56.33.194 port 2804 ssh2
-Oct  3 06:38:09 [sshd] Failed password for illegal user adm from 217.56.33.194 port 2837 ssh2
-Oct  3 06:38:11 [sshd] Failed password for illegal user root from 217.56.33.194 port 2872 ssh2
-Oct  3 06:38:13 [sshd] Failed password for illegal user root from 217.56.33.194 port 2907 ssh2
-Oct  3 06:38:14 [sshd] Failed password for illegal user root from 217.56.33.194 port 2950 ssh2
-Oct  3 06:38:16 [sshd] Failed password for illegal user jane from 217.56.33.194 port 2986 ssh2
-Oct  3 06:38:17 [sshd] Failed password for illegal user pamela from 217.56.33.194 port 3019 ssh2
-Oct  3 06:38:18 [sshd] Failed password for illegal user root from 217.56.33.194 port 3053 ssh2
-Oct  3 06:38:20 [sshd] Failed password for illegal user root from 217.56.33.194 port 3085 ssh2
-Oct  3 06:38:21 [sshd] Failed password for illegal user root from 217.56.33.194 port 3115 ssh2
-Oct  3 06:38:22 [sshd] Failed password for illegal user root from 217.56.33.194 port 3147 ssh2
-Oct  3 06:38:24 [sshd] Failed password for illegal user root from 217.56.33.194 port 3177 ssh2
-Oct  3 06:38:25 [sshd] Failed password for illegal user cosmin from 217.56.33.194 port 3208 ssh2
-Oct  3 06:38:26 [sshd] Failed password for illegal user root from 217.56.33.194 port 3239 ssh2
-Oct  3 06:38:28 [sshd] Failed password for illegal user root from 217.56.33.194 port 3272 ssh2
-Oct  3 06:38:29 [sshd] Failed password for illegal user root from 217.56.33.194 port 3302 ssh2
-Oct  3 06:38:30 [sshd] Failed password for illegal user root from 217.56.33.194 port 3336 ssh2
-Oct  3 06:38:32 [sshd] Failed password for illegal user root from 217.56.33.194 port 3367 ssh2
-Oct  3 06:38:33 [sshd] Failed password for illegal user root from 217.56.33.194 port 3403 ssh2
-Oct  3 06:38:34 [sshd] Failed password for illegal user root from 217.56.33.194 port 3432 ssh2
-Oct  3 06:38:36 [sshd] Failed password for illegal user root from 217.56.33.194 port 3458 ssh2
-Oct  3 06:38:37 [sshd] Failed password for illegal user root from 217.56.33.194 port 3494 ssh2
-Oct  3 06:38:38 [sshd] Failed password for illegal user root from 217.56.33.194 port 3525 ssh2
-Oct  3 06:38:40 [sshd] Failed password for illegal user root from 217.56.33.194 port 3554 ssh2
-Oct  3 06:38:41 [sshd] Failed password for illegal user root from 217.56.33.194 port 3590 ssh2
-Oct  3 06:38:42 [sshd] Failed password for illegal user root from 217.56.33.194 port 3623 ssh2
-Oct  3 06:38:44 [sshd] Failed password for illegal user root from 217.56.33.194 port 3654 ssh2
-Oct  3 06:38:45 [sshd] Failed password for illegal user root from 217.56.33.194 port 3690 ssh2
-Oct  3 06:38:46 [sshd] Failed password for illegal user root from 217.56.33.194 port 3720 ssh2
-Oct  3 06:38:48 [sshd] Failed password for illegal user root from 217.56.33.194 port 3752 ssh2
-Oct  3 06:38:49 [sshd] Failed password for illegal user root from 217.56.33.194 port 3785 ssh2
-Oct  3 06:38:51 [sshd] Failed password for illegal user root from 217.56.33.194 port 3817 ssh2
-Oct  3 06:38:52 [sshd] Failed password for illegal user root from 217.56.33.194 port 3853 ssh2
-Oct  3 06:38:53 [sshd] Failed password for illegal user root from 217.56.33.194 port 3886 ssh2
-Oct  3 06:38:55 [sshd] Failed password for illegal user root from 217.56.33.194 port 3923 ssh2
-Oct  3 06:38:56 [sshd] Failed password for illegal user root from 217.56.33.194 port 3955 ssh2
-Oct  3 06:38:57 [sshd] Failed password for illegal user root from 217.56.33.194 port 3983 ssh2
-Oct  3 06:38:59 [sshd] Failed password for illegal user root from 217.56.33.194 port 4016 ssh2
-Oct  3 06:39:00 [sshd] Failed password for illegal user root from 217.56.33.194 port 4045 ssh2
-Oct  3 06:39:01 [sshd] Failed password for illegal user root from 217.56.33.194 port 4073 ssh2
-Oct  3 06:39:03 [sshd] Failed password for illegal user root from 217.56.33.194 port 4110 ssh2
-Oct  3 06:39:04 [sshd] Failed password for illegal user root from 217.56.33.194 port 4140 ssh2
-Oct  3 06:39:05 [sshd] Failed password for illegal user root from 217.56.33.194 port 4171 ssh2
-Oct  3 06:39:07 [sshd] Failed password for illegal user root from 217.56.33.194 port 4201 ssh2
-Oct  3 06:39:08 [sshd] Failed password for illegal user root from 217.56.33.194 port 4235 ssh2
-Oct  3 06:39:09 [sshd] Failed password for illegal user root from 217.56.33.194 port 4267 ssh2
-Oct  3 06:39:11 [sshd] Failed password for illegal user root from 217.56.33.194 port 4300 ssh2
-Oct  3 06:39:12 [sshd] Failed password for illegal user root from 217.56.33.194 port 4326 ssh2
-Oct  3 06:39:13 [sshd] Failed password for illegal user root from 217.56.33.194 port 4358 ssh2
-Oct  3 06:39:15 [sshd] Failed password for illegal user cip52 from 217.56.33.194 port 4390 ssh2
-Oct  3 06:39:16 [sshd] Failed password for illegal user cip51 from 217.56.33.194 port 4427 ssh2
-Oct  3 06:39:18 [sshd] Failed password for illegal user root from 217.56.33.194 port 4459 ssh2
-Oct  3 06:39:19 [sshd] Failed password for illegal user noc from 217.56.33.194 port 4492 ssh2
-Oct  3 06:39:20 [sshd] Failed password for illegal user root from 217.56.33.194 port 4526 ssh2
-Oct  3 06:39:22 [sshd] Failed password for illegal user root from 217.56.33.194 port 4557 ssh2
-Oct  3 06:39:23 [sshd] Failed password for illegal user root from 217.56.33.194 port 4588 ssh2
-Oct  3 06:39:24 [sshd] Failed password for illegal user root from 217.56.33.194 port 4618 ssh2
-Oct  3 06:39:26 [sshd] Failed password for illegal user webmaster from 217.56.33.194 port 4652 ssh2
-Oct  3 06:39:27 [sshd] Failed password for illegal user data from 217.56.33.194 port 4679 ssh2
-Oct  3 06:39:28 [sshd] Failed password for illegal user user from 217.56.33.194 port 4716 ssh2
-Oct  3 06:39:30 [sshd] Failed password for illegal user user from 217.56.33.194 port 4744 ssh2
-Oct  3 06:39:31 [sshd] Failed password for illegal user user from 217.56.33.194 port 4777 ssh2
-Oct  3 06:39:32 [sshd] Failed password for illegal user web from 217.56.33.194 port 4808 ssh2
-Oct  3 06:39:34 [sshd] Failed password for illegal user web from 217.56.33.194 port 4842 ssh2
-Oct  3 06:39:35 [sshd] Failed password for illegal user oracle from 217.56.33.194 port 4869 ssh2
-Oct  3 06:39:36 [sshd] Failed password for illegal user sybase from 217.56.33.194 port 4899 ssh2
-Oct  3 06:39:38 [sshd] Failed password for illegal user master from 217.56.33.194 port 4933 ssh2
-Oct  3 06:39:39 [sshd] Failed password for illegal user account from 217.56.33.194 port 4969 ssh2
-Oct  3 06:39:40 [sshd] Failed password for illegal user backup from 217.56.33.194 port 4999 ssh2
-Oct  3 06:39:42 [sshd] Failed password for illegal user server from 217.56.33.194 port 1051 ssh2
-Oct  3 06:39:43 [sshd] Failed password for illegal user adam from 217.56.33.194 port 1082 ssh2
-Oct  3 06:39:44 [sshd] Failed password for illegal user alan from 217.56.33.194 port 1114 ssh2
-Oct  3 06:39:46 [sshd] Failed password for illegal user frank from 217.56.33.194 port 1141 ssh2
-Oct  3 06:39:47 [sshd] Failed password for illegal user george from 217.56.33.194 port 1174 ssh2
-Oct  3 06:39:49 [sshd] Failed password for illegal user henry from 217.56.33.194 port 1205 ssh2
-Oct  3 06:39:50 [sshd] Failed password for illegal user john from 217.56.33.194 port 1236 ssh2
-Oct  3 06:39:51 [sshd] Failed password for illegal user root from 217.56.33.194 port 1271 ssh2
-Oct  3 06:39:53 [sshd] Failed password for illegal user root from 217.56.33.194 port 1300 ssh2
-Oct  3 06:39:55 [sshd] Failed password for illegal user root from 217.56.33.194 port 1332 ssh2
-Oct  3 06:39:56 [sshd] Failed password for illegal user root from 217.56.33.194 port 1380 ssh2
-Oct  3 06:39:57 [sshd] Failed password for illegal user root from 217.56.33.194 port 1412 ssh2
-Oct  3 06:39:59 [sshd] Failed password for illegal user test from 217.56.33.194 port 1449 ssh2
-Oct  4 04:43:59 [sshd] Failed password for illegal user test from 212.204.226.21 port 60349 ssh2
-Oct  4 04:44:03 [sshd] Failed password for illegal user guest from 212.204.226.21 port 60394 ssh2
-Oct  4 04:44:06 [sshd] Failed password for illegal user admin from 212.204.226.21 port 60540 ssh2
-Oct  4 04:44:08 [sshd] Failed password for illegal user admin from 212.204.226.21 port 60620 ssh2
-Oct  4 04:44:11 [sshd] Failed password for illegal user user from 212.204.226.21 port 60679 ssh2
-Oct  4 04:44:14 [sshd] Failed password for illegal user root from 212.204.226.21 port 60773 ssh2
-Oct  4 04:44:15 [sshd] Failed password for illegal user root from 212.204.226.21 port 60828 ssh2
-Oct  4 04:44:18 [sshd] Failed password for illegal user root from 212.204.226.21 port 60880 ssh2
-Oct  4 04:44:21 [sshd] Failed password for illegal user test from 212.204.226.21 port 60957 ssh2
-Oct  4 09:32:21 [sshd] Failed password for illegal user test from 62.141.56.70 port 45600 ssh2
-Oct  4 09:32:27 [sshd] Failed password for illegal user guest from 62.141.56.70 port 47635 ssh2
-Oct  4 09:32:32 [sshd] Failed password for illegal user admin from 62.141.56.70 port 49967 ssh2
-Oct  4 09:32:37 [sshd] Failed password for illegal user admin from 62.141.56.70 port 52093 ssh2
-Oct  4 09:32:42 [sshd] Failed password for illegal user user from 62.141.56.70 port 53840 ssh2
-Oct  4 09:32:47 [sshd] Failed password for illegal user root from 62.141.56.70 port 55568 ssh2
-Oct  4 09:32:51 [sshd] Failed password for illegal user root from 62.141.56.70 port 57526 ssh2
-Oct  4 09:32:51 [sshd] Failed password for illegal user root from 62.141.56.70 port 58454 ssh2
-Oct  4 09:32:52 [sshd] Failed password for illegal user test from 62.141.56.70 port 58819 ssh2
-Oct  4 14:09:11 [sshd] Failed password for illegal user test from 211.234.125.100 port 46642 ssh2
-Oct  4 14:09:18 [sshd] Failed password for illegal user guest from 211.234.125.100 port 46788 ssh2
-Oct  4 14:09:23 [sshd] Failed password for illegal user admin from 211.234.125.100 port 46886 ssh2
-Oct  4 14:09:30 [sshd] Failed password for illegal user admin from 211.234.125.100 port 46960 ssh2
-Oct  4 14:09:43 [sshd] Failed password for illegal user user from 211.234.125.100 port 47025 ssh2
-Oct  6 04:13:11 [sshd] Failed password for illegal user test from 64.246.30.17 port 58277 ssh2
-Oct  6 04:13:13 [sshd] Failed password for illegal user guest from 64.246.30.17 port 58360 ssh2
-Oct  6 04:13:15 [sshd] Failed password for illegal user admin from 64.246.30.17 port 58428 ssh2
-Oct  6 04:13:17 [sshd] Failed password for illegal user admin from 64.246.30.17 port 58514 ssh2
-Oct  6 22:13:56 [sshd] Failed password for illegal user test from 61.11.98.217 port 45434 ssh2
-Oct  6 22:14:00 [sshd] Failed password for illegal user guest from 61.11.98.217 port 45586 ssh2
-Oct  6 22:14:05 [sshd] Failed password for illegal user admin from 61.11.98.217 port 45672 ssh2
-Oct  6 22:14:10 [sshd] Failed password for illegal user admin from 61.11.98.217 port 45748 ssh2
-Oct  6 22:14:18 [sshd] Failed password for illegal user user from 61.11.98.217 port 45833 ssh2
-Oct  7 00:25:34 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37086 ssh2
-Oct  7 00:25:34 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37086 ssh2
-                - Last output repeated twice -
-Oct  7 00:26:27 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37089 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:26:37 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37092 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:27:21 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37095 ssh2
-                - Last output repeated twice -
-Oct  7 00:51:31 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37130 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:51:48 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37138 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:52:02 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37141 ssh2
-Oct  7 00:56:10 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37153 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:56:41 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37156 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:57:00 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37159 ssh2
-Oct  7 00:58:17 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37162 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:58:29 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37165 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:58:39 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37168 ssh2
-Oct  7 01:00:32 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37171 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:00:44 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37175 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:01:23 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37178 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:03:01 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37181 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:03:12 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37184 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:03:20 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37187 ssh2
-                - Last output repeated 2 times -
-Nov 14 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
-Nov 14 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
-Nov 14 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
-Nov 15 11:12:11 yellow sshd[16069]: Failed password for cyril from 212.41.79.210 port 29404 ssh2
-Nov 15 21:54:11 yellow sshd[16069]: Illegal user for cyril from 212.41.79.210 port 29404 ssh2
diff --git a/logreader/logreader.py b/logreader/logreader.py
deleted file mode 100644
index 72043e4d..00000000
--- a/logreader/logreader.py
+++ /dev/null
@@ -1,225 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import os, sys, time, re, logging
-
-from utils.dns import *
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban")
-
-class LogReader:
-	""" Reads a log file and reports information about IP that make password
-		failure, bad user or anything else that is considered as doubtful login
-		attempt.	
-	"""
-	
-	def __init__(self, logPath, timeregex, timepattern, failregex,
-				  maxRetry, findTime):
-		self.logPath = logPath
-		self.maxRetry = maxRetry
-		self.timeregex = timeregex
-		self.timepattern = timepattern
-		self.failregex = failregex
-		self.findTime = findTime
-		self.ignoreIpList = []
-		self.lastModTime = 0
-		self.lastPos = 0
-		self.lastDate = 0
-		self.logStats = None
-	
-	def getMaxRetry(self):
-		""" Gets the maximum number of failures
-		"""
-		return self.maxRetry
-	
-	def getFindTime(self):
-		""" Gets the find time.
-		"""
-		return self.findTime
-	
-	def addIgnoreIP(self, ip):
-		""" Adds an IP to the ignore list.
-		"""
-		logSys.debug("Add "+ip+" to ignore list")
-		self.ignoreIpList.append(ip)
-		
-	def inIgnoreIPList(self, ip):
-		""" Checks if IP is in the ignore list.
-		"""
-		for i in self.ignoreIpList:
-			s = i.split('/', 1)
-			# IP address without CIDR mask
-			if len(s) == 1:
-				s.insert(1, '32')
-			s[1] = long(s[1])
-			a = cidr(s[0], s[1])
-			b = cidr(ip, s[1])
-			if a == b:
-				return True
-		return False
-	
-	def openLogFile(self):
-		""" Opens the log file specified on init.
-		"""
-		try:
-			fileHandler = open(self.logPath)
-		except OSError:
-			logSys.error("Unable to open "+self.logPath)
-			
-		return fileHandler
-		
-	def isModified(self):
-		""" Checks if the log file has been modified using os.stat().
-		"""
-		try:
-			self.logStats = os.stat(self.logPath)
-			if self.lastModTime == self.logStats.st_mtime:
-				return False
-			else:
-				logSys.debug(self.logPath+" has been modified")
-				self.lastModTime = self.logStats.st_mtime
-				return True
-		except OSError:
-			logSys.error("Unable to get stat on "+self.logPath)
-			return False
-	
-	def setFilePos(self, file):
-		""" Sets the file position. We must take care of log file rotation
-			and reset the position to 0 in that case. Use the log message
-			timestamp in order to detect this.		
-		"""
-		line = file.readline()
-		if self.lastDate < self.getTime(line):
-			logSys.debug("Date " + `self.lastDate` + " is " + "smaller than " +
-							`self.getTime(line)`)
-			logSys.debug("Log rotation detected for " + self.logPath)
-			self.lastPos = 0
-		
-		logSys.debug("Setting file position to " + `self.lastPos` + " for " +
-						self.logPath)
-		file.seek(self.lastPos)
-	
-	def getFailures(self):
-		""" Gets all the failure in the log file which are
-			newer than time.time()-self.findTime.
-			
-			Returns a dict with the IP, the number of failure
-			and the latest failure time.
-		"""
-		ipList = dict()
-		logSys.debug(self.logPath)
-		logFile = self.openLogFile()
-		self.setFilePos(logFile)
-		lastLine = None
-		for line in logFile:
-			if not self.hasTime(line):
-				# There is no valid time in this line
-				continue
-			lastLine = line
-			for element in self.findFailure(line):
-				ip = element[0]
-				unixTime = element[1]
-				if unixTime < time.time()-self.findTime:
-					break
-				if self.inIgnoreIPList(ip):
-					logSys.debug("Ignore "+ip)
-					continue
-				logSys.debug("Found "+ip)
-				if ipList.has_key(ip):
-					ipList[ip] = (ipList[ip][0]+1, unixTime)
-				else:
-					ipList[ip] = (1, unixTime)
-		self.lastPos = logFile.tell()
-		if lastLine:
-			self.lastDate = self.getTime(lastLine)
-		logFile.close()
-		return ipList
-
-	def findFailure(self, line):
-		""" Finds the failure in line. Uses the failregex pattern
-			to find it and timeregex in order to find the logging
-			time.
-			
-			Returns a dict with IP and timestamp.
-		"""
-		failList = list()
-		match = re.search(self.failregex, line)
-		if match:
-			timeMatch = re.search(self.timeregex, match.string)
-			if timeMatch:
-				date = self.getUnixTime(timeMatch.group())
-				ipMatch = textToIp(match.string)
-				if ipMatch:
-					for ip in ipMatch:
-						failList.append([ip, date])
-		return failList
-	
-	def hasTime(self, line):
-		""" Return true if the line contains a date
-		"""
-		timeMatch = re.search(self.timeregex, line)
-		if timeMatch:
-			return True
-		else:
-			return False
-	
-	def getTime(self, line):
-		""" Gets the time of a log message.
-		"""
-		date = 0
-		timeMatch = re.search(self.timeregex, line)
-		if timeMatch:
-			date = self.getUnixTime(timeMatch.group())
-		return date
-		
-	def getUnixTime(self, value):
-		""" Returns the Unix timestamp of the given value.
-			Pattern should describe the date construction of
-			value.
-		"""
-		try:
-			# Check if the parsed value is in TAI64N format
-			if not self.timepattern.lower() == "tai64n":
-				date = list(time.strptime(value, self.timepattern))
-			else:
-				# extract part of format which represents seconds since epoch
-				seconds_since_epoch = value[2:17]
-				date = list(time.gmtime(int(seconds_since_epoch, 16)))
-		except ValueError, e:
-			logSys.error(e)
-			logSys.error("Please check the format and your locale settings.")
-			return None
-		if date[0] < 2000:
-			# There is probably no year field in the logs
-			date[0] = time.gmtime()[0]
-			# Bug fix for #1241756
-			# If the date is greater than the current time, we suppose
-			# that the log is not from this year but from the year before
-			if time.mktime(date) > time.time():
-				date[0] -= 1
-		unixTime = time.mktime(date)
-		return unixTime
diff --git a/man/fail2ban.8 b/man/fail2ban.8
deleted file mode 100644
index 1c2e4f73..00000000
--- a/man/fail2ban.8
+++ /dev/null
@@ -1,58 +0,0 @@
-.\" 
-.TH "FAIL2BAN" "8" "July 2005" "Cyril Jaquier" "System administration tools"
-.SH "NAME"
-fail2ban \- bans IP that makes too many password failures
-.SH "SYNOPSIS"
-.B fail2ban
-[\fIOPTIONS\fR]
-.SH "DESCRIPTION"
-\fBFail2Ban\fR reads log file that contains password failure report
-and bans the corresponding IP addresses using firewall rules. It updates
-firewall rules to reject the IP address.
-.SH "OPTIONS"
-.TP 
-\fB\-b\fR
-start in background
-.TP 
-\fB\-c\fR \fIFILE\fR
-read configuration file \fIFILE\fR
-.TP 
-\fB\-p\fR \fIFILE\fR
-create PID lock in \fIFILE\fR
-.TP 
-\fB\-h, \-\-help\fR
-display this help message
-.TP 
-\fB\-i\fR \fIIP\fR
-\fIIP\fR(s) to ignore
-.TP 
-\fB\-k\fR
-kill a currently running Fail2Ban instance
-.TP 
-\fB\-r\fR \fIVALUE\fR
-allow a max of \fIVALUE\fR password failure [maxfailures]
-.TP 
-\fB\-t\fR \fITIME\fR
-ban IP for \fITIME\fR seconds [bantime]
-.TP 
-\fB\-f\fR \fITIME\fR
-lifetime in seconds of failed entry [findtime]
-.TP 
-\fB\-v\fR
-verbose. Use twice for greater effect
-.TP 
-\fB\-V, \-\-version\fR
-print software version
-.SH "FILES"
-.I /etc/fail2ban.conf
-.RS
-The configuration file. See \fBfail2ban.conf\fR(5) for further details.
-.SH "REPORTING BUGS"
-Please report bugs at http://sourceforge.net/projects/fail2ban/
-via bug tracker
-.SH "AUTHOR"
-Cyril Jaquier <lostcontrol@users.sourceforge.net>
-.SH "SEE ALSO"
-.TP 
-See
-.BR "http://fail2ban.sourceforge.net/".
diff --git a/man/fail2ban.conf.5 b/man/fail2ban.conf.5
deleted file mode 100644
index 91328a35..00000000
--- a/man/fail2ban.conf.5
+++ /dev/null
@@ -1,20 +0,0 @@
-.\" 
-.TH "FAIL2BAN.CONF" "5" "July 2005" "Cyril Jaquier" "System administration tools"
-.SH "NAME"
-fail2ban.conf \- configuration data for fail2ban
-.SH "DESCRIPTION"
-\fB/etc/fail2ban.conf\fR contains data about the general configuration of fail2ban, the mail notification and services to monitor.
-.SH "VARIABLES"
-Please look at the file itself
-.SH "FILES"
-.I /etc/fail2ban.conf
-.SH "REPORTING BUGS"
-Please report bugs at http://sourceforge.net/projects/fail2ban/
-via bug tracker
-.SH "AUTHOR"
-Cyril Jaquier <lostcontrol@users.sourceforge.net>
-.SH "SEE ALSO"
-.BR fail2ban (8)
-.TP 
-See
-.BR "http://fail2ban.sourceforge.net/".
diff --git a/logreader/__init__.py b/server/__init__.py
similarity index 88%
rename from logreader/__init__.py
rename to server/__init__.py
index 76dba873..60ef5531 100644
--- a/logreader/__init__.py
+++ b/server/__init__.py
@@ -16,10 +16,10 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.1 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
\ No newline at end of file
diff --git a/server/action.py b/server/action.py
new file mode 100644
index 00000000..f47fe579
--- /dev/null
+++ b/server/action.py
@@ -0,0 +1,281 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from banmanager import BanManager
+from failmanager import FailManager, FailManagerEmpty
+from jailthread import JailThread
+import time, logging, os
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.action")
+
+##
+# Execute commands.
+#
+# This class reads the failures from the Jail queue and decide if an
+# action has to be taken. A BanManager take care of the banned IP
+# addresses.
+
+class Action(JailThread):
+	
+	##
+	# Constructor.
+	#
+	# Initialize the filter object with default values.
+	# @param jail the jail object
+	
+	def __init__(self, jail):
+		JailThread.__init__(self, jail)
+		## The jail which contains this action.
+		self.jail = jail
+		## The ban manager.
+		self.banManager = BanManager()
+		## Command executed in order to initialize the system.
+		self.actionStart = ''
+		## Command executed when an IP address gets banned.
+		self.actionBan = ''
+		## Command executed when an IP address gets removed.
+		self.actionUnban = ''
+		## Command executed in order to check requirements.
+		self.actionCheck = ''
+		## Command executed in order to stop the system.
+		self.actionStop = ''
+		logSys.debug("Created Action")
+
+	##
+	# Set the "start" command.
+	#
+	# @param value the command
+		
+	def setActionStart(self, value):
+		self.actionStart = value
+		logSys.info("Set actionStart = %s" % value)
+	
+	##
+	# Get the "start" command.
+	#
+	# @return the command
+	
+	def getActionStart(self):
+		return self.actionStart
+	
+	##
+	# Set the "ban" command.
+	#
+	# @param value the command
+	
+	def setActionBan(self, value):
+		self.actionBan = value
+		logSys.info("Set actionBan = %s" % value)
+	
+	##
+	# Get the "ban" command.
+	#
+	# @return the command
+	
+	def getActionBan(self):
+		return self.actionBan
+	
+	##
+	# Set the "unban" command.
+	#
+	# @param value the command
+	
+	def setActionUnban(self, value):
+		self.actionUnban = value
+		logSys.info("Set actionUnban = %s" % value)
+	
+	##
+	# Get the "unban" command.
+	#
+	# @return the command
+	
+	def getActionUnban(self):
+		return self.actionUnban
+	
+	##
+	# Set the "check" command.
+	#
+	# @param value the command
+	
+	def setActionCheck(self, value):
+		self.actionCheck = value
+		logSys.info("Set actionCheck = %s" % value)
+	
+	##
+	# Get the "check" command.
+	#
+	# @return the command
+	
+	def getActionCheck(self):
+		return self.actionCheck
+	
+	##
+	# Set the "stop" command.
+	#
+	# @param value the command
+	
+	def setActionStop(self, value):
+		self.actionStop = value
+		logSys.info("Set actionStop = %s" % value)
+	
+	##
+	# Get the "stop" command.
+	#
+	# @return the command
+	
+	def getActionStop(self):
+		return self.actionStop
+	
+	##
+	# Set the ban time.
+	#
+	# @param value the time
+	
+	def setBanTime(self, value):
+		self.banManager.setBanTime(value)
+		logSys.info("Set banTime = %s" % value)
+	
+	##
+	# Get the ban time.
+	#
+	# @return the time
+	
+	def getBanTime(self):
+		return self.banManager.getBanTime()
+	
+	##
+	# Main loop.
+	#
+	# This function is the main loop of the thread. It checks the Jail
+	# queue and executes commands when an IP address is banned.
+	# @return True when the thread exits nicely
+	
+	def run(self):
+		self.executeCmd(self.actionStart)
+		self.setActive(True)
+		while self.isActive():
+			if not self.isIdle:
+				#logSys.debug(self.jail.getName() + ": action")
+				ret = self.checkBan()
+				if not ret:
+					self.checkUnBan()
+					time.sleep(self.sleepTime)
+			else:
+				time.sleep(self.sleepTime)
+		self.flushBan()
+		self.executeCmd(self.actionStop)
+		logSys.debug(self.jail.getName() + ": action terminated")
+		return True
+
+	##
+	# Check for IP address to ban.
+	#
+	# Look in the Jail queue for FailTicket. If a ticket is available,
+	# it executes the "ban" command and add a ticket to the BanManager.
+	# @return True if an IP address get banned
+	
+	def checkBan(self):
+		logSys.debug("Check for IP address to ban")
+		ticket = self.jail.getFailTicket()
+		if ticket != False:
+			aInfo = dict()
+			bTicket = BanManager.createBanTicket(ticket)
+			aInfo["ip"] = bTicket.getIP()
+			logSys.info("Ban %s" % aInfo["ip"])
+			self.executeCmd(self.replaceTag(self.actionBan, aInfo))
+			self.banManager.addBanTicket(bTicket)
+			return True
+		return False
+	
+	##
+	# Check for IP address to unban.
+	#
+	# Unban IP address which are outdated.
+	
+	def checkUnBan(self):
+		logSys.debug("Check for IP address to unban")
+		for ticket in self.banManager.unBanList(time.time()):
+			aInfo = dict()
+			aInfo["ip"] = ticket.getIP()
+			logSys.info("Unban %s" % aInfo["ip"])
+			self.executeCmd(self.replaceTag(self.actionUnban, aInfo))
+	
+	##
+	# Flush the ban list.
+	#
+	# Unban all IP address which are still in the banning list.
+	
+	def flushBan(self):
+		logSys.debug("Flush ban list")
+		for ticket in self.banManager.flushBanList():
+			aInfo = dict()
+			aInfo["ip"] = ticket.getIP()
+			logSys.info("Unban %s" % aInfo["ip"])
+			self.executeCmd(self.replaceTag(self.actionUnban, aInfo))
+	
+	##
+	# Get the status of the filter.
+	#
+	# Get some informations about the filter state such as the total
+	# number of failures.
+	# @return a list with tuple
+	
+	def status(self):
+		ret = [("Currently banned", self.banManager.size()),
+			   ("Total banned", self.banManager.getBanTotal())]
+		return ret
+	
+	@staticmethod
+	def replaceTag(query, aInfo):
+		""" Replace tags in query
+		"""
+		string = query
+		for tag in aInfo:
+			string = string.replace('<' + tag + '>', str(aInfo[tag]))
+		# New line
+		string = string.replace("<br>", '\n')
+		return string
+	
+	@staticmethod
+	def executeCmd(cmd):
+		""" Executes an OS command.
+		"""
+		if cmd == "":
+			logSys.debug("Nothing to do")
+			return True
+		
+		logSys.debug(cmd)
+		retval = os.system(cmd)
+		#if not retval == 0:
+		#	logSys.error("'" + cmd + "' returned " + `retval`)
+		#	raise Exception("Execution of command '%s' failed" % cmd)
+		if retval == 0:
+			return True
+		else:
+			logSys.error("%s returned %x" % (cmd, retval))
+			return False
+		
\ No newline at end of file
diff --git a/server/banmanager.py b/server/banmanager.py
new file mode 100644
index 00000000..1ae6122b
--- /dev/null
+++ b/server/banmanager.py
@@ -0,0 +1,184 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from banticket import BanTicket
+from threading import Lock
+import time, logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.action")
+
+##
+# Banning Manager.
+#
+# Manage the banned IP addresses. Convert FailTicket to BanTicket.
+# This class is mainly used by the Action class.
+
+class BanManager:
+	
+	##
+	# Constructor.
+	#
+	# Initialize members with default values.
+	
+	def __init__(self):
+		## Mutex used to protect the ban list.
+		self.lock = Lock()
+		## The ban list.
+		self.banList = list()
+		## The amount of time an IP address gets banned.
+		self.banTime = 600
+		## Total number of banned IP address
+		self.banTotal = 0
+	
+	##
+	# Set the ban time.
+	#
+	# Set the amount of time an IP address get banned.
+	# @param value the time
+	
+	def setBanTime(self, value):
+		self.banTime = int(value)
+	
+	##
+	# Get the ban time.
+	#
+	# Get the amount of time an IP address get banned.
+	# @return the time
+	
+	def getBanTime(self):
+		return self.banTime
+	
+	##
+	# Set the total number of banned address.
+	#
+	# @param value total number
+	
+	def setBanTotal(self, value):
+		self.banTotal = value
+	
+	##
+	# Get the total number of banned address.
+	#
+	# @return the total number
+	
+	def getBanTotal(self):
+		return self.banTotal
+	
+	##
+	# Create a ban ticket.
+	#
+	# Create a BanTicket from a FailTicket. The timestamp of the BanTicket
+	# is the current time. This is a static method.
+	# @param ticket the FailTicket
+	# @return a BanTicket
+	
+	@staticmethod
+	def createBanTicket(ticket):
+		ip = ticket.getIP()
+		#lastTime = ticket.getTime()
+		lastTime = time.time()
+		return BanTicket(ip, lastTime)
+	
+	##
+	# Add a ban ticket.
+	#
+	# Add a BanTicket instance into the ban list.
+	# @param ticket the ticket
+	# @return True if the IP address is not in the ban list
+	
+	def addBanTicket(self, ticket):
+		self.lock.acquire()
+		if not self.inBanList(ticket):
+			self.banList.append(ticket)
+			self.banTotal += 1
+			self.lock.release()
+			return True
+		self.lock.release()
+		return False
+	
+	##
+	# Delete a ban ticket.
+	#
+	# Remove a BanTicket from the ban list.
+	# @param ticket the ticket
+	
+	def delBanTicket(self, ticket):
+		self.banList.remove(ticket)
+	
+	##
+	# Get the size of the ban list.
+	#
+	# @return the size
+	
+	def size(self):
+		return len(self.banList)
+	
+	##
+	# Check if a ticket is in the list.
+	#
+	# Check if a BanTicket with a given IP address is already in the
+	# ban list.
+	# @param ticket the ticket
+	# @return True if a ticket already exists
+	
+	def inBanList(self, ticket):
+		for i in self.banList:
+			if ticket.getIP() == i.getIP():
+				return True
+		return False
+	
+	##
+	# Get the list of IP address to unban.
+	#
+	# Return a list of BanTicket which need to be unbanned.
+	# @param time the time
+	# @return the list of ticket to unban
+	# @todo Check the delete operation
+	
+	def unBanList(self, time):
+		uBList = list()
+		self.lock.acquire()
+		for ticket in self.banList:
+			if ticket.getTime() < time - self.banTime:
+				uBList.append(ticket)
+				self.delBanTicket(ticket)
+		self.lock.release()
+		return uBList
+	
+	##
+	# Flush the ban list.
+	#
+	# Get the ban list and initialize it with an empty one.
+	# @return the complete ban list
+	
+	def flushBanList(self):
+		self.lock.acquire()
+		uBList = self.banList
+		self.banList = list()
+		self.lock.release()
+		return uBList
+	
\ No newline at end of file
diff --git a/server/banticket.py b/server/banticket.py
new file mode 100644
index 00000000..7d271e6c
--- /dev/null
+++ b/server/banticket.py
@@ -0,0 +1,50 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time, logging
+from ticket import Ticket
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+##
+# Ban Ticket.
+#
+# This class extends the Ticket class. It is mainly used by the BanManager.
+
+class BanTicket(Ticket):
+	
+	##
+	# Constructor.
+	#
+	# Call the Ticket (parent) constructor and initialize default
+	# values.
+	# @param ip the IP address
+	# @param time the ban time
+	
+	def __init__(self, ip, time):
+		Ticket.__init__(self, ip, time)
+	
\ No newline at end of file
diff --git a/server/faildata.py b/server/faildata.py
new file mode 100644
index 00000000..f1b2441e
--- /dev/null
+++ b/server/faildata.py
@@ -0,0 +1,53 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time, logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+class FailData:
+	
+	def __init__(self):
+		self.retry = 0
+		self.lastTime = 0
+	
+	def setRetry(self, value):
+		self.retry = value
+	
+	def getRetry(self):
+		return self.retry
+	
+	def inc(self):
+		self.retry += 1
+	
+	def setLastTime(self, value):
+		if value > self.lastTime:
+			self.lastTime = value
+	
+	def getLastTime(self):
+		return self.lastTime
+	
\ No newline at end of file
diff --git a/server/failmanager.py b/server/failmanager.py
new file mode 100644
index 00000000..0a4266b9
--- /dev/null
+++ b/server/failmanager.py
@@ -0,0 +1,106 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from faildata import FailData
+from failticket import FailTicket
+from threading import Lock
+import time, logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.filter")
+
+class FailManager:
+	
+	def __init__(self):
+		self.lock = Lock()
+		self.failList = dict()
+		self.maxRetry = 3
+		self.maxTime = 600
+		self.failTotal = 0
+	
+	def setFailTotal(self, value):
+		self.failTotal = value
+		
+	def getFailTotal(self):
+		return self.failTotal
+	
+	def setMaxRetry(self, value):
+		self.maxRetry = value
+	
+	def getMaxRetry(self):
+		return self.maxRetry
+	
+	def setMaxTime(self, value):
+		self.maxTime = value
+	
+	def getMaxTime(self):
+		return self.maxTime
+
+	def addFailure(self, ticket):
+		self.lock.acquire()
+		ip = ticket.getIP()
+		unixTime = ticket.getTime()
+		if self.failList.has_key(ip):
+			fData = self.failList[ip]
+			fData.inc()
+			fData.setLastTime(unixTime)
+		else:
+			fData = FailData()
+			fData.inc()
+			fData.setLastTime(unixTime)
+			self.failList[ip] = fData
+		self.failTotal += 1
+		self.lock.release()
+	
+	def size(self):
+		return len(self.failList)
+	
+	def cleanup(self, time):
+		self.lock.acquire()
+		tmp = self.failList.copy()
+		for item in tmp:
+			if tmp[item].getLastTime() < time - self.maxTime:
+				self.delFailure(item)
+		self.lock.release()
+	
+	def delFailure(self, ip):
+		if self.failList.has_key(ip):
+			del self.failList[ip]
+	
+	def toBan(self):
+		self.lock.acquire()
+		for ip in self.failList:
+			data = self.failList[ip]
+			if data.getRetry() >= self.maxRetry:
+				self.delFailure(ip)
+				self.lock.release()
+				return FailTicket(ip, data.getLastTime())
+		self.lock.release()
+		raise FailManagerEmpty
+
+class FailManagerEmpty(Exception):
+	pass
+	
\ No newline at end of file
diff --git a/version.py b/server/failticket.py
similarity index 73%
rename from version.py
rename to server/failticket.py
index 80f0c7a8..395ec0d3 100644
--- a/version.py
+++ b/server/failticket.py
@@ -16,12 +16,22 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.1 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.6.1"
+import time, logging
+from ticket import Ticket
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+class FailTicket(Ticket):
+	
+	def __init__(self, ip, time):
+		Ticket.__init__(self, ip, time)
+	
\ No newline at end of file
diff --git a/server/filter.py b/server/filter.py
new file mode 100644
index 00000000..ccbea64d
--- /dev/null
+++ b/server/filter.py
@@ -0,0 +1,452 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from failmanager import FailManager
+from failmanager import FailManagerEmpty
+from failticket import FailTicket
+from jailthread import JailThread
+from utils.dns import *
+import time, logging, os, re, sys, socket
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.filter")
+
+##
+# Log reader class.
+#
+# This class reads a log file and detects login failures or anything else
+# that matches a given regular expression. This class is instanciated by
+# a Jail object.
+
+class Filter(JailThread):
+
+	##
+	# Constructor.
+	#
+	# Initialize the filter object with default values.
+	# @param jail the jail object
+	
+	def __init__(self, jail):
+		JailThread.__init__(self, jail)
+		## The jail which contains this filter.
+		self.jail = jail
+		## The failures manager.
+		self.failManager = FailManager()
+		## The log file handler.
+		self.fileHandler = None
+		## The log file path.
+		self.logPath = ''
+		## The regular expression matching the date.
+		self.timeRegex = ''
+		## The pattern matching the date.
+		self.timePattern = ''
+		## The regular expression matching the failure.
+		self.failRegex = ''
+		## The amount of time to look back.
+		self.findTime = 6000
+		## The ignore IP list.
+		self.ignoreIpList = []
+		## The time of the last modification of the file.
+		self.lastModTime = 0
+		## The last position of the file.
+		self.lastPos = 0
+		## The last date in tht log file.
+		self.lastDate = 0
+		## The file statistics.
+		self.logStats = None
+		logSys.info("Created Filter")
+
+	##
+	# Set the log file path
+	#
+	# @param value log file path
+
+	def setLogPath(self, value):
+		self.logPath = value
+		logSys.info("Set logfile = %s" % value)
+
+	##
+	# Get the log file path
+	#
+	# @return log file path
+		
+	def getLogPath(self):
+		return self.logPath
+	
+	##
+	# Set the regular expression which matches the time.
+	#
+	# @param value the regular expression
+	
+	def setTimeRegex(self, value):
+		self.timeRegex = value
+		logSys.info("Set timeregex = %s" % value)
+	
+	##
+	# Get the regular expression which matches the time.
+	#
+	# @return the regular expression
+		
+	def getTimeRegex(self):
+		return self.timeRegex
+	
+	##
+	# Set the time pattern.
+	#
+	# @param value the time pattern
+	
+	def setTimePattern(self, value):
+		self.timePattern = value
+		logSys.info("Set timepattern = %s" % value)
+	
+	##
+	# Get the time pattern.
+	#
+	# @return the time pattern
+	
+	def getTimePattern(self):
+		return self.timePattern
+	
+	##
+	# Set the regular expression which matches the failure.
+	#
+	# The regular expression can also match any other pattern than failures
+	# and thus can be used for many purporse.
+	# @param value the regular expression
+	
+	def setFailRegex(self, value):
+		self.failRegex = value
+		logSys.info("Set failregex = %s" % value)
+	
+	##
+	# Get the regular expression which matches the failure.
+	#
+	# @return the regular expression
+	
+	def getFailRegex(self):
+		return self.failRegex
+	
+	##
+	# Set the time needed to find a failure.
+	#
+	# This value tells the filter how long it has to take failures into
+	# account.
+	# @param value the time
+	
+	def setFindTime(self, value):
+		self.findTime = value
+		logSys.info("Set findtime = %s" % value)
+	
+	##
+	# Get the time needed to find a failure.
+	#
+	# @return the time
+	
+	def getFindTime(self):
+		return self.findTime
+	
+	##
+	# Set the maximum retry value.
+	#
+	# @param value the retry value
+	
+	def setMaxRetry(self, value):
+		self.failManager.setMaxRetry(value)
+		logSys.info("Set maxRetry = %s" % value)
+	
+	##
+	# Get the maximum retry value.
+	#
+	# @return the retry value
+	
+	def getMaxRetry(self):
+		return self.failManager.getMaxRetry()
+	
+	##
+	# Set the maximum time a failure stays in the list.
+	#
+	# @param value the maximum time
+	
+	def setMaxTime(self, value):
+		self.failManager.setMaxTime(value)
+		logSys.info("Set maxTime = %s" % value)
+	
+	##
+	# Get the maximum time a failure stays in the list.
+	#
+	# @return the time value
+	
+	def getMaxTime(self):
+		return self.failManager.getMaxTime()
+
+	##
+	# Main loop.
+	#
+	# This function is the main loop of the thread. It checks if the
+	# file has been modified and looks for failures.
+	# @return True when the thread exits nicely
+
+	def run(self):
+		self.setActive(True)
+		while self.isActive():
+			if not self.isIdle:
+				if self.isModified():
+					self.getFailures()
+				try:
+					ticket = self.failManager.toBan()
+					self.jail.putFailTicket(ticket)
+				except FailManagerEmpty:
+					self.failManager.cleanup(time.time())
+					time.sleep(self.sleepTime)
+			else:
+				time.sleep(self.sleepTime)
+		logSys.debug(self.jail.getName() + ": filter terminated")
+		return True
+	
+	##
+	# Add an IP to the ignore list.
+	#
+	# IP addresses in the ignore list are not taken into account
+	# when finding failures. CIDR mask are also accepted.
+	# @param ip IP address to ignore
+	
+	def addIgnoreIP(self, ip):
+		logSys.debug("Add " + ip + " to ignore list")
+		self.ignoreIpList.append(ip)
+	
+	##
+	# Check if IP address is in the ignore list.
+	#
+	# Check if the given IP address matches an IP address or a CIDR
+	# mask in the ignore list.
+	# @param ip IP address
+	# @return True if IP address is in ignore list
+	
+	def inIgnoreIPList(self, ip):
+		for i in self.ignoreIpList:
+			s = i.split('/', 1)
+			# IP address without CIDR mask
+			if len(s) == 1:
+				s.insert(1, '32')
+			s[1] = long(s[1])
+			try:
+				a = cidr(s[0], s[1])
+				b = cidr(ip, s[1])
+			except Exception:
+				return False
+			if a == b:
+				return True
+		return False
+	
+	##
+	# Open the log file.
+	
+	def openLogFile(self):
+		""" Opens the log file specified on init.
+		"""
+		try:
+			self.fileHandler = open(self.logPath)
+		except OSError:
+			logSys.error("Unable to open "+self.logPath)
+	
+	##
+	# Close the log file.
+	
+	def closeLogFile(self):
+		self.fileHandler.close()
+	
+	##
+	# Checks if the log file has been modified.
+	#
+	# Checks if the log file has been modified using os.stat().
+	# @return True if log file has been modified
+	
+	def isModified(self):
+		try:
+			self.logStats = os.stat(self.logPath)
+			if self.lastModTime == self.logStats.st_mtime:
+				return False
+			else:
+				logSys.debug(self.logPath + " has been modified")
+				self.lastModTime = self.logStats.st_mtime
+				return True
+		except OSError:
+			logSys.error("Unable to get stat on " + self.logPath)
+			return False
+
+	##
+	# Set the file position.
+	#
+	# Sets the file position. We must take care of log file rotation
+	# and reset the position to 0 in that case. Use the log message
+	# timestamp in order to detect this.
+	
+	def setFilePos(self):
+		line = self.fileHandler.readline()
+		if self.lastDate < self.getTime(line):
+			logSys.debug("Date " + `self.lastDate` + " is " + "smaller than " +
+							`self.getTime(line)`)
+			logSys.debug("Log rotation detected for " + self.logPath)
+			self.lastPos = 0
+		
+		logSys.debug("Setting file position to " + `self.lastPos` + " for " +
+						self.logPath)
+		self.fileHandler.seek(self.lastPos)
+
+	##
+	# Get the file position.
+	
+	def getFilePos(self):
+		return self.fileHandler.tell()
+
+	##
+	# Gets all the failure in the log file.
+	#
+	# Gets all the failure in the log file which are newer than
+	# time.time()-self.findTime. When a failure is detected, a FailTicket
+	# is created and is added to the FailManager.
+	
+	def getFailures(self):
+		ipList = dict()
+		logSys.debug(self.logPath)
+		self.openLogFile()
+		self.setFilePos()
+		lastLine = None
+		for line in self.fileHandler:
+			try:
+				# Try to convert UTF-8 string to Latin-1
+				line = line.decode('utf-8').encode('latin-1')
+			except UnicodeDecodeError:
+				pass
+			if not self.hasTime(line):
+				# There is no valid time in this line
+				continue
+			lastLine = line
+			for element in self.findFailure(line):
+				ip = element[0]
+				unixTime = element[1]
+				if unixTime < time.time()-self.findTime:
+					break
+				if self.inIgnoreIPList(ip):
+					logSys.debug("Ignore "+ip)
+					continue
+				logSys.debug("Found "+ip)
+				self.failManager.addFailure(FailTicket(ip, unixTime))
+		self.lastPos = self.getFilePos()
+		if lastLine:
+			self.lastDate = self.getTime(lastLine)
+		self.closeLogFile()
+
+	##
+	# Finds the failure in a line.
+	#
+	# Uses the failregex pattern to find it and timeregex in order
+	# to find the logging time.
+	# @return a dict with IP and timestamp.
+
+	def findFailure(self, line):
+		failList = list()
+		match = re.search(self.failRegex, line)
+		if match:
+			timeMatch = re.search(self.timeRegex, match.string)
+			if timeMatch:
+				date = self.getUnixTime(timeMatch.group())
+				ipMatch = textToIp(match.string)
+				if ipMatch:
+					for ip in ipMatch:
+						failList.append([ip, date])
+		return failList
+	
+	##
+	# Check is a line contains a valid date.
+	#
+	# @param line the line
+	# @return True if the line contains a valid date
+	
+	def hasTime(self, line):
+		timeMatch = re.search(self.timeRegex, line)
+		if timeMatch:
+			return True
+		else:
+			return False
+
+	##
+	# Get the time of a log line.
+	#
+	# @param line the line
+	# @return the timestamp of the log line
+	
+	def getTime(self, line):
+		date = 0
+		timeMatch = re.search(self.timeRegex, line)
+		if timeMatch:
+			date = self.getUnixTime(timeMatch.group())
+		return date
+
+	##
+	# Get the Unix timestamp.
+	#
+	# Get the Unix timestamp of a given date. Pattern should describe the
+	# date construction of value.
+	# @param value the date
+	# @return the Unix timestamp
+		
+	def getUnixTime(self, value):
+		try:
+			# Check if the parsed value is in TAI64N format
+			if not self.timePattern.lower() == "tai64n":
+				date = list(time.strptime(value, self.timePattern))
+			else:
+				# extract part of format which represents seconds since epoch
+				seconds_since_epoch = value[2:17]
+				date = list(time.gmtime(int(seconds_since_epoch, 16)))
+		except ValueError, e:
+			logSys.error(e)
+			logSys.error("Please check the format and your locale settings.")
+			return None
+		if date[0] < 2000:
+			# There is probably no year field in the logs
+			date[0] = time.gmtime()[0]
+			# Bug fix for #1241756
+			# If the date is greater than the current time, we suppose
+			# that the log is not from this year but from the year before
+			#if time.mktime(date) > time.time():
+			#	date[0] -= 1
+		unixTime = time.mktime(date)
+		return unixTime
+
+	##
+	# Get the status of the filter.
+	#
+	# Get some informations about the filter state such as the total
+	# number of failures.
+	# @return a list with tuple
+	
+	def status(self):
+		ret = [("Currently failed", self.failManager.size()),
+			   ("Total failed", self.failManager.getFailTotal())]
+		return ret
+	
\ No newline at end of file
diff --git a/server/jail.py b/server/jail.py
new file mode 100644
index 00000000..06b1229d
--- /dev/null
+++ b/server/jail.py
@@ -0,0 +1,95 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from action import Action
+from filter import Filter
+import Queue
+
+
+class Jail:
+	
+	def __init__(self, name, filter = None, action = None):
+		self.name = name
+		self.queue = Queue.Queue()
+		self.filter = Filter(self)
+		self.action = Action(self)
+	
+	def setName(self, name):
+		self.name = name
+	
+	def getName(self):
+		return self.name
+	
+	def setFilter(self, filter):
+		self.filter = filter
+	
+	def getFilter(self):
+		return self.filter
+	
+	def setAction(self, action):
+		self.action = action
+	
+	def getAction(self):
+		return self.action
+	
+	def putFailTicket(self, ticket):
+		self.queue.put(ticket)
+	
+	def getFailTicket(self):
+		try:
+			return self.queue.get(False)
+		except Queue.Empty:
+			return False
+	
+	def start(self):
+		self.filter.start()
+		self.action.start()
+	
+	def stop(self):
+		self.filter.stop()
+		self.action.stop()
+		self.filter.join()
+		self.action.join()
+	
+	def isActive(self):
+		isActive0 = self.filter.isActive()
+		isActive1 = self.action.isActive()
+		return isActive0 or isActive1
+	
+	def setIdle(self, value):
+		self.filter.setIdle(value)
+		self.action.setIdle(value)
+	
+	def getIdle(self):
+		return self.filter.getIdle() or self.action.getIdle()
+	
+	def getStatus(self):
+		fStatus = self.filter.status()
+		aStatus = self.action.status()
+		ret = [("filter", fStatus),
+			   ("action", aStatus)]
+		return ret
+	
\ No newline at end of file
diff --git a/server/jailthread.py b/server/jailthread.py
new file mode 100644
index 00000000..e74c4db2
--- /dev/null
+++ b/server/jailthread.py
@@ -0,0 +1,114 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from threading import Thread
+
+class JailThread(Thread):
+	
+	##
+	# Constructor.
+	#
+	# Initialize the filter object with default values.
+	# @param jail the jail object
+	
+	def __init__(self, jail):
+		Thread.__init__(self)
+		## Control the state of the thread.
+		self.isRunning = False
+		## Control the idle state of the thread.
+		self.isIdle = False
+		## The time the thread sleeps in the loop.
+		self.sleepTime = 1
+	
+	##
+	# Set the time that the thread sleeps.
+	#
+	# This value could also be called "polling time". A value of 1 is a
+	# good one. This unit is "second"
+	# @param value the polling time (second)
+	
+	def setSleepTime(self, value):
+		self.sleepTime = value
+		logSys.info("Set sleeptime = " + value)
+	
+	##
+	# Get the time that the thread sleeps.
+	#
+	# @return the polling time
+	
+	def getSleepTime(self):
+		return self.sleeptime
+	
+	##
+	# Set the idle flag.
+	#
+	# This flag stops the check of the log file.
+	# @param value boolean value
+	
+	def setIdle(self, value):
+		self.isIdle = value
+	
+	##
+	# Get the idle state.
+	#
+	# @return the idle state
+	
+	def getIdle(self):
+		return self.isIdle
+	
+	##
+	# Stop the thread.
+	#
+	# Stop the exection of the thread and quit.
+	
+	def stop(self):
+		self.isRunning = False
+	
+	##
+	# Set the isRunning flag.
+	#
+	# @param value True if the thread is running
+	
+	def setActive(self, value):
+		self.isRunning = value
+	
+	##
+	# Check if the thread is active.
+	#
+	# Check if the filter thread is running.
+	# @return True if the thread is running
+	
+	def isActive(self):
+		return self.isRunning
+	
+	##
+	# Get the status of the thread
+	#
+	# Get some informations about the thread. This is an abstract method.
+	# @return a list with tuple
+	
+	def status(self):
+		pass
\ No newline at end of file
diff --git a/server/server.py b/server/server.py
new file mode 100644
index 00000000..7ef3886f
--- /dev/null
+++ b/server/server.py
@@ -0,0 +1,291 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from jail import Jail
+from transmitter import Transmitter
+import locale, logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.server")
+
+class Server:
+	
+	def __init__(self):
+		self.jails = dict()
+		self.transm = Transmitter(self)
+		self.logLevel = 3
+		# Set logging level
+		self.setLogLevel(self.logLevel)
+	
+	def start(self):
+		# Start the communication
+		self.transm.start()
+	
+	def quit(self):
+		for jail in self.jails.copy():
+			self.stopJail(jail)
+		self.transm.stop()
+	
+	def addJail(self, name):
+		self.jails[name] = Jail(name)
+		
+	def delJail(self, name):
+		if self.jails.has_key(name):
+			del self.jails[name]
+		else:
+			raise ServerUnknownJail(name)
+	
+	def startJail(self, name):
+		if self.jails.has_key(name):
+			self.jails[name].start()
+		else:
+			raise ServerUnknownJail(name)
+	
+	def stopJail(self, name):
+		if self.jails.has_key(name):
+			if self.isActive(name):
+				self.jails[name].stop()
+				self.delJail(name)
+		else:
+			raise ServerUnknownJail(name)
+			
+	def isActive(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].isActive()
+		else:
+			raise ServerUnknownJail(name)
+	
+	def setIdleJail(self, name, value):
+		if self.jails.has_key(name):
+			self.jails[name].setIdle(value)
+			return True
+		else:
+			raise ServerUnknownJail(name)
+
+	def getIdleJail(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getIdle()
+		else:
+			raise ServerUnknownJail(name)
+	
+	# Filter
+	def setLogPath(self, name, file):
+		if self.jails.has_key(name):
+			self.jails[name].getFilter().setLogPath(file)
+	
+	def getLogPath(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getFilter().getLogPath()
+		else:
+			raise ServerUnknownJail(name)
+	
+	def setTimeRegex(self, name, value):
+		if self.jails.has_key(name):
+			self.jails[name].getFilter().setTimeRegex(value)
+		else:
+			raise ServerUnknownJail(name)
+	
+	def getTimeRegex(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getFilter().getTimeRegex()
+		else:
+			raise ServerUnknownJail(name)
+	
+	def setTimePattern(self, name, value):
+		if self.jails.has_key(name):
+			self.jails[name].getFilter().setTimePattern(value)
+		else:
+			raise ServerUnknownJail(name)
+	
+	def getTimePattern(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getFilter().getTimePattern()
+		else:
+			raise ServerUnknownJail(name)
+
+	def setFailRegex(self, name, value):
+		if self.jails.has_key(name):
+			self.jails[name].getFilter().setFailRegex(value)
+		else:
+			raise ServerUnknownJail(name)
+	
+	def getFailRegex(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getFilter().getFailRegex()
+		else:
+			raise ServerUnknownJail(name)
+	
+	def setMaxRetry(self, name, value):
+		if self.jails.has_key(name):
+			self.jails[name].getFilter().setMaxRetry(value)
+		else:
+			raise ServerUnknownJail(name)
+	
+	def getMaxRetry(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getFilter().getMaxRetry()
+		else:
+			raise ServerUnknownJail(name)
+	
+	def setMaxTime(self, name, value):
+		if self.jails.has_key(name):
+			self.jails[name].getFilter().setMaxTime(value)
+		else:
+			raise ServerUnknownJail(name)
+	
+	def getMaxTime(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getFilter().getMaxTime()
+		else:
+			raise ServerUnknownJail(name)
+	
+	# Action	
+	def setBanTime(self, name, value):
+		if self.jails.has_key(name):
+			self.jails[name].getAction().setBanTime(value)
+		else:
+			raise ServerUnknownJail(name)
+	
+	def getBanTime(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getAction().getBanTime()
+		else:
+			raise ServerUnknownJail(name)
+	
+	def setActionStart(self, name, value):
+		if self.jails.has_key(name):
+			self.jails[name].getAction().setActionStart(value)
+		else:
+			raise ServerUnknownJail(name)
+	
+	def getActionStart(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getAction().getActionStart()
+		else:
+			raise ServerUnknownJail(name)
+		
+	def setActionStop(self, name, value):
+		if self.jails.has_key(name):
+			self.jails[name].getAction().setActionStop(value)
+		else:
+			raise ServerUnknownJail(name)
+	
+	def getActionStop(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getAction().getActionStop()
+		else:
+			raise ServerUnknownJail(name)
+	
+	def setActionCheck(self, name, value):
+		if self.jails.has_key(name):
+			self.jails[name].getAction().setActionCheck(value)
+		else:
+			raise ServerUnknownJail(name)
+	
+	def getActionCheck(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getAction().getActionCheck()
+		else:
+			raise ServerUnknownJail(name)
+	
+	def setActionBan(self, name, value):
+		if self.jails.has_key(name):
+			self.jails[name].getAction().setActionBan(value)
+		else:
+			raise ServerUnknownJail(name)
+	
+	def getActionBan(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getAction().getActionBan()
+		else:
+			raise ServerUnknownJail(name)
+	
+	def setActionUnban(self, name, value):
+		if self.jails.has_key(name):
+			self.jails[name].getAction().setActionUnban(value)
+		else:
+			raise ServerUnknownJail(name)
+	
+	def getActionUnban(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getAction().getActionUnban()
+		else:
+			raise ServerUnknownJail(name)
+		
+	# Status
+	def status(self):
+		jailList = ''
+		for jail in self.jails:
+			jailList += jail + ', '
+		length = len(jailList)
+		if not length == 0:
+			jailList = jailList[:length-2]
+		ret = [("Number of jail", len(self.jails)),
+			   ("Jail list", jailList)]
+		return ret
+	
+	def statusJail(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getStatus()
+		raise ServerUnknownJail(name)
+	
+	# Logging
+	
+	##
+	# Set the logging level.
+	#
+	# Incrementing the value gives more messages.
+	# 0 = FATAL
+	# 1 = ERROR
+	# 2 = WARNING
+	# 3 = INFO
+	# 4 = DEBUG
+	# @param value the level
+	
+	def setLogLevel(self, value):
+		self.logLevel = value
+		logLevel = logging.DEBUG
+		if value == 0:
+			logLevel = logging.FATAL
+		elif value == 1:
+			logLevel = logging.ERROR
+		elif value == 2:
+			logLevel = logging.WARNING
+		elif value == 3:
+			logLevel = logging.INFO
+		logging.getLogger("fail2ban").setLevel(logLevel)
+	
+	##
+	# Get the logging level.
+	#
+	# @see setLogLevel
+	# @return the log level
+	
+	def getLogLevel(self):
+		return self.logLevel
+
+class ServerUnknownJail(Exception):
+	pass
\ No newline at end of file
diff --git a/server/ssocket.py b/server/ssocket.py
new file mode 100644
index 00000000..2c3fcf0a
--- /dev/null
+++ b/server/ssocket.py
@@ -0,0 +1,103 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from threading import Thread
+import socket, time, logging, pickle, os, os.path
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.comm")
+
+class SSocket(Thread):
+	
+	def __init__(self, transmitter):
+		Thread.__init__(self)
+		self.socketFile = "/tmp/fail2ban.sock"
+		self.transmit = transmitter
+		self.isRunning = False
+		logSys.debug("Created SSocket")
+	
+	def initialize(self):
+		# Remove socket
+		if os.path.exists(self.socketFile):
+			os.remove(self.socketFile)
+		# Create an INET, STREAMing socket
+		#self.ssock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+		self.ssock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+		#self.ssock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+		self.ssock.setblocking(False)
+		# Bind the socket to a public host and a well-known port
+		#self.ssock.bind(("localhost", 2222))
+		self.ssock.bind(self.socketFile)
+		# Become a server socket
+		self.ssock.listen(1)
+	
+	def run(self):
+		self.isRunning = True
+		stime = 1.0
+		while self.isRunning:
+			try:
+				# Accept connections from outside
+				(csock, address) = self.ssock.accept()
+				stime /= 10
+				logSys.debug("Connection accepted")
+				msg = self.receive(csock)
+				msg = self.transmit.proceed(msg)
+				self.send(csock, msg)
+				csock.close()
+			except Exception:
+				time.sleep(stime)
+				stime += 0.05
+				if stime > 1.0:
+					stime = 1.0
+		self.ssock.close()
+		# Remove socket
+		if os.path.exists(self.socketFile):
+			logSys.debug("Removed socket file " + self.socketFile)
+			os.remove(self.socketFile)
+		logSys.debug("Socket shutdown")
+		return True
+	
+	##
+	# Stop the thread.
+	#
+	# Set the isRunning flag to False.
+	# @bug It seems to be some concurrency problem with this flag
+	
+	def stop(self):
+		self.isRunning = False
+	
+	def send(self, socket, msg):
+		obj = pickle.dumps(msg)
+		socket.send(obj + "<F2B_END_COMMAND>")
+	
+	def receive(self, socket):
+		msg = ''
+		while msg.rfind("<F2B_END_COMMAND>") == -1:
+			chunk = socket.recv(6)
+			if chunk == '':
+				raise RuntimeError, "socket connection broken"
+			msg = msg + chunk
+		return pickle.loads(msg)
diff --git a/server/ticket.py b/server/ticket.py
new file mode 100644
index 00000000..511f4769
--- /dev/null
+++ b/server/ticket.py
@@ -0,0 +1,49 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time, logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+class Ticket:
+	
+	def __init__(self, ip, time):
+		self.ip = ip
+		self.time = time
+	
+	def setIP(self, value):
+		self.ip = value
+	
+	def getIP(self):
+		return self.ip
+	
+	def setTime(self, value):
+		self.time = value
+	
+	def getTime(self):
+		return self.time
+	
\ No newline at end of file
diff --git a/server/transmitter.py b/server/transmitter.py
new file mode 100644
index 00000000..a3de9a23
--- /dev/null
+++ b/server/transmitter.py
@@ -0,0 +1,182 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from ssocket import SSocket
+import re, pickle, logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.comm")
+
+class Transmitter:
+	
+	def __init__(self, server):
+		self.server = server
+		self.socket = SSocket(self)
+	
+	def start(self):
+		self.socket.initialize()
+		self.socket.start()
+	
+	##
+	# Stop the transmitter.
+	#
+	# @bug Fix the issue with join(). When using servertestcase.py, errors
+	# happen which disappear when using join() in this function.
+	
+	def stop(self):
+		self.socket.stop()
+		#self.socket.join()
+		
+	def proceed(self, action):
+		# Deserialize object
+		logSys.debug("Action: " + `action`)
+		try:
+			ret = self.actionHandler(action)
+			ack = 0, ret
+		except Exception, e:
+			logSys.warn("Invalid command")
+			ack = 1, e
+		return ack
+	
+	##
+	# Handle an action.
+	#
+	# 
+	
+	def actionHandler(self, action):
+		if action[0] == "ping":
+			return "pong"
+		elif action[0] == "add":
+			name = action[1]
+			self.server.addJail(name)
+			return name
+		elif action[0] == "start":
+			name = action[1]
+			self.server.startJail(name)
+			return None
+		elif action[0] == "stop":
+			name = action[1]
+			self.server.stopJail(name)
+			return None
+		elif action[0] == "sleep":
+			value = action[1]
+			time.sleep(int(value))
+			return None
+		elif action[0] == "set":
+			return self.actionSet(action[1:])
+		elif action[0] == "get":
+			return self.actionGet(action[1:])
+		elif action[0] == "status":
+			return self.status(action[1:])
+		elif action[0] == "quit":
+			self.server.quit()
+			return None
+		raise Exception("Invalid command")
+	
+	def actionSet(self, action):
+		name = action[0]
+		# Logging
+		if name == "loglevel":
+			value = int(action[1])
+			self.server.setLogLevel(value)
+			return self.server.getLogLevel()
+		# Jail
+		if action[1] == "idle":
+			if action[2] == "on":
+				self.server.setIdleJail(name, True)
+			elif action[2] == "off":
+				self.server.setIdleJail(name, False)
+			return self.server.getIdleJail(name)
+		# Filter
+		elif action[1] == "logpath":
+			value = action[2]
+			self.server.setLogPath(name, value)
+			return self.server.getLogPath(name)
+		elif action[1] == "timeregex":
+			value = action[2]
+			self.server.setTimeRegex(name, value)
+			return self.server.getTimeRegex(name)
+		elif action[1] == "timepattern":
+			value = action[2]
+			self.server.setTimePattern(name, value)
+			return self.server.getTimePattern(name)
+		elif action[1] == "failregex":
+			value = action[2]
+			self.server.setFailRegex(name, value)
+			return self.server.getFailRegex(name)
+		elif action[1] == "maxtime":
+			value = action[2]
+			self.server.setMaxTime(name, int(value))
+			return self.server.getMaxTime(name)
+		elif action[1] == "maxretry":
+			value = action[2]
+			self.server.setMaxRetry(name, int(value))
+			return self.server.getMaxRetry(name)
+		# Action
+		elif action[1] == "bantime":
+			value = action[2]
+			self.server.setBanTime(name, int(value))
+			return self.server.getBanTime(name)
+		elif action[1] == "actionstart":
+			value = action[2]
+			self.server.setActionStart(name, value)
+			return self.server.getActionStart(name)
+		elif action[1] == "actionstop":
+			value = action[2]
+			self.server.setActionStop(name, value)
+			return self.server.getActionStop(name)
+		elif action[1] == "actioncheck":
+			value = action[2]
+			self.server.setActionCheck(name, value)
+			return self.server.getActionCheck(name)
+		elif action[1] == "actionban":
+			value = action[2]
+			self.server.setActionBan(name, value)
+			return self.server.getActionBan(name)
+		elif action[1] == "actionunban":
+			value = action[2]
+			self.server.setActionUnban(name, value)
+			return self.server.getActionUnban(name)
+		raise Exception("Invalid command (no set action)")
+	
+	def actionGet(self, action):
+		name = action[0]
+		# Logging
+		if name == "loglevel":
+			return self.server.getLogLevel()
+		# Filter
+		if action[1] == "logpath":
+			return self.server.getLogPath(name)
+		raise Exception("Invalid command (no get action)")
+	
+	def status(self, action):
+		if len(action) == 0:
+			return self.server.status()
+		else:
+			name = action[0]
+			return self.server.statusJail(name)
+		raise Exception("Invalid command (no status)")
+	
\ No newline at end of file
diff --git a/setup.cfg b/setup.cfg
deleted file mode 100644
index fba97f88..00000000
--- a/setup.cfg
+++ /dev/null
@@ -1,5 +0,0 @@
-[install]
-install-purelib=/usr/lib/fail2ban
-
-[sdist]
-formats=bztar
diff --git a/setup.py b/setup.py
deleted file mode 100755
index 99b7f024..00000000
--- a/setup.py
+++ /dev/null
@@ -1,82 +0,0 @@
-#!/usr/bin/env python
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-from distutils.core import setup
-from version import version
-from os.path import isfile, join
-from sys import exit, argv
-
-longdesc = '''
-Fail2Ban scans log files like /var/log/pwdfail or
-/var/log/apache/error_log and bans IP that makes
-too many password failures. It updates firewall rules
-to reject the IP address or executes user defined
-commands.'''
-
-setup(
-	name = "fail2ban",
-	version = version,
-	description = "Ban IPs that make too many password failure",
-	long_description = longdesc,
-	author = "Cyril Jaquier",
-	author_email = "lostcontrol@users.sourceforge.net",
-	url = "http://fail2ban.sourceforge.net",
-	license = "GPL",
-	platforms = "Posix",
-	scripts = ['fail2ban'],
-	py_modules = ['fail2ban', 'version'],
-	packages = ['firewall', 'logreader', 'confreader', 'utils']
-)
-
-# Do some checks after installation
-# Search for obsolete files.
-obsoleteFiles = []
-elements = {"/usr/bin/": ["fail2ban.py"],
-			"/usr/lib/fail2ban/firewall/": ["iptables.py", "ipfwadm.py",
-											"ipfw.py"]}
-for dir in elements:
-	for f in elements[dir]:
-		path = join(dir, f)
-		if isfile(path):
-			obsoleteFiles.append(path)
-if obsoleteFiles:
-	print
-	print "Obsolete files from previous Fail2Ban versions were found on " \
-		  "your system."
-	print "Please delete them:"
-	print
-	for f in obsoleteFiles:
-		print "\t" + f
-	print
-
-# Update config file
-if argv[1] == "install":
-	print
-	print "Please do not forget to update your configuration file."
-	print "Use config/fail2ban.conf.* as example."
-	print
diff --git a/firewall/__init__.py b/testcases/__init__.py
similarity index 88%
rename from firewall/__init__.py
rename to testcases/__init__.py
index 76dba873..60ef5531 100644
--- a/firewall/__init__.py
+++ b/testcases/__init__.py
@@ -16,10 +16,10 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.1 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
\ No newline at end of file
diff --git a/testcases/banmanagertestcase.py b/testcases/banmanagertestcase.py
new file mode 100644
index 00000000..8fcedfbb
--- /dev/null
+++ b/testcases/banmanagertestcase.py
@@ -0,0 +1,56 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import unittest, socket, time, pickle
+from server.banmanager import BanManager
+from server.banticket import BanTicket
+
+class AddFailure(unittest.TestCase):
+
+	def setUp(self):
+		"""Call before every test case."""
+		self.ticket = BanTicket('193.168.0.128', 1167605999.0)
+		self.banManager = BanManager()
+		self.assertTrue(self.banManager.addBanTicket(self.ticket))
+
+	def tearDown(self):
+		"""Call after every test case."""
+	
+	def testAdd(self):
+		self.assertEqual(self.banManager.size(), 1)
+	
+	def testAddDuplicate(self):
+		self.assertFalse(self.banManager.addBanTicket(self.ticket))
+		self.assertEqual(self.banManager.size(), 1)
+		
+	def testInListOK(self):
+		ticket = BanTicket('193.168.0.128', 1167605999.0)
+		self.assertTrue(self.banManager.inBanList(ticket))
+	
+	def testInListNOK(self):
+		ticket = BanTicket('111.111.1.111', 1167605999.0)
+		self.assertFalse(self.banManager.inBanList(ticket))
+		
\ No newline at end of file
diff --git a/testcases/failmanagertestcase.py b/testcases/failmanagertestcase.py
new file mode 100644
index 00000000..24d82bd5
--- /dev/null
+++ b/testcases/failmanagertestcase.py
@@ -0,0 +1,79 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import unittest, socket, time, pickle
+from server.failmanager import FailManager
+from server.failmanager import FailManagerEmpty
+from server.failticket import FailTicket
+
+class AddFailure(unittest.TestCase):
+
+	def setUp(self):
+		"""Call before every test case."""
+		self.items = [['193.168.0.128', 1167605999.0],
+					  ['193.168.0.128', 1167605999.0],
+					  ['193.168.0.128', 1167605999.0],
+					  ['193.168.0.128', 1167605999.0],
+					  ['193.168.0.128', 1167605999.0],
+					  ['87.142.124.10', 1167605999.0],
+					  ['87.142.124.10', 1167605999.0],
+					  ['87.142.124.10', 1167605999.0]]
+		
+		self.failManager = FailManager()
+		for i in self.items:
+			self.failManager.addFailure(FailTicket(i[0], i[1]))
+
+	def tearDown(self):
+		"""Call after every test case."""
+	
+	def testAdd(self):
+		self.assertEqual(self.failManager.size(), 2)
+	
+	def testDel(self):
+		self.failManager.delFailure('193.168.0.128')
+		self.failManager.delFailure('111.111.1.111')
+		
+		self.assertEqual(self.failManager.size(), 1)
+		
+	def testCleanupOK(self):
+		timestamp = 1167606999.0
+		self.failManager.cleanup(timestamp)
+		self.assertEqual(self.failManager.size(), 0)
+		
+	def testCleanupNOK(self):
+		timestamp = 1167605990.0
+		self.failManager.cleanup(timestamp)
+		self.assertEqual(self.failManager.size(), 2)
+	
+	def testbanOK(self):
+		self.failManager.setMaxRetry(5)
+		#ticket = FailTicket('193.168.0.128', None)
+		ticket = self.failManager.toBan()
+		self.assertEqual(ticket.getIP(), "193.168.0.128")
+	
+	def testbanNOK(self):
+		self.failManager.setMaxRetry(10)
+		self.assertRaises(FailManagerEmpty, self.failManager.toBan)
diff --git a/testcases/files/testcase01.log b/testcases/files/testcase01.log
new file mode 100644
index 00000000..43143d0b
--- /dev/null
+++ b/testcases/files/testcase01.log
@@ -0,0 +1,18 @@
+Déc 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Déc 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Déc 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
+Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
+Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
+Dez 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dez 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dez 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+De  31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+De  31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+De  31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
+Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
+Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
diff --git a/testcases/files/testcase02.log b/testcases/files/testcase02.log
new file mode 100644
index 00000000..547f8a53
--- /dev/null
+++ b/testcases/files/testcase02.log
@@ -0,0 +1,10 @@
+Mar 16 04:57:00 i60p295 sshd[11437]: input_userauth_request: illegal user test123
+Mar 16 04:57:00 i60p295 sshd[11437]: Failed password for illegal user test123 from ::ffff:66.38.192.238 port 51381 ssh2
+Mar 16 04:57:00 i60p295 sshd[11437]: Connection closed by ::ffff:66.38.192.238
+Mar 16 10:33:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Mar 16 10:33:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Mar 16 10:33:59 i60p295 sshd[12365]: Postponed keyboard-interactive for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Mar 16 10:34:01 i60p295 sshd[12365]: Postponed keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Mar 16 10:34:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Mär 16 10:33:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Mär 16 10:33:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
new file mode 100644
index 00000000..5465400c
--- /dev/null
+++ b/testcases/filtertestcase.py
@@ -0,0 +1,98 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import unittest, socket
+from server.filter import Filter
+from server.failmanager import FailManager
+
+class IgnoreIP(unittest.TestCase):
+
+	def setUp(self):
+		"""Call before every test case."""
+		self.filter = Filter(None)
+
+	def tearDown(self):
+		"""Call after every test case."""
+
+	def testIgnoreIPOK(self):
+		ipList = "127.0.0.1", "192.168.0.1", "255.255.255.255", "99.99.99.99"
+		for ip in ipList:
+			self.filter.addIgnoreIP(ip)
+			self.assertTrue(self.filter.inIgnoreIPList(ip))
+	
+	def testIgnoreIPNOK(self):
+		ipList = "", "999.999.999.999", "abcdef", "192.168.0"
+		for ip in ipList:
+			self.filter.addIgnoreIP(ip)
+			self.assertFalse(self.filter.inIgnoreIPList(ip))
+
+
+class LogFile(unittest.TestCase):
+
+	def setUp(self):
+		"""Call before every test case."""
+		self.filter = Filter(None)
+		self.filter.setLogPath("testcases/files/testcase01.log")
+
+	def tearDown(self):
+		"""Call after every test case."""
+		
+	def testOpen(self):
+		self.filter.openLogFile()
+	
+	def testIsModified(self):
+		self.filter.openLogFile()
+		self.assertTrue(self.filter.isModified())
+
+
+class GetFailures(unittest.TestCase):
+
+	def setUp(self):
+		"""Call before every test case."""
+		self.filter = Filter(None)
+		self.filter.setLogPath("testcases/files/testcase01.log")
+		self.filter.setTimeRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+		self.filter.setTimePattern("%b %d %H:%M:%S")
+		self.filter.setFailRegex("Authentication failure")
+
+	def tearDown(self):
+		"""Call after every test case."""
+		
+	def testGetFailures(self):
+		output = [('87.142.124.10', 3, 1167605999.0),
+				  ('193.168.0.128', 3, 1167605999.0)]
+
+		self.filter.openLogFile()
+		self.filter.getFailures()
+		
+		found = []
+		for ip in self.filter.failManager.failList:
+			fData = self.filter.failManager.failList[ip]
+			retry = fData.getRetry()
+			lTime = fData.getLastTime()
+			found.append((ip, retry, lTime))
+		self.assertEqual(found, output)
+		
\ No newline at end of file
diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
new file mode 100644
index 00000000..34e60537
--- /dev/null
+++ b/testcases/servertestcase.py
@@ -0,0 +1,127 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import unittest, socket, time
+from server.server import Server
+
+class StartStop(unittest.TestCase):
+
+	def setUp(self):
+		"""Call before every test case."""
+		self.server = Server()
+		self.server.setLogLevel(0)
+		self.server.start()
+
+	def tearDown(self):
+		"""Call after every test case."""
+		self.server.quit()
+	
+	def testStartStopJail(self):
+		name = "TestCase"
+		self.server.addJail(name)
+		self.server.startJail(name)
+		time.sleep(1)
+		self.server.stopJail(name)
+
+
+class Transmitter(unittest.TestCase):
+	
+	def setUp(self):
+		"""Call before every test case."""
+		self.server = Server()
+		self.server.setLogLevel(0)
+		self.server.start()
+
+	def tearDown(self):
+		"""Call after every test case."""
+		self.server.quit()
+	
+	def testSetActionOK(self):
+		name = "TestCase"
+		cmdList = [["add", name],
+				   ["set", name, "actionstart", "Action Start"],
+				   ["set", name, "actionstop", "Action Stop"],
+				   ["set", name, "actioncheck", "Action Check"],
+				   ["set", name, "actionban", "Action Ban"],
+				   ["set", name, "actionunban", "Action Unban"],
+				   ["quit"]]
+		
+		outList = [(0, name),
+				   (0, 'Action Start'),
+				   (0, 'Action Stop'),
+				   (0, 'Action Check'),
+				   (0, 'Action Ban'),
+				   (0, 'Action Unban'),
+				   (0, None)]
+		
+		cnt = 0
+		for cmd in cmdList:
+			self.assertEqual(self.server.transm.proceed(cmd), outList[cnt])
+			cnt += 1
+	
+	def testSetActionNOK(self):
+		name = "TestCase"
+		cmdList = [["addd", name],
+				   ["set", name, "test"],
+				   ["prout prout", "Stop"],
+				   ["fail2ban", "sucks"],
+				   ["set"],
+				   ["_/&%", "@*+%&"],
+				   [" quit"]]
+		
+		outList = [1,
+				   1,
+				   1,
+				   1,
+				   1,
+				   1,
+				   1]
+		
+		cnt = 0
+		for cmd in cmdList:
+			msg = self.server.transm.proceed(cmd)
+			self.assertEqual(msg[0], outList[cnt])
+			cnt += 1
+	
+	def testJail(self):
+		name = "TestCase"
+		cmdList = [["add", name],
+				   ["set", name, "logpath", "testcases/files/testcase01.log"],
+				   ["set", name, "timeregex", "\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}"],
+				   ["set", name, "timepattern", "%b %d %H:%M:%S"],
+				   ["set", name, "failregex", "Authentication failure"],
+				   ["start", name],
+				   ["stop", name],
+				   ["quit"]]
+				  
+		for cmd in cmdList:
+			self.server.transm.proceed(cmd)
+			if cmd == ["start", name]:
+				time.sleep(2)
+				jail = self.server.jails[name]
+				self.assertEqual(jail.getFilter().failManager.size(), 0)
+				self.assertEqual(jail.getAction().banManager.size(), 2)
+		
\ No newline at end of file
diff --git a/utils/process.py b/utils/process.py
index b310f090..cf6aafcd 100644
--- a/utils/process.py
+++ b/utils/process.py
@@ -51,8 +51,8 @@ def createDaemon():
 		pid = os.fork()
 	except OSError, e:
 		return((e.errno, e.strerror))	 # ERROR (return a tuple)
-
-	if (pid == 0):	   # The first child.
+	
+	if pid == 0:	   # The first child.
 
 		# Next we call os.setsid() to become the session leader of this new
 		# session.  The process also becomes the process group leader of the
@@ -85,7 +85,7 @@ def createDaemon():
 			os._exit(0)	  # Exit parent (the first child) of the second child.
 	else:
 		os._exit(0)		 # Exit parent of the first child.
-
+	
 	# Close all open files.  Try the system configuration variable, SC_OPEN_MAX,
 	# for the maximum number of open files to close.  If it doesn't exist, use
 	# the default value (configurable).
@@ -104,34 +104,5 @@ def createDaemon():
    	os.open("/dev/null", os.O_RDONLY)	# standard input (0)
 	os.open("/dev/null", os.O_RDWR)		# standard output (1)
 	os.open("/dev/null", os.O_RDWR)		# standard error (2)
-
-	return True
-
-def killPID(pid):
-	""" Kills the process with the given PID using the
-		INT signal (same effect as <ctrl>+<c>).
-	"""
-	try:
-		return os.kill(pid, 2)
-	except OSError:
-		logSys.error("Can not kill process " + `pid` + ". Please check that " +
-					"Fail2Ban is not running and remove the file " +
-					"'/tmp/fail2ban.pid'")
-		return False
-
-def executeCmd(cmd, debug):
-	""" Executes an OS command.
-	"""
-	if cmd == "":
-		logSys.debug("Nothing to do")
-		return None
 	
-	logSys.debug(cmd)
-	if not debug:
-		retval = os.system(cmd)
-		if not retval == 0:
-			logSys.error("'" + cmd + "' returned " + `retval`)
-			raise ExternalError("Execution of command '%s' failed" % cmd)
-		return retval
-	else:
-		return None
+	return True

From 12c222bd1cdc8ab4aa714ee2df09f55d02af0bc5 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 8 Jul 2006 16:51:14 +0000
Subject: [PATCH 216/549] - One step forward to 0.7.0

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@250 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                  |  13 ++-
 MANIFEST                   |  61 +++++++++----
 TODO                       |   2 +-
 client/actionreader.py     |  19 ++--
 client/jailreader.py       |  15 +--
 config/action.d/dummy.conf |   2 -
 config/action.d/foo.conf   |  50 ++++++++++
 config/fail2ban.conf       |   2 +-
 config/fail2ban.local      |   3 -
 config/jail.conf           |   4 +-
 fail2ban-client            |   7 +-
 fail2ban-server            |  10 +-
 fail2ban-testcases         |   7 +-
 server/action.py           | 158 ++++++++------------------------
 server/actions.py          | 183 +++++++++++++++++++++++++++++++++++++
 server/jail.py             |   4 +-
 server/server.py           |  60 +++++++-----
 server/transmitter.py      |  44 +++++----
 setup.cfg                  |   5 +
 setup.py                   |  84 +++++++++++++++++
 version.py                 |  27 ++++++
 21 files changed, 550 insertions(+), 210 deletions(-)
 create mode 100644 config/action.d/foo.conf
 create mode 100644 server/actions.py
 create mode 100644 setup.cfg
 create mode 100755 setup.py
 create mode 100644 version.py

diff --git a/CHANGELOG b/CHANGELOG
index fd74f7ce..ebcac024 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,20 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.6.1)                           2006/03/16
+Fail2Ban (version 0.7.0)                           2006/07/??
 =============================================================
 
+ver. 0.7.0 (2006/07/??) - alpha
+----------
+- Almost a complete rewrite :) Fail2ban design is really
+  better (IMHO). There is a lot of new features
+- Client/Server architecture
+- Multithreading. Each jail has its own threads: one for the
+  log reading and another for the actions
+- Execute several actions
+- Split configuration files. They are more readable and easy
+  to use
+
 ver. 0.6.1 (2006/03/16) - stable
 ----------
 - Added permanent banning. Set banTime to a negative value to
diff --git a/MANIFEST b/MANIFEST
index 22731947..22b3eca8 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -1,29 +1,52 @@
 README
 CHANGELOG
 TODO
-setup.cfg
+fail2ban-client
+fail2ban-server
+fail2ban-testcases
+client/__init__.py
+client/actionreader.py
+client/configreader.py
+client/configurator.py
+client/csocket.py
+client/fail2banreader.py
+client/filterreader.py
+client/jailreader.py
+client/jailsreader.py
+server/__init__.py
+server/action.py
+server/actions.py
+server/banmanager.py
+server/banticket.py
+server/faildata.py
+server/failmanager.py
+server/failticket.py
+server/filter.py
+server/jail.py
+server/jailthread.py
+server/server.py
+server/ssocket.py
+server/ticket.py
+server/transmitter.py
 setup.py
-version.py
-fail2ban
-fail2ban.py
-firewall/__init__.py
-firewall/firewall.py
-logreader/__init__.py
-logreader/logreader.py
-confreader/__init__.py
-confreader/configreader.py
+testcases/__init__.py
+testcases/banmanagertestcase.py
+testcases/failmanagertestcase.py
+testcases/filtertestcase.py
+testcases/servertestcase.py
 utils/__init__.py
 utils/dns.py
-utils/process.py
 utils/mail.py
-utils/strings.py
 utils/pidlock.py
-config/fail2ban.conf.iptables
-config/fail2ban.conf.shorewall
-config/fail2ban.conf.hostsdeny
-config/gentoo-initd
-config/gentoo-confd
-config/redhat-initd
-config/debian-initd
+utils/process.py
+utils/strings.py
+version.py
+config/fail2ban.conf
+config/fail2ban.local
+config/jail.conf
+config/action.d/dummy.conf
+config/action.d/iptables.conf
+config/filter.d/apache-auth.conf
+config/filter.d/sshd.conf
 man/fail2ban.8
 man/fail2ban.conf.5
diff --git a/TODO b/TODO
index 7c388e85..81ed4bbf 100644
--- a/TODO
+++ b/TODO
@@ -1,2 +1,2 @@
 - Don't close socket after a send
-- Multiple actions !!!
\ No newline at end of file
+- Refactoring in server.py, actions.py, filter.py
\ No newline at end of file
diff --git a/client/actionreader.py b/client/actionreader.py
index 5486b90e..5b620d82 100644
--- a/client/actionreader.py
+++ b/client/actionreader.py
@@ -53,8 +53,7 @@ class ActionReader(ConfigReader):
 		ConfigReader.read(self, "action.d/" + self.file)
 	
 	def getOptions(self, pOpts):
-		opts = [["string", "bantime", "600"],
-				["string", "actionstart", ""],
+		opts = [["string", "actionstart", ""],
 				["string", "actionstop", ""],
 				["string", "actioncheck", ""],
 				["string", "actionban", ""],
@@ -62,19 +61,19 @@ class ActionReader(ConfigReader):
 		self.opts = ConfigReader.getOptions(self, "DEFAULT", opts, pOpts)
 	
 	def convert(self):
+		head = ["set", self.name]
 		stream = list()
+		stream.append(head + ["addaction", self.file])
 		for opt in self.opts:
-			if opt == "bantime":
-				stream.append(["set", self.name, "bantime", self.opts[opt]])
-			elif opt == "actionstart":
-				stream.append(["set", self.name, "actionstart", self.opts[opt]])
+			if opt == "actionstart":
+				stream.append(head + ["actionstart", self.file, self.opts[opt]])
 			elif opt == "actionstop":
-				stream.append(["set", self.name, "actionstop", self.opts[opt]])
+				stream.append(head + ["actionstop", self.file, self.opts[opt]])
 			elif opt == "actioncheck":
-				stream.append(["set", self.name, "actioncheck", self.opts[opt]])
+				stream.append(head + ["actioncheck", self.file, self.opts[opt]])
 			elif opt == "actionban":
-				stream.append(["set", self.name, "actionban", self.opts[opt]])
+				stream.append(head + ["actionban", self.file, self.opts[opt]])
 			elif opt == "actionunban":
-				stream.append(["set", self.name, "actionunban", self.opts[opt]])
+				stream.append(head + ["actionunban", self.file, self.opts[opt]])
 		return stream
 		
\ No newline at end of file
diff --git a/client/jailreader.py b/client/jailreader.py
index b839172c..52a62d16 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -38,7 +38,7 @@ class JailReader(ConfigReader):
 		ConfigReader.__init__(self)
 		self.name = name
 		self.filter = None
-		self.action = None
+		self.actions = list()
 	
 	def setName(self, value):
 		self.name = value
@@ -55,7 +55,7 @@ class JailReader(ConfigReader):
 	def getOptions(self):
 		opts = [["bool", "enabled", "false"],
 				["int", "maxretry", None],
-				["int", "bantime", None],
+				["int", "bantime", 600],
 				["string", "filter", ""],
 				["string", "action", ""]]
 		self.opts = ConfigReader.getOptions(self, self.name, opts)
@@ -67,9 +67,11 @@ class JailReader(ConfigReader):
 			self.filter.getOptions(self.opts)
 			
 			# Read action
-			self.action = ActionReader(self.opts["action"], self.name)
-			self.action.read()
-			self.action.getOptions(self.opts)
+			for act in self.opts["action"].split():
+				action = ActionReader(act, self.name)
+				action.read()
+				action.getOptions(self.opts)
+				self.actions.append(action)
 	
 	def convert(self):
 		stream = [["add", self.name]]
@@ -79,6 +81,7 @@ class JailReader(ConfigReader):
 			elif opt == "bantime":
 				stream.append(["set", self.name, "bantime", self.opts[opt]])
 		stream.extend(self.filter.convert())
-		stream.extend(self.action.convert())
+		for action in self.actions:
+			stream.extend(action.convert())
 		return stream
 	
\ No newline at end of file
diff --git a/config/action.d/dummy.conf b/config/action.d/dummy.conf
index 1be6253b..9f95871f 100644
--- a/config/action.d/dummy.conf
+++ b/config/action.d/dummy.conf
@@ -1,7 +1,5 @@
 [DEFAULT]
 
-bantime = 1234
-
 name = temporary
 
 # Option:  protocol
diff --git a/config/action.d/foo.conf b/config/action.d/foo.conf
new file mode 100644
index 00000000..6be4c389
--- /dev/null
+++ b/config/action.d/foo.conf
@@ -0,0 +1,50 @@
+[DEFAULT]
+
+name = temporary
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD  Default:
+#
+actionstart = touch /tmp/fail2ban.foo
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD  Default:
+#
+actionstop = rm /tmp/fail2ban.foo
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD  Default:
+#
+actioncheck = 
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+actionban = echo "+<ip>" >> /tmp/fail2ban.foo
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+actionunban = echo "-<ip>" >> /tmp/fail2ban.foo
diff --git a/config/fail2ban.conf b/config/fail2ban.conf
index 32a33411..4c29363d 100644
--- a/config/fail2ban.conf
+++ b/config/fail2ban.conf
@@ -1,4 +1,4 @@
 [DEFAULT]
 
-loglevel = 4
+loglevel = 3
 
diff --git a/config/fail2ban.local b/config/fail2ban.local
index 12b8a6f5..db4574b5 100644
--- a/config/fail2ban.local
+++ b/config/fail2ban.local
@@ -1,4 +1 @@
 [DEFAULT]
-
-test = 4567
-prout = fuck you
diff --git a/config/jail.conf b/config/jail.conf
index 66853517..ffa314e1 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -2,9 +2,9 @@
 
 enabled = true
 filter = sshd
-action = dummy
+action = dummy foo
 maxretry = 2
-#bantime = 10
+bantime = 5
 
 [SSH]
 
diff --git a/fail2ban-client b/fail2ban-client
index fa395b6e..f88f52bf 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -32,6 +32,7 @@ import sys, string, os, pickle, re, logging, getopt, time
 sys.path.insert(1, "/usr/lib/fail2ban")
 
 # Now we can import our modules
+from version import version
 from client.csocket import CSocket
 from client.configurator import Configurator
 
@@ -57,7 +58,7 @@ class Fail2banClient:
 		"""
 		print "Usage: "+self.argv[0]+" [OPTIONS] <COMMAND>"
 		print
-		print "Fail2Ban v0.7 reads log file that contains password failure report"
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
 		print
 		print "  -b         start in background"
@@ -126,6 +127,10 @@ class Fail2banClient:
 			self.startServer(self.conf["background"])
 			# Configure the server
 			self.processCmd(self.stream)
+		elif cmd[0] == "loadconf" and len(cmd) == 1:
+			self.readConfig()
+			# Configure the server
+			self.processCmd(self.stream)
 		else:
 			try:
 				client = CSocket()
diff --git a/fail2ban-server b/fail2ban-server
index 1d8ece42..c23c528e 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -25,9 +25,15 @@ __date__ = "$Date: 2004/10/10 13:33:40 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
+import locale, getopt, logging, sys
+
+# Inserts our own modules path first in the list
+# fix for bug #343821
+sys.path.insert(1, "/usr/lib/fail2ban")
+
+from version import version
 from server.server import Server
 from utils.process import *
-import locale, getopt, logging, sys
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban")
@@ -53,7 +59,7 @@ class Fail2banServer:
 		"""
 		print "Usage: "+self.argv[0]+" [OPTIONS]"
 		print
-		print "Fail2Ban v0.7 reads log file that contains password failure report"
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
 		print
 		print "  -b         start in background"
diff --git a/fail2ban-testcases b/fail2ban-testcases
index 3c427fe9..59f34461 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -28,6 +28,11 @@ __license__ = "GPL"
 
 import unittest, logging, sys
 
+# Inserts our own modules path first in the list
+# fix for bug #343821
+sys.path.insert(1, "/usr/lib/fail2ban")
+
+from version import version
 from testcases import filtertestcase
 from testcases import servertestcase
 from testcases import failmanagertestcase
@@ -40,7 +45,7 @@ stdout = logging.StreamHandler(sys.stdout)
 logSys.addHandler(stdout)
 logSys.setLevel(logging.FATAL)
 
-print "Fail2ban test suite. Please wait..."
+print "Fail2ban " + version + " test suite. Please wait..."
 
 tests = unittest.TestSuite()
 
diff --git a/server/action.py b/server/action.py
index f47fe579..69ce903e 100644
--- a/server/action.py
+++ b/server/action.py
@@ -24,13 +24,10 @@ __date__ = "$Date: 2004/10/10 13:33:40 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from banmanager import BanManager
-from failmanager import FailManager, FailManagerEmpty
-from jailthread import JailThread
 import time, logging, os
 
 # Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.action")
+logSys = logging.getLogger("fail2ban.actions.action")
 
 ##
 # Execute commands.
@@ -39,20 +36,10 @@ logSys = logging.getLogger("fail2ban.action")
 # action has to be taken. A BanManager take care of the banned IP
 # addresses.
 
-class Action(JailThread):
+class Action:
 	
-	##
-	# Constructor.
-	#
-	# Initialize the filter object with default values.
-	# @param jail the jail object
-	
-	def __init__(self, jail):
-		JailThread.__init__(self, jail)
-		## The jail which contains this action.
-		self.jail = jail
-		## The ban manager.
-		self.banManager = BanManager()
+	def __init__(self, name):
+		self.name = name
 		## Command executed in order to initialize the system.
 		self.actionStart = ''
 		## Command executed when an IP address gets banned.
@@ -64,7 +51,13 @@ class Action(JailThread):
 		## Command executed in order to stop the system.
 		self.actionStop = ''
 		logSys.debug("Created Action")
-
+	
+	def setName(self, name):
+		self.name = name
+	
+	def getName(self):
+		return self.name
+	
 	##
 	# Set the "start" command.
 	#
@@ -82,6 +75,9 @@ class Action(JailThread):
 	def getActionStart(self):
 		return self.actionStart
 	
+	def execActionStart(self, aInfo):
+		return self.executeCmd(self.actionStart, aInfo);
+	
 	##
 	# Set the "ban" command.
 	#
@@ -99,6 +95,9 @@ class Action(JailThread):
 	def getActionBan(self):
 		return self.actionBan
 	
+	def execActionBan(self, aInfo):
+		return self.executeCmd(self.actionBan, aInfo);
+	
 	##
 	# Set the "unban" command.
 	#
@@ -116,6 +115,9 @@ class Action(JailThread):
 	def getActionUnban(self):
 		return self.actionUnban
 	
+	def execActionUnban(self, aInfo):
+		return self.executeCmd(self.actionUnban, aInfo);
+	
 	##
 	# Set the "check" command.
 	#
@@ -133,6 +135,9 @@ class Action(JailThread):
 	def getActionCheck(self):
 		return self.actionCheck
 	
+	def execActionCheck(self, aInfo):
+		return self.executeCmd(self.actionCheck, aInfo);
+	
 	##
 	# Set the "stop" command.
 	#
@@ -150,104 +155,8 @@ class Action(JailThread):
 	def getActionStop(self):
 		return self.actionStop
 	
-	##
-	# Set the ban time.
-	#
-	# @param value the time
-	
-	def setBanTime(self, value):
-		self.banManager.setBanTime(value)
-		logSys.info("Set banTime = %s" % value)
-	
-	##
-	# Get the ban time.
-	#
-	# @return the time
-	
-	def getBanTime(self):
-		return self.banManager.getBanTime()
-	
-	##
-	# Main loop.
-	#
-	# This function is the main loop of the thread. It checks the Jail
-	# queue and executes commands when an IP address is banned.
-	# @return True when the thread exits nicely
-	
-	def run(self):
-		self.executeCmd(self.actionStart)
-		self.setActive(True)
-		while self.isActive():
-			if not self.isIdle:
-				#logSys.debug(self.jail.getName() + ": action")
-				ret = self.checkBan()
-				if not ret:
-					self.checkUnBan()
-					time.sleep(self.sleepTime)
-			else:
-				time.sleep(self.sleepTime)
-		self.flushBan()
-		self.executeCmd(self.actionStop)
-		logSys.debug(self.jail.getName() + ": action terminated")
-		return True
-
-	##
-	# Check for IP address to ban.
-	#
-	# Look in the Jail queue for FailTicket. If a ticket is available,
-	# it executes the "ban" command and add a ticket to the BanManager.
-	# @return True if an IP address get banned
-	
-	def checkBan(self):
-		logSys.debug("Check for IP address to ban")
-		ticket = self.jail.getFailTicket()
-		if ticket != False:
-			aInfo = dict()
-			bTicket = BanManager.createBanTicket(ticket)
-			aInfo["ip"] = bTicket.getIP()
-			logSys.info("Ban %s" % aInfo["ip"])
-			self.executeCmd(self.replaceTag(self.actionBan, aInfo))
-			self.banManager.addBanTicket(bTicket)
-			return True
-		return False
-	
-	##
-	# Check for IP address to unban.
-	#
-	# Unban IP address which are outdated.
-	
-	def checkUnBan(self):
-		logSys.debug("Check for IP address to unban")
-		for ticket in self.banManager.unBanList(time.time()):
-			aInfo = dict()
-			aInfo["ip"] = ticket.getIP()
-			logSys.info("Unban %s" % aInfo["ip"])
-			self.executeCmd(self.replaceTag(self.actionUnban, aInfo))
-	
-	##
-	# Flush the ban list.
-	#
-	# Unban all IP address which are still in the banning list.
-	
-	def flushBan(self):
-		logSys.debug("Flush ban list")
-		for ticket in self.banManager.flushBanList():
-			aInfo = dict()
-			aInfo["ip"] = ticket.getIP()
-			logSys.info("Unban %s" % aInfo["ip"])
-			self.executeCmd(self.replaceTag(self.actionUnban, aInfo))
-	
-	##
-	# Get the status of the filter.
-	#
-	# Get some informations about the filter state such as the total
-	# number of failures.
-	# @return a list with tuple
-	
-	def status(self):
-		ret = [("Currently banned", self.banManager.size()),
-			   ("Total banned", self.banManager.getBanTotal())]
-		return ret
+	def execActionStop(self, aInfo):
+		return self.executeCmd(self.actionStop, aInfo);
 	
 	@staticmethod
 	def replaceTag(query, aInfo):
@@ -261,21 +170,26 @@ class Action(JailThread):
 		return string
 	
 	@staticmethod
-	def executeCmd(cmd):
+	def executeCmd(cmd, aInfo = None):
 		""" Executes an OS command.
 		"""
 		if cmd == "":
 			logSys.debug("Nothing to do")
 			return True
 		
-		logSys.debug(cmd)
-		retval = os.system(cmd)
+		# Replace tags
+		if not aInfo == None:
+			realCmd = Action.replaceTag(cmd, aInfo)
+		else:
+			realCmd = cmd
+		
+		logSys.debug(realCmd)
+		retval = os.system(realCmd)
 		#if not retval == 0:
 		#	logSys.error("'" + cmd + "' returned " + `retval`)
 		#	raise Exception("Execution of command '%s' failed" % cmd)
 		if retval == 0:
 			return True
 		else:
-			logSys.error("%s returned %x" % (cmd, retval))
-			return False
-		
\ No newline at end of file
+			logSys.error("%s returned %x" % (realCmd, retval))
+			return False
\ No newline at end of file
diff --git a/server/actions.py b/server/actions.py
new file mode 100644
index 00000000..707272d4
--- /dev/null
+++ b/server/actions.py
@@ -0,0 +1,183 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from banmanager import BanManager
+from failmanager import FailManager, FailManagerEmpty
+from jailthread import JailThread
+from action import Action
+import time, logging, os
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.actions")
+
+##
+# Execute commands.
+#
+# This class reads the failures from the Jail queue and decide if an
+# action has to be taken. A BanManager take care of the banned IP
+# addresses.
+
+class Actions(JailThread):
+	
+	##
+	# Constructor.
+	#
+	# Initialize the filter object with default values.
+	# @param jail the jail object
+	
+	def __init__(self, jail):
+		JailThread.__init__(self, jail)
+		## The jail which contains this action.
+		self.jail = jail
+		self.actions = list()
+		## The ban manager.
+		self.banManager = BanManager()
+	
+	def addAction(self, name):
+		action = Action(name)
+		self.actions.append(action)
+	
+	def delAction(self, name):
+		for action in self.actions:
+			if action.getName() == name:
+				self.actions.remove(action)
+				break
+	
+	def getAction(self, name):
+		for action in self.actions:
+			if action.getName() == name:
+				return action
+		raise KeyError
+	
+	def getLastAction(self):
+		action = self.actions.pop()
+		self.actions.append(action)
+		return action
+	
+	##
+	# Set the ban time.
+	#
+	# @param value the time
+	
+	def setBanTime(self, value):
+		self.banManager.setBanTime(value)
+		logSys.info("Set banTime = %s" % value)
+	
+	##
+	# Get the ban time.
+	#
+	# @return the time
+	
+	def getBanTime(self):
+		return self.banManager.getBanTime()
+	
+	##
+	# Main loop.
+	#
+	# This function is the main loop of the thread. It checks the Jail
+	# queue and executes commands when an IP address is banned.
+	# @return True when the thread exits nicely
+	
+	def run(self):
+		for action in self.actions:
+			action.execActionStart(None)
+		self.setActive(True)
+		while self.isActive():
+			if not self.isIdle:
+				#logSys.debug(self.jail.getName() + ": action")
+				ret = self.checkBan()
+				if not ret:
+					self.checkUnBan()
+					time.sleep(self.sleepTime)
+			else:
+				time.sleep(self.sleepTime)
+		self.flushBan()
+		for action in self.actions:
+			action.execActionStop(None)
+		logSys.debug(self.jail.getName() + ": action terminated")
+		return True
+
+	##
+	# Check for IP address to ban.
+	#
+	# Look in the Jail queue for FailTicket. If a ticket is available,
+	# it executes the "ban" command and add a ticket to the BanManager.
+	# @return True if an IP address get banned
+	
+	def checkBan(self):
+		logSys.debug("Check for IP address to ban")
+		ticket = self.jail.getFailTicket()
+		if ticket != False:
+			aInfo = dict()
+			bTicket = BanManager.createBanTicket(ticket)
+			aInfo["ip"] = bTicket.getIP()
+			logSys.info("Ban %s" % aInfo["ip"])
+			for action in self.actions:
+				action.execActionBan(aInfo)
+			self.banManager.addBanTicket(bTicket)
+			return True
+		return False
+	
+	##
+	# Check for IP address to unban.
+	#
+	# Unban IP address which are outdated.
+	
+	def checkUnBan(self):
+		logSys.debug("Check for IP address to unban")
+		for ticket in self.banManager.unBanList(time.time()):
+			aInfo = dict()
+			aInfo["ip"] = ticket.getIP()
+			logSys.info("Unban %s" % aInfo["ip"])
+			for action in self.actions:
+				action.execActionUnban(aInfo)
+	
+	##
+	# Flush the ban list.
+	#
+	# Unban all IP address which are still in the banning list.
+	
+	def flushBan(self):
+		logSys.debug("Flush ban list")
+		for ticket in self.banManager.flushBanList():
+			aInfo = dict()
+			aInfo["ip"] = ticket.getIP()
+			logSys.info("Unban %s" % aInfo["ip"])
+			for action in self.actions:
+				action.execActionUnban(aInfo)
+	
+	##
+	# Get the status of the filter.
+	#
+	# Get some informations about the filter state such as the total
+	# number of failures.
+	# @return a list with tuple
+	
+	def status(self):
+		ret = [("Currently banned", self.banManager.size()),
+			   ("Total banned", self.banManager.getBanTotal())]
+		return ret
+		
\ No newline at end of file
diff --git a/server/jail.py b/server/jail.py
index 06b1229d..10dd22df 100644
--- a/server/jail.py
+++ b/server/jail.py
@@ -24,7 +24,7 @@ __date__ = "$Date: 2004/10/10 13:33:40 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from action import Action
+from actions import Actions
 from filter import Filter
 import Queue
 
@@ -35,7 +35,7 @@ class Jail:
 		self.name = name
 		self.queue = Queue.Queue()
 		self.filter = Filter(self)
-		self.action = Action(self)
+		self.action = Actions(self)
 	
 	def setName(self, name):
 		self.name = name
diff --git a/server/server.py b/server/server.py
index 7ef3886f..31f9d97d 100644
--- a/server/server.py
+++ b/server/server.py
@@ -162,7 +162,25 @@ class Server:
 		else:
 			raise ServerUnknownJail(name)
 	
-	# Action	
+	# Action
+	def addAction(self, name, value):
+		if self.jails.has_key(name):
+			self.jails[name].getAction().addAction(value)
+		else:
+			raise ServerUnknownJail(name)
+	
+	def getLastAction(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getAction().getLastAction()
+		else:
+			raise ServerUnknownJail(name)
+	
+	def delAction(self, name, value):
+		if self.jails.has_key(name):
+			self.jails[name].getAction().delAction(value)
+		else:
+			raise ServerUnknownJail(name)
+	
 	def setBanTime(self, name, value):
 		if self.jails.has_key(name):
 			self.jails[name].getAction().setBanTime(value)
@@ -175,63 +193,63 @@ class Server:
 		else:
 			raise ServerUnknownJail(name)
 	
-	def setActionStart(self, name, value):
+	def setActionStart(self, name, action, value):
 		if self.jails.has_key(name):
-			self.jails[name].getAction().setActionStart(value)
+			self.jails[name].getAction().getAction(action).setActionStart(value)
 		else:
 			raise ServerUnknownJail(name)
 	
-	def getActionStart(self, name):
+	def getActionStart(self, name, action):
 		if self.jails.has_key(name):
-			return self.jails[name].getAction().getActionStart()
+			return self.jails[name].getAction().getAction(action).getActionStart()
 		else:
 			raise ServerUnknownJail(name)
 		
-	def setActionStop(self, name, value):
+	def setActionStop(self, name, action, value):
 		if self.jails.has_key(name):
-			self.jails[name].getAction().setActionStop(value)
+			self.jails[name].getAction().getAction(action).setActionStop(value)
 		else:
 			raise ServerUnknownJail(name)
 	
-	def getActionStop(self, name):
+	def getActionStop(self, name, action):
 		if self.jails.has_key(name):
-			return self.jails[name].getAction().getActionStop()
+			return self.jails[name].getAction().getAction(action).getActionStop()
 		else:
 			raise ServerUnknownJail(name)
 	
-	def setActionCheck(self, name, value):
+	def setActionCheck(self, name, action, value):
 		if self.jails.has_key(name):
-			self.jails[name].getAction().setActionCheck(value)
+			self.jails[name].getAction().getAction(action).setActionCheck(value)
 		else:
 			raise ServerUnknownJail(name)
 	
-	def getActionCheck(self, name):
+	def getActionCheck(self, name, action):
 		if self.jails.has_key(name):
-			return self.jails[name].getAction().getActionCheck()
+			return self.jails[name].getAction().getAction(action).getActionCheck()
 		else:
 			raise ServerUnknownJail(name)
 	
-	def setActionBan(self, name, value):
+	def setActionBan(self, name, action, value):
 		if self.jails.has_key(name):
-			self.jails[name].getAction().setActionBan(value)
+			self.jails[name].getAction().getAction(action).setActionBan(value)
 		else:
 			raise ServerUnknownJail(name)
 	
-	def getActionBan(self, name):
+	def getActionBan(self, name, action):
 		if self.jails.has_key(name):
-			return self.jails[name].getAction().getActionBan()
+			return self.jails[name].getAction().getAction(action).getActionBan()
 		else:
 			raise ServerUnknownJail(name)
 	
-	def setActionUnban(self, name, value):
+	def setActionUnban(self, name, action, value):
 		if self.jails.has_key(name):
-			self.jails[name].getAction().setActionUnban(value)
+			self.jails[name].getAction().getAction(action).setActionUnban(value)
 		else:
 			raise ServerUnknownJail(name)
 	
-	def getActionUnban(self, name):
+	def getActionUnban(self, name, action):
 		if self.jails.has_key(name):
-			return self.jails[name].getAction().getActionUnban()
+			return self.jails[name].getAction().getAction(action).getActionUnban()
 		else:
 			raise ServerUnknownJail(name)
 		
diff --git a/server/transmitter.py b/server/transmitter.py
index a3de9a23..c10157c9 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -104,7 +104,7 @@ class Transmitter:
 			self.server.setLogLevel(value)
 			return self.server.getLogLevel()
 		# Jail
-		if action[1] == "idle":
+		elif action[1] == "idle":
 			if action[2] == "on":
 				self.server.setIdleJail(name, True)
 			elif action[2] == "off":
@@ -140,26 +140,38 @@ class Transmitter:
 			value = action[2]
 			self.server.setBanTime(name, int(value))
 			return self.server.getBanTime(name)
+		elif action[1] == "addaction":
+			value = action[2]
+			self.server.addAction(name, value)
+			return self.server.getLastAction(name).getName()
+		elif action[1] == "delaction":
+			self.server.delAction(name, value)
+			return None
 		elif action[1] == "actionstart":
-			value = action[2]
-			self.server.setActionStart(name, value)
-			return self.server.getActionStart(name)
+			act = action[2]
+			value = action[3]
+			self.server.setActionStart(name, act, value)
+			return self.server.getActionStart(name, act)
 		elif action[1] == "actionstop":
-			value = action[2]
-			self.server.setActionStop(name, value)
-			return self.server.getActionStop(name)
+			act = action[2]
+			value = action[3]
+			self.server.setActionStop(name, act, value)
+			return self.server.getActionStop(name, act)
 		elif action[1] == "actioncheck":
-			value = action[2]
-			self.server.setActionCheck(name, value)
-			return self.server.getActionCheck(name)
+			act = action[2]
+			value = action[3]
+			self.server.setActionCheck(name, act, value)
+			return self.server.getActionCheck(name, act)
 		elif action[1] == "actionban":
-			value = action[2]
-			self.server.setActionBan(name, value)
-			return self.server.getActionBan(name)
+			act = action[2]
+			value = action[3]
+			self.server.setActionBan(name, act, value)
+			return self.server.getActionBan(name, act)
 		elif action[1] == "actionunban":
-			value = action[2]
-			self.server.setActionUnban(name, value)
-			return self.server.getActionUnban(name)
+			act = action[2]
+			value = action[3]
+			self.server.setActionUnban(name, act, value)
+			return self.server.getActionUnban(name, act)
 		raise Exception("Invalid command (no set action)")
 	
 	def actionGet(self, action):
diff --git a/setup.cfg b/setup.cfg
new file mode 100644
index 00000000..fba97f88
--- /dev/null
+++ b/setup.cfg
@@ -0,0 +1,5 @@
+[install]
+install-purelib=/usr/lib/fail2ban
+
+[sdist]
+formats=bztar
diff --git a/setup.py b/setup.py
new file mode 100755
index 00000000..f894f3a2
--- /dev/null
+++ b/setup.py
@@ -0,0 +1,84 @@
+#!/usr/bin/env python
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.6 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.6 $"
+__date__ = "$Date: 2006/01/22 11:08:42 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from distutils.core import setup
+from version import version
+from os.path import isfile, join
+from sys import exit, argv
+
+longdesc = '''
+Fail2Ban scans log files like /var/log/pwdfail or
+/var/log/apache/error_log and bans IP that makes
+too many password failures. It updates firewall rules
+to reject the IP address or executes user defined
+commands.'''
+
+setup(
+	name = "fail2ban",
+	version = version,
+	description = "Ban IPs that make too many password failure",
+	long_description = longdesc,
+	author = "Cyril Jaquier",
+	author_email = "lostcontrol@users.sourceforge.net",
+	url = "http://fail2ban.sourceforge.net",
+	license = "GPL",
+	platforms = "Posix",
+	scripts = ['fail2ban-client', 'fail2ban-server',
+			   'fail2ban-testcases'],
+	py_modules = ['version'],
+	packages = ['client', 'server', 'testcases', 'utils']
+)
+
+# Do some checks after installation
+# Search for obsolete files.
+obsoleteFiles = []
+elements = {"/etc/": ["fail2ban.conf"],
+			"/usr/bin/": ["fail2ban.py"],
+			"/usr/lib/fail2ban/firewall/": ["iptables.py", "ipfwadm.py",
+											"ipfw.py"]}
+for dir in elements:
+	for f in elements[dir]:
+		path = join(dir, f)
+		if isfile(path):
+			obsoleteFiles.append(path)
+if obsoleteFiles:
+	print
+	print "Obsolete files from previous Fail2Ban versions were found on " \
+		  "your system."
+	print "Please delete them:"
+	print
+	for f in obsoleteFiles:
+		print "\t" + f
+	print
+
+# Update config file
+if argv[1] == "install":
+	print
+	print "Please do not forget to update your configuration files."
+	print "Use config/ as an example."
+	print
diff --git a/version.py b/version.py
new file mode 100644
index 00000000..d4fe1137
--- /dev/null
+++ b/version.py
@@ -0,0 +1,27 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.15.2.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.15.2.1 $"
+__date__ = "$Date: 2006/03/19 18:35:21 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+version = "0.7.0-SVN"

From 7048e199953dee5ba797de3f45bcaf97272066a6 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 16 Jul 2006 21:35:08 +0000
Subject: [PATCH 217/549] - 0.7.0 soon

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@251 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/actionreader.py           | 17 +++++++--
 client/fail2banreader.py         |  2 +-
 client/filterreader.py           |  2 +-
 client/jailreader.py             | 16 +++++++--
 client/jailsreader.py            |  2 +-
 config/action.d/dummy.conf       | 15 ++++----
 config/action.d/foo.conf         |  8 ++---
 config/action.d/hostsdeny.conf   | 59 ++++++++++++++++++++++++++++++++
 config/action.d/iptables.conf    | 47 +++++++++++++++----------
 config/fail2ban.conf             |  2 +-
 config/filter.d/apache-auth.conf | 35 +++++++++++++++++++
 config/filter.d/sshd.conf        | 10 ++++--
 config/filter.d/vsftpd.conf      | 33 ++++++++++++++++++
 config/jail.conf                 |  6 ++--
 server/action.py                 | 52 +++++++++++++++++++++-------
 server/actions.py                |  4 +--
 server/server.py                 | 18 ++++++++++
 server/transmitter.py            | 11 ++++++
 18 files changed, 276 insertions(+), 63 deletions(-)
 create mode 100644 config/action.d/hostsdeny.conf
 create mode 100644 config/filter.d/vsftpd.conf

diff --git a/client/actionreader.py b/client/actionreader.py
index 5b620d82..9be467c6 100644
--- a/client/actionreader.py
+++ b/client/actionreader.py
@@ -32,9 +32,10 @@ logSys = logging.getLogger("fail2ban.client.config")
 
 class ActionReader(ConfigReader):
 	
-	def __init__(self, file, name):
+	def __init__(self, action, name):
 		ConfigReader.__init__(self)
-		self.file = file
+		self.file = action[0]
+		self.cInfo = action[1]
 		self.name = name
 	
 	def setFile(self, file):
@@ -58,7 +59,12 @@ class ActionReader(ConfigReader):
 				["string", "actioncheck", ""],
 				["string", "actionban", ""],
 				["string", "actionunban", ""]]
-		self.opts = ConfigReader.getOptions(self, "DEFAULT", opts, pOpts)
+		self.opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
+		
+		if self.has_section("Init"):
+			for opt in self.options("Init"):
+				if not self.cInfo.has_key(opt):
+					self.cInfo[opt] = self.get("Init", opt)
 	
 	def convert(self):
 		head = ["set", self.name]
@@ -75,5 +81,10 @@ class ActionReader(ConfigReader):
 				stream.append(head + ["actionban", self.file, self.opts[opt]])
 			elif opt == "actionunban":
 				stream.append(head + ["actionunban", self.file, self.opts[opt]])
+		# cInfo
+		if self.cInfo:
+			for p in self.cInfo:
+				stream.append(head + ["setcinfo", self.file, p, self.cInfo[p]])
+
 		return stream
 		
\ No newline at end of file
diff --git a/client/fail2banreader.py b/client/fail2banreader.py
index a99c3001..1f31b650 100644
--- a/client/fail2banreader.py
+++ b/client/fail2banreader.py
@@ -40,7 +40,7 @@ class Fail2banReader(ConfigReader):
 	
 	def getOptions(self):
 		opts = [["int", "loglevel", 1]]
-		self.opts = ConfigReader.getOptions(self, "DEFAULT", opts)
+		self.opts = ConfigReader.getOptions(self, "Definition", opts)
 	
 	def convert(self):
 		stream = list()
diff --git a/client/filterreader.py b/client/filterreader.py
index 79f517b8..fbca9bef 100644
--- a/client/filterreader.py
+++ b/client/filterreader.py
@@ -59,7 +59,7 @@ class FilterReader(ConfigReader):
 				["string", "failregex", ""],
 				["int", "maxtime", 600],
 				["int", "maxretry", 3]]
-		self.opts = ConfigReader.getOptions(self, "DEFAULT", opts, pOpts)
+		self.opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
 	
 	def convert(self):
 		stream = list()
diff --git a/client/jailreader.py b/client/jailreader.py
index 52a62d16..afcf029e 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -24,7 +24,7 @@ __date__ = "$Date: 2005/11/20 17:07:47 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import logging
+import logging, re
 from configreader import ConfigReader
 from filterreader import FilterReader
 from actionreader import ActionReader
@@ -68,7 +68,8 @@ class JailReader(ConfigReader):
 			
 			# Read action
 			for act in self.opts["action"].split():
-				action = ActionReader(act, self.name)
+				splitAct = JailReader.splitAction(act)
+				action = ActionReader(splitAct, self.name)
 				action.read()
 				action.getOptions(self.opts)
 				self.actions.append(action)
@@ -84,4 +85,13 @@ class JailReader(ConfigReader):
 		for action in self.actions:
 			stream.extend(action.convert())
 		return stream
-	
\ No newline at end of file
+	
+	@staticmethod
+	def splitAction(action):
+		m = re.match("^(\w+)(?:\[(.*)\])?$", action)
+		d = dict()
+		if m.group(2) <> None:
+			for param in m.group(2).split(','):
+				p = param.split('=')
+				d[p[0]] = p[1]
+		return [m.group(1), d]
diff --git a/client/jailsreader.py b/client/jailsreader.py
index b092cf21..8e23ea61 100644
--- a/client/jailsreader.py
+++ b/client/jailsreader.py
@@ -42,7 +42,7 @@ class JailsReader(ConfigReader):
 	
 	def getOptions(self):
 		opts = []
-		self.opts = ConfigReader.getOptions(self, "DEFAULT", opts)
+		self.opts = ConfigReader.getOptions(self, "Definition", opts)
 
 		for sec in self.sections():
 			jail = JailReader(sec)
diff --git a/config/action.d/dummy.conf b/config/action.d/dummy.conf
index 9f95871f..010d2b27 100644
--- a/config/action.d/dummy.conf
+++ b/config/action.d/dummy.conf
@@ -1,18 +1,11 @@
-[DEFAULT]
-
-name = temporary
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
+[Definition]
 
 # Option:  fwstart
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD  Default:
 #
 actionstart = touch /tmp/fail2ban.dummy
+              echo "<init>" >> /tmp/fail2ban.dummy
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
@@ -48,3 +41,7 @@ actionban = echo "+<ip>" >> /tmp/fail2ban.dummy
 # Default: iptables -D INPUT -s <ip> -j DROP
 #
 actionunban = echo "-<ip>" >> /tmp/fail2ban.dummy
+
+[Init]
+
+init = 123
diff --git a/config/action.d/foo.conf b/config/action.d/foo.conf
index 6be4c389..1eb14993 100644
--- a/config/action.d/foo.conf
+++ b/config/action.d/foo.conf
@@ -1,6 +1,4 @@
-[DEFAULT]
-
-name = temporary
+[Definition]
 
 # Option:  protocol
 # Notes.:  internally used by config reader for interpolations.
@@ -18,13 +16,13 @@ actionstart = touch /tmp/fail2ban.foo
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD  Default:
 #
-actionstop = rm /tmp/fail2ban.foo
+actionstop = rm -f /tmp/fail2ban.foo
 
 # Option:  fwcheck
 # Notes.:  command executed once before each fwban command
 # Values:  CMD  Default:
 #
-actioncheck = 
+actioncheck = [ -e "/tmp/fail2ban.foo" ]
 
 # Option:  fwban
 # Notes.:  command executed when banning an IP. Take care that the
diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf
new file mode 100644
index 00000000..6af73ecf
--- /dev/null
+++ b/config/action.d/hostsdeny.conf
@@ -0,0 +1,59 @@
+[Definition]
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD  Default:
+#
+actionstart = touch <tmpfile>
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD  Default:
+#
+actionstop = rm -f <tmpfile>
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD  Default:
+#
+actioncheck = 
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+actionban = IP=<ip> &&
+            echo "ALL: $IP" >> <file>
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+actionunban = IP=<ip> &&
+              grep -v "ALL: $IP" <file> > <tmpfile> &&
+              mv <tmpfile> <file>
+
+[Init]
+
+# Option:  file
+# Notes.:  hosts.deny file path.
+# Values:  STR  Default:  /etc/hosts.deny
+#
+file = /etc/hosts.deny
+
+# Option:  file
+# Notes.:  hosts.deny temporary file path.
+# Values:  STR  Default:  /etc/hostsdeny.failban
+#
+tmpfile = /tmp/hosts.deny.tmp
diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf
index 2da845f4..9baa9c4f 100644
--- a/config/action.d/iptables.conf
+++ b/config/action.d/iptables.conf
@@ -1,35 +1,26 @@
-[DEFAULT]
-
-name = temporary
-port = 22
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
+[Definition]
 
 # Option:  fwstart
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD  Default:
 #
-actionstart = iptables -N fail2ban-%(name)s
-              iptables -A fail2ban-%(name)s -j RETURN
-              iptables -I INPUT -p %(protocol)s --dport %(port)s -j fail2ban-%(name)s
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I INPUT -p <protocol> --dport <port> -j fail2ban-<name>
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD  Default:
 #
-actionstop = iptables -D INPUT -p %(protocol)s --dport %(port)s -j fail2ban-%(name)s
-             iptables -F fail2ban-%(name)s
-             iptables -X fail2ban-%(name)s
+actionstop = iptables -D INPUT -p <protocol> --dport <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
 
 # Option:  fwcheck
 # Notes.:  command executed once before each fwban command
 # Values:  CMD  Default:
 #
-actioncheck = iptables -L INPUT | grep -q fail2ban-%(name)s
+actioncheck = iptables -L INPUT | grep -q fail2ban-<name>
 
 # Option:  fwban
 # Notes.:  command executed when banning an IP. Take care that the
@@ -41,7 +32,7 @@ actioncheck = iptables -L INPUT | grep -q fail2ban-%(name)s
 # Values:  CMD
 # Default: iptables -I INPUT 1 -s <ip> -j DROP
 #
-actionban = iptables -I fail2ban-%(name)s 1 -s <ip> -j DROP
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 
 # Option:  fwunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -52,4 +43,22 @@ actionban = iptables -I fail2ban-%(name)s 1 -s <ip> -j DROP
 # Values:  CMD
 # Default: iptables -D INPUT -s <ip> -j DROP
 #
-actionunban = iptables -D fail2ban-%(name)s -s <ip> -j DROP
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
diff --git a/config/fail2ban.conf b/config/fail2ban.conf
index 4c29363d..33323e04 100644
--- a/config/fail2ban.conf
+++ b/config/fail2ban.conf
@@ -1,4 +1,4 @@
-[DEFAULT]
+[Definition]
 
 loglevel = 3
 
diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index e69de29b..642386bc 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -0,0 +1,35 @@
+[Definition]
+
+# Option:  maxretry
+# Notes.:  number of failures before IP gets banned.
+# Values:  NUM  Default:  5
+#
+maxretry = 5
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/httpd/access_log
+#
+logfile = /var/log/httpd/access_log
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in Apache logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
+# Values:  [Wed Jan 05 15:08:01 2005]
+# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+#
+timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
+# Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
+#
+timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile.
+# Values:  TEXT  Default:  authentication failure|user .* not found
+#
+failregex = authentication failure|user .* not found
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 7d2a007a..da301e67 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -1,12 +1,16 @@
-[DEFAULT]
+[Definition]
 
-maxretry = 22
+# Option:  maxretry
+# Notes.:  number of failures before IP gets banned.
+# Values:  NUM  Default:  5
+#
+maxretry = 5
 
 # Option:  logpath
 # Notes.:  logfile to monitor.
 # Values:  FILE  Default:  /var/log/secure
 #
-logpath = testcases/files/testcase01.log
+logpath = /var/log/secure
 
 # Option:  timeregex
 # Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
new file mode 100644
index 00000000..52141374
--- /dev/null
+++ b/config/filter.d/vsftpd.conf
@@ -0,0 +1,33 @@
+[Definition]
+
+# Option:  maxretry
+# Notes.:  number of failures before IP gets banned.
+# Values:  NUM  Default:  5
+#
+maxretry = 5
+
+# Option: logfile
+# Notes.: logfile to monitor.
+# Values: FILE Default: /var/log/vsftpd.log
+#
+logfile = /var/log/vsftpd.log
+
+# Option: timeregex
+# Notes.: regex to match timestamp in VSFTPD logfile.
+# Values: [Mar 7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option: timepattern
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT Default: Authentication failure|Failed password|Invalid user
+#
+failregex = FAIL LOGIN
diff --git a/config/jail.conf b/config/jail.conf
index ffa314e1..63851932 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -2,18 +2,18 @@
 
 enabled = true
 filter = sshd
-action = dummy foo
+action = hostsdeny[file=/tmp/hosts.deny]
 maxretry = 2
 bantime = 5
 
-[SSH]
+[ssh]
 
 enabled = false
 filter = sshd
 action = iptables
 bantime = 10
 
-[Apache-error]
+[apache-error]
 
 enabled = false
 filter = apache-error
diff --git a/server/action.py b/server/action.py
index 69ce903e..08b0f71c 100644
--- a/server/action.py
+++ b/server/action.py
@@ -40,6 +40,7 @@ class Action:
 	
 	def __init__(self, name):
 		self.name = name
+		self.cInfo = dict()
 		## Command executed in order to initialize the system.
 		self.actionStart = ''
 		## Command executed when an IP address gets banned.
@@ -58,6 +59,15 @@ class Action:
 	def getName(self):
 		return self.name
 	
+	def setCInfo(self, key, value):
+		self.cInfo[key] = value
+	
+	def getCInfo(self, key):
+		return self.cInfo[key]
+	
+	def delCInfo(self, key):
+		del self.cInfo[key]
+	
 	##
 	# Set the "start" command.
 	#
@@ -75,8 +85,9 @@ class Action:
 	def getActionStart(self):
 		return self.actionStart
 	
-	def execActionStart(self, aInfo):
-		return self.executeCmd(self.actionStart, aInfo);
+	def execActionStart(self):
+		startCmd = Action.replaceTag(self.actionStart, self.cInfo)
+		return Action.executeCmd(startCmd)
 	
 	##
 	# Set the "ban" command.
@@ -96,7 +107,7 @@ class Action:
 		return self.actionBan
 	
 	def execActionBan(self, aInfo):
-		return self.executeCmd(self.actionBan, aInfo);
+		return self.processCmd(self.actionBan, aInfo);
 	
 	##
 	# Set the "unban" command.
@@ -116,7 +127,7 @@ class Action:
 		return self.actionUnban
 	
 	def execActionUnban(self, aInfo):
-		return self.executeCmd(self.actionUnban, aInfo);
+		return self.processCmd(self.actionUnban, aInfo);
 	
 	##
 	# Set the "check" command.
@@ -135,9 +146,6 @@ class Action:
 	def getActionCheck(self):
 		return self.actionCheck
 	
-	def execActionCheck(self, aInfo):
-		return self.executeCmd(self.actionCheck, aInfo);
-	
 	##
 	# Set the "stop" command.
 	#
@@ -155,8 +163,9 @@ class Action:
 	def getActionStop(self):
 		return self.actionStop
 	
-	def execActionStop(self, aInfo):
-		return self.executeCmd(self.actionStop, aInfo);
+	def execActionStop(self):
+		stopCmd = Action.replaceTag(self.actionStop, self.cInfo)
+		return Action.executeCmd(stopCmd)
 	
 	@staticmethod
 	def replaceTag(query, aInfo):
@@ -169,20 +178,38 @@ class Action:
 		string = string.replace("<br>", '\n')
 		return string
 	
-	@staticmethod
-	def executeCmd(cmd, aInfo = None):
+	def processCmd(self, cmd, aInfo = None):
 		""" Executes an OS command.
 		"""
 		if cmd == "":
 			logSys.debug("Nothing to do")
 			return True
 		
+		checkCmd = Action.replaceTag(self.actionCheck, self.cInfo)
+		if not Action.executeCmd(checkCmd):
+			logSys.error("Invariant check failed. Trying to restore a sane" +
+						 " environment")
+			stopCmd = Action.replaceTag(self.actionStop, self.cInfo)
+			Action.executeCmd(stopCmd)
+			startCmd = Action.replaceTag(self.actionStart, self.cInfo)
+			Action.executeCmd(startCmd)
+			if not Action.executeCmd(checkCmd):
+				logSys.fatal("Unable to restore environment")
+				return False
+
 		# Replace tags
 		if not aInfo == None:
 			realCmd = Action.replaceTag(cmd, aInfo)
 		else:
 			realCmd = cmd
 		
+		# Replace static fields
+		realCmd = Action.replaceTag(realCmd, self.cInfo)
+		
+  		return Action.executeCmd(realCmd)
+
+  	@staticmethod
+	def executeCmd(realCmd):
 		logSys.debug(realCmd)
 		retval = os.system(realCmd)
 		#if not retval == 0:
@@ -192,4 +219,5 @@ class Action:
 			return True
 		else:
 			logSys.error("%s returned %x" % (realCmd, retval))
-			return False
\ No newline at end of file
+			return False
+		
\ No newline at end of file
diff --git a/server/actions.py b/server/actions.py
index 707272d4..bed16762 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -103,7 +103,7 @@ class Actions(JailThread):
 	
 	def run(self):
 		for action in self.actions:
-			action.execActionStart(None)
+			action.execActionStart()
 		self.setActive(True)
 		while self.isActive():
 			if not self.isIdle:
@@ -116,7 +116,7 @@ class Actions(JailThread):
 				time.sleep(self.sleepTime)
 		self.flushBan()
 		for action in self.actions:
-			action.execActionStop(None)
+			action.execActionStop()
 		logSys.debug(self.jail.getName() + ": action terminated")
 		return True
 
diff --git a/server/server.py b/server/server.py
index 31f9d97d..e868cfc6 100644
--- a/server/server.py
+++ b/server/server.py
@@ -181,6 +181,24 @@ class Server:
 		else:
 			raise ServerUnknownJail(name)
 	
+	def setCInfo(self, name, action, key, value):
+		if self.jails.has_key(name):
+			self.jails[name].getAction().getAction(action).setCInfo(key, value)
+		else:
+			raise ServerUnknownJail(name)
+	
+	def getCInfo(self, name, action, key):
+		if self.jails.has_key(name):
+			return self.jails[name].getAction().getAction(action).getCInfo(key)
+		else:
+			raise ServerUnknownJail(name)
+	
+	def delCInfo(self, name, action, key):
+		if self.jails.has_key(name):
+			self.jails[name].getAction().getAction(action).delCInfo(key)
+		else:
+			raise ServerUnknownJail(name)
+	
 	def setBanTime(self, name, value):
 		if self.jails.has_key(name):
 			self.jails[name].getAction().setBanTime(value)
diff --git a/server/transmitter.py b/server/transmitter.py
index c10157c9..daf65c4c 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -147,6 +147,17 @@ class Transmitter:
 		elif action[1] == "delaction":
 			self.server.delAction(name, value)
 			return None
+		elif action[1] == "setcinfo":
+			act = action[2]
+			key = action[3]
+			value = action[4]
+			self.server.setCInfo(name, act, key, value)
+			return self.server.getCInfo(name, act, key)
+		elif action[1] == "delcinfo":
+			act = action[2]
+			key = action[3]
+			self.server.delCInfo(name, act, key)
+			return None
 		elif action[1] == "actionstart":
 			act = action[2]
 			value = action[3]

From 5155e4dd2e9fb8f5839d7a39928740b8c7d45ea5 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 16 Jul 2006 22:05:56 +0000
Subject: [PATCH 218/549] - Updated TODO list

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@252 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 107 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 105 insertions(+), 2 deletions(-)

diff --git a/TODO b/TODO
index 81ed4bbf..34c5d5af 100644
--- a/TODO
+++ b/TODO
@@ -1,2 +1,105 @@
-- Don't close socket after a send
-- Refactoring in server.py, actions.py, filter.py
\ No newline at end of file
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+ToDo                                        $Revision$
+=============================================================
+
+Legend:
+- not yet done
+? maybe
+# partially done
+* done
+
+See Feature Request Tracking System at SourceForge.net
+
+- improve installation process (better prefix support)
+
+# improve documentation and website for user
+
+* use Doxygen
+
+- use PyLint to check the code
+
+* better configuration files
+
+- add a check to see if the time of the log messages is
+  correctly detected (valid regexp)
+
+? use Gentoo Portage style for scripts.
+  - banning engines script in /etc/fail2ban/scripts.d
+    Example: /etc/fail2ban/scripts.d/iptables
+    Will be mostly bash scripting which is more "user
+    friendly".
+  - split configuration files in /etc/fail2ban/services.d
+    for log files
+    Example: /etc/fail2ban/services.d/apache
+    Mainly regular expressions.
+  - template for common regex in /etc/fail2ban/templates.d
+    Example: /etc/fail2ban/templates.d/date
+    Mainly regular expressions.
+
+* remove debug mode (root check)
+
+# better return values in function
+
+? use more email.Utils in mail.py
+
+? add gettext support. Is this really needed for a server
+  utility?
+
+- send an email when fail2ban is running
+
+* add multithreading. Python threading is not really
+  efficient. However, fail2ban could benefit of it. We could
+  use threads like this:
+  - one thread which check for host to unban.
+  - one thread per file to watch. This will allow things like
+    different polling time for each file.
+  <srv> is read-only (we only read log files) thus no locks
+  are required. However, <meth> is read-write and must take
+  care of concurrency in case of multithreading.
+
+- add FAM/Gamin support. Should be quite efficient with
+  threading. Take care that handle_one_event() release the
+  Python lock.
+
+# add a test framework. We could use unittest which is in
+  Python since 2.1. It should be possible to run all tests
+  automatically.
+
+* add client/server using socket. Something similar to
+  gdesklets. DBUS seems to be designed for desktop use.
+  - fail2ban start -> start the daemon.
+  - fail2ban stop -> stop the daemon.
+  - fail2ban add <srv> <meth> -> add <srv> monitoring with
+    <meth> ban method (iptables, hosts.deny, etc).
+  - fail2ban del <srv> -> remove <srv> monitoring.
+  - fail2ban status <srv> -> query current fail2ban status.
+    Should return infos like a ban counter. Could be graph
+    with rrdtool.
+  - fail2ban pause <srv> -> suspend monitoring.
+  - fail2ban resume <srv> -> resume monitoring.
+  - fail2ban list -> list available services.
+  - fail2ban flush <srv> -> flush the <srv> ban list.
+  
+- remove PID file.
+
+# remove most of the command lines options if possible.
+
+- add the possibility to specify wildcard in log files.
+  Example: logfile = /var/log/apache2/access-*.log
+  Should we start one thread per file or just one thread per
+  serivce?
+
+- autodetect date format in log file. Match the most popular
+  format and sort them using the hit ratio. Should avoid
+  user problem with regex and not have a big impact on perfs.
+
+- restart automatically the daemon if an exception occurs.
+
+- do not close socket after a send
+
+- refactoring in server.py, actions.py, filter.py

From 6d2aa15aa78296c16af12f0dcb931d22bbbec95f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 16 Jul 2006 22:21:58 +0000
Subject: [PATCH 219/549] - Added property 'svn:keywords'

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@253 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/__init__.py               | 6 +++---
 client/actionreader.py           | 6 +++---
 client/configreader.py           | 6 +++---
 client/configurator.py           | 6 +++---
 client/csocket.py                | 6 +++---
 client/fail2banreader.py         | 6 +++---
 client/filterreader.py           | 6 +++---
 client/jailreader.py             | 6 +++---
 client/jailsreader.py            | 6 +++---
 fail2ban-client                  | 6 +++---
 fail2ban-server                  | 6 +++---
 fail2ban-testcases               | 6 +++---
 server/__init__.py               | 6 +++---
 server/action.py                 | 6 +++---
 server/actions.py                | 6 +++---
 server/banmanager.py             | 6 +++---
 server/banticket.py              | 6 +++---
 server/faildata.py               | 6 +++---
 server/failmanager.py            | 6 +++---
 server/failticket.py             | 6 +++---
 server/filter.py                 | 6 +++---
 server/jail.py                   | 6 +++---
 server/jailthread.py             | 6 +++---
 server/server.py                 | 6 +++---
 server/ssocket.py                | 6 +++---
 server/ticket.py                 | 6 +++---
 server/transmitter.py            | 6 +++---
 setup.py                         | 6 +++---
 testcases/__init__.py            | 6 +++---
 testcases/banmanagertestcase.py  | 6 +++---
 testcases/failmanagertestcase.py | 6 +++---
 testcases/filtertestcase.py      | 6 +++---
 testcases/servertestcase.py      | 6 +++---
 version.py                       | 6 +++---
 34 files changed, 102 insertions(+), 102 deletions(-)

diff --git a/client/__init__.py b/client/__init__.py
index 60ef5531..76dba873 100644
--- a/client/__init__.py
+++ b/client/__init__.py
@@ -16,10 +16,10 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
\ No newline at end of file
diff --git a/client/actionreader.py b/client/actionreader.py
index 9be467c6..348cb3bf 100644
--- a/client/actionreader.py
+++ b/client/actionreader.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.6 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.6 $"
-__date__ = "$Date: 2005/11/20 17:07:47 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/client/configreader.py b/client/configreader.py
index 27b56fd2..55b0faac 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.6 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.6 $"
-__date__ = "$Date: 2005/11/20 17:07:47 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/client/configurator.py b/client/configurator.py
index 9ceed3d2..88d6d0ee 100644
--- a/client/configurator.py
+++ b/client/configurator.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.6 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.6 $"
-__date__ = "$Date: 2005/11/20 17:07:47 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/client/csocket.py b/client/csocket.py
index 4e07fa0d..1f9915b7 100644
--- a/client/csocket.py
+++ b/client/csocket.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/client/fail2banreader.py b/client/fail2banreader.py
index 1f31b650..eebd8827 100644
--- a/client/fail2banreader.py
+++ b/client/fail2banreader.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.6 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.6 $"
-__date__ = "$Date: 2005/11/20 17:07:47 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/client/filterreader.py b/client/filterreader.py
index fbca9bef..1e2b28a9 100644
--- a/client/filterreader.py
+++ b/client/filterreader.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.6 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.6 $"
-__date__ = "$Date: 2005/11/20 17:07:47 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/client/jailreader.py b/client/jailreader.py
index afcf029e..3b2fb0fb 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.6 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.6 $"
-__date__ = "$Date: 2005/11/20 17:07:47 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/client/jailsreader.py b/client/jailsreader.py
index 8e23ea61..7515597b 100644
--- a/client/jailsreader.py
+++ b/client/jailsreader.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.6 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.6 $"
-__date__ = "$Date: 2005/11/20 17:07:47 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/fail2ban-client b/fail2ban-client
index f88f52bf..5bd1a889 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -17,11 +17,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/fail2ban-server b/fail2ban-server
index c23c528e..f95fbe6c 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -17,11 +17,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/fail2ban-testcases b/fail2ban-testcases
index 59f34461..cdbd2197 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -17,11 +17,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/__init__.py b/server/__init__.py
index 60ef5531..76dba873 100644
--- a/server/__init__.py
+++ b/server/__init__.py
@@ -16,10 +16,10 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
\ No newline at end of file
diff --git a/server/action.py b/server/action.py
index 08b0f71c..3944c389 100644
--- a/server/action.py
+++ b/server/action.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/actions.py b/server/actions.py
index bed16762..eb0fb2c3 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/banmanager.py b/server/banmanager.py
index 1ae6122b..6f634555 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/banticket.py b/server/banticket.py
index 7d271e6c..94c03254 100644
--- a/server/banticket.py
+++ b/server/banticket.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/faildata.py b/server/faildata.py
index f1b2441e..8d6c0de9 100644
--- a/server/faildata.py
+++ b/server/faildata.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/failmanager.py b/server/failmanager.py
index 0a4266b9..75468306 100644
--- a/server/failmanager.py
+++ b/server/failmanager.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/failticket.py b/server/failticket.py
index 395ec0d3..8a14b8d9 100644
--- a/server/failticket.py
+++ b/server/failticket.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/filter.py b/server/filter.py
index ccbea64d..140aa61b 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/jail.py b/server/jail.py
index 10dd22df..906cab02 100644
--- a/server/jail.py
+++ b/server/jail.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/jailthread.py b/server/jailthread.py
index e74c4db2..a8ff1cc4 100644
--- a/server/jailthread.py
+++ b/server/jailthread.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/server.py b/server/server.py
index e868cfc6..ba9bc060 100644
--- a/server/server.py
+++ b/server/server.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/ssocket.py b/server/ssocket.py
index 2c3fcf0a..c047f413 100644
--- a/server/ssocket.py
+++ b/server/ssocket.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/ticket.py b/server/ticket.py
index 511f4769..3eee74cb 100644
--- a/server/ticket.py
+++ b/server/ticket.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/transmitter.py b/server/transmitter.py
index daf65c4c..9ff3e92c 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/setup.py b/setup.py
index f894f3a2..0d0da689 100755
--- a/setup.py
+++ b/setup.py
@@ -18,11 +18,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.6 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.6 $"
-__date__ = "$Date: 2006/01/22 11:08:42 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/testcases/__init__.py b/testcases/__init__.py
index 60ef5531..76dba873 100644
--- a/testcases/__init__.py
+++ b/testcases/__init__.py
@@ -16,10 +16,10 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
\ No newline at end of file
diff --git a/testcases/banmanagertestcase.py b/testcases/banmanagertestcase.py
index 8fcedfbb..f1393537 100644
--- a/testcases/banmanagertestcase.py
+++ b/testcases/banmanagertestcase.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/testcases/failmanagertestcase.py b/testcases/failmanagertestcase.py
index 24d82bd5..56d82f7a 100644
--- a/testcases/failmanagertestcase.py
+++ b/testcases/failmanagertestcase.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 5465400c..64ba025a 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index 34e60537..f664d12b 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.1 $"
-__date__ = "$Date: 2004/10/10 13:33:40 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/version.py b/version.py
index d4fe1137..43dd7e7c 100644
--- a/version.py
+++ b/version.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 1.15.2.1 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 1.15.2.1 $"
-__date__ = "$Date: 2006/03/19 18:35:21 $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 

From 9aa6a505eb4dbd64dde4f5b970b6882e04531bf2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 17 Jul 2006 19:26:14 +0000
Subject: [PATCH 220/549] - Added header

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@254 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/dummy.conf       | 7 +++++++
 config/action.d/foo.conf         | 7 +++++++
 config/action.d/hostsdeny.conf   | 7 +++++++
 config/action.d/iptables.conf    | 7 +++++++
 config/fail2ban.conf             | 7 +++++++
 config/filter.d/apache-auth.conf | 7 +++++++
 config/filter.d/sshd.conf        | 7 +++++++
 config/filter.d/vsftpd.conf      | 7 +++++++
 config/jail.conf                 | 7 +++++++
 9 files changed, 63 insertions(+)

diff --git a/config/action.d/dummy.conf b/config/action.d/dummy.conf
index 010d2b27..bfd9599d 100644
--- a/config/action.d/dummy.conf
+++ b/config/action.d/dummy.conf
@@ -1,3 +1,10 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
 [Definition]
 
 # Option:  fwstart
diff --git a/config/action.d/foo.conf b/config/action.d/foo.conf
index 1eb14993..796d736a 100644
--- a/config/action.d/foo.conf
+++ b/config/action.d/foo.conf
@@ -1,3 +1,10 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
 [Definition]
 
 # Option:  protocol
diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf
index 6af73ecf..ba813ac8 100644
--- a/config/action.d/hostsdeny.conf
+++ b/config/action.d/hostsdeny.conf
@@ -1,3 +1,10 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
 [Definition]
 
 # Option:  fwstart
diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf
index 9baa9c4f..3d9083f1 100644
--- a/config/action.d/iptables.conf
+++ b/config/action.d/iptables.conf
@@ -1,3 +1,10 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
 [Definition]
 
 # Option:  fwstart
diff --git a/config/fail2ban.conf b/config/fail2ban.conf
index 33323e04..c4028d54 100644
--- a/config/fail2ban.conf
+++ b/config/fail2ban.conf
@@ -1,3 +1,10 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
 [Definition]
 
 loglevel = 3
diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 642386bc..3bd2c0f8 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -1,3 +1,10 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
 [Definition]
 
 # Option:  maxretry
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index da301e67..7b847fbd 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -1,3 +1,10 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
 [Definition]
 
 # Option:  maxretry
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index 52141374..1d759b41 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -1,3 +1,10 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
 [Definition]
 
 # Option:  maxretry
diff --git a/config/jail.conf b/config/jail.conf
index 63851932..ef876714 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -1,3 +1,10 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
 [dummy]
 
 enabled = true

From 40425d051ef7b44464759ded9013425516dcdddb Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 17 Jul 2006 19:49:45 +0000
Subject: [PATCH 221/549] - Removed debug comment

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@255 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index 140aa61b..b286ffd5 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -433,8 +433,8 @@ class Filter(JailThread):
 			# Bug fix for #1241756
 			# If the date is greater than the current time, we suppose
 			# that the log is not from this year but from the year before
-			#if time.mktime(date) > time.time():
-			#	date[0] -= 1
+			if time.mktime(date) > time.time():
+				date[0] -= 1
 		unixTime = time.mktime(date)
 		return unixTime
 

From be7cc4f81ccb8d5973648d6e1bae74c28488dbc9 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 19 Jul 2006 21:35:22 +0000
Subject: [PATCH 222/549] - Added mail script

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@256 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/mail.conf | 69 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 config/action.d/mail.conf

diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf
new file mode 100644
index 00000000..5d06c121
--- /dev/null
+++ b/config/action.d/mail.conf
@@ -0,0 +1,69 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 254 $
+#
+
+[Definition]
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD  Default:
+#
+actionstart = echo -en "Hi,\n
+              The jail <name> has been started successfuly.\n
+              Regards,\n
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD  Default:
+#
+actionstop = echo -en "Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD  Default:
+#
+actioncheck = 
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+actionban = echo -en "Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <section>.\n
+            Regards,\n
+            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destinataire of the mail
+#
+dest = root

From 894bcbdbbfc541ce0893ae0fde80cab0ea13dd8c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 31 Jul 2006 21:48:13 +0000
Subject: [PATCH 223/549] - Improved mail script

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@257 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/mail.conf | 2 +-
 config/jail.conf          | 3 ++-
 server/actions.py         | 1 +
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf
index 5d06c121..88cbae25 100644
--- a/config/action.d/mail.conf
+++ b/config/action.d/mail.conf
@@ -43,7 +43,7 @@ actioncheck =
 #
 actionban = echo -en "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
-            <failures> attempts against <section>.\n
+            <failures> attempts against <name>.\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
 
diff --git a/config/jail.conf b/config/jail.conf
index ef876714..04adac31 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -10,8 +10,9 @@
 enabled = true
 filter = sshd
 action = hostsdeny[file=/tmp/hosts.deny]
+         mail[name=SSH,dest=cyril.jaquier@bluewin.ch]
 maxretry = 2
-bantime = 5
+bantime = 10
 
 [ssh]
 
diff --git a/server/actions.py b/server/actions.py
index eb0fb2c3..145560a7 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -134,6 +134,7 @@ class Actions(JailThread):
 			aInfo = dict()
 			bTicket = BanManager.createBanTicket(ticket)
 			aInfo["ip"] = bTicket.getIP()
+			aInfo["failures"] = bTicket.getTime()
 			logSys.info("Ban %s" % aInfo["ip"])
 			for action in self.actions:
 				action.execActionBan(aInfo)

From e09bdac206270ef0492433aa08e514b61289045f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Aug 2006 21:18:04 +0000
Subject: [PATCH 224/549] - Updated TODO

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@258 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/TODO b/TODO
index 34c5d5af..3131dd65 100644
--- a/TODO
+++ b/TODO
@@ -13,7 +13,11 @@ Legend:
 # partially done
 * done
 
-See Feature Request Tracking System at SourceForge.net
+- see Feature Request Tracking System at SourceForge.net
+
+- findall in dns.py should be no more needed
+
+- remove utils/ directory
 
 - improve installation process (better prefix support)
 

From 7b16590d8c0e564d39ed6f209fce9827ac1c57d8 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Aug 2006 21:18:44 +0000
Subject: [PATCH 225/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@259 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index ebcac024..250ebf52 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -17,6 +17,8 @@ ver. 0.7.0 (2006/07/??) - alpha
 - Execute several actions
 - Split configuration files. They are more readable and easy
   to use
+- failregex uses group (<host>) now. This feature was already
+  present in the Debian package
 
 ver. 0.6.1 (2006/03/16) - stable
 ----------

From b5c0f7bae23691f2f1b6ca1997b9438352ad8e3d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Aug 2006 21:20:28 +0000
Subject: [PATCH 226/549] - Added whois information to mail. Feature Request
 #1533626

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@260 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/mail-whois.conf | 71 +++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 config/action.d/mail-whois.conf

diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf
new file mode 100644
index 00000000..80971f61
--- /dev/null
+++ b/config/action.d/mail-whois.conf
@@ -0,0 +1,71 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 254 $
+#
+
+[Definition]
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD  Default:
+#
+actionstart = echo -en "Hi,\n
+              The jail <name> has been started successfuly.\n
+              Regards,\n
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD  Default:
+#
+actionstop = echo -en "Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD  Default:
+#
+actioncheck = 
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+actionban = echo -en "Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here are more information about <ip>:\n\n
+            `whois <ip>`\n
+            Regards,\n
+            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destinataire of the mail
+#
+dest = root

From 79fc53bc04bf81421f2e1029430a8acda8e8bafc Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Aug 2006 21:22:26 +0000
Subject: [PATCH 227/549] - Regular expressions are now compiled

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@261 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index b286ffd5..018ecde8 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -61,10 +61,12 @@ class Filter(JailThread):
 		self.logPath = ''
 		## The regular expression matching the date.
 		self.timeRegex = ''
+		self.timeRegexObj = None
 		## The pattern matching the date.
 		self.timePattern = ''
 		## The regular expression matching the failure.
 		self.failRegex = ''
+		self.failRegexObj = None
 		## The amount of time to look back.
 		self.findTime = 6000
 		## The ignore IP list.
@@ -103,6 +105,7 @@ class Filter(JailThread):
 	
 	def setTimeRegex(self, value):
 		self.timeRegex = value
+		self.timeRegexObj = re.compile(value)
 		logSys.info("Set timeregex = %s" % value)
 	
 	##
@@ -139,6 +142,7 @@ class Filter(JailThread):
 	
 	def setFailRegex(self, value):
 		self.failRegex = value
+		self.failRegexObj = re.compile(value)
 		logSys.info("Set failregex = %s" % value)
 	
 	##
@@ -369,15 +373,19 @@ class Filter(JailThread):
 
 	def findFailure(self, line):
 		failList = list()
-		match = re.search(self.failRegex, line)
+		match = self.failRegexObj.search(line)
 		if match:
-			timeMatch = re.search(self.timeRegex, match.string)
+			timeMatch = self.timeRegexObj.search(match.string)
 			if timeMatch:
 				date = self.getUnixTime(timeMatch.group())
-				ipMatch = textToIp(match.string)
-				if ipMatch:
-					for ip in ipMatch:
-						failList.append([ip, date])
+				try:
+					ipMatch = textToIp(match.group("host"))
+					if ipMatch:
+						for ip in ipMatch:
+							failList.append([ip, date])
+				except IndexError:
+					logSys.error("There is no 'host' group in the rule. " +
+								 "Please correct your configuration.")
 		return failList
 	
 	##

From 3d73f45531d695d8e9101250a695324b825d82d2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Aug 2006 21:23:06 +0000
Subject: [PATCH 228/549] - Added 'host' group in failregex

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@262 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/sshd.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 7b847fbd..42806e20 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -39,5 +39,5 @@ timepattern = %%b %%d %%H:%%M:%%S
 # Notes.:  regex to match the password failures messages in the logfile.
 # Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
 #
-failregex = Authentication failure|Failed password|Invalid user
+failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
 

From f248c460f2dd8a203cb64700fb7b8c42a94a81ed Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Aug 2006 21:24:06 +0000
Subject: [PATCH 229/549] - Improved logging in server - Added logtarget option

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@263 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/fail2banreader.py |  5 ++++-
 config/fail2ban.conf     |  1 +
 server/server.py         | 31 ++++++++++++++++++++++++++++++-
 server/transmitter.py    |  4 ++++
 4 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/client/fail2banreader.py b/client/fail2banreader.py
index eebd8827..8a210d57 100644
--- a/client/fail2banreader.py
+++ b/client/fail2banreader.py
@@ -39,7 +39,8 @@ class Fail2banReader(ConfigReader):
 		ConfigReader.read(self, "fail2ban")
 	
 	def getOptions(self):
-		opts = [["int", "loglevel", 1]]
+		opts = [["int", "loglevel", 1],
+				["string", "logtarget", "STDERR"]]
 		self.opts = ConfigReader.getOptions(self, "Definition", opts)
 	
 	def convert(self):
@@ -47,5 +48,7 @@ class Fail2banReader(ConfigReader):
 		for opt in self.opts:
 			if opt == "loglevel":
 				stream.append(["set", "loglevel", self.opts[opt]])
+			elif opt == "logtarget":
+				stream.append(["set", "logtarget", self.opts[opt]])
 		return stream
 	
\ No newline at end of file
diff --git a/config/fail2ban.conf b/config/fail2ban.conf
index c4028d54..0e34c456 100644
--- a/config/fail2ban.conf
+++ b/config/fail2ban.conf
@@ -9,3 +9,4 @@
 
 loglevel = 3
 
+logtarget = /var/log/fail2ban.log
diff --git a/server/server.py b/server/server.py
index ba9bc060..08dfff20 100644
--- a/server/server.py
+++ b/server/server.py
@@ -26,7 +26,7 @@ __license__ = "GPL"
 
 from jail import Jail
 from transmitter import Transmitter
-import locale, logging
+import locale, logging, sys
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.server")
@@ -37,8 +37,10 @@ class Server:
 		self.jails = dict()
 		self.transm = Transmitter(self)
 		self.logLevel = 3
+		self.logTarget = "STDERR"
 		# Set logging level
 		self.setLogLevel(self.logLevel)
+		self.setLogTarget(self.logTarget)
 	
 	def start(self):
 		# Start the communication
@@ -322,6 +324,33 @@ class Server:
 	
 	def getLogLevel(self):
 		return self.logLevel
+	
+	def setLogTarget(self, target):
+		# Remove previous handler
+		logging.getLogger("fail2ban").handlers = []
+		self.logTarget = target
+		if target == "SYSLOG":
+			logSys.error("Not yet implemented")
+			return False
+		elif target == "STDERR":
+			hdlr = logging.StreamHandler(sys.stderr)
+		else:
+			# Target should be a file
+			try:
+				open(target, "a")
+				hdlr = logging.FileHandler(target)
+			except IOError:
+				logSys.error("Unable to log to " + target)
+				return False
+		# set a format which is simpler for console use
+		formatter = logging.Formatter('%(name)-16s: %(levelname)-6s %(message)s')
+		# tell the handler to use this format
+		hdlr.setFormatter(formatter)
+		logging.getLogger("fail2ban").addHandler(hdlr)
+		return True
+	
+	def getLogTarget(self):
+		return self.logTarget
 
 class ServerUnknownJail(Exception):
 	pass
\ No newline at end of file
diff --git a/server/transmitter.py b/server/transmitter.py
index 9ff3e92c..a2653bf8 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -103,6 +103,10 @@ class Transmitter:
 			value = int(action[1])
 			self.server.setLogLevel(value)
 			return self.server.getLogLevel()
+		elif name == "logtarget":
+			value = action[1]
+			self.server.setLogTarget(value)
+			return self.server.getLogTarget()
 		# Jail
 		elif action[1] == "idle":
 			if action[2] == "on":

From d4c9d92ae12f46c2c59ece9a2b09d52082a6500c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Aug 2006 21:25:23 +0000
Subject: [PATCH 230/549] - Fixed bug with "<failures>" tag

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@264 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/actions.py     | 2 +-
 server/banmanager.py  | 4 +++-
 server/failmanager.py | 5 ++++-
 server/ticket.py      | 7 +++++++
 4 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/server/actions.py b/server/actions.py
index 145560a7..7cf7d692 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -134,7 +134,7 @@ class Actions(JailThread):
 			aInfo = dict()
 			bTicket = BanManager.createBanTicket(ticket)
 			aInfo["ip"] = bTicket.getIP()
-			aInfo["failures"] = bTicket.getTime()
+			aInfo["failures"] = bTicket.getAttempt()
 			logSys.info("Ban %s" % aInfo["ip"])
 			for action in self.actions:
 				action.execActionBan(aInfo)
diff --git a/server/banmanager.py b/server/banmanager.py
index 6f634555..fc18f55d 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -101,7 +101,9 @@ class BanManager:
 		ip = ticket.getIP()
 		#lastTime = ticket.getTime()
 		lastTime = time.time()
-		return BanTicket(ip, lastTime)
+		banTicket = BanTicket(ip, lastTime)
+		banTicket.setAttempt(ticket.getAttempt())
+		return banTicket
 	
 	##
 	# Add a ban ticket.
diff --git a/server/failmanager.py b/server/failmanager.py
index 75468306..18ea5a86 100644
--- a/server/failmanager.py
+++ b/server/failmanager.py
@@ -97,7 +97,10 @@ class FailManager:
 			if data.getRetry() >= self.maxRetry:
 				self.delFailure(ip)
 				self.lock.release()
-				return FailTicket(ip, data.getLastTime())
+				# Create a FailTicket from BanData
+				failTicket = FailTicket(ip, data.getLastTime())
+				failTicket.setAttempt(data.getRetry())
+				return failTicket
 		self.lock.release()
 		raise FailManagerEmpty
 
diff --git a/server/ticket.py b/server/ticket.py
index 3eee74cb..1ca3f725 100644
--- a/server/ticket.py
+++ b/server/ticket.py
@@ -34,6 +34,7 @@ class Ticket:
 	def __init__(self, ip, time):
 		self.ip = ip
 		self.time = time
+		self.attempt = 0
 	
 	def setIP(self, value):
 		self.ip = value
@@ -46,4 +47,10 @@ class Ticket:
 	
 	def getTime(self):
 		return self.time
+	
+	def setAttempt(self, value):
+		self.attempt = value
+	
+	def getAttempt(self):
+		return self.attempt
 	
\ No newline at end of file

From 6ff620e7a26bd4da1939d8704f838332f6d816a2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Aug 2006 21:26:05 +0000
Subject: [PATCH 231/549] - Removed logging as logger is not started yet here

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@265 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-server | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/fail2ban-server b/fail2ban-server
index f95fbe6c..071c83dd 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -25,7 +25,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import locale, getopt, logging, sys
+import locale, getopt, sys
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
@@ -35,9 +35,6 @@ from version import version
 from server.server import Server
 from utils.process import *
 
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban")
-
 ##
 # \mainpage Fail2Ban
 #
@@ -101,19 +98,11 @@ class Fail2banServer:
 			
 		self.getCmdLineOptions(optList)
 		
-		# Add the default logging handler
-		stdout = logging.StreamHandler(sys.stdout)
-		# set a format which is simpler for console use
-		formatter = logging.Formatter('%(name)-16s: %(levelname)-6s %(message)s')
-		# tell the handler to use this format
-		stdout.setFormatter(formatter)
-		logSys.addHandler(stdout)
-		
 		if self.conf["background"]:
 			retCode = createDaemon()
 			#signal.signal(signal.SIGTERM, sigTERMhandler)
 			if not retCode:
-				logSys.error("Unable to start daemon")
+				print "Unable to start daemon"
 				sys.exit(-1)
 		
 		try:

From 8af85f5c401d652d564f521e9a5d25930f41c578 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Aug 2006 21:56:01 +0000
Subject: [PATCH 232/549] - Bug fix: '-', '_' and '.' are valid as action file
 - Added a pyunit test

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@266 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/jailreader.py              |  2 +-
 fail2ban-testcases                |  7 +++--
 testcases/clientreadertestcase.py | 43 +++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 3 deletions(-)
 create mode 100644 testcases/clientreadertestcase.py

diff --git a/client/jailreader.py b/client/jailreader.py
index 3b2fb0fb..0054b0d1 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -88,7 +88,7 @@ class JailReader(ConfigReader):
 	
 	@staticmethod
 	def splitAction(action):
-		m = re.match("^(\w+)(?:\[(.*)\])?$", action)
+		m = re.match("^((?:\w|-|_|\.)+)(?:\[(.*)\])?$", action)
 		d = dict()
 		if m.group(2) <> None:
 			for param in m.group(2).split(','):
diff --git a/fail2ban-testcases b/fail2ban-testcases
index cdbd2197..8391c3ca 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -33,10 +33,11 @@ import unittest, logging, sys
 sys.path.insert(1, "/usr/lib/fail2ban")
 
 from version import version
+from testcases import banmanagertestcase
+from testcases import clientreadertestcase
+from testcases import failmanagertestcase
 from testcases import filtertestcase
 from testcases import servertestcase
-from testcases import failmanagertestcase
-from testcases import banmanagertestcase
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban")
@@ -60,6 +61,8 @@ tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
 tests.addTest(unittest.makeSuite(failmanagertestcase.AddFailure))
 # BanManager
 tests.addTest(unittest.makeSuite(banmanagertestcase.AddFailure))
+# ClientReader
+tests.addTest(unittest.makeSuite(clientreadertestcase.JailReaderTest))
 
 # Tests runner
 testRunner = unittest.TextTestRunner()
diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
new file mode 100644
index 00000000..c1b1eddf
--- /dev/null
+++ b/testcases/clientreadertestcase.py
@@ -0,0 +1,43 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 253 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 253 $"
+__date__ = "$Date: 2006-07-17 00:21:58 +0200 (Mon, 17 Jul 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import unittest
+from client.jailreader import JailReader
+
+class JailReaderTest(unittest.TestCase):
+
+	def setUp(self):
+		"""Call before every test case."""
+
+	def tearDown(self):
+		"""Call after every test case."""
+
+	def testSplitAction(self):
+		action = "mail-whois[name=SSH]"
+		expected = ['mail-whois', {'name': 'SSH'}]
+		result = JailReader.splitAction(action)
+		self.assertEquals(expected, result)
+		
\ No newline at end of file

From 857f6d619bb373b2126a812f25670c75ec848379 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Aug 2006 22:14:34 +0000
Subject: [PATCH 233/549] - Fixed bug in failregex

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@267 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/sshd.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 42806e20..67870017 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -39,5 +39,5 @@ timepattern = %%b %%d %%H:%%M:%%S
 # Notes.:  regex to match the password failures messages in the logfile.
 # Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
 #
-failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
+failregex = (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
 

From 4bc6fe419b1c389bc08600fdad587ae48d3dff08 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 6 Aug 2006 22:15:10 +0000
Subject: [PATCH 234/549] - Removed a new line

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@268 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/mail-whois.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf
index 80971f61..459fbf51 100644
--- a/config/action.d/mail-whois.conf
+++ b/config/action.d/mail-whois.conf
@@ -44,7 +44,7 @@ actioncheck =
 actionban = echo -en "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n\n
-            Here are more information about <ip>:\n\n
+            Here are more information about <ip>:\n
             `whois <ip>`\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>

From 448701ad612fac0e88b5906c44060cfa899c8c03 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 17 Aug 2006 21:22:24 +0000
Subject: [PATCH 235/549] - Removed file reading. It does not work

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@269 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 36 ++----------------------------------
 1 file changed, 2 insertions(+), 34 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 5bd1a889..40f7de3c 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -49,7 +49,6 @@ class Fail2banClient:
 		self.argv = None
 		self.stream = None
 		self.conf = dict()
-		self.conf["cmdfile"] = None
 		self.conf["background"] = True
 		self.conf["dump"] = False
 	
@@ -64,7 +63,6 @@ class Fail2banClient:
 		print "  -b         start in background"
 		print "  -f         start in foreground"
 		print "  -c <DIR>   configuration directory"
-		print "  -s <FILE>  read command file"
 		print "  -d         dump configuration"
 		print "  -h         display this help message"
 		print
@@ -81,8 +79,6 @@ class Fail2banClient:
 				self.conf["background"] = True
 			if opt[0] == "-f":
 				self.conf["background"] = False
-			if opt[0] == "-s":
-				self.conf["cmdfile"] = opt[1]
 			if opt[0] in ["-h", "--help"]:
 	 			self.dispUsage()
 	
@@ -119,8 +115,7 @@ class Fail2banClient:
 			return True
 		
 		if len(sys.argv) < 2:
-			logSys.error("Add some options...")
-			return False
+			self.dispUsage()
 		
 		if cmd[0] == "start" and len(cmd) == 1:
 			self.readConfig()
@@ -148,30 +143,6 @@ class Fail2banClient:
 				logSys.error("Arrggh... Start the server first")
 				return False
 	
-	##
-	# Process a script file.
-	#
-	# Read each line of the file and execute the command. Lines which
-	# start with '#' are ignored.
-	# @bug The splitting of the command is wrong and awful.
-	# @param file the path of the script file
-	
-	def processFile(self, file):
-		try:
-			handler = open(file)
-		except IOError:
-			logSys.fatal("Unable to open " + file)
-			return False
-		for line in handler:
-			l = line.strip()
-			if l.find('#') != 0:
-				s = re.split("\s+", l, 3)
-				j = list()
-				for i in s:
-					j.append(i.strip("'"))
-				self.processCommand(j)
-		return True
-	
 	##
 	# Start Fail2Ban server.
 	#
@@ -216,10 +187,7 @@ class Fail2banClient:
 		stdout.setFormatter(formatter)
 		logSys.addHandler(stdout)
 
-		if self.conf["cmdfile"] == None:
-			self.processCommand(args)
-		else:
-			self.processFile(self.conf["cmdfile"])
+		self.processCommand(args)
 
 	def readConfig(self):
 		# Read the configuration

From a694df4a9a6d4b113a5b1ddd8a8ce0eff0f20334 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 17 Aug 2006 22:48:42 +0000
Subject: [PATCH 236/549] - Improved server startup checks - Added "force"
 option "-x"

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@270 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-server       |  8 ++++++--
 server/server.py      |  4 ++--
 server/ssocket.py     | 13 +++++++++++--
 server/transmitter.py | 22 +++++++++++++---------
 4 files changed, 32 insertions(+), 15 deletions(-)

diff --git a/fail2ban-server b/fail2ban-server
index 071c83dd..718813cc 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -50,6 +50,7 @@ class Fail2banServer:
 		self.argv = None
 		self.conf = dict()
 		self.conf["background"] = True
+		self.conf["force"] = False
 	
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
@@ -61,6 +62,7 @@ class Fail2banServer:
 		print
 		print "  -b         start in background"
 		print "  -f         start in foreground"
+		print "  -x         force execution of the server"
 		print "  -h         display this help message"
 		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
@@ -74,6 +76,8 @@ class Fail2banServer:
 				self.conf["background"] = True
 			if opt[0] == "-f":
 				self.conf["background"] = False
+			if opt[0] == "-x":
+				self.conf["force"] = True
 			if opt[0] in ["-h", "--help"]:
 	 			self.dispUsage()
 	
@@ -90,7 +94,7 @@ class Fail2banServer:
 		
 		# Reads the command line options.
 		try:
-			cmdOpts = 'bfh'
+			cmdOpts = 'bfxh'
 			cmdLongOpts = ['help']
 			optList, args = getopt.getopt(self.argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
@@ -107,7 +111,7 @@ class Fail2banServer:
 		
 		try:
 			self.server = Server()
-			self.server.start()
+			self.server.start(self.conf["force"])
 		except Exception, e:
 			print e
 			self.server.quit()
diff --git a/server/server.py b/server/server.py
index 08dfff20..93157a07 100644
--- a/server/server.py
+++ b/server/server.py
@@ -42,9 +42,9 @@ class Server:
 		self.setLogLevel(self.logLevel)
 		self.setLogTarget(self.logTarget)
 	
-	def start(self):
+	def start(self, force):
 		# Start the communication
-		self.transm.start()
+		self.transm.start(force)
 	
 	def quit(self):
 		for jail in self.jails.copy():
diff --git a/server/ssocket.py b/server/ssocket.py
index c047f413..b25754b2 100644
--- a/server/ssocket.py
+++ b/server/ssocket.py
@@ -39,10 +39,15 @@ class SSocket(Thread):
 		self.isRunning = False
 		logSys.debug("Created SSocket")
 	
-	def initialize(self):
+	def initialize(self, force = False):
 		# Remove socket
 		if os.path.exists(self.socketFile):
-			os.remove(self.socketFile)
+			logSys.error("Fail2ban seems to be already running")
+			if force:
+				logSys.warn("Forcing execution of the server")
+				os.remove(self.socketFile)
+			else:
+				raise SSocketErrorException("Server already running")
 		# Create an INET, STREAMing socket
 		#self.ssock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 		self.ssock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
@@ -101,3 +106,7 @@ class SSocket(Thread):
 				raise RuntimeError, "socket connection broken"
 			msg = msg + chunk
 		return pickle.loads(msg)
+
+
+class SSocketErrorException(Exception):
+	pass
diff --git a/server/transmitter.py b/server/transmitter.py
index a2653bf8..81977fc6 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -25,6 +25,7 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 from ssocket import SSocket
+from ssocket import SSocketErrorException
 import re, pickle, logging
 
 # Gets the instance of the logger.
@@ -36,9 +37,12 @@ class Transmitter:
 		self.server = server
 		self.socket = SSocket(self)
 	
-	def start(self):
-		self.socket.initialize()
-		self.socket.start()
+	def start(self, force):
+		try:
+			self.socket.initialize(force)
+			self.socket.start()
+		except SSocketErrorException:
+			logSys.error("Could not start server")
 	
 	##
 	# Stop the transmitter.
@@ -78,8 +82,11 @@ class Transmitter:
 			self.server.startJail(name)
 			return None
 		elif action[0] == "stop":
-			name = action[1]
-			self.server.stopJail(name)
+			if len(action) == 1:
+				self.server.quit()
+			else:
+				name = action[1]
+				self.server.stopJail(name)
 			return None
 		elif action[0] == "sleep":
 			value = action[1]
@@ -90,10 +97,7 @@ class Transmitter:
 		elif action[0] == "get":
 			return self.actionGet(action[1:])
 		elif action[0] == "status":
-			return self.status(action[1:])
-		elif action[0] == "quit":
-			self.server.quit()
-			return None
+			return self.status(action[1:])			
 		raise Exception("Invalid command")
 	
 	def actionSet(self, action):

From 1ec9cb8e063bf043eb2bdd9accb1cc4348be0953 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 17 Aug 2006 22:50:20 +0000
Subject: [PATCH 237/549] - Removed foreground and background options -
 Improved startup procedure - Added "force" option "-x"

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@271 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 83 +++++++++++++++++++++++++------------------------
 1 file changed, 43 insertions(+), 40 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 40f7de3c..612add7f 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -49,8 +49,8 @@ class Fail2banClient:
 		self.argv = None
 		self.stream = None
 		self.conf = dict()
-		self.conf["background"] = True
 		self.conf["dump"] = False
+		self.conf["force"] = False
 	
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
@@ -60,10 +60,9 @@ class Fail2banClient:
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
 		print
-		print "  -b         start in background"
-		print "  -f         start in foreground"
 		print "  -c <DIR>   configuration directory"
 		print "  -d         dump configuration"
+		print "  -x         force execution of the server"
 		print "  -h         display this help message"
 		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
@@ -75,10 +74,8 @@ class Fail2banClient:
 		for opt in optList:
 			if opt[0] == "-d":
 				self.conf["dump"] = True
-			if opt[0] == "-b":
-				self.conf["background"] = True
-			if opt[0] == "-f":
-				self.conf["background"] = False
+			if opt[0] == "-x":
+				self.conf["force"] = True
 			if opt[0] in ["-h", "--help"]:
 	 			self.dispUsage()
 	
@@ -118,51 +115,53 @@ class Fail2banClient:
 			self.dispUsage()
 		
 		if cmd[0] == "start" and len(cmd) == 1:
-			self.readConfig()
-			self.startServer(self.conf["background"])
-			# Configure the server
-			self.processCmd(self.stream)
-		elif cmd[0] == "loadconf" and len(cmd) == 1:
-			self.readConfig()
-			# Configure the server
-			self.processCmd(self.stream)
-		else:
-			try:
-				client = CSocket()
-				ret = client.send(cmd)
-				if ret[0] == 0:
-					logSys.info("OK : " + `ret[1]`)
-					return True
-				else:
-					logSys.info("NOK: " + `ret[1].args`)
-					return False
-			except SystemExit, e:
-				return True
-			except Exception, e:
-				logSys.error(e)
-				logSys.error("Arrggh... Start the server first")
+			if self.ping():
+				logSys.info("Server already running")
 				return False
+			else:
+				self.startServerAsync(self.conf["force"])
+				# Read the config while the server is starting
+				self.readConfig()
+				try:
+					# Wait for the server to start
+					self.waitOnServer()
+					# Configure the server
+					self.processCmd(self.stream)
+					return True
+				except ServerExecutionException:
+					logSys.error("Could not start server. Try -x option")
+					return False
+		else:
+			return self.processCmd([cmd])
+	
 	
 	##
 	# Start Fail2Ban server.
 	#
 	# Start the Fail2ban server in daemon mode.
 	
-	def startServer(self, background = True):
+	def startServerAsync(self, force = False):
 		args = list()
+		
 		args.append("fail2ban-server")
-		if background:
-			args.append("-b")
-		else:
-			args.append("-f")
+		args.append("-b")
+		if force:
+			args.append("-x")
 		
 		pid = os.fork()
 		if pid == 0:
 			os.execv("fail2ban-server", args)
-		else:
-			# Wait for the server to start
-			while not self.ping():
-				time.sleep(0.1)
+						
+			
+	def waitOnServer(self):
+		# Wait for the server to start
+		cnt = 0
+		while not self.ping():
+			if cnt > 10:
+				raise ServerExecutionException("Failed to start server")
+			time.sleep(0.1)
+			cnt = cnt + 1
+			
 	
 	def start(self, argv):
 		# Command line options
@@ -170,7 +169,7 @@ class Fail2banClient:
 		
 		# Reads the command line options.
 		try:
-			cmdOpts = 'bfhc:s:d'
+			cmdOpts = 'hc:xd'
 			cmdLongOpts = ['help']
 			optList, args = getopt.getopt(self.argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
@@ -204,6 +203,10 @@ class Fail2banClient:
 			print c
 		return True
 
+
+class ServerExecutionException(Exception):
+	pass
+
 if __name__ == "__main__":
 	client = Fail2banClient()
 	client.start(sys.argv)

From 01c9c4dbfab8ac70633c04b2cfd31145776abb4b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 17 Aug 2006 22:50:36 +0000
Subject: [PATCH 238/549] - Updated TODO

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@272 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/TODO b/TODO
index 3131dd65..4a4689ca 100644
--- a/TODO
+++ b/TODO
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-ToDo                                        $Revision$
+ToDo                                         $Revision$
 =============================================================
 
 Legend:
@@ -13,6 +13,8 @@ Legend:
 # partially done
 * done
 
+- add a reload option to fail2ban-client
+
 - see Feature Request Tracking System at SourceForge.net
 
 - findall in dns.py should be no more needed

From ec8f620f80b211484cd8f3606437ccc0862e0b27 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Aug 2006 20:38:08 +0000
Subject: [PATCH 239/549] - Improved "action" option handling

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@273 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/jailreader.py | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/client/jailreader.py b/client/jailreader.py
index 0054b0d1..e8baf80e 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -67,12 +67,16 @@ class JailReader(ConfigReader):
 			self.filter.getOptions(self.opts)
 			
 			# Read action
-			for act in self.opts["action"].split():
-				splitAct = JailReader.splitAction(act)
-				action = ActionReader(splitAct, self.name)
-				action.read()
-				action.getOptions(self.opts)
-				self.actions.append(action)
+			for act in self.opts["action"].split('\n'):
+				try:
+					splitAct = JailReader.splitAction(act)
+					action = ActionReader(splitAct, self.name)
+					action.read()
+					action.getOptions(self.opts)
+					self.actions.append(action)
+				except AttributeError, e:
+					logSys.error("Error in action definition " + act)
+					logSys.debug(e)
 	
 	def convert(self):
 		stream = [["add", self.name]]

From 535b9a6a36ed1b52ce0436e5109dc42bc1a6e410 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Aug 2006 20:39:45 +0000
Subject: [PATCH 240/549] - Removed "utils" directory - Created a "DNSUtils"
 class in filter.py

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@274 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py  | 105 +++++++++++++++++++++++++++++++++++++++++---
 utils/__init__.py |  25 -----------
 utils/dns.py      | 102 -------------------------------------------
 utils/mail.py     |  91 --------------------------------------
 utils/pidlock.py  | 109 ----------------------------------------------
 utils/process.py  | 108 ---------------------------------------------
 utils/strings.py  |  40 -----------------
 7 files changed, 100 insertions(+), 480 deletions(-)
 delete mode 100644 utils/__init__.py
 delete mode 100644 utils/dns.py
 delete mode 100644 utils/mail.py
 delete mode 100644 utils/pidlock.py
 delete mode 100644 utils/process.py
 delete mode 100644 utils/strings.py

diff --git a/server/filter.py b/server/filter.py
index 018ecde8..3d51d3ed 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -28,7 +28,6 @@ from failmanager import FailManager
 from failmanager import FailManagerEmpty
 from failticket import FailTicket
 from jailthread import JailThread
-from utils.dns import *
 import time, logging, os, re, sys, socket
 
 # Gets the instance of the logger.
@@ -257,8 +256,8 @@ class Filter(JailThread):
 				s.insert(1, '32')
 			s[1] = long(s[1])
 			try:
-				a = cidr(s[0], s[1])
-				b = cidr(ip, s[1])
+				a = DNSUtils.cidr(s[0], s[1])
+				b = DNSUtils.cidr(ip, s[1])
 			except Exception:
 				return False
 			if a == b:
@@ -379,7 +378,7 @@ class Filter(JailThread):
 			if timeMatch:
 				date = self.getUnixTime(timeMatch.group())
 				try:
-					ipMatch = textToIp(match.group("host"))
+					ipMatch = DNSUtils.textToIp(match.group("host"))
 					if ipMatch:
 						for ip in ipMatch:
 							failList.append([ip, date])
@@ -457,4 +456,100 @@ class Filter(JailThread):
 		ret = [("Currently failed", self.failManager.size()),
 			   ("Total failed", self.failManager.getFailTotal())]
 		return ret
-	
\ No newline at end of file
+
+
+##
+# Utils class for DNS and IP handling.
+#
+# This class contains only static methods used to handle DNS and IP
+# addresses.
+
+import socket, struct
+
+class DNSUtils:
+	
+	dnsRe = re.compile("(?:(?:\w|-)+\.){2,}\w+")
+	ipRe = re.compile("(?:\d{1,3}\.){3}\d{1,3}")
+	
+	@staticmethod
+	def dnsToIp(dns):
+		""" Convert a DNS into an IP address using the Python socket module.
+			Thanks to Kevin Drapel.
+		"""
+		try:
+			return socket.gethostbyname_ex(dns)[2]
+		except socket.gaierror:
+			return list()
+	
+	@staticmethod
+	def textToDns(text):
+		""" Search for possible DNS in an arbitrary text.
+			Thanks to Tom Pike.
+		"""
+		match = dnsRe.find(text)
+		if match:
+			return match
+		else:
+			return None
+	
+	@staticmethod
+	def searchIP(text):
+		""" Search if an IP address if directly available and return
+			it.
+		"""
+		match = ipRe.find(text)
+		if match:
+			return match
+		else:
+			return None
+	
+	@staticmethod
+	def isValidIP(str):
+		""" Return true if str is a valid IP
+		"""
+		s = str.split('/', 1)
+		try:
+			socket.inet_aton(s[0])
+			return True
+		except socket.error:
+			return False
+	
+	@staticmethod
+	def textToIp(text):
+		""" Return the IP of DNS found in a given text.
+		"""
+		ipList = list()
+		# Search for plain IP
+		plainIP = DNSUtils.searchIP(text)
+		if not plainIP == None:
+			if isValidIP(element):
+				ipList.append(element)
+		if not ipList:
+			# Try to get IP from possible DNS
+			dnsList = DNSUtils.textToDns(text)
+			if not dnsList == None:
+				dns = DNSUtils.dnsToIp(element)
+				for e in dns:
+					ipList.append(e)
+		return ipList
+	
+	@staticmethod
+	def cidr(i, n):
+		""" Convert an IP address string with a CIDR mask into a 32-bit
+			integer.
+		"""
+		# 32-bit IPv4 address mask
+		MASK = 0xFFFFFFFFL
+		return ~(MASK >> n) & MASK & DNSUtils.addr2bin(i)
+	
+	@staticmethod
+	def addr2bin(str):
+		""" Convert a string IPv4 address into an unsigned integer.
+		"""
+		return struct.unpack("!L", socket.inet_aton(str))[0]
+	
+	@staticmethod
+	def bin2addr(addr):
+		""" Convert a numeric IPv4 address into string n.n.n.n form.
+		"""
+		return socket.inet_ntoa(struct.pack("!L", addr))
diff --git a/utils/__init__.py b/utils/__init__.py
deleted file mode 100644
index 76dba873..00000000
--- a/utils/__init__.py
+++ /dev/null
@@ -1,25 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
\ No newline at end of file
diff --git a/utils/dns.py b/utils/dns.py
deleted file mode 100644
index 8d099753..00000000
--- a/utils/dns.py
+++ /dev/null
@@ -1,102 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import os, re, socket, struct
-
-def dnsToIp(dns):
-	""" Convert a DNS into an IP address using the Python socket module.
-		Thanks to Kevin Drapel.
-	"""
-	try:
-		return socket.gethostbyname_ex(dns)[2]
-	except socket.gaierror:
-		return list()
-
-def textToDns(text):
-	""" Search for possible DNS in an arbitrary text.
-		Thanks to Tom Pike.
-	"""
-	match = re.findall("(?:(?:\w|-)+\.){2,}\w+", text)
-	if match:
-		return match
-	else:
-		return []
-
-def searchIP(text):
-	""" Search if an IP address if directly available and return
-		it.
-	"""
-	match = re.findall("(?:\d{1,3}\.){3}\d{1,3}", text)
-	if match:
-		return match
-	else:
-		return []
-
-def isValidIP(str):
-	""" Return true if str is a valid IP
-	"""
-	s = str.split('/', 1)
-	try:
-		socket.inet_aton(s[0])
-		return True
-	except socket.error:
-		return False
-
-def textToIp(text):
-	""" Return the IP of DNS found in a given text.
-	"""
-	ipList = list()
-	# Search for plain IP
-	plainIP = searchIP(text)
-	for element in plainIP:
-		if isValidIP(element):
-			ipList.append(element)
-	if not ipList:
-		# Try to get IP from possible DNS
-		dnsList = textToDns(text)
-		for element in dnsList:
-			dns = dnsToIp(element)
-			for e in dns:
-				ipList.append(e)
-	return ipList
-
-def cidr(i, n):
-	""" Convert an IP address string with a CIDR mask into a 32-bit
-		integer.
-	"""
-	# 32-bit IPv4 address mask
-	MASK = 0xFFFFFFFFL
-	return ~(MASK >> n) & MASK & addr2bin(i)
-
-def addr2bin(str):
-	""" Convert a string IPv4 address into an unsigned integer.
-	"""
-	return struct.unpack("!L", socket.inet_aton(str))[0]
-
-def bin2addr(addr):
-	""" Convert a numeric IPv4 address into string n.n.n.n form.
-	"""
-	return socket.inet_ntoa(struct.pack("!L", addr))
diff --git a/utils/mail.py b/utils/mail.py
deleted file mode 100644
index 9a89896e..00000000
--- a/utils/mail.py
+++ /dev/null
@@ -1,91 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import logging, smtplib, email.Utils
-
-from utils.strings import replaceTag
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban")
-
-class Mail:
-	""" Mailer class
-	"""
-	
-	def __init__(self, host, port = 25):
-		self.host = host
-		self.port = port
-		self.localTimeFlag = False
-		
-	def setFromAddr(self, fromAddr):
-		""" Set from: address
-		"""
-		self.fromAddr = fromAddr
-
-	def setUser(self, user):
-		""" Set smtpuser
-		"""
-		self.user = user
-
-	def setPassword(self, password):
-		""" Set smtppassword
-		"""
-		self.password = password
-	
-	def setToAddr(self, toAddr):
-		""" Set to: address
-		"""
-		self.toAddr = toAddr.split()
-
-	def setLocalTimeFlag(self, localTimeFlag):
-		""" Set to: address
-		"""
-		self.localTimeFlag = localTimeFlag
-
-	def sendmail(self, subject, message, aInfo):
-		""" Send an email using smtplib
-		"""
-		subj = replaceTag(subject, aInfo)
-		msg = replaceTag(message, aInfo)
-		
-		mail = ("From: %s\r\nTo: %s\r\nDate: %s\r\nSubject: %s\r\n\r\n" %
-				(self.fromAddr, ", ".join(self.toAddr),
-				email.Utils.formatdate(localtime = self.localTimeFlag),
-				subj)) + msg
-		
-		try:
-			server = smtplib.SMTP(self.host, self.port)
-			#server.set_debuglevel(1)
-			if not self.user == '':
-				server.login(self.user, self.password)
-			server.sendmail(self.fromAddr, self.toAddr, mail)
-			logSys.debug("Email sent to " + `self.toAddr`)
-			server.quit()	
-		except Exception, e:
-			logSys.error("Unable to send mail to " + self.host + ":" +
-						 `self.port` + " from " + self.fromAddr + " to " +
-						 `self.toAddr` + ": " + `e` + ": " + `e.args`)
-		
diff --git a/utils/pidlock.py b/utils/pidlock.py
deleted file mode 100644
index 4659dfb3..00000000
--- a/utils/pidlock.py
+++ /dev/null
@@ -1,109 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import os, logging
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban")
-
-class PIDLock:
-	""" Manages the PID lock file.
-	
-		The following class shows how to implement the singleton pattern[1] in
-		Python. A singleton is a class that makes sure only one instance of it
-		is ever created. Typically such classes are used to manage resources
-		that by their very nature can only exist once.
-		
-		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/52558
-	"""
-	
-	class __impl:
-		""" Implementation of the singleton interface """
-
-		def setPath(self, path):
-			""" Set PID lock file path.
-			"""
-			self.path = path
-		
-		def create(self):
-			""" Create PID lock.
-			"""
-			try:
-				fileHandler = open(self.path, mode='w')
-				pid = os.getpid()
-				fileHandler.write(`pid` + '\n')
-				fileHandler.close()
-				logSys.debug("Created PID lock (" + `pid` + ") in " + self.path)
-				return True
-			except:
-				logSys.error("Unable to create PID lock " + self.path)
-				return False	
-		
-		def remove(self):
-			""" Remove PID lock.
-			"""
-			try:
-				os.remove(self.path)
-				logSys.debug("Removed PID lock " + self.path)
-			except OSError:
-				logSys.error("Unable to remove PID lock " + self.path)
-			except AttributeError:
-				# AttributeError if self.path wasn't specified yet
-				logSys.debug("PID lock not removed because not defined yet")
-		
-		def exists(self):
-			""" Returns the current PID if Fail2Ban is running or False
-				if no instance found.
-			"""
-			try:
-				fileHandler = open(self.path)
-				pid = fileHandler.readline()
-				fileHandler.close()
-				return pid
-			except IOError:
-				return False
-
-	# storage for the instance reference
-	__instance = None
-
-	def __init__(self):
-		""" Create singleton instance """
-		# Check whether we already have an instance
-		if PIDLock.__instance is None:
-			# Create and remember instance
-			PIDLock.__instance = PIDLock.__impl()
-
-		# Store instance reference as the only member in the handle
-		self.__dict__['_PIDLock__instance'] = PIDLock.__instance
-
-	def __getattr__(self, attr):
-		""" Delegate access to implementation """
-		return getattr(self.__instance, attr)
-
-	def __setattr__(self, attr, value):
-		""" Delegate access to implementation """
-		return setattr(self.__instance, attr, value)
-	
\ No newline at end of file
diff --git a/utils/process.py b/utils/process.py
deleted file mode 100644
index cf6aafcd..00000000
--- a/utils/process.py
+++ /dev/null
@@ -1,108 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import os, logging, signal
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban")
-
-class ExternalError(UserWarning):
-	""" Exception to warn about failed fwcheck or fwban command
-	"""
-	pass
-
-def createDaemon():
-	""" Detach a process from the controlling terminal and run it in the
-		background as a daemon.
-	
-		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
-	"""
-
-	try:
-		# Fork a child process so the parent can exit.  This will return control
-		# to the command line or shell.  This is required so that the new process
-		# is guaranteed not to be a process group leader.  We have this guarantee
-		# because the process GID of the parent is inherited by the child, but
-		# the child gets a new PID, making it impossible for its PID to equal its
-		# PGID.
-		pid = os.fork()
-	except OSError, e:
-		return((e.errno, e.strerror))	 # ERROR (return a tuple)
-	
-	if pid == 0:	   # The first child.
-
-		# Next we call os.setsid() to become the session leader of this new
-		# session.  The process also becomes the process group leader of the
-		# new process group.  Since a controlling terminal is associated with a
-		# session, and this new session has not yet acquired a controlling
-		# terminal our process now has no controlling terminal.  This shouldn't
-		# fail, since we're guaranteed that the child is not a process group
-		# leader.
-		os.setsid()
-	
-		# When the first child terminates, all processes in the second child
-		# are sent a SIGHUP, so it's ignored.
-		signal.signal(signal.SIGHUP, signal.SIG_IGN)
-	
-		try:
-			# Fork a second child to prevent zombies.  Since the first child is
-			# a session leader without a controlling terminal, it's possible for
-			# it to acquire one by opening a terminal in the future.  This second
-			# fork guarantees that the child is no longer a session leader, thus
-			# preventing the daemon from ever acquiring a controlling terminal.
-			pid = os.fork()		# Fork a second child.
-		except OSError, e:
-			return((e.errno, e.strerror))  # ERROR (return a tuple)
-	
-		if (pid == 0):	  # The second child.
-			# Ensure that the daemon doesn't keep any directory in use.  Failure
-			# to do this could make a filesystem unmountable.
-			os.chdir("/")
-		else:
-			os._exit(0)	  # Exit parent (the first child) of the second child.
-	else:
-		os._exit(0)		 # Exit parent of the first child.
-	
-	# Close all open files.  Try the system configuration variable, SC_OPEN_MAX,
-	# for the maximum number of open files to close.  If it doesn't exist, use
-	# the default value (configurable).
-	try:
-		maxfd = os.sysconf("SC_OPEN_MAX")
-	except (AttributeError, ValueError):
-		maxfd = 256	   # default maximum
-
-	for fd in range(0, maxfd):
-		try:
-			os.close(fd)
-		except OSError:   # ERROR (ignore)
-			pass
-
-	# Redirect the standard file descriptors to /dev/null.
-   	os.open("/dev/null", os.O_RDONLY)	# standard input (0)
-	os.open("/dev/null", os.O_RDWR)		# standard output (1)
-	os.open("/dev/null", os.O_RDWR)		# standard error (2)
-	
-	return True
diff --git a/utils/strings.py b/utils/strings.py
deleted file mode 100644
index 6ed7ece8..00000000
--- a/utils/strings.py
+++ /dev/null
@@ -1,40 +0,0 @@
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
-
-import logging
-
-# Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban")
-
-def replaceTag(query, aInfo):
-	""" Replace tags in query
-	"""
-	string = query
-	for tag in aInfo:
-		string = string.replace('<'+tag+'>', `aInfo[tag]`)
-	# New line
-	string = string.replace('<br>', '\n')
-	return string

From 0326a9415717bc0500c94f99051c724e9b98c16b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Aug 2006 20:40:47 +0000
Subject: [PATCH 241/549] - Removed test which depends on current time - Fixed
 self.server.start()

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@275 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-testcases          | 2 +-
 testcases/servertestcase.py | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 8391c3ca..bed875cd 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -53,7 +53,7 @@ tests = unittest.TestSuite()
 # Filter
 tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
 tests.addTest(unittest.makeSuite(filtertestcase.LogFile))
-tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
+#tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
 # Server
 #tests.addTest(unittest.makeSuite(servertestcase.StartStop))
 #tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index f664d12b..42627111 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -33,7 +33,7 @@ class StartStop(unittest.TestCase):
 		"""Call before every test case."""
 		self.server = Server()
 		self.server.setLogLevel(0)
-		self.server.start()
+		self.server.start(False)
 
 	def tearDown(self):
 		"""Call after every test case."""
@@ -53,7 +53,7 @@ class Transmitter(unittest.TestCase):
 		"""Call before every test case."""
 		self.server = Server()
 		self.server.setLogLevel(0)
-		self.server.start()
+		self.server.start(False)
 
 	def tearDown(self):
 		"""Call after every test case."""

From 2455cb4f8a69f226bddd8100e009a84448089ffa Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Aug 2006 20:41:55 +0000
Subject: [PATCH 242/549] - Updated TODO

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@276 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/TODO b/TODO
index 4a4689ca..8add3074 100644
--- a/TODO
+++ b/TODO
@@ -13,13 +13,17 @@ Legend:
 # partially done
 * done
 
+- correct handling of threads (join???)
+
+- signal handling (ctrl-c, etc)
+
 - add a reload option to fail2ban-client
 
 - see Feature Request Tracking System at SourceForge.net
 
-- findall in dns.py should be no more needed
+* findall in dns.py should be no more needed
 
-- remove utils/ directory
+* remove utils/ directory
 
 - improve installation process (better prefix support)
 
@@ -56,7 +60,7 @@ Legend:
 ? add gettext support. Is this really needed for a server
   utility?
 
-- send an email when fail2ban is running
+* send an email when fail2ban is running
 
 * add multithreading. Python threading is not really
   efficient. However, fail2ban could benefit of it. We could
@@ -91,9 +95,9 @@ Legend:
   - fail2ban list -> list available services.
   - fail2ban flush <srv> -> flush the <srv> ban list.
   
-- remove PID file.
+* remove PID file.
 
-# remove most of the command lines options if possible.
+* remove most of the command lines options if possible.
 
 - add the possibility to specify wildcard in log files.
   Example: logfile = /var/log/apache2/access-*.log

From 64ddab56c8671c9271bfc3be8c411a316c4ac494 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Aug 2006 21:07:28 +0000
Subject: [PATCH 243/549] - Added a "reload" option which reload the
 configuration - Added "stop all" which stop all jails but do not exit

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@277 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client       | 8 ++++++++
 server/server.py      | 7 +++++--
 server/transmitter.py | 4 ++++
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 612add7f..fea1c8a6 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -131,6 +131,14 @@ class Fail2banClient:
 				except ServerExecutionException:
 					logSys.error("Could not start server. Try -x option")
 					return False
+		elif cmd[0] == "reload" and len(cmd) == 1:
+			if self.ping():
+				self.readConfig()
+				self.processCmd(['stop', 'all'])
+				# Configure the server
+				self.processCmd(self.stream)
+			else:
+				logSys.error("Could not find server")
 		else:
 			return self.processCmd([cmd])
 	
diff --git a/server/server.py b/server/server.py
index 93157a07..66a0ce9b 100644
--- a/server/server.py
+++ b/server/server.py
@@ -47,8 +47,7 @@ class Server:
 		self.transm.start(force)
 	
 	def quit(self):
-		for jail in self.jails.copy():
-			self.stopJail(jail)
+		self.stopAllJail()
 		self.transm.stop()
 	
 	def addJail(self, name):
@@ -73,6 +72,10 @@ class Server:
 				self.delJail(name)
 		else:
 			raise ServerUnknownJail(name)
+	
+	def stopAllJail(self):
+		for jail in self.jails.copy():
+			self.stopJail(jail)
 			
 	def isActive(self, name):
 		if self.jails.has_key(name):
diff --git a/server/transmitter.py b/server/transmitter.py
index 81977fc6..5dad10eb 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -75,6 +75,8 @@ class Transmitter:
 			return "pong"
 		elif action[0] == "add":
 			name = action[1]
+			if name == "all":
+				raise Exception("Reserved name")
 			self.server.addJail(name)
 			return name
 		elif action[0] == "start":
@@ -84,6 +86,8 @@ class Transmitter:
 		elif action[0] == "stop":
 			if len(action) == 1:
 				self.server.quit()
+			elif action[1] == "all":
+				self.server.stopAllJail()
 			else:
 				name = action[1]
 				self.server.stopJail(name)

From 7ed59912f29d596afe0eae6bd256da54171e69ae Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Aug 2006 21:18:39 +0000
Subject: [PATCH 244/549] - Added *.local as svn:ignore

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@278 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.local | 5 ++++-
 config/jail.conf      | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/config/fail2ban.local b/config/fail2ban.local
index db4574b5..da561caa 100644
--- a/config/fail2ban.local
+++ b/config/fail2ban.local
@@ -1 +1,4 @@
-[DEFAULT]
+[Definition]
+
+logtarget = /tmp/fail2ban.log
+loglevel = 4
diff --git a/config/jail.conf b/config/jail.conf
index 04adac31..0c6ab0c4 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -10,7 +10,7 @@
 enabled = true
 filter = sshd
 action = hostsdeny[file=/tmp/hosts.deny]
-         mail[name=SSH,dest=cyril.jaquier@bluewin.ch]
+         mail[name=SSH, dest=cyril.jaquier@bluewin.ch]
 maxretry = 2
 bantime = 10
 

From f752dbe065ed80c24949ff57f5c0bc3b70463d2f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Aug 2006 21:20:53 +0000
Subject: [PATCH 245/549] - Removed from version control

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@279 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.local | 4 ----
 1 file changed, 4 deletions(-)
 delete mode 100644 config/fail2ban.local

diff --git a/config/fail2ban.local b/config/fail2ban.local
deleted file mode 100644
index da561caa..00000000
--- a/config/fail2ban.local
+++ /dev/null
@@ -1,4 +0,0 @@
-[Definition]
-
-logtarget = /tmp/fail2ban.log
-loglevel = 4

From ad279c9f1729b0a3a6ff03a7abf215ee1c939e8e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Aug 2006 21:29:15 +0000
Subject: [PATCH 246/549] - Fixed bug when adding space between parameters

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@280 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/jailreader.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/jailreader.py b/client/jailreader.py
index e8baf80e..af66b1a4 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -97,5 +97,5 @@ class JailReader(ConfigReader):
 		if m.group(2) <> None:
 			for param in m.group(2).split(','):
 				p = param.split('=')
-				d[p[0]] = p[1]
+				d[p[0].strip()] = p[1].strip()
 		return [m.group(1), d]

From d7682360bc262bcf7f1684f88c518ce72a59ec57 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Aug 2006 21:34:55 +0000
Subject: [PATCH 247/549] - Clean up configuration files

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@281 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/foo.conf | 55 ----------------------------------------
 config/fail2ban.conf     | 12 +++++++++
 config/jail.conf         | 16 +-----------
 3 files changed, 13 insertions(+), 70 deletions(-)
 delete mode 100644 config/action.d/foo.conf

diff --git a/config/action.d/foo.conf b/config/action.d/foo.conf
deleted file mode 100644
index 796d736a..00000000
--- a/config/action.d/foo.conf
+++ /dev/null
@@ -1,55 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision$
-#
-
-[Definition]
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | all ] Default: tcp
-#
-protocol = tcp
-
-# Option:  fwstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD  Default:
-#
-actionstart = touch /tmp/fail2ban.foo
-
-# Option:  fwend
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
-#
-actionstop = rm -f /tmp/fail2ban.foo
-
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
-#
-actioncheck = [ -e "/tmp/fail2ban.foo" ]
-
-# Option:  fwban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
-# Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
-#
-actionban = echo "+<ip>" >> /tmp/fail2ban.foo
-
-# Option:  fwunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
-# Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
-#
-actionunban = echo "-<ip>" >> /tmp/fail2ban.foo
diff --git a/config/fail2ban.conf b/config/fail2ban.conf
index 0e34c456..d3b91464 100644
--- a/config/fail2ban.conf
+++ b/config/fail2ban.conf
@@ -7,6 +7,18 @@
 
 [Definition]
 
+# Option:  loglevel
+# Notes.:  Set the log level output.
+#          1 = ERROR
+#          2 = WARN
+#          3 = INFO
+#          4 = DEBUG
+# Values:  NUM  Default:  3
+#
 loglevel = 3
 
+# Option:  logtarget
+# Notes.:  Set the log target. This could be a file, SYSLOG, STDERR.
+# Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
+#
 logtarget = /var/log/fail2ban.log
diff --git a/config/jail.conf b/config/jail.conf
index 0c6ab0c4..c8b94c0b 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -7,23 +7,9 @@
 
 [dummy]
 
-enabled = true
+enabled = false
 filter = sshd
 action = hostsdeny[file=/tmp/hosts.deny]
          mail[name=SSH, dest=cyril.jaquier@bluewin.ch]
 maxretry = 2
 bantime = 10
-
-[ssh]
-
-enabled = false
-filter = sshd
-action = iptables
-bantime = 10
-
-[apache-error]
-
-enabled = false
-filter = apache-error
-action = hostdeny
-

From 9fe1efcc45090b8adb244076d834613d1801e9eb Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Aug 2006 21:59:27 +0000
Subject: [PATCH 248/549] - Improved client

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@282 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 50 +++++++++++++++++++++++++++++++++----------------
 1 file changed, 34 insertions(+), 16 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index fea1c8a6..8b8a2919 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -51,6 +51,7 @@ class Fail2banClient:
 		self.conf = dict()
 		self.conf["dump"] = False
 		self.conf["force"] = False
+		self.conf["verbose"] = 2
 	
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
@@ -62,6 +63,8 @@ class Fail2banClient:
 		print
 		print "  -c <DIR>   configuration directory"
 		print "  -d         dump configuration"
+		print "  -v         increase verbosity"
+		print "  -q         decrease verbosity"
 		print "  -x         force execution of the server"
 		print "  -h         display this help message"
 		print
@@ -74,28 +77,35 @@ class Fail2banClient:
 		for opt in optList:
 			if opt[0] == "-d":
 				self.conf["dump"] = True
-			if opt[0] == "-x":
+			elif opt[0] == "-v":
+				self.conf["verbose"] = self.conf["verbose"] + 1
+			elif opt[0] == "-q":
+				self.conf["verbose"] = self.conf["verbose"] - 1
+			elif opt[0] == "-x":
 				self.conf["force"] = True
-			if opt[0] in ["-h", "--help"]:
+			elif opt[0] in ["-h", "--help"]:
 	 			self.dispUsage()
 	
 	def ping(self):
-		return self.processCmd([["ping"]])
+		return self.processCmd([["ping"]], False)
 	
 	@staticmethod
-	def processCmd(cmd):
+	def processCmd(cmd, showRet = True):
 		for c in cmd:
 			try:
 				client = CSocket()
 			except Exception, e:
-				logSys.error(e)
-				logSys.error("Arrggh... Start the server first")
+				if showRet:
+					logSys.error(e)
+					logSys.error("Arrggh... Start the server first")
 				return False
 			ret = client.send(c)
 			if ret[0] == 0:
-				logSys.info("OK : " + `ret[1]`)
+				logSys.debug("OK : " + `ret[1]`)
+				if showRet:
+					print `ret[1]`
 			else:
-				logSys.info("NOK: " + `ret[1].args`)
+				logSys.error("NOK: " + `ret[1].args`)
 				return False
 		return True
 		
@@ -114,7 +124,7 @@ class Fail2banClient:
 		if len(sys.argv) < 2:
 			self.dispUsage()
 		
-		if cmd[0] == "start" and len(cmd) == 1:
+		if len(cmd) == 1 and cmd[0] == "start":
 			if self.ping():
 				logSys.info("Server already running")
 				return False
@@ -126,17 +136,17 @@ class Fail2banClient:
 					# Wait for the server to start
 					self.waitOnServer()
 					# Configure the server
-					self.processCmd(self.stream)
+					self.processCmd(self.stream, False)
 					return True
 				except ServerExecutionException:
 					logSys.error("Could not start server. Try -x option")
 					return False
-		elif cmd[0] == "reload" and len(cmd) == 1:
+		elif len(cmd) == 1 and cmd[0] == "reload":
 			if self.ping():
 				self.readConfig()
-				self.processCmd(['stop', 'all'])
+				self.processCmd(['stop', 'all'], False)
 				# Configure the server
-				self.processCmd(self.stream)
+				self.processCmd(self.stream, False)
 			else:
 				logSys.error("Could not find server")
 		else:
@@ -177,7 +187,7 @@ class Fail2banClient:
 		
 		# Reads the command line options.
 		try:
-			cmdOpts = 'hc:xd'
+			cmdOpts = 'hc:xdvq'
 			cmdLongOpts = ['help']
 			optList, args = getopt.getopt(self.argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
@@ -185,11 +195,19 @@ class Fail2banClient:
 			
 		self.getCmdLineOptions(optList)
 		
-		logSys.setLevel(logging.DEBUG)
+		verbose = self.conf["verbose"]
+		if verbose <= 0:
+			logSys.setLevel(logging.ERROR)
+		elif verbose == 1:
+			logSys.setLevel(logging.WARN)
+		elif verbose == 2:
+			logSys.setLevel(logging.INFO)
+		else:
+			logSys.setLevel(logging.DEBUG)
 		# Add the default logging handler
 		stdout = logging.StreamHandler(sys.stdout)
 		# set a format which is simpler for console use
-		formatter = logging.Formatter('%(name)-16s: %(levelname)-6s %(message)s')
+		formatter = logging.Formatter('%(levelname)-6s %(message)s')
 		# tell the handler to use this format
 		stdout.setFormatter(formatter)
 		logSys.addHandler(stdout)

From ca5b70cd24aa5fd9ef856847e547b2ae4b7ca569 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Aug 2006 22:32:44 +0000
Subject: [PATCH 249/549] - Fixed a bug with static class members

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@283 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/jailreader.py | 4 +++-
 server/filter.py     | 9 +++++----
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/client/jailreader.py b/client/jailreader.py
index af66b1a4..6bd712a2 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -34,6 +34,8 @@ logSys = logging.getLogger("fail2ban.client.config")
 
 class JailReader(ConfigReader):
 	
+	actionCRE = re.compile("^((?:\w|-|_|\.)+)(?:\[(.*)\])?$")
+	
 	def __init__(self, name):
 		ConfigReader.__init__(self)
 		self.name = name
@@ -92,7 +94,7 @@ class JailReader(ConfigReader):
 	
 	@staticmethod
 	def splitAction(action):
-		m = re.match("^((?:\w|-|_|\.)+)(?:\[(.*)\])?$", action)
+		m = JailReader.actionCRE.match(action)
 		d = dict()
 		if m.group(2) <> None:
 			for param in m.group(2).split(','):
diff --git a/server/filter.py b/server/filter.py
index 3d51d3ed..081a83e7 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -468,8 +468,8 @@ import socket, struct
 
 class DNSUtils:
 	
-	dnsRe = re.compile("(?:(?:\w|-)+\.){2,}\w+")
-	ipRe = re.compile("(?:\d{1,3}\.){3}\d{1,3}")
+	dnsCRE = re.compile("(?:(?:\w|-)+\.){2,}\w+")
+	ipCRE = re.compile("(?:\d{1,3}\.){3}\d{1,3}")
 	
 	@staticmethod
 	def dnsToIp(dns):
@@ -486,7 +486,7 @@ class DNSUtils:
 		""" Search for possible DNS in an arbitrary text.
 			Thanks to Tom Pike.
 		"""
-		match = dnsRe.find(text)
+		match = DNSUtils.dnsCRE.match(text)
 		if match:
 			return match
 		else:
@@ -497,7 +497,8 @@ class DNSUtils:
 		""" Search if an IP address if directly available and return
 			it.
 		"""
-		match = ipRe.find(text)
+		print DNSUtils.ipCRE
+		match = DNSUtils.ipCRE.match(text)
 		if match:
 			return match
 		else:

From 1fd2071cd8e7157cb7b04ef06da165d304cfcad5 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Aug 2006 22:54:05 +0000
Subject: [PATCH 250/549] - Fixed a bug in DNSUtils

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@284 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index 081a83e7..3a004f61 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -497,7 +497,6 @@ class DNSUtils:
 		""" Search if an IP address if directly available and return
 			it.
 		"""
-		print DNSUtils.ipCRE
 		match = DNSUtils.ipCRE.match(text)
 		if match:
 			return match
@@ -523,14 +522,15 @@ class DNSUtils:
 		# Search for plain IP
 		plainIP = DNSUtils.searchIP(text)
 		if not plainIP == None:
-			if isValidIP(element):
-				ipList.append(element)
+			plainIPStr = plainIP.group(0)
+			if DNSUtils.isValidIP(plainIPStr):
+				ipList.append(plainIPStr)
 		if not ipList:
 			# Try to get IP from possible DNS
-			dnsList = DNSUtils.textToDns(text)
-			if not dnsList == None:
-				dns = DNSUtils.dnsToIp(element)
-				for e in dns:
+			dns = DNSUtils.textToDns(text)
+			if not dns == None:
+				ip = DNSUtils.dnsToIp(dns.group(0))
+				for e in ip:
 					ipList.append(e)
 		return ipList
 	

From 5c4a4f8726c102092b1d25534a4dbe6e9a19d9d0 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 20 Aug 2006 22:54:53 +0000
Subject: [PATCH 251/549] - Updated setFailRegex() with group

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@285 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 testcases/filtertestcase.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 64ba025a..f23cfd10 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -76,7 +76,7 @@ class GetFailures(unittest.TestCase):
 		self.filter.setLogPath("testcases/files/testcase01.log")
 		self.filter.setTimeRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 		self.filter.setTimePattern("%b %d %H:%M:%S")
-		self.filter.setFailRegex("Authentication failure")
+		self.filter.setFailRegex("(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)")
 
 	def tearDown(self):
 		"""Call after every test case."""

From bdc4c8905138b4990c1e757471f77bb5c75d5da7 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Aug 2006 21:16:23 +0000
Subject: [PATCH 252/549] - Improved usage message - Exit with correct return
 code

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@286 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 48 ++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 38 insertions(+), 10 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 8b8a2919..ec8b315d 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -61,15 +61,35 @@ class Fail2banClient:
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
 		print
-		print "  -c <DIR>   configuration directory"
-		print "  -d         dump configuration"
-		print "  -v         increase verbosity"
-		print "  -q         decrease verbosity"
-		print "  -x         force execution of the server"
-		print "  -h         display this help message"
+		print "  <COMMAND>"
+		print
+		print "    start                   start the server and the jails"
+		print "    reload                  reload the configuration"
+		print "    stop                    stop all jails and terminate the server"
+		print "    status                  get the current status"
+		print
+		print "    set loglevel <LEVEL>    set loglevel to <LEVEL>"
+		print "    get loglevel            get loglevel"
+		print "    set logtarget <TARGET>  set log target to <TARGET>"
+		print "    get logtarget           get log target"
+		print
+		print "    add <JAIL>              create <JAIL>"
+		print "    set <JAIL> <CMD>        set the <CMD> value for <JAIL>"
+		print "    get <JAIL> <CMD>        get the <CMD> value for <JAIL>"
+		print "    start <JAIL>            start <JAIL>"
+		print "    stop <JAIL>             stop <JAIL>. The jail is removed"
+		print "    status <JAIL>           get the current status of <JAIL>"
+		print
+		print "  [OPTIONS]"
+		print
+		print "    -c <DIR>                configuration directory"
+		print "    -d                      dump configuration. For debugging"
+		print "    -v                      increase verbosity"
+		print "    -q                      decrease verbosity"
+		print "    -x                      force execution of the server"
+		print "    -h                      display this help message"
 		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
-		sys.exit(0)
 	
 	def getCmdLineOptions(self, optList):
 		""" Gets the command line options
@@ -85,6 +105,7 @@ class Fail2banClient:
 				self.conf["force"] = True
 			elif opt[0] in ["-h", "--help"]:
 	 			self.dispUsage()
+	 			sys.exit(0)
 	
 	def ping(self):
 		return self.processCmd([["ping"]], False)
@@ -123,6 +144,7 @@ class Fail2banClient:
 		
 		if len(sys.argv) < 2:
 			self.dispUsage()
+			return False
 		
 		if len(cmd) == 1 and cmd[0] == "start":
 			if self.ping():
@@ -146,9 +168,10 @@ class Fail2banClient:
 				self.readConfig()
 				self.processCmd(['stop', 'all'], False)
 				# Configure the server
-				self.processCmd(self.stream, False)
+				return self.processCmd(self.stream, False)
 			else:
 				logSys.error("Could not find server")
+				return False
 		else:
 			return self.processCmd([cmd])
 	
@@ -212,7 +235,7 @@ class Fail2banClient:
 		stdout.setFormatter(formatter)
 		logSys.addHandler(stdout)
 
-		self.processCommand(args)
+		return self.processCommand(args)
 
 	def readConfig(self):
 		# Read the configuration
@@ -235,4 +258,9 @@ class ServerExecutionException(Exception):
 
 if __name__ == "__main__":
 	client = Fail2banClient()
-	client.start(sys.argv)
+	# Exit with correct return value
+	if client.start(sys.argv):
+		sys.exit(0)
+	else:
+		sys.exit(-1)
+

From 432bd3a04cf7c67bee823afe462a0dc2a6a8b151 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Aug 2006 21:18:58 +0000
Subject: [PATCH 253/549] - MANIFEST was broken

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@287 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 56 +++++++++++++++++++++++++++-----------------------------
 1 file changed, 27 insertions(+), 29 deletions(-)

diff --git a/MANIFEST b/MANIFEST
index 22b3eca8..f8927ee7 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -4,49 +4,47 @@ TODO
 fail2ban-client
 fail2ban-server
 fail2ban-testcases
-client/__init__.py
-client/actionreader.py
 client/configreader.py
+client/jailreader.py
+client/fail2banreader.py
+client/jailsreader.py
+client/filterreader.py
+client/actionreader.py
+client/__init__.py
 client/configurator.py
 client/csocket.py
-client/fail2banreader.py
-client/filterreader.py
-client/jailreader.py
-client/jailsreader.py
-server/__init__.py
-server/action.py
-server/actions.py
-server/banmanager.py
+server/ssocket.py
 server/banticket.py
+server/filter.py
+server/server.py
+server/failticket.py
+server/actions.py
 server/faildata.py
 server/failmanager.py
-server/failticket.py
-server/filter.py
-server/jail.py
 server/jailthread.py
-server/server.py
-server/ssocket.py
-server/ticket.py
 server/transmitter.py
+server/action.py
+server/ticket.py
+server/jail.py
+server/__init__.py
+server/banmanager.py
 setup.py
-testcases/__init__.py
 testcases/banmanagertestcase.py
 testcases/failmanagertestcase.py
+testcases/clientreadertestcase.py
 testcases/filtertestcase.py
+testcases/__init__.py
 testcases/servertestcase.py
-utils/__init__.py
-utils/dns.py
-utils/mail.py
-utils/pidlock.py
-utils/process.py
-utils/strings.py
+testcases/files/testcase01.log
+testcases/files/testcase02.log
 version.py
-config/fail2ban.conf
-config/fail2ban.local
 config/jail.conf
-config/action.d/dummy.conf
-config/action.d/iptables.conf
+config/filter.d/vsftpd.conf
 config/filter.d/apache-auth.conf
 config/filter.d/sshd.conf
-man/fail2ban.8
-man/fail2ban.conf.5
+config/action.d/iptables.conf
+config/action.d/mail-whois.conf
+config/action.d/dummy.conf
+config/action.d/mail.conf
+config/action.d/hostsdeny.conf
+config/fail2ban.conf

From acf3b52e18c27edd69479375ca00c3a618a804e7 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Aug 2006 21:59:51 +0000
Subject: [PATCH 254/549] - Catched exception if no "Definition" section found

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@288 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/configreader.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/client/configreader.py b/client/configreader.py
index 55b0faac..ca4303fa 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -77,6 +77,9 @@ class ConfigReader(SafeConfigParser):
 				if not pOptions == None and option[1] in pOptions:
 					continue
 				values[option[1]] = v
+			except NoSectionError, e:
+				# No "Definition" section or wrong basedir
+				logSys.error(e)
 			except NoOptionError:
 				if not option[2] == None:
 					logSys.warn("No '" + option[1] + "' defined in '" + sec + "'")

From 887fbc840fcb60e456891f5b89a7b62894a848e2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Aug 2006 22:00:50 +0000
Subject: [PATCH 255/549] - Configuration path was hardcoded. Use the "-c"
 value instead

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@289 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index ec8b315d..ccde6c25 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -49,6 +49,7 @@ class Fail2banClient:
 		self.argv = None
 		self.stream = None
 		self.conf = dict()
+		self.conf["conf"] = "/etc/fail2ban"
 		self.conf["dump"] = False
 		self.conf["force"] = False
 		self.conf["verbose"] = 2
@@ -95,7 +96,9 @@ class Fail2banClient:
 		""" Gets the command line options
 		"""
 		for opt in optList:
-			if opt[0] == "-d":
+			if opt[0] == "-c":
+				self.conf["conf"] = opt[1]
+			elif opt[0] == "-d":
 				self.conf["dump"] = True
 			elif opt[0] == "-v":
 				self.conf["verbose"] = self.conf["verbose"] + 1
@@ -240,7 +243,7 @@ class Fail2banClient:
 	def readConfig(self):
 		# Read the configuration
 		cfg = Configurator()
-		cfg.setBaseDir("config")
+		cfg.setBaseDir(self.conf["conf"])
 		cfg.readAll()
 		cfg.getAllOptions()
 		cfg.convertToProtocol()

From 8c36bb15a22de981ce51ddb89bef30bc18609e3c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Aug 2006 22:05:08 +0000
Subject: [PATCH 256/549] - Fixed setup process

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@290 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 setup.py | 62 ++++++++++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 53 insertions(+), 9 deletions(-)

diff --git a/setup.py b/setup.py
index 0d0da689..f7cf6e4f 100755
--- a/setup.py
+++ b/setup.py
@@ -48,19 +48,63 @@ setup(
 	url = "http://fail2ban.sourceforge.net",
 	license = "GPL",
 	platforms = "Posix",
-	scripts = ['fail2ban-client', 'fail2ban-server',
-			   'fail2ban-testcases'],
-	py_modules = ['version'],
-	packages = ['client', 'server', 'testcases', 'utils']
+	scripts =	[
+					'fail2ban-client',
+					'fail2ban-server',
+					'fail2ban-testcases'
+				],
+	py_modules =	['version'],
+	packages =	[
+					'client',
+					'server',
+					'testcases'
+				],
+	data_files =	[
+						('/etc/fail2ban',
+							[
+								'config/fail2ban.conf',
+								'config/jail.conf'
+							]
+						),
+						('/etc/fail2ban/filter.d',
+							[
+								'config/filter.d/vsftpd.conf',
+								'config/filter.d/apache-auth.conf',
+								'config/filter.d/sshd.conf'
+							]
+						),
+						('/etc/fail2ban/action.d',
+							[
+								'config/action.d/iptables.conf',
+								'config/action.d/mail-whois.conf',
+								'config/action.d/dummy.conf',
+								'config/action.d/mail.conf',
+								'config/action.d/hostsdeny.conf'
+							]
+						)
+					]
 )
 
 # Do some checks after installation
 # Search for obsolete files.
 obsoleteFiles = []
-elements = {"/etc/": ["fail2ban.conf"],
-			"/usr/bin/": ["fail2ban.py"],
-			"/usr/lib/fail2ban/firewall/": ["iptables.py", "ipfwadm.py",
-											"ipfw.py"]}
+elements =	{
+				"/etc/":
+					[
+						"fail2ban.conf"
+					],
+				"/usr/bin/":
+					[
+						"fail2ban.py"
+					],
+				"/usr/lib/fail2ban/firewall/":
+					[
+						"iptables.py",
+						"ipfwadm.py",
+						"ipfw.py"
+					]
+			}
+
 for dir in elements:
 	for f in elements[dir]:
 		path = join(dir, f)
@@ -80,5 +124,5 @@ if obsoleteFiles:
 if argv[1] == "install":
 	print
 	print "Please do not forget to update your configuration files."
-	print "Use config/ as an example."
+	print "They are in /etc/fail2ban/."
 	print

From c61f4b12f096619c4ba2701132aa0dfddfb12035 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Aug 2006 22:05:28 +0000
Subject: [PATCH 257/549] - Updated version to 0.7.0

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@291 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.py b/version.py
index 43dd7e7c..8746c8ae 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.0-SVN"
+version = "0.7.0"

From 9973bba20f8c23902392cd212bc975bdec418de4 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Aug 2006 22:11:12 +0000
Subject: [PATCH 258/549] - Do not install "testcase"

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@292 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 setup.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/setup.py b/setup.py
index f7cf6e4f..664636f4 100755
--- a/setup.py
+++ b/setup.py
@@ -50,14 +50,12 @@ setup(
 	platforms = "Posix",
 	scripts =	[
 					'fail2ban-client',
-					'fail2ban-server',
-					'fail2ban-testcases'
+					'fail2ban-server'
 				],
 	py_modules =	['version'],
 	packages =	[
 					'client',
-					'server',
-					'testcases'
+					'server'
 				],
 	data_files =	[
 						('/etc/fail2ban',

From 0f6829bd648935ceb4ae89468b229ddf00d1ec63 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Aug 2006 22:20:09 +0000
Subject: [PATCH 259/549] - Updated for 0.7.0

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@293 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG |  5 ++--
 README    | 79 ++++++++++++++++++++++++++-----------------------------
 2 files changed, 40 insertions(+), 44 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 250ebf52..972fd7ad 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.0)                           2006/07/??
+Fail2Ban (version 0.7.0)                           2006/08/23
 =============================================================
 
-ver. 0.7.0 (2006/07/??) - alpha
+ver. 0.7.0 (2006/08/23) - alpha
 ----------
 - Almost a complete rewrite :) Fail2ban design is really
   better (IMHO). There is a lot of new features
@@ -19,6 +19,7 @@ ver. 0.7.0 (2006/07/??) - alpha
   to use
 - failregex uses group (<host>) now. This feature was already
   present in the Debian package
+- lots of things...
 
 ver. 0.6.1 (2006/03/16) - stable
 ----------
diff --git a/README b/README
index c7878a59..bfa7dde3 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.6.1)                           2006/03/16
+Fail2Ban (version 0.7.0)                           2006/08/23
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -58,12 +58,12 @@ Require: python-2.4 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.6.1.tar.bz2
-> cd fail2ban-0.6.1
+> tar xvfj fail2ban-0.7.0.tar.bz2
+> cd fail2ban-0.7.0
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The
-fail2ban executable is placed into /usr/bin.
+executable scripts are placed into /usr/bin.
 
 Gentoo: ebuilds are available on the website.
 Debian: Fail2Ban is in Debian unstable.
@@ -71,50 +71,45 @@ RedHat: packages are available on the website.
 
 Fail2Ban should now be correctly installed. Just type:
 
-> fail2ban -h
+> fail2ban-client -h
 
-to see if everything is alright. You can configure fail2ban
-with a config file. Different kind of configuration files are
-available:
-
-iptables:   copy config/fail2ban.conf.iptables to
-            /etc/fail2ban.conf
-hosts.deny: copy config/fail2ban.conf.hostsdeny to
-            /etc/fail2ban.conf
-shorewall:  copy config/fail2ban.conf.shorewall to
-            /etc/fail2ban.conf
-
-Do not forget to edit fail2ban.conf to meet your needs.
-
-You can use the initd script available in config/. Copy
-<dist>-initd to /etc/init.d/fail2ban. Gentoo users must copy
-gentoo-confd to /etc/conf.d/fail2ban. You can start fail2ban:
-
-> /etc/init.d/fail2ban start
-
-Gentoo users can add it to the default runlevel:
-
-> rc-update add fail2ban default
+to see if everything is alright.
 
 Configuration:
 --------------
 
-You can configure fail2ban using the file /etc/fail2ban.conf
-or using command line options. Command line options override
-the value stored in fail2ban.conf. Here are the command line
-options:
+You can configure fail2ban using the files in /etc/fail2ban
+or using command line. Here are the available command line
+options (not complete yet):
 
-  -b         start in background
-  -c <FILE>  read configuration file FILE
-  -p <FILE>  create PID lock in FILE
-  -h         display this help message
-  -i <IP(s)> IP(s) to ignore
-  -k         kill a currently running instance
-  -r <VALUE> allow a max of VALUE password failure [maxfailures]
-  -t <TIME>  ban IP for TIME seconds [bantime]
-  -f <TIME>  lifetime in seconds of failed entry [findtime]
-  -v         verbose. Use twice for greater effect
-  -V         print software version
+  <COMMAND>
+
+    start                   start the server and the jails
+    reload                  reload the configuration
+    stop                    stop all jails and terminate the
+                            server
+    status                  get the current status
+
+    set loglevel <LEVEL>    set loglevel to <LEVEL>
+    get loglevel            get loglevel
+    set logtarget <TARGET>  set log target to <TARGET>
+    get logtarget           get log target
+
+    add <JAIL>              create <JAIL>
+    set <JAIL> <CMD>        set the <CMD> value for <JAIL>
+    get <JAIL> <CMD>        get the <CMD> value for <JAIL>
+    start <JAIL>            start <JAIL>
+    stop <JAIL>             stop <JAIL>. The jail is removed
+    status <JAIL>           get the current status of <JAIL>
+
+  [OPTIONS]
+
+    -c <DIR>                configuration directory
+    -d                      dump configuration. For debugging
+    -v                      increase verbosity
+    -q                      decrease verbosity
+    -x                      force execution of the server
+    -h                      display this help message
 
 Contact:
 --------

From 15f0d6357b54c4946b8308a0124f4bbc3d740657 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Aug 2006 23:17:08 +0000
Subject: [PATCH 260/549] - Added setup.cfg

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@295 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MANIFEST b/MANIFEST
index f8927ee7..a76831a0 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -29,6 +29,7 @@ server/jail.py
 server/__init__.py
 server/banmanager.py
 setup.py
+setup.cfg
 testcases/banmanagertestcase.py
 testcases/failmanagertestcase.py
 testcases/clientreadertestcase.py

From d053fd7db2b3682b6dec155aad4ae42c727a6a20 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 22 Aug 2006 23:23:38 +0000
Subject: [PATCH 261/549] - Removed utils.process import

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@297 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-server | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fail2ban-server b/fail2ban-server
index 718813cc..e72f9e9c 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -33,7 +33,6 @@ sys.path.insert(1, "/usr/lib/fail2ban")
 
 from version import version
 from server.server import Server
-from utils.process import *
 
 ##
 # \mainpage Fail2Ban

From 704a0b834f8a55240e2db1e4fc15bb3d434c2489 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 23 Aug 2006 19:53:09 +0000
Subject: [PATCH 262/549] - Fixed startup and daemon mode

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@300 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-server       | 16 ++++----
 server/server.py      | 91 ++++++++++++++++++++++++++++++++++++++++++-
 server/transmitter.py |  8 +++-
 3 files changed, 103 insertions(+), 12 deletions(-)

diff --git a/fail2ban-server b/fail2ban-server
index e72f9e9c..67a14144 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -101,20 +101,18 @@ class Fail2banServer:
 			
 		self.getCmdLineOptions(optList)
 		
-		if self.conf["background"]:
-			retCode = createDaemon()
-			#signal.signal(signal.SIGTERM, sigTERMhandler)
-			if not retCode:
-				print "Unable to start daemon"
-				sys.exit(-1)
-		
 		try:
-			self.server = Server()
+			self.server = Server(self.conf["background"])
 			self.server.start(self.conf["force"])
+			return True
 		except Exception, e:
 			print e
 			self.server.quit()
+			return False
 		
 if __name__ == "__main__":
 	server = Fail2banServer()
-	server.start(sys.argv)
+	if server.start(sys.argv):
+		sys.exit(0)
+	else:
+		sys.exit(-1)
diff --git a/server/server.py b/server/server.py
index 66a0ce9b..b4430252 100644
--- a/server/server.py
+++ b/server/server.py
@@ -26,15 +26,16 @@ __license__ = "GPL"
 
 from jail import Jail
 from transmitter import Transmitter
-import locale, logging, sys
+import locale, logging, sys, os, signal
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.server")
 
 class Server:
 	
-	def __init__(self):
+	def __init__(self, daemon = False):
 		self.jails = dict()
+		self.daemon = daemon
 		self.transm = Transmitter(self)
 		self.logLevel = 3
 		self.logTarget = "STDERR"
@@ -43,8 +44,18 @@ class Server:
 		self.setLogTarget(self.logTarget)
 	
 	def start(self, force):
+		logSys.info("Starting Fail2ban")
+		if self.daemon:
+			ret = self.createDaemon()
+			if ret:
+				logSys.info("Daemon started")
+			else:
+				logSys.error("Could not create daemon")
+				raise ServerInitializationError("Could not create daemon")
 		# Start the communication
+		logSys.debug("Starting communication")
 		self.transm.start(force)
+		logSys.info("Exiting Fail2ban")
 	
 	def quit(self):
 		self.stopAllJail()
@@ -354,6 +365,82 @@ class Server:
 	
 	def getLogTarget(self):
 		return self.logTarget
+	
+	def createDaemon(self):
+		""" Detach a process from the controlling terminal and run it in the
+			background as a daemon.
+		
+			http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
+		"""
+	
+		try:
+			# Fork a child process so the parent can exit.  This will return control
+			# to the command line or shell.  This is required so that the new process
+			# is guaranteed not to be a process group leader.  We have this guarantee
+			# because the process GID of the parent is inherited by the child, but
+			# the child gets a new PID, making it impossible for its PID to equal its
+			# PGID.
+			pid = os.fork()
+		except OSError, e:
+			return((e.errno, e.strerror))	 # ERROR (return a tuple)
+		
+		if pid == 0:	   # The first child.
+	
+			# Next we call os.setsid() to become the session leader of this new
+			# session.  The process also becomes the process group leader of the
+			# new process group.  Since a controlling terminal is associated with a
+			# session, and this new session has not yet acquired a controlling
+			# terminal our process now has no controlling terminal.  This shouldn't
+			# fail, since we're guaranteed that the child is not a process group
+			# leader.
+			os.setsid()
+		
+			# When the first child terminates, all processes in the second child
+			# are sent a SIGHUP, so it's ignored.
+			signal.signal(signal.SIGHUP, signal.SIG_IGN)
+		
+			try:
+				# Fork a second child to prevent zombies.  Since the first child is
+				# a session leader without a controlling terminal, it's possible for
+				# it to acquire one by opening a terminal in the future.  This second
+				# fork guarantees that the child is no longer a session leader, thus
+				# preventing the daemon from ever acquiring a controlling terminal.
+				pid = os.fork()		# Fork a second child.
+			except OSError, e:
+				return((e.errno, e.strerror))  # ERROR (return a tuple)
+		
+			if (pid == 0):	  # The second child.
+				# Ensure that the daemon doesn't keep any directory in use.  Failure
+				# to do this could make a filesystem unmountable.
+				os.chdir("/")
+			else:
+				os._exit(0)	  # Exit parent (the first child) of the second child.
+		else:
+			os._exit(0)		 # Exit parent of the first child.
+		
+		# Close all open files.  Try the system configuration variable, SC_OPEN_MAX,
+		# for the maximum number of open files to close.  If it doesn't exist, use
+		# the default value (configurable).
+		try:
+			maxfd = os.sysconf("SC_OPEN_MAX")
+		except (AttributeError, ValueError):
+			maxfd = 256	   # default maximum
+	
+		for fd in range(0, maxfd):
+			try:
+				os.close(fd)
+			except OSError:   # ERROR (ignore)
+				pass
+	
+		# Redirect the standard file descriptors to /dev/null.
+	   	os.open("/dev/null", os.O_RDONLY)	# standard input (0)
+		os.open("/dev/null", os.O_RDWR)		# standard output (1)
+		os.open("/dev/null", os.O_RDWR)		# standard error (2)
+		return True
+
 
 class ServerUnknownJail(Exception):
+	pass
+
+class ServerInitializationError(Exception):
 	pass
\ No newline at end of file
diff --git a/server/transmitter.py b/server/transmitter.py
index 5dad10eb..6b1de4aa 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -37,10 +37,16 @@ class Transmitter:
 		self.server = server
 		self.socket = SSocket(self)
 	
+	##
+	# Start the transmittion server.
+	#
+	# This function wait for the socket thread.
+	
 	def start(self, force):
 		try:
 			self.socket.initialize(force)
 			self.socket.start()
+			self.socket.join()
 		except SSocketErrorException:
 			logSys.error("Could not start server")
 	
@@ -61,7 +67,7 @@ class Transmitter:
 			ret = self.actionHandler(action)
 			ack = 0, ret
 		except Exception, e:
-			logSys.warn("Invalid command")
+			logSys.warn("Invalid command: " + `action`)
 			ack = 1, e
 		return ack
 	

From f44dab9ea766d6182dfbda3629d06d4428d2138d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 23 Aug 2006 19:53:50 +0000
Subject: [PATCH 263/549] - Fixed reload option

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@301 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban-client b/fail2ban-client
index ccde6c25..6b9b3fd2 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -169,7 +169,7 @@ class Fail2banClient:
 		elif len(cmd) == 1 and cmd[0] == "reload":
 			if self.ping():
 				self.readConfig()
-				self.processCmd(['stop', 'all'], False)
+				self.processCmd([['stop', 'all']], False)
 				# Configure the server
 				return self.processCmd(self.stream, False)
 			else:

From 2ff4d50d9792af74e075ecad277ff2caaff68823 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 23 Aug 2006 20:56:07 +0000
Subject: [PATCH 265/549] - Added Gentoo init.d script

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@303 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 files/gentoo-initd | 52 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100755 files/gentoo-initd

diff --git a/files/gentoo-initd b/files/gentoo-initd
new file mode 100755
index 00000000..60ce443d
--- /dev/null
+++ b/files/gentoo-initd
@@ -0,0 +1,52 @@
+#!/sbin/runscript
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# Author: Sireyessire, Cyril Jaquier
+# 
+# $Revision: 1.2 $
+
+opts="start stop restart reload showlog"
+
+FAIL2BAN="/usr/bin/fail2ban-client"
+
+depend() {
+	need net
+	need logger
+	after iptables
+}
+
+start() {
+	ebegin "Starting fail2ban"
+	${FAIL2BAN} start &> /dev/null
+	eend $? "Failed to start fail2ban"
+}
+
+stop() {
+	ebegin "Stopping fail2ban"
+	${FAIL2BAN} stop &> /dev/null
+	eend $? "Failed to stop fail2ban"
+}
+
+reload() {
+	ebegin "Reloading fail2ban"
+	${FAIL2BAN} reload > /dev/null
+	eend $? "Failed to reload fail2ban"
+}
+
+showlog(){
+	less /var/log/fail2ban.log
+}

From 5c6e05f9220780996ac70c76e66ba1549dbe5700 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 23 Aug 2006 20:56:31 +0000
Subject: [PATCH 266/549] - Added Gentoo init.d script

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@304 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MANIFEST b/MANIFEST
index a76831a0..e57a528f 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -49,3 +49,4 @@ config/action.d/dummy.conf
 config/action.d/mail.conf
 config/action.d/hostsdeny.conf
 config/fail2ban.conf
+files/gentoo-initd

From 89b034b6767f80c13410bd49bf5beeb8549dd888 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 23 Aug 2006 20:58:10 +0000
Subject: [PATCH 267/549] - Search "fail2ban-server" using PATH and if it
 fails,   use the current directory

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@305 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/fail2ban-client b/fail2ban-client
index 6b9b3fd2..0e7f159b 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -194,7 +194,16 @@ class Fail2banClient:
 		
 		pid = os.fork()
 		if pid == 0:
-			os.execv("fail2ban-server", args)
+			try:
+				# Use the PATH env
+				os.execvp("fail2ban-server", args)
+			except OSError:
+				try:
+					# Use the current directory
+					os.execv("fail2ban-server", args)
+				except OSError:
+					print "Could not find fail2ban-server"
+					os.exit(-1)
 						
 			
 	def waitOnServer(self):

From d46a125d6d8cc1932118cde49ab10fd55a1b211b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 23 Aug 2006 21:03:47 +0000
Subject: [PATCH 268/549] - Updated for 0.7.1

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@306 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  | 9 ++++++++-
 README     | 6 +++---
 version.py | 2 +-
 3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 972fd7ad..762504b5 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,16 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.0)                           2006/08/23
+Fail2Ban (version 0.7.1)                           2006/08/23
 =============================================================
 
+ver. 0.7.1 (2006/08/23) - alpha
+----------
+- Fixed daemon mode bug
+- Added Gentoo init.d script
+- Fixed path bug when trying to start "fail2ban-server"
+- Fixed reload command
+
 ver. 0.7.0 (2006/08/23) - alpha
 ----------
 - Almost a complete rewrite :) Fail2ban design is really
diff --git a/README b/README
index bfa7dde3..e5516b60 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.0)                           2006/08/23
+Fail2Ban (version 0.7.1)                           2006/08/23
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -58,8 +58,8 @@ Require: python-2.4 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.7.0.tar.bz2
-> cd fail2ban-0.7.0
+> tar xvfj fail2ban-0.7.1.tar.bz2
+> cd fail2ban-0.7.1
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The
diff --git a/version.py b/version.py
index 8746c8ae..86aafaf3 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.0"
+version = "0.7.1"

From cc25b7868708def60227e78c77a50599a323d019 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 24 Aug 2006 18:10:26 +0000
Subject: [PATCH 269/549] - Removed "utils" directory - Modified a few options

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@308 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 doc/Doxyfile | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/doc/Doxyfile b/doc/Doxyfile
index 39a9beae..94725a96 100644
--- a/doc/Doxyfile
+++ b/doc/Doxyfile
@@ -23,7 +23,7 @@ PROJECT_NAME           = Fail2Ban
 # This could be handy for archiving the generated documentation or 
 # if some version control system is used.
 
-PROJECT_NUMBER         = 0.7
+PROJECT_NUMBER         = 0.7-SVN
 
 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) 
 # base path where the generated documentation will be put. 
@@ -193,7 +193,7 @@ OPTIMIZE_OUTPUT_FOR_C  = NO
 # For instance, namespaces will be presented as packages, qualified scopes 
 # will look different, etc.
 
-OPTIMIZE_OUTPUT_JAVA   = YES
+OPTIMIZE_OUTPUT_JAVA   = NO
 
 # If you use STL classes (i.e. std::string, std::vector, etc.) but do not want to 
 # include (a tag file for) the STL sources as input, then you should 
@@ -387,7 +387,7 @@ SHOW_USED_FILES        = YES
 # then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy 
 # in the documentation. The default is NO.
 
-SHOW_DIRECTORIES       = NO
+SHOW_DIRECTORIES       = YES
 
 # The FILE_VERSION_FILTER tag can be used to specify a program or script that 
 # doxygen should invoke to get the current version for each file (typically from the 
@@ -459,7 +459,7 @@ WARN_LOGFILE           =
 # directories like "/usr/src/myproject". Separate the files or directories 
 # with spaces.
 
-INPUT                  = ../server ../client ../testcases ../utils ../
+INPUT                  = ../server ../client ../testcases ../
 
 # If the value of the INPUT tag contains directories, you can use the 
 # FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp 
@@ -1141,7 +1141,7 @@ INCLUDED_BY_GRAPH      = YES
 # So in most cases it will be better to enable call graphs for selected 
 # functions only using the \callgraph command.
 
-CALL_GRAPH             = NO
+CALL_GRAPH             = YES
 
 # If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen 
 # will graphical hierarchy of all classes instead of a textual one.
@@ -1206,7 +1206,7 @@ MAX_DOT_GRAPH_DEPTH    = 0
 # badly anti-aliased labels on the edges of a graph (i.e. they become hard to 
 # read).
 
-DOT_TRANSPARENT        = NO
+DOT_TRANSPARENT        = YES
 
 # Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output 
 # files in one run (i.e. multiple -o and -T options on the command line). This 

From ce5ea1fa23d0166ab67965882489eef8f592c691 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 28 Aug 2006 20:16:32 +0000
Subject: [PATCH 270/549] - Moved hardcoded socket path to a class variable

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@309 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/csocket.py | 10 ++++++----
 server/ssocket.py | 20 +++++++++++---------
 2 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/client/csocket.py b/client/csocket.py
index 1f9915b7..ae53a50b 100644
--- a/client/csocket.py
+++ b/client/csocket.py
@@ -28,25 +28,27 @@ import socket, pickle
 
 class CSocket:
 	
+	END_STRING = "<F2B_END_COMMAND>"
+	SOCKET_FILE = "/tmp/fail2ban.sock"
+	
 	def __init__(self):
-		self.socketFile = "/tmp/fail2ban.sock"
 		# Create an INET, STREAMing socket
 		#self.csock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 		self.csock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
 		#self.csock.connect(("localhost", 2222))
-		self.csock.connect(self.socketFile)
+		self.csock.connect(CSocket.SOCKET_FILE)
 	
 	def send(self, msg):
 		# Convert every list member to string
 		obj = pickle.dumps(map(str, msg))
-		self.csock.send(obj + "<F2B_END_COMMAND>")
+		self.csock.send(obj + CSocket.END_STRING)
 		ret = self.receive(self.csock)
 		self.csock.close()
 		return ret
 	
 	def receive(self, socket):
 		msg = ''
-		while msg.rfind("<F2B_END_COMMAND>") == -1:
+		while msg.rfind(CSocket.END_STRING) == -1:
 			chunk = socket.recv(6)
 			if chunk == '':
 				raise RuntimeError, "socket connection broken"
diff --git a/server/ssocket.py b/server/ssocket.py
index b25754b2..57bf26c8 100644
--- a/server/ssocket.py
+++ b/server/ssocket.py
@@ -32,20 +32,22 @@ logSys = logging.getLogger("fail2ban.comm")
 
 class SSocket(Thread):
 	
+	END_STRING = "<F2B_END_COMMAND>"
+	SOCKET_FILE = "/tmp/fail2ban.sock"
+	
 	def __init__(self, transmitter):
 		Thread.__init__(self)
-		self.socketFile = "/tmp/fail2ban.sock"
 		self.transmit = transmitter
 		self.isRunning = False
 		logSys.debug("Created SSocket")
 	
 	def initialize(self, force = False):
 		# Remove socket
-		if os.path.exists(self.socketFile):
+		if os.path.exists(SSocket.SOCKET_FILE):
 			logSys.error("Fail2ban seems to be already running")
 			if force:
 				logSys.warn("Forcing execution of the server")
-				os.remove(self.socketFile)
+				os.remove(SSocket.SOCKET_FILE)
 			else:
 				raise SSocketErrorException("Server already running")
 		# Create an INET, STREAMing socket
@@ -55,7 +57,7 @@ class SSocket(Thread):
 		self.ssock.setblocking(False)
 		# Bind the socket to a public host and a well-known port
 		#self.ssock.bind(("localhost", 2222))
-		self.ssock.bind(self.socketFile)
+		self.ssock.bind(SSocket.SOCKET_FILE)
 		# Become a server socket
 		self.ssock.listen(1)
 	
@@ -79,9 +81,9 @@ class SSocket(Thread):
 					stime = 1.0
 		self.ssock.close()
 		# Remove socket
-		if os.path.exists(self.socketFile):
-			logSys.debug("Removed socket file " + self.socketFile)
-			os.remove(self.socketFile)
+		if os.path.exists(SSocket.SOCKET_FILE):
+			logSys.debug("Removed socket file " + SSocket.SOCKET_FILE)
+			os.remove(SSocket.SOCKET_FILE)
 		logSys.debug("Socket shutdown")
 		return True
 	
@@ -96,11 +98,11 @@ class SSocket(Thread):
 	
 	def send(self, socket, msg):
 		obj = pickle.dumps(msg)
-		socket.send(obj + "<F2B_END_COMMAND>")
+		socket.send(obj + SSocket.END_STRING)
 	
 	def receive(self, socket):
 		msg = ''
-		while msg.rfind("<F2B_END_COMMAND>") == -1:
+		while msg.rfind(SSocket.END_STRING) == -1:
 			chunk = socket.recv(6)
 			if chunk == '':
 				raise RuntimeError, "socket connection broken"

From 9f2d90104029a08d8f2b95bb193c430128440865 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 28 Aug 2006 20:20:18 +0000
Subject: [PATCH 271/549] - Added a beautifier

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@310 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/beautifier.py | 90 ++++++++++++++++++++++++++++++++++++++++++++
 fail2ban-client      |  8 +++-
 2 files changed, 96 insertions(+), 2 deletions(-)
 create mode 100644 client/beautifier.py

diff --git a/client/beautifier.py b/client/beautifier.py
new file mode 100644
index 00000000..24c74095
--- /dev/null
+++ b/client/beautifier.py
@@ -0,0 +1,90 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 288 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 288 $"
+__date__ = "$Date: 2006-08-22 23:59:51 +0200 (Tue, 22 Aug 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from server.server import ServerUnknownJail
+from server.server import ServerDuplicateJail
+import logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.client.config")
+
+##
+# Beautify the output of the client.
+#
+# Fail2ban server only return unformatted return codes which need to be
+# converted into user readable messages.
+
+class Beautifier:
+	
+	def __init__(self, cmd = None):
+		self.inputCmd = cmd
+
+	def setInputCmd(self, cmd):
+		self.inputCmd = cmd
+		
+	def getInputCmd(self):
+		return self.inputCmd
+		
+	def beautify(self, response):
+		logSys.debug("Beautify " + `response` + " with " + `self.inputCmd`)
+		msg = response
+		if self.inputCmd[0:1] == ['status']:
+			if len(self.inputCmd) > 1:
+				msg = "Status for the jail: " + self.inputCmd[1] + "\n"
+				msg = msg + "|- " + response[0][0] + "\n"
+				msg = msg + "|  |- " + response[0][1][0][0] + ":\t\t" + `response[0][1][0][1]` + "\n"
+				msg = msg + "|  `- " + response[0][1][1][0] + ":\t\t" + `response[0][1][1][1]` + "\n"
+				msg = msg + "`- " + response[1][0] + "\n"
+				msg = msg + "   |- " + response[1][1][0][0] + ":\t\t" + `response[1][1][0][1]` + "\n"
+				msg = msg + "   `- " + response[1][1][1][0] + ":\t\t" + `response[1][1][1][1]`
+			else:
+				msg = "Status\n"
+				msg = msg + "|- " + response[0][0] + ":\t" + `response[0][1]` + "\n"
+				msg = msg + "`- " + response[1][0] + ":\t\t" + response[1][1]
+		elif self.inputCmd[1:2] == ['loglevel']:
+			msg = "Current logging level is "
+			if response == 1:
+				msg = msg + "ERROR"
+			elif response == 2:
+				msg = msg + "WARN"
+			elif response == 3:
+				msg = msg + "INFO"
+			elif response == 4:
+				msg = msg + "DEBUG"
+			else:
+				msg = msg + `response`
+		return msg
+
+	def beautifyError(self, response):
+		logSys.debug("Beautify (error) " + `response` + " with " + `self.inputCmd`)
+		msg = response
+		if isinstance(response, ServerUnknownJail):
+			msg = "Sorry but the jail '" + response[0] + "' does not exist"
+		elif isinstance(response, IndexError):
+			msg = "Sorry but the command is invalid"
+		elif isinstance(response, ServerDuplicateJail):
+			msg = "The jail '" + response[0] + "' already exists"
+		return msg
diff --git a/fail2ban-client b/fail2ban-client
index 0e7f159b..68fb6198 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -35,6 +35,7 @@ sys.path.insert(1, "/usr/lib/fail2ban")
 from version import version
 from client.csocket import CSocket
 from client.configurator import Configurator
+from client.beautifier import Beautifier
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.client")
@@ -115,7 +116,9 @@ class Fail2banClient:
 	
 	@staticmethod
 	def processCmd(cmd, showRet = True):
+		beautifier = Beautifier()
 		for c in cmd:
+			beautifier.setInputCmd(c)
 			try:
 				client = CSocket()
 			except Exception, e:
@@ -127,9 +130,10 @@ class Fail2banClient:
 			if ret[0] == 0:
 				logSys.debug("OK : " + `ret[1]`)
 				if showRet:
-					print `ret[1]`
+					print beautifier.beautify(ret[1])
 			else:
-				logSys.error("NOK: " + `ret[1].args`)
+				logSys.debug("NOK: " + `ret[1].args`)
+				print beautifier.beautifyError(ret[1])
 				return False
 		return True
 		

From 846a3d04779b4623913ce25cc8d1513dd56c68ed Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 28 Aug 2006 20:22:15 +0000
Subject: [PATCH 272/549] - Added a set/get for "failtime"

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@311 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/server.py      | 177 ++++++++++++++----------------------------
 server/transmitter.py |   8 +-
 2 files changed, 63 insertions(+), 122 deletions(-)

diff --git a/server/server.py b/server/server.py
index b4430252..96525a8a 100644
--- a/server/server.py
+++ b/server/server.py
@@ -62,7 +62,10 @@ class Server:
 		self.transm.stop()
 	
 	def addJail(self, name):
-		self.jails[name] = Jail(name)
+		if self.jails.has_key(name):
+			raise ServerDuplicateJail(name)
+		else:
+			self.jails[name] = Jail(name)
 		
 	def delJail(self, name):
 		if self.jails.has_key(name):
@@ -87,7 +90,19 @@ class Server:
 	def stopAllJail(self):
 		for jail in self.jails.copy():
 			self.stopJail(jail)
-			
+	
+	def getAction(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getAction()
+		else:
+			raise ServerUnknownJail(name)
+	
+	def getFilter(self, name):
+		if self.jails.has_key(name):
+			return self.jails[name].getFilter()
+		else:
+			raise ServerUnknownJail(name)
+	
 	def isActive(self, name):
 		if self.jails.has_key(name):
 			return self.jails[name].isActive()
@@ -113,179 +128,98 @@ class Server:
 			self.jails[name].getFilter().setLogPath(file)
 	
 	def getLogPath(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getFilter().getLogPath()
-		else:
-			raise ServerUnknownJail(name)
+		return self.getFilter(name).getLogPath()
 	
 	def setTimeRegex(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getFilter().setTimeRegex(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.getFilter(name).setTimeRegex(value)
 	
 	def getTimeRegex(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getFilter().getTimeRegex()
-		else:
-			raise ServerUnknownJail(name)
-	
+		return self.getFilter(name).getTimeRegex()
+
 	def setTimePattern(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getFilter().setTimePattern(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.getFilter(name).setTimePattern(value)
 	
 	def getTimePattern(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getFilter().getTimePattern()
-		else:
-			raise ServerUnknownJail(name)
+		return self.getFilter(name).getTimePattern()
+	
+	def setFindTime(self, name, value):
+		self.getFilter(name).setFindTime(value)
+	
+	def getFindTime(self):
+		return self.getFilter(name).getFindTime()
 
 	def setFailRegex(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getFilter().setFailRegex(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.getFilter(name).setFailRegex(value)
 	
 	def getFailRegex(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getFilter().getFailRegex()
-		else:
-			raise ServerUnknownJail(name)
+		return self.getFilter(name).getFailRegex()
 	
 	def setMaxRetry(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getFilter().setMaxRetry(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.getFilter(name).setMaxRetry(value)
 	
 	def getMaxRetry(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getFilter().getMaxRetry()
-		else:
-			raise ServerUnknownJail(name)
+		return self.getFilter(name).getMaxRetry()
 	
 	def setMaxTime(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getFilter().setMaxTime(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.getFilter(name).setMaxTime(value)
 	
 	def getMaxTime(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getFilter().getMaxTime()
-		else:
-			raise ServerUnknownJail(name)
+		return self.getFilter(name).getMaxTime()
 	
 	# Action
 	def addAction(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().addAction(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.getAction(name).addAction(value)
 	
 	def getLastAction(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getLastAction()
-		else:
-			raise ServerUnknownJail(name)
+		return self.getAction(name).getLastAction()
 	
 	def delAction(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().delAction(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.getAction(name).delAction(value)
 	
 	def setCInfo(self, name, action, key, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().getAction(action).setCInfo(key, value)
-		else:
-			raise ServerUnknownJail(name)
+		self.getAction(name).getAction(action).setCInfo(key, value)
 	
 	def getCInfo(self, name, action, key):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getAction(action).getCInfo(key)
-		else:
-			raise ServerUnknownJail(name)
+		return self.getAction(name).getAction(action).getCInfo(key)
 	
 	def delCInfo(self, name, action, key):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().getAction(action).delCInfo(key)
-		else:
-			raise ServerUnknownJail(name)
+		self.getAction(name).getAction(action).delCInfo(key)
 	
 	def setBanTime(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().setBanTime(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.getAction(name).setBanTime(value)
 	
 	def getBanTime(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getBanTime()
-		else:
-			raise ServerUnknownJail(name)
+		return self.getAction(name).getBanTime()
 	
 	def setActionStart(self, name, action, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().getAction(action).setActionStart(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.getAction(name).getAction(action).setActionStart(value)
 	
 	def getActionStart(self, name, action):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getAction(action).getActionStart()
-		else:
-			raise ServerUnknownJail(name)
+		return self.getAction(name).getAction(action).getActionStart()
 		
 	def setActionStop(self, name, action, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().getAction(action).setActionStop(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.getAction(name).getAction(action).setActionStop(value)
 	
 	def getActionStop(self, name, action):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getAction(action).getActionStop()
-		else:
-			raise ServerUnknownJail(name)
+		return self.getAction(name).getAction(action).getActionStop()
 	
 	def setActionCheck(self, name, action, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().getAction(action).setActionCheck(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.getAction(name).getAction(action).setActionCheck(value)
 	
 	def getActionCheck(self, name, action):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getAction(action).getActionCheck()
-		else:
-			raise ServerUnknownJail(name)
+		return self.getAction(name).getAction(action).getActionCheck()
 	
 	def setActionBan(self, name, action, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().getAction(action).setActionBan(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.getAction(name).getAction(action).setActionBan(value)
 	
 	def getActionBan(self, name, action):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getAction(action).getActionBan()
-		else:
-			raise ServerUnknownJail(name)
+		return self.getAction(name).getAction(action).getActionBan()
 	
 	def setActionUnban(self, name, action, value):
-		if self.jails.has_key(name):
-			self.jails[name].getAction().getAction(action).setActionUnban(value)
-		else:
-			raise ServerUnknownJail(name)
+		self.getAction(name).getAction(action).setActionUnban(value)
 	
 	def getActionUnban(self, name, action):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction().getAction(action).getActionUnban()
-		else:
-			raise ServerUnknownJail(name)
+		return self.getAction(name).getAction(action).getActionUnban()
 		
 	# Status
 	def status(self):
@@ -295,7 +229,7 @@ class Server:
 		length = len(jailList)
 		if not length == 0:
 			jailList = jailList[:length-2]
-		ret = [("Number of jail", len(self.jails)),
+		ret = [("Number of jail", len(self.jails)), 
 			   ("Jail list", jailList)]
 		return ret
 	
@@ -439,6 +373,9 @@ class Server:
 		return True
 
 
+class ServerDuplicateJail(Exception):
+	pass
+
 class ServerUnknownJail(Exception):
 	pass
 
diff --git a/server/transmitter.py b/server/transmitter.py
index 6b1de4aa..1bdff67f 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -149,6 +149,10 @@ class Transmitter:
 			value = action[2]
 			self.server.setMaxTime(name, int(value))
 			return self.server.getMaxTime(name)
+		elif action[1] == "findtime":
+			value = action[2]
+			self.server.setFindTime(name, int(value))
+			return self.server.getFindTime(name)
 		elif action[1] == "maxretry":
 			value = action[2]
 			self.server.setMaxRetry(name, int(value))
@@ -201,7 +205,7 @@ class Transmitter:
 			value = action[3]
 			self.server.setActionUnban(name, act, value)
 			return self.server.getActionUnban(name, act)
-		raise Exception("Invalid command (no set action)")
+		raise Exception("Invalid command (no set action or not yet implemented)")
 	
 	def actionGet(self, action):
 		name = action[0]
@@ -211,7 +215,7 @@ class Transmitter:
 		# Filter
 		if action[1] == "logpath":
 			return self.server.getLogPath(name)
-		raise Exception("Invalid command (no get action)")
+		raise Exception("Invalid command (no get action or not yet implemented)")
 	
 	def status(self, action):
 		if len(action) == 0:

From db868e49993905ad47474e88f811d842506af4d2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 28 Aug 2006 20:22:58 +0000
Subject: [PATCH 273/549] - Added beautifier.py

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@312 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MANIFEST b/MANIFEST
index e57a528f..9473e4a5 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -4,6 +4,7 @@ TODO
 fail2ban-client
 fail2ban-server
 fail2ban-testcases
+client/beautifier.py
 client/configreader.py
 client/jailreader.py
 client/fail2banreader.py

From b13379d7f8464602d1cc28ed385b3bbb7dceaa7a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 28 Aug 2006 20:23:46 +0000
Subject: [PATCH 274/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@313 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG |  7 ++++++-
 TODO      | 19 ++++---------------
 2 files changed, 10 insertions(+), 16 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 762504b5..d4c8de35 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,14 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.1)                           2006/08/23
+Fail2Ban (version 0.7.2)                           2006/??/??
 =============================================================
 
+ver. 0.7.2 (2006/??/??) - ???
+----------
+- Refactoring and code cleanup
+- Improved client output
+
 ver. 0.7.1 (2006/08/23) - alpha
 ----------
 - Fixed daemon mode bug
diff --git a/TODO b/TODO
index 8add3074..4191a063 100644
--- a/TODO
+++ b/TODO
@@ -13,11 +13,13 @@ Legend:
 # partially done
 * done
 
+# implement all get/set functions
+
 - correct handling of threads (join???)
 
 - signal handling (ctrl-c, etc)
 
-- add a reload option to fail2ban-client
+* add a reload option to fail2ban-client
 
 - see Feature Request Tracking System at SourceForge.net
 
@@ -38,19 +40,6 @@ Legend:
 - add a check to see if the time of the log messages is
   correctly detected (valid regexp)
 
-? use Gentoo Portage style for scripts.
-  - banning engines script in /etc/fail2ban/scripts.d
-    Example: /etc/fail2ban/scripts.d/iptables
-    Will be mostly bash scripting which is more "user
-    friendly".
-  - split configuration files in /etc/fail2ban/services.d
-    for log files
-    Example: /etc/fail2ban/services.d/apache
-    Mainly regular expressions.
-  - template for common regex in /etc/fail2ban/templates.d
-    Example: /etc/fail2ban/templates.d/date
-    Mainly regular expressions.
-
 * remove debug mode (root check)
 
 # better return values in function
@@ -108,7 +97,7 @@ Legend:
   format and sort them using the hit ratio. Should avoid
   user problem with regex and not have a big impact on perfs.
 
-- restart automatically the daemon if an exception occurs.
+? restart automatically the daemon if an exception occurs.
 
 - do not close socket after a send
 

From 5a3edcb61947a3324650bcbb7a86f8241023a05c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 28 Aug 2006 21:33:54 +0000
Subject: [PATCH 275/549] - Fixed bug with dispUsage()

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@314 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fail2ban-client b/fail2ban-client
index 68fb6198..098c32b8 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -149,7 +149,7 @@ class Fail2banClient:
 			self.dumpConfig(self.stream)
 			return True
 		
-		if len(sys.argv) < 2:
+		if len(cmd) < 1:
 			self.dispUsage()
 			return False
 		
@@ -231,6 +231,7 @@ class Fail2banClient:
 			optList, args = getopt.getopt(self.argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
 			self.dispUsage()
+			return False
 			
 		self.getCmdLineOptions(optList)
 		

From ab133f9364c028ab6124f99129541740d3ad9086 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 28 Aug 2006 21:37:39 +0000
Subject: [PATCH 276/549] - Added more get commands

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@315 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/transmitter.py | 35 +++++++++++++++++++++++++++++++++--
 1 file changed, 33 insertions(+), 2 deletions(-)

diff --git a/server/transmitter.py b/server/transmitter.py
index 1bdff67f..2415cf73 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -212,9 +212,40 @@ class Transmitter:
 		# Logging
 		if name == "loglevel":
 			return self.server.getLogLevel()
-		# Filter
-		if action[1] == "logpath":
+		elif action[1] == "logpath":
 			return self.server.getLogPath(name)
+		elif action[1] == "timeregex":
+			return self.server.getTimeRegex(name)
+		elif action[1] == "timepattern":
+			return self.server.getTimePattern(name)
+		elif action[1] == "failregex":
+			return self.server.getFailRegex(name)
+		elif action[1] == "maxtime":
+			return self.server.getMaxTime(name)
+		elif action[1] == "findtime":
+			return self.server.getFindTime(name)
+		elif action[1] == "maxretry":
+			return self.server.getMaxRetry(name)
+		# Filter
+		elif action[1] == "bantime":
+			return self.server.getBanTime(name)
+		elif action[1] == "addaction":
+			return self.server.getLastAction(name).getName()
+		elif action[1] == "actionstart":
+			act = action[2]
+			return self.server.getActionStart(name, act)
+		elif action[1] == "actionstop":
+			act = action[2]
+			return self.server.getActionStop(name, act)
+		elif action[1] == "actioncheck":
+			act = action[2]
+			return self.server.getActionCheck(name, act)
+		elif action[1] == "actionban":
+			act = action[2]
+			return self.server.getActionBan(name, act)
+		elif action[1] == "actionunban":
+			act = action[2]
+			return self.server.getActionUnban(name, act)
 		raise Exception("Invalid command (no get action or not yet implemented)")
 	
 	def status(self, action):

From 511d9a75399cf9b4f1658b7c54ec1c0ffd1d8b43 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 28 Aug 2006 21:39:12 +0000
Subject: [PATCH 277/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@316 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG b/CHANGELOG
index d4c8de35..432e51ee 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -11,6 +11,7 @@ ver. 0.7.2 (2006/??/??) - ???
 ----------
 - Refactoring and code cleanup
 - Improved client output
+- Added more get/set commands
 
 ver. 0.7.1 (2006/08/23) - alpha
 ----------

From 131a0a9cb3a5984700a9d35f3dfc79a298215f2d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 30 Aug 2006 22:16:52 +0000
Subject: [PATCH 278/549] - Added a couriersmtpd filter

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@317 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                        |  1 +
 config/filter.d/couriersmtp.conf | 42 ++++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+)
 create mode 100644 config/filter.d/couriersmtp.conf

diff --git a/CHANGELOG b/CHANGELOG
index 432e51ee..bf636128 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -12,6 +12,7 @@ ver. 0.7.2 (2006/??/??) - ???
 - Refactoring and code cleanup
 - Improved client output
 - Added more get/set commands
+- Added more configuration templates
 
 ver. 0.7.1 (2006/08/23) - alpha
 ----------
diff --git a/config/filter.d/couriersmtp.conf b/config/filter.d/couriersmtp.conf
new file mode 100644
index 00000000..ec35528b
--- /dev/null
+++ b/config/filter.d/couriersmtp.conf
@@ -0,0 +1,42 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 267 $
+#
+
+[Definition]
+
+# Option:  maxretry
+# Notes.:  number of failures before IP gets banned.
+# Values:  NUM  Default:  5
+#
+maxretry = 5
+
+# Option:  logpath
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/messages
+#
+logpath = /var/log/messages
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in the logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
+# Values:  [Mar  7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
+# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile.
+# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
+#
+failregex = error,relay=(?:::f{4,6}:)?(?P<host>\S*),.*550 User unknown

From 6456676d355bd6346fcb1e662875bcd061aeb0fb Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 30 Aug 2006 22:17:49 +0000
Subject: [PATCH 279/549] - Added a couriersmtpd filter

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@318 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MANIFEST b/MANIFEST
index 9473e4a5..bb31b743 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -44,6 +44,7 @@ config/jail.conf
 config/filter.d/vsftpd.conf
 config/filter.d/apache-auth.conf
 config/filter.d/sshd.conf
+config/filter.d/couriersmtp.conf
 config/action.d/iptables.conf
 config/action.d/mail-whois.conf
 config/action.d/dummy.conf

From 761d50610e4d6fbd592910ec1090df12464cc5ae Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 4 Sep 2006 19:16:44 +0000
Subject: [PATCH 280/549] - Added "stop" beautifier

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@319 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/beautifier.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/client/beautifier.py b/client/beautifier.py
index 24c74095..c2443e8d 100644
--- a/client/beautifier.py
+++ b/client/beautifier.py
@@ -76,6 +76,9 @@ class Beautifier:
 				msg = msg + "DEBUG"
 			else:
 				msg = msg + `response`
+		elif self.inputCmd == ["stop"]:
+			if response == None:
+				msg = "Shutdown successful"
 		return msg
 
 	def beautifyError(self, response):

From f1f12518c8d2c3b332c3be74a826ba431cbe1ac9 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 4 Sep 2006 19:18:57 +0000
Subject: [PATCH 281/549] - Moved "logpath" and "maxtime" to "jail.conf"

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@320 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/filterreader.py           | 17 ++++-------------
 client/jailreader.py             | 10 ++++++++--
 config/filter.d/apache-auth.conf | 12 ------------
 config/filter.d/couriersmtp.conf | 12 ------------
 config/filter.d/sshd.conf        | 12 ------------
 config/filter.d/vsftpd.conf      | 12 ------------
 config/jail.conf                 |  1 +
 7 files changed, 13 insertions(+), 63 deletions(-)

diff --git a/client/filterreader.py b/client/filterreader.py
index 1e2b28a9..f8384d2f 100644
--- a/client/filterreader.py
+++ b/client/filterreader.py
@@ -53,28 +53,19 @@ class FilterReader(ConfigReader):
 		ConfigReader.read(self, "filter.d/" + self.file)
 	
 	def getOptions(self, pOpts):
-		opts = [["string", "logpath", "/var/log/sshd.log"],
-				["string", "timeregex", ""],
+		opts = [["string", "timeregex", ""],
 				["string", "timepattern", ""],
-				["string", "failregex", ""],
-				["int", "maxtime", 600],
-				["int", "maxretry", 3]]
+				["string", "failregex", ""]]
 		self.opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
 	
 	def convert(self):
 		stream = list()
 		for opt in self.opts:
-			if opt == "logpath":
-				stream.append(["set", self.name, "logpath", self.opts[opt]])
-			elif opt == "timeregex":
+			if opt == "timeregex":
 				stream.append(["set", self.name, "timeregex", self.opts[opt]])
 			elif opt == "timepattern":
 				stream.append(["set", self.name, "timepattern", self.opts[opt]])
 			elif opt == "failregex":
-				stream.append(["set", self.name, "failregex", self.opts[opt]])
-			elif opt == "maxtime":
-				stream.append(["set", self.name, "maxtime", self.opts[opt]])
-			elif opt == "maxretry":
-				stream.append(["set", self.name, "maxretry", self.opts[opt]])
+				stream.append(["set", self.name, "failregex", self.opts[opt]])		
 		return stream
 		
\ No newline at end of file
diff --git a/client/jailreader.py b/client/jailreader.py
index 6bd712a2..3483582a 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -56,7 +56,9 @@ class JailReader(ConfigReader):
 	
 	def getOptions(self):
 		opts = [["bool", "enabled", "false"],
-				["int", "maxretry", None],
+				["string", "logpath", "/var/log/messages"],
+				["int", "maxretry", 3],
+				["int", "maxtime", 600],
 				["int", "bantime", 600],
 				["string", "filter", ""],
 				["string", "action", ""]]
@@ -83,8 +85,12 @@ class JailReader(ConfigReader):
 	def convert(self):
 		stream = [["add", self.name]]
 		for opt in self.opts:
-			if opt == "maxretry":
+			if opt == "logpath":
+				stream.append(["set", self.name, "logpath", self.opts[opt]])
+			elif opt == "maxretry":
 				stream.append(["set", self.name, "maxretry", self.opts[opt]])
+			elif opt == "maxtime":
+				stream.append(["set", self.name, "maxtime", self.opts[opt]])
 			elif opt == "bantime":
 				stream.append(["set", self.name, "bantime", self.opts[opt]])
 		stream.extend(self.filter.convert())
diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 3bd2c0f8..479f3ae8 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -7,18 +7,6 @@
 
 [Definition]
 
-# Option:  maxretry
-# Notes.:  number of failures before IP gets banned.
-# Values:  NUM  Default:  5
-#
-maxretry = 5
-
-# Option:  logfile
-# Notes.:  logfile to monitor.
-# Values:  FILE  Default:  /var/log/httpd/access_log
-#
-logfile = /var/log/httpd/access_log
-
 # Option:  timeregex
 # Notes.:  regex to match timestamp in Apache logfile. For TAI64N format,
 #          use timeregex = @[0-9a-f]{24}
diff --git a/config/filter.d/couriersmtp.conf b/config/filter.d/couriersmtp.conf
index ec35528b..4b54bca3 100644
--- a/config/filter.d/couriersmtp.conf
+++ b/config/filter.d/couriersmtp.conf
@@ -7,18 +7,6 @@
 
 [Definition]
 
-# Option:  maxretry
-# Notes.:  number of failures before IP gets banned.
-# Values:  NUM  Default:  5
-#
-maxretry = 5
-
-# Option:  logpath
-# Notes.:  logfile to monitor.
-# Values:  FILE  Default:  /var/log/messages
-#
-logpath = /var/log/messages
-
 # Option:  timeregex
 # Notes.:  regex to match timestamp in the logfile. For TAI64N format,
 #          use timeregex = @[0-9a-f]{24}
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 67870017..bfa2306f 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -7,18 +7,6 @@
 
 [Definition]
 
-# Option:  maxretry
-# Notes.:  number of failures before IP gets banned.
-# Values:  NUM  Default:  5
-#
-maxretry = 5
-
-# Option:  logpath
-# Notes.:  logfile to monitor.
-# Values:  FILE  Default:  /var/log/secure
-#
-logpath = /var/log/secure
-
 # Option:  timeregex
 # Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
 #          use timeregex = @[0-9a-f]{24}
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index 1d759b41..d35f9279 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -7,18 +7,6 @@
 
 [Definition]
 
-# Option:  maxretry
-# Notes.:  number of failures before IP gets banned.
-# Values:  NUM  Default:  5
-#
-maxretry = 5
-
-# Option: logfile
-# Notes.: logfile to monitor.
-# Values: FILE Default: /var/log/vsftpd.log
-#
-logfile = /var/log/vsftpd.log
-
 # Option: timeregex
 # Notes.: regex to match timestamp in VSFTPD logfile.
 # Values: [Mar 7 17:53:28]
diff --git a/config/jail.conf b/config/jail.conf
index c8b94c0b..dab9d671 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -11,5 +11,6 @@ enabled = false
 filter = sshd
 action = hostsdeny[file=/tmp/hosts.deny]
          mail[name=SSH, dest=cyril.jaquier@bluewin.ch]
+logpath = /home/cyril/workspace/fail2ban-unstable/testcases/files/testcase01.log
 maxretry = 2
 bantime = 10

From 88ef30c4c52819eae17773a58845284d2591b667 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 4 Sep 2006 19:19:58 +0000
Subject: [PATCH 282/549] - Removed unneeded constructor arguments

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@321 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/jail.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/jail.py b/server/jail.py
index 906cab02..1c77ca6c 100644
--- a/server/jail.py
+++ b/server/jail.py
@@ -31,7 +31,7 @@ import Queue
 
 class Jail:
 	
-	def __init__(self, name, filter = None, action = None):
+	def __init__(self, name):
 		self.name = name
 		self.queue = Queue.Queue()
 		self.filter = Filter(self)

From f880d1ff26c6fb16bc8300d85f418e1b6d6fc637 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 4 Sep 2006 19:20:44 +0000
Subject: [PATCH 283/549] - Added interactive mode

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@322 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 54 ++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 42 insertions(+), 12 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 098c32b8..a76db1e2 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -25,7 +25,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import sys, string, os, pickle, re, logging, getopt, time
+import sys, string, os, pickle, re, logging, getopt, time, readline, shlex
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
@@ -46,6 +46,8 @@ logSys = logging.getLogger("fail2ban.client")
 
 class Fail2banClient:
 
+	prompt = "fail2ban> "
+
 	def __init__(self):
 		self.argv = None
 		self.stream = None
@@ -54,6 +56,7 @@ class Fail2banClient:
 		self.conf["dump"] = False
 		self.conf["force"] = False
 		self.conf["verbose"] = 2
+		self.conf["interactive"] = False
 	
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
@@ -93,6 +96,11 @@ class Fail2banClient:
 		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	
+	def dispInteractive(self):
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+		print 
+	
 	def getCmdLineOptions(self, optList):
 		""" Gets the command line options
 		"""
@@ -107,6 +115,8 @@ class Fail2banClient:
 				self.conf["verbose"] = self.conf["verbose"] - 1
 			elif opt[0] == "-x":
 				self.conf["force"] = True
+			elif opt[0] == "-i":
+				self.conf["interactive"] = True
 			elif opt[0] in ["-h", "--help"]:
 	 			self.dispUsage()
 	 			sys.exit(0)
@@ -144,15 +154,6 @@ class Fail2banClient:
 	# @param cmd the command line
 
 	def processCommand(self, cmd):
-		if self.conf["dump"]:
-			self.readConfig()
-			self.dumpConfig(self.stream)
-			return True
-		
-		if len(cmd) < 1:
-			self.dispUsage()
-			return False
-		
 		if len(cmd) == 1 and cmd[0] == "start":
 			if self.ping():
 				logSys.info("Server already running")
@@ -226,7 +227,7 @@ class Fail2banClient:
 		
 		# Reads the command line options.
 		try:
-			cmdOpts = 'hc:xdvq'
+			cmdOpts = 'hc:xdviq'
 			cmdLongOpts = ['help']
 			optList, args = getopt.getopt(self.argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
@@ -252,7 +253,36 @@ class Fail2banClient:
 		stdout.setFormatter(formatter)
 		logSys.addHandler(stdout)
 
-		return self.processCommand(args)
+		if self.conf["dump"]:
+			self.readConfig()
+			self.dumpConfig(self.stream)
+			return True
+		
+		# Interactive mode
+		if self.conf["interactive"]:
+			try:
+				ret = True
+				if len(args) > 0:
+					ret = self.processCommand(args)
+				if ret:
+					readline.parse_and_bind("tab: complete")
+					self.dispInteractive()
+					while True:
+						cmd = raw_input(self.prompt)
+						if cmd == "exit" or cmd == "quit":
+							# Exit
+							return True
+						if not cmd == "":
+							self.processCommand(shlex.split(cmd))
+			except (EOFError, KeyboardInterrupt):
+				print
+				return True
+		# Single command mode
+		else:
+			if len(args) < 1:
+				self.dispUsage()
+				return False
+			return self.processCommand(args)
 
 	def readConfig(self):
 		# Read the configuration

From 82f062ff24f7d80d452aafe10ae64ac4864483af Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 4 Sep 2006 19:21:01 +0000
Subject: [PATCH 284/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@323 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 5 ++++-
 TODO      | 4 +++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index bf636128..e03bfea0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -13,6 +13,9 @@ ver. 0.7.2 (2006/??/??) - ???
 - Improved client output
 - Added more get/set commands
 - Added more configuration templates
+- Removed "logpath" and "maxretry" from filter templates.
+  They must be defined in jail.conf now
+- Added interactive mode. Use "-i"
 
 ver. 0.7.1 (2006/08/23) - alpha
 ----------
@@ -50,7 +53,7 @@ ver. 0.6.1 (2006/03/16) - stable
 - Added parsing of timestamp in TAI64N format (#1275325).
   Thanks to Mark Edgington
 - Added patch #1382936 (Default formatted syslog logging).
-  Thanks to Patrick Börjesson
+  Thanks to Patrick B�rjesson
 - Removed 192.168.0.0/16 from ignoreip. Attacks could also
   come from the local network.
 - Robust startup: if iptables module does not get fully
diff --git a/TODO b/TODO
index 4191a063..5e9be5e0 100644
--- a/TODO
+++ b/TODO
@@ -13,6 +13,8 @@ Legend:
 # partially done
 * done
 
+- Is there a do...while loop in Python? For interactive mode
+
 # implement all get/set functions
 
 - correct handling of threads (join???)
@@ -101,4 +103,4 @@ Legend:
 
 - do not close socket after a send
 
-- refactoring in server.py, actions.py, filter.py
+# refactoring in server.py, actions.py, filter.py

From 8c2406f2880651756b088aa023eab8ea5304174a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 5 Sep 2006 20:55:38 +0000
Subject: [PATCH 285/549] - Changed version to "0.7.1-SVN"

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@324 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.py b/version.py
index 86aafaf3..0181c320 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.1"
+version = "0.7.1-SVN"

From 21b6e76cde81fa2776a5aac7fc2311af66cfb5cc Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 5 Sep 2006 21:16:28 +0000
Subject: [PATCH 286/549] - Added date detector

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@325 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                        |  2 +
 client/filterreader.py           |  4 +-
 config/filter.d/apache-auth.conf | 16 ------
 config/filter.d/couriersmtp.conf | 16 ------
 config/filter.d/sshd.conf        | 16 ------
 config/filter.d/vsftpd.conf      | 14 -----
 fail2ban-testcases               |  3 ++
 server/filter.py                 | 92 ++++++--------------------------
 8 files changed, 23 insertions(+), 140 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index e03bfea0..81e42b7c 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -16,6 +16,8 @@ ver. 0.7.2 (2006/??/??) - ???
 - Removed "logpath" and "maxretry" from filter templates.
   They must be defined in jail.conf now
 - Added interactive mode. Use "-i"
+- Added a date detector. "timeregex" and "timepattern" are no
+  more needed
 
 ver. 0.7.1 (2006/08/23) - alpha
 ----------
diff --git a/client/filterreader.py b/client/filterreader.py
index f8384d2f..fbf3146f 100644
--- a/client/filterreader.py
+++ b/client/filterreader.py
@@ -53,8 +53,8 @@ class FilterReader(ConfigReader):
 		ConfigReader.read(self, "filter.d/" + self.file)
 	
 	def getOptions(self, pOpts):
-		opts = [["string", "timeregex", ""],
-				["string", "timepattern", ""],
+		opts = [["string", "timeregex", None],
+				["string", "timepattern", None],
 				["string", "failregex", ""]]
 		self.opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
 	
diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 479f3ae8..b4d5bb94 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -7,22 +7,6 @@
 
 [Definition]
 
-# Option:  timeregex
-# Notes.:  regex to match timestamp in Apache logfile. For TAI64N format,
-#          use timeregex = @[0-9a-f]{24}
-# Values:  [Wed Jan 05 15:08:01 2005]
-# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
-#
-timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
-
-# Option:  timepattern
-# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
-#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
-#          For TAI64N format, use timepattern = tai64n
-# Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
-#
-timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
-
 # Option:  failregex
 # Notes.:  regex to match the password failure messages in the logfile.
 # Values:  TEXT  Default:  authentication failure|user .* not found
diff --git a/config/filter.d/couriersmtp.conf b/config/filter.d/couriersmtp.conf
index 4b54bca3..0a57373f 100644
--- a/config/filter.d/couriersmtp.conf
+++ b/config/filter.d/couriersmtp.conf
@@ -7,22 +7,6 @@
 
 [Definition]
 
-# Option:  timeregex
-# Notes.:  regex to match timestamp in the logfile. For TAI64N format,
-#          use timeregex = @[0-9a-f]{24}
-# Values:  [Mar  7 17:53:28]
-# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-#
-timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-
-# Option:  timepattern
-# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
-#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
-#          For TAI64N format, use timepattern = tai64n
-# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
-#
-timepattern = %%b %%d %%H:%%M:%%S
-
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile.
 # Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index bfa2306f..88b4cc50 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -7,22 +7,6 @@
 
 [Definition]
 
-# Option:  timeregex
-# Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
-#          use timeregex = @[0-9a-f]{24}
-# Values:  [Mar  7 17:53:28]
-# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-#
-timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-
-# Option:  timepattern
-# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
-#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
-#          For TAI64N format, use timepattern = tai64n
-# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
-#
-timepattern = %%b %%d %%H:%%M:%%S
-
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile.
 # Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index d35f9279..f1c82be2 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -7,20 +7,6 @@
 
 [Definition]
 
-# Option: timeregex
-# Notes.: regex to match timestamp in VSFTPD logfile.
-# Values: [Mar 7 17:53:28]
-# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-#
-timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
-
-# Option: timepattern
-# Notes.: format used in "timeregex" fields definition. Note that '%' must be
-# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
-# Values: TEXT Default: %%b %%d %%H:%%M:%%S
-#
-timepattern = %%b %%d %%H:%%M:%%S
-
 # Option: failregex
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT Default: Authentication failure|Failed password|Invalid user
diff --git a/fail2ban-testcases b/fail2ban-testcases
index bed875cd..309ada27 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -38,6 +38,7 @@ from testcases import clientreadertestcase
 from testcases import failmanagertestcase
 from testcases import filtertestcase
 from testcases import servertestcase
+from testcases import datedetectortestcase
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban")
@@ -63,6 +64,8 @@ tests.addTest(unittest.makeSuite(failmanagertestcase.AddFailure))
 tests.addTest(unittest.makeSuite(banmanagertestcase.AddFailure))
 # ClientReader
 tests.addTest(unittest.makeSuite(clientreadertestcase.JailReaderTest))
+# DateDetector
+tests.addTest(unittest.makeSuite(datedetectortestcase.DateDetectorTest))
 
 # Tests runner
 testRunner = unittest.TextTestRunner()
diff --git a/server/filter.py b/server/filter.py
index 3a004f61..7a1fd776 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -28,6 +28,8 @@ from failmanager import FailManager
 from failmanager import FailManagerEmpty
 from failticket import FailTicket
 from jailthread import JailThread
+from datedetector import DateDetector
+
 import time, logging, os, re, sys, socket
 
 # Gets the instance of the logger.
@@ -58,11 +60,6 @@ class Filter(JailThread):
 		self.fileHandler = None
 		## The log file path.
 		self.logPath = ''
-		## The regular expression matching the date.
-		self.timeRegex = ''
-		self.timeRegexObj = None
-		## The pattern matching the date.
-		self.timePattern = ''
 		## The regular expression matching the failure.
 		self.failRegex = ''
 		self.failRegexObj = None
@@ -78,6 +75,8 @@ class Filter(JailThread):
 		self.lastDate = 0
 		## The file statistics.
 		self.logStats = None
+		self.dateDetector = DateDetector()
+		self.dateDetector.addDefaultTemplate()
 		logSys.info("Created Filter")
 
 	##
@@ -103,9 +102,8 @@ class Filter(JailThread):
 	# @param value the regular expression
 	
 	def setTimeRegex(self, value):
-		self.timeRegex = value
-		self.timeRegexObj = re.compile(value)
-		logSys.info("Set timeregex = %s" % value)
+		self.dateDetector.setDefaultRegex(value)
+		logSys.info("Set default regex = %s" % value)
 	
 	##
 	# Get the regular expression which matches the time.
@@ -113,7 +111,7 @@ class Filter(JailThread):
 	# @return the regular expression
 		
 	def getTimeRegex(self):
-		return self.timeRegex
+		return self.dateDetector.getDefaultRegex()
 	
 	##
 	# Set the time pattern.
@@ -121,8 +119,8 @@ class Filter(JailThread):
 	# @param value the time pattern
 	
 	def setTimePattern(self, value):
-		self.timePattern = value
-		logSys.info("Set timepattern = %s" % value)
+		self.dateDetector.setDefaultPattern(value)
+		logSys.info("Set default pattern = %s" % value)
 	
 	##
 	# Get the time pattern.
@@ -130,7 +128,7 @@ class Filter(JailThread):
 	# @return the time pattern
 	
 	def getTimePattern(self):
-		return self.timePattern
+		return self.dateDetector.getDefaultPattern()
 	
 	##
 	# Set the regular expression which matches the failure.
@@ -309,9 +307,9 @@ class Filter(JailThread):
 	
 	def setFilePos(self):
 		line = self.fileHandler.readline()
-		if self.lastDate < self.getTime(line):
+		if self.lastDate < self.dateDetector.getTime(line):
 			logSys.debug("Date " + `self.lastDate` + " is " + "smaller than " +
-							`self.getTime(line)`)
+							`self.dateDetector.getTime(line)`)
 			logSys.debug("Log rotation detected for " + self.logPath)
 			self.lastPos = 0
 		
@@ -344,7 +342,7 @@ class Filter(JailThread):
 				line = line.decode('utf-8').encode('latin-1')
 			except UnicodeDecodeError:
 				pass
-			if not self.hasTime(line):
+			if not self.dateDetector.matchTime(line):
 				# There is no valid time in this line
 				continue
 			lastLine = line
@@ -360,7 +358,7 @@ class Filter(JailThread):
 				self.failManager.addFailure(FailTicket(ip, unixTime))
 		self.lastPos = self.getFilePos()
 		if lastLine:
-			self.lastDate = self.getTime(lastLine)
+			self.lastDate = self.dateDetector.getTime(lastLine)
 		self.closeLogFile()
 
 	##
@@ -374,9 +372,8 @@ class Filter(JailThread):
 		failList = list()
 		match = self.failRegexObj.search(line)
 		if match:
-			timeMatch = self.timeRegexObj.search(match.string)
-			if timeMatch:
-				date = self.getUnixTime(timeMatch.group())
+			date = self.dateDetector.getUnixTime(match.string)
+			if date <> None:
 				try:
 					ipMatch = DNSUtils.textToIp(match.group("host"))
 					if ipMatch:
@@ -387,63 +384,6 @@ class Filter(JailThread):
 								 "Please correct your configuration.")
 		return failList
 	
-	##
-	# Check is a line contains a valid date.
-	#
-	# @param line the line
-	# @return True if the line contains a valid date
-	
-	def hasTime(self, line):
-		timeMatch = re.search(self.timeRegex, line)
-		if timeMatch:
-			return True
-		else:
-			return False
-
-	##
-	# Get the time of a log line.
-	#
-	# @param line the line
-	# @return the timestamp of the log line
-	
-	def getTime(self, line):
-		date = 0
-		timeMatch = re.search(self.timeRegex, line)
-		if timeMatch:
-			date = self.getUnixTime(timeMatch.group())
-		return date
-
-	##
-	# Get the Unix timestamp.
-	#
-	# Get the Unix timestamp of a given date. Pattern should describe the
-	# date construction of value.
-	# @param value the date
-	# @return the Unix timestamp
-		
-	def getUnixTime(self, value):
-		try:
-			# Check if the parsed value is in TAI64N format
-			if not self.timePattern.lower() == "tai64n":
-				date = list(time.strptime(value, self.timePattern))
-			else:
-				# extract part of format which represents seconds since epoch
-				seconds_since_epoch = value[2:17]
-				date = list(time.gmtime(int(seconds_since_epoch, 16)))
-		except ValueError, e:
-			logSys.error(e)
-			logSys.error("Please check the format and your locale settings.")
-			return None
-		if date[0] < 2000:
-			# There is probably no year field in the logs
-			date[0] = time.gmtime()[0]
-			# Bug fix for #1241756
-			# If the date is greater than the current time, we suppose
-			# that the log is not from this year but from the year before
-			if time.mktime(date) > time.time():
-				date[0] -= 1
-		unixTime = time.mktime(date)
-		return unixTime
 
 	##
 	# Get the status of the filter.

From 438f0e81227faa8a75b5c295ffdb1270c627aefb Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 5 Sep 2006 21:17:35 +0000
Subject: [PATCH 287/549] - Added date detector

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@326 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST                          |   2 +
 server/datedetector.py            | 103 ++++++++++++++++++++++++++++++
 server/datetemplate.py            |  74 +++++++++++++++++++++
 testcases/datedetectortestcase.py |  52 +++++++++++++++
 4 files changed, 231 insertions(+)
 create mode 100644 server/datedetector.py
 create mode 100644 server/datetemplate.py
 create mode 100644 testcases/datedetectortestcase.py

diff --git a/MANIFEST b/MANIFEST
index bb31b743..7e43bf11 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -17,6 +17,8 @@ client/csocket.py
 server/ssocket.py
 server/banticket.py
 server/filter.py
+server/datedetector.py
+server/datetemplate.py
 server/server.py
 server/failticket.py
 server/actions.py
diff --git a/server/datedetector.py b/server/datedetector.py
new file mode 100644
index 00000000..5b52326e
--- /dev/null
+++ b/server/datedetector.py
@@ -0,0 +1,103 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 321 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 321 $"
+__date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time
+
+from datetemplate import DateTemplate
+
+class DateDetector:
+	
+	def __init__(self):
+		self.templates = list()
+		self.defTemplate = DateTemplate()
+	
+	def addDefaultTemplate(self):
+		template = DateTemplate()
+		template.setRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+		template.setPattern("%b %d %H:%M:%S")
+		self.templates.append(template)
+		
+		template = DateTemplate()
+		template.setRegex("\S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}")
+		template.setPattern("%a %b %d %H:%M:%S %Y")
+		self.templates.append(template)
+	
+	def setDefaultRegex(self, value):
+		self.defTemplate.setRegex(value)
+	
+	def getDefaultRegex(self):
+		return self.defTemplate.getRegex()
+	
+	def setDefaultPattern(self, value):
+		self.defTemplate.setPattern(value)
+	
+	def getDefaultPattern(self):
+		return self.defTemplate.getPattern()
+	
+	#def addTemplate(self, template):
+	#	self.templates.append(template)
+	
+	def matchTime(self, line):
+		if self.defTemplate.isValid():
+			return self.defTemplate.matchDate(line)
+		else:
+			# TODO Should be called from outside. Add locking
+			for template in self.templates:
+				match = template.matchDate(line)
+				if match <> None:
+					return match
+			return None
+
+	def getTime(self, line):
+		if self.defTemplate.isValid():
+			try:
+				date = self.defTemplate.getDate(line)
+				return date
+			except ValueError:
+				return None
+		else:
+			# TODO Should be called from outside. Add locking
+			self.sortTemplate()
+			for template in self.templates:
+				try:
+					date = template.getDate(line)
+					template.incHits()
+					return date
+				except ValueError:
+					pass
+			return None
+
+	def getUnixTime(self, line):
+		date = self.getTime(line)
+		if date == None:
+			return None
+		else:
+			return time.mktime(date)
+
+	def sortTemplate(self):
+		self.templates.sort(cmp = lambda x, y: cmp(x.getHits(), y.getHits()), 
+							reverse=True)
+		
\ No newline at end of file
diff --git a/server/datetemplate.py b/server/datetemplate.py
new file mode 100644
index 00000000..5944adca
--- /dev/null
+++ b/server/datetemplate.py
@@ -0,0 +1,74 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 321 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 321 $"
+__date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import re, time
+
+class DateTemplate:
+	
+	def __init__(self):
+		self.regex = ""
+		self.pattern = ""
+		self.hits = 0
+	
+	def setRegex(self, regex):
+		self.regex = regex
+		
+	def getRegex(self):
+		return self.regex
+	
+	def setPattern(self, pattern):
+		self.pattern = pattern
+		
+	def getPattern(self):
+		return self.pattern
+	
+	def isValid(self):
+		return self.regex != "" and self.pattern != ""
+	
+	def incHits(self):
+		self.hits = self.hits + 1
+	
+	def getHits(self):
+		return self.hits
+	
+	def matchDate(self, line):
+		dateMatch = re.search(self.regex, line)
+		return dateMatch
+	
+	def getDate(self, line):
+		date = None
+		dateMatch = self.matchDate(line)
+		if dateMatch:
+			date = list(time.strptime(dateMatch.group(), self.pattern))
+			if date[0] < 2000:
+				# There is probably no year field in the logs
+				date[0] = time.gmtime()[0]
+				# Bug fix for #1241756
+				# If the date is greater than the current time, we suppose
+				# that the log is not from this year but from the year before
+				if time.mktime(date) > time.time():
+					date[0] -= 1
+		return date
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
new file mode 100644
index 00000000..64d703d8
--- /dev/null
+++ b/testcases/datedetectortestcase.py
@@ -0,0 +1,52 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 253 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 253 $"
+__date__ = "$Date: 2006-07-17 00:21:58 +0200 (Mon, 17 Jul 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import unittest, time
+from server.datedetector import DateDetector
+from server.datetemplate import DateTemplate
+
+class DateDetectorTest(unittest.TestCase):
+
+	def setUp(self):
+		"""Call before every test case."""
+		self.datedetector = DateDetector()
+		self.datedetector.addDefaultTemplate()
+
+	def tearDown(self):
+		"""Call after every test case."""
+	
+	def testGetTime(self):
+		log = "Jan 23 21:59:59 [sshd] error: PAM: Authentication failure"
+		date = [2006, 1, 23, 21, 59, 59, 1, 23, -1]
+		dateUnix = 1138049999.0
+	
+		self.assertEqual(self.datedetector.getTime(log), date)
+		self.assertEqual(self.datedetector.getTime(log), date)
+		self.assertEqual(self.datedetector.getTime(log), date)
+		self.assertEqual(self.datedetector.getUnixTime(log), dateUnix)
+		self.assertEqual(self.datedetector.getUnixTime(log), dateUnix)
+		self.assertEqual(self.datedetector.getUnixTime(log), dateUnix)
+		
\ No newline at end of file

From 4306c23c0f7f88e3c8702ae2129246eb7a537bae Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 6 Sep 2006 17:39:57 +0000
Subject: [PATCH 288/549] - Added timestamp to logs

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@327 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/server.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/server.py b/server/server.py
index 96525a8a..97d84245 100644
--- a/server/server.py
+++ b/server/server.py
@@ -291,7 +291,7 @@ class Server:
 				logSys.error("Unable to log to " + target)
 				return False
 		# set a format which is simpler for console use
-		formatter = logging.Formatter('%(name)-16s: %(levelname)-6s %(message)s')
+		formatter = logging.Formatter("%(asctime)s %(name)-16s: %(levelname)-6s %(message)s")
 		# tell the handler to use this format
 		hdlr.setFormatter(formatter)
 		logging.getLogger("fail2ban").addHandler(hdlr)

From 90d46d177d28fc0a75d1e7ad5c1cfe4629d7c688 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 6 Sep 2006 17:41:07 +0000
Subject: [PATCH 289/549] - Set the jail to idle state if file path is wrong or
 file is unreadable

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@328 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/server/filter.py b/server/filter.py
index 7a1fd776..9f81bc8d 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -77,6 +77,7 @@ class Filter(JailThread):
 		self.logStats = None
 		self.dateDetector = DateDetector()
 		self.dateDetector.addDefaultTemplate()
+		self.fileNotFoundCnt = 0
 		logSys.info("Created Filter")
 
 	##
@@ -288,6 +289,7 @@ class Filter(JailThread):
 	def isModified(self):
 		try:
 			self.logStats = os.stat(self.logPath)
+			self.fileNotFoundCnt = 0
 			if self.lastModTime == self.logStats.st_mtime:
 				return False
 			else:
@@ -296,6 +298,11 @@ class Filter(JailThread):
 				return True
 		except OSError:
 			logSys.error("Unable to get stat on " + self.logPath)
+			self.fileNotFoundCnt = self.fileNotFoundCnt + 1
+			if self.fileNotFoundCnt > 2:
+				logSys.warn("Too much read error. Set the jail idle")
+				self.jail.setIdle(True)
+				self.fileNotFoundCnt = 0
 			return False
 
 	##

From a998e54bb9baf28df9f5cfb17162f17a483e05a1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 6 Sep 2006 18:25:11 +0000
Subject: [PATCH 290/549] - Added "fail2ban-regex". This is a tool to help
 finding "failregex"

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@329 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG      |  2 ++
 MANIFEST       |  1 +
 fail2ban-regex | 82 ++++++++++++++++++++++++++++++++++++++++++++++++++
 setup.py       |  3 +-
 4 files changed, 87 insertions(+), 1 deletion(-)
 create mode 100755 fail2ban-regex

diff --git a/CHANGELOG b/CHANGELOG
index 81e42b7c..298d9b98 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -18,6 +18,8 @@ ver. 0.7.2 (2006/??/??) - ???
 - Added interactive mode. Use "-i"
 - Added a date detector. "timeregex" and "timepattern" are no
   more needed
+- Added "fail2ban-regex". This is a tool to help finding
+  "failregex"
 
 ver. 0.7.1 (2006/08/23) - alpha
 ----------
diff --git a/MANIFEST b/MANIFEST
index 7e43bf11..4dbbf17a 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -4,6 +4,7 @@ TODO
 fail2ban-client
 fail2ban-server
 fail2ban-testcases
+fail2ban-regex
 client/beautifier.py
 client/configreader.py
 client/jailreader.py
diff --git a/fail2ban-regex b/fail2ban-regex
new file mode 100755
index 00000000..be3f8223
--- /dev/null
+++ b/fail2ban-regex
@@ -0,0 +1,82 @@
+#!/usr/bin/env python
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 300 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 300 $"
+__date__ = "$Date: 2006-08-23 21:53:09 +0200 (Wed, 23 Aug 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import locale, getopt, sys, time
+
+# Inserts our own modules path first in the list
+# fix for bug #343821
+sys.path.insert(1, "/usr/lib/fail2ban")
+
+from version import version
+from server.filter import Filter
+
+class Fail2banRegex:
+	
+	def __init__(self):
+		self.filter = Filter(None)
+	
+	def dispUsage(self):
+		print "Usage: "+sys.argv[0]+" <logline> <failregex>"
+		print
+		print "Fail2Ban v" + version + " reads log file that contains password failure report"
+		print "and bans the corresponding IP addresses using firewall rules."
+	
+	def setRegex(self, value):
+		self.filter.setFailRegex(value)
+	
+	def testRegex(self, line):
+		print
+		try:
+			ret = self.filter.findFailure(line)
+		except IndexError:
+			print "Sorry, but no <host> found in regex"
+			return False
+		if len(ret) == 0:
+			print "Sorry, no match"
+			return False
+		else:
+			print "Success, the following data were found:"
+			timeTuple = time.localtime(ret[0][1])
+			print "Date: " + time.strftime("%a %b %d %H:%M:%S %Y", timeTuple)
+			ipList = ""
+			for i in ret:
+				ipList = ipList + " " + i[0]
+			print "IP  :" + ipList
+			return True
+			
+if __name__ == "__main__":
+	regex = Fail2banRegex()
+	if len(sys.argv) <> 3:
+		regex.dispUsage()
+		sys.exit(-1)
+	else:
+		regex.setRegex(sys.argv[2])
+		ret = regex.testRegex(sys.argv[1])
+		if ret:
+			sys.exit(0)
+		else:
+			sys.exit(-1)
diff --git a/setup.py b/setup.py
index 664636f4..69c1e187 100755
--- a/setup.py
+++ b/setup.py
@@ -50,7 +50,8 @@ setup(
 	platforms = "Posix",
 	scripts =	[
 					'fail2ban-client',
-					'fail2ban-server'
+					'fail2ban-server',
+					'fail2ban-regex'
 				],
 	py_modules =	['version'],
 	packages =	[

From 6b1d9b6180c791f3710fa6f0020ed8801954ef82 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 6 Sep 2006 19:31:23 +0000
Subject: [PATCH 291/549] - Added benchmark

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@330 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-regex | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/fail2ban-regex b/fail2ban-regex
index be3f8223..6aab952b 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -25,7 +25,7 @@ __date__ = "$Date: 2006-08-23 21:53:09 +0200 (Wed, 23 Aug 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import locale, getopt, sys, time
+import locale, getopt, sys, time, logging
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
@@ -66,6 +66,29 @@ class Fail2banRegex:
 			for i in ret:
 				ipList = ipList + " " + i[0]
 			print "IP  :" + ipList
+			print
+			print "Benchmark. Executing 1000..."
+			total = 0
+			maxValue = 0
+			maxPos = 0
+			minValue = 99999999
+			minPos = 0
+			for i in range(1000):
+				start = time.time()
+				ret = self.filter.findFailure(line)
+				end = time.time()
+				diff = (end - start) * 1000
+				total = total + diff
+				minValue = min(minValue, diff)
+				if minValue == diff:
+					minPos = i
+				maxValue = max(maxValue, diff)
+				if maxValue == diff:
+					maxPos = i
+			print "Performance"
+			print "Avg: " + `total / 1000` + " ms"
+			print "Max: " + `maxValue` + " ms (Run " + `maxPos` + ")"
+			print "Min: " + `minValue` + " ms (Run " + `minPos` + ")"
 			return True
 			
 if __name__ == "__main__":

From b1160ab7cae051975a393519e1fddcfa73dab709 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 6 Sep 2006 19:34:03 +0000
Subject: [PATCH 292/549] - Added qmail and postfix filters - Updated vsftpd
 and couriersmtp

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@331 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST                         |  2 ++
 config/filter.d/couriersmtp.conf |  2 +-
 config/filter.d/postfix.conf     | 14 ++++++++++++++
 config/filter.d/qmail.conf       | 14 ++++++++++++++
 config/filter.d/vsftpd.conf      |  2 +-
 5 files changed, 32 insertions(+), 2 deletions(-)
 create mode 100644 config/filter.d/postfix.conf
 create mode 100644 config/filter.d/qmail.conf

diff --git a/MANIFEST b/MANIFEST
index 4dbbf17a..9f386450 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -48,6 +48,8 @@ config/filter.d/vsftpd.conf
 config/filter.d/apache-auth.conf
 config/filter.d/sshd.conf
 config/filter.d/couriersmtp.conf
+config/filter.d/qmail.conf
+config/filter.d/postfix.conf
 config/action.d/iptables.conf
 config/action.d/mail-whois.conf
 config/action.d/dummy.conf
diff --git a/config/filter.d/couriersmtp.conf b/config/filter.d/couriersmtp.conf
index 0a57373f..92d942b6 100644
--- a/config/filter.d/couriersmtp.conf
+++ b/config/filter.d/couriersmtp.conf
@@ -9,6 +9,6 @@
 
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile.
-# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
+# Values:  TEXT  Default:
 #
 failregex = error,relay=(?:::f{4,6}:)?(?P<host>\S*),.*550 User unknown
diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf
new file mode 100644
index 00000000..a226d28b
--- /dev/null
+++ b/config/filter.d/postfix.conf
@@ -0,0 +1,14 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 267 $
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile.
+# Values:  TEXT  Default:
+#
+failregex = reject: RCPT from (.*)\[(?P<host>\S*)\]: 554
diff --git a/config/filter.d/qmail.conf b/config/filter.d/qmail.conf
new file mode 100644
index 00000000..082f15cc
--- /dev/null
+++ b/config/filter.d/qmail.conf
@@ -0,0 +1,14 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 267 $
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile.
+# Values:  TEXT  Default:
+#
+failregex = (?:[\d,.]+[\d,.] rblsmtpd: |421 badiprbl: ip )(?P<host>\S*)
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index f1c82be2..0c992359 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -11,4 +11,4 @@
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT Default: Authentication failure|Failed password|Invalid user
 #
-failregex = FAIL LOGIN
+failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S*)

From ebd999a7583ba1daf4e43769c8ba4815feeb55f2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 6 Sep 2006 20:28:03 +0000
Subject: [PATCH 293/549] - Added new filters

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@332 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 setup.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/setup.py b/setup.py
index 69c1e187..8cdbcde8 100755
--- a/setup.py
+++ b/setup.py
@@ -69,7 +69,10 @@ setup(
 							[
 								'config/filter.d/vsftpd.conf',
 								'config/filter.d/apache-auth.conf',
-								'config/filter.d/sshd.conf'
+								'config/filter.d/sshd.conf',
+								'config/filter.d/couriersmtp.conf',
+								'config/filter.d/postfix.conf',
+								'config/filter.d/qmail.conf'
 							]
 						),
 						('/etc/fail2ban/action.d',

From 9d8ef7675e66bf47310f98305cc7bc66da203b28 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 6 Sep 2006 20:32:28 +0000
Subject: [PATCH 294/549] - Added interactive mode in help

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@333 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fail2ban-client b/fail2ban-client
index a76db1e2..2135aa62 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -89,6 +89,7 @@ class Fail2banClient:
 		print
 		print "    -c <DIR>                configuration directory"
 		print "    -d                      dump configuration. For debugging"
+		print "    -i                      interactive mode"
 		print "    -v                      increase verbosity"
 		print "    -q                      decrease verbosity"
 		print "    -x                      force execution of the server"

From 1c3088b2675067bc940eb92ac3c54cc5f6c4a0a1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 6 Sep 2006 21:19:58 +0000
Subject: [PATCH 295/549] - Added new action

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@334 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST                         |  1 +
 config/action.d/mail-report.conf | 59 ++++++++++++++++++++++++++++++++
 setup.py                         |  1 +
 3 files changed, 61 insertions(+)
 create mode 100644 config/action.d/mail-report.conf

diff --git a/MANIFEST b/MANIFEST
index 9f386450..f3880d47 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -54,6 +54,7 @@ config/action.d/iptables.conf
 config/action.d/mail-whois.conf
 config/action.d/dummy.conf
 config/action.d/mail.conf
+config/action.d/mail-report.conf
 config/action.d/hostsdeny.conf
 config/fail2ban.conf
 files/gentoo-initd
diff --git a/config/action.d/mail-report.conf b/config/action.d/mail-report.conf
new file mode 100644
index 00000000..993064fc
--- /dev/null
+++ b/config/action.d/mail-report.conf
@@ -0,0 +1,59 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 254 $
+#
+
+[Definition]
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD  Default:
+#
+actionstart = 
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD  Default:
+#
+actionstop = fail2ban-client status|mail -s "[Fail2Ban] Status report" <dest>
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD  Default:
+#
+actioncheck = 
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+actionban = 
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destinataire of the mail
+#
+dest = root
diff --git a/setup.py b/setup.py
index 8cdbcde8..28f75bc9 100755
--- a/setup.py
+++ b/setup.py
@@ -81,6 +81,7 @@ setup(
 								'config/action.d/mail-whois.conf',
 								'config/action.d/dummy.conf',
 								'config/action.d/mail.conf',
+								'config/action.d/mail-report.conf',
 								'config/action.d/hostsdeny.conf'
 							]
 						)

From 7864bdc95380090a3a3598b83bcd1315a7b1b999 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 6 Sep 2006 21:33:18 +0000
Subject: [PATCH 296/549] - Improved jail.conf - Removed useless parameter in
 mail-report.conf

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@335 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/mail-report.conf |  4 --
 config/jail.conf                 | 71 ++++++++++++++++++++++++++++----
 2 files changed, 63 insertions(+), 12 deletions(-)

diff --git a/config/action.d/mail-report.conf b/config/action.d/mail-report.conf
index 993064fc..c5994e59 100644
--- a/config/action.d/mail-report.conf
+++ b/config/action.d/mail-report.conf
@@ -50,10 +50,6 @@ actionunban =
 
 [Init]
 
-# Defaut name of the chain
-#
-name = default
-
 # Destinataire of the mail
 #
 dest = root
diff --git a/config/jail.conf b/config/jail.conf
index dab9d671..a35414d9 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -5,12 +5,67 @@
 # $Revision$
 #
 
-[dummy]
+# This jail corresponds to the standard configuration in Fail2ban 0.6.
+# The mail-whois action send a notification e-mail with a whois request
+# in the body.
 
-enabled = false
-filter = sshd
-action = hostsdeny[file=/tmp/hosts.deny]
-         mail[name=SSH, dest=cyril.jaquier@bluewin.ch]
-logpath = /home/cyril/workspace/fail2ban-unstable/testcases/files/testcase01.log
-maxretry = 2
-bantime = 10
+[ssh-iptables]
+
+enabled  = false
+filter   = sshd
+action   = iptables[name=SSH, port=ssh, protocol=tcp]
+           mail-whois[name=SSH, dest=yourmail@mail.com]
+logpath  = /var/log/sshd.log
+maxretry = 5
+bantime  = 600
+
+# This one behaves like the previous and sends a report when the jail
+# is stopped.
+
+[ssh-iptables-report]
+
+enabled  = false
+filter   = sshd
+action   = iptables[name=SSH, port=ssh, protocol=tcp]
+           mail-whois[name=SSH, dest=yourmail@mail.com]
+           mail-report[dest=yourmail@mail.com]
+logpath  = /var/log/sshd.log
+maxretry = 5
+bantime  = 600
+
+# Here we use TCP-Wrappers instead of Netfilter/Iptables.
+
+[ssh-tcpwrapper]
+
+enabled  = false
+filter   = sshd
+action   = hostsdeny
+           mail-whois[name=SSH, dest=yourmail@mail.com]
+logpath  = /var/log/sshd.log
+maxretry = 3
+bantime  = 600
+
+# The hosts.deny path can be defined with the "file" argument if it is
+# not in /etc.
+
+[postfix-tcpwrapper]
+
+enabled  = false
+filter   = postfix
+action   = hostsdeny[file=/not/a/standard/path/hosts.deny]
+           mail[name=Postfix, dest=yourmail@mail.com]
+logpath  = /var/log/postfix.log
+maxretry = 6
+bantime  = 300
+
+# Do not ban anybody. Just report information about the remote host.
+# A notification is sent at most every 600 seconds (bantime).
+
+[vsftpd-notification]
+
+enabled  = false
+filter   = vsftpd
+action   = mail-whois[name=VSFTPD, dest=yourmail@mail.com]
+logpath  = /var/log/vsftpd.log
+maxretry = 3
+bantime  = 600

From 46dee1bd9adfad0eb09e8108dde8ddcf25479aeb Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Sep 2006 21:00:44 +0000
Subject: [PATCH 297/549] - Improved checking when parsing the configuration

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@336 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/actionreader.py |  2 +-
 client/configreader.py | 11 +++++++++--
 client/filterreader.py |  2 +-
 client/jailreader.py   | 19 ++++++++++++++-----
 client/jailsreader.py  | 11 +++++++----
 5 files changed, 32 insertions(+), 13 deletions(-)

diff --git a/client/actionreader.py b/client/actionreader.py
index 348cb3bf..d069fc39 100644
--- a/client/actionreader.py
+++ b/client/actionreader.py
@@ -51,7 +51,7 @@ class ActionReader(ConfigReader):
 		return self.name
 	
 	def read(self):
-		ConfigReader.read(self, "action.d/" + self.file)
+		return ConfigReader.read(self, "action.d/" + self.file)
 	
 	def getOptions(self, pOpts):
 		opts = [["string", "actionstart", ""],
diff --git a/client/configreader.py b/client/configreader.py
index ca4303fa..d9322aff 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import logging
+import logging, os
 from ConfigParser import *
 
 # Gets the instance of the logger.
@@ -53,7 +53,14 @@ class ConfigReader(SafeConfigParser):
 		global basedir
 		basename = basedir + filename
 		logSys.debug("Reading " + basename)
-		SafeConfigParser.read(self, [basename + ".conf", basename + ".local"])
+		bConf = basename + ".conf"
+		bLocal = basename + ".local"
+		if os.path.exists(bConf) or os.path.exists(bLocal):
+			SafeConfigParser.read(self, [bConf, bLocal])
+			return True
+		else:
+			logSys.error(bConf + " and " + bLocal + " do not exist")
+			return False
 	
 	##
 	# Read the options.
diff --git a/client/filterreader.py b/client/filterreader.py
index fbf3146f..e746292d 100644
--- a/client/filterreader.py
+++ b/client/filterreader.py
@@ -50,7 +50,7 @@ class FilterReader(ConfigReader):
 		return self.name
 	
 	def read(self):
-		ConfigReader.read(self, "filter.d/" + self.file)
+		return ConfigReader.read(self, "filter.d/" + self.file)
 	
 	def getOptions(self, pOpts):
 		opts = [["string", "timeregex", None],
diff --git a/client/jailreader.py b/client/jailreader.py
index 3483582a..986f3645 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -67,20 +67,29 @@ class JailReader(ConfigReader):
 		if self.isEnabled():
 			# Read filter
 			self.filter = FilterReader(self.opts["filter"], self.name)
-			self.filter.read()
-			self.filter.getOptions(self.opts)
+			ret = self.filter.read()
+			if ret:
+				self.filter.getOptions(self.opts)
+			else:
+				logSys.error("Unable to read the filter")
+				return False
 			
 			# Read action
 			for act in self.opts["action"].split('\n'):
 				try:
 					splitAct = JailReader.splitAction(act)
 					action = ActionReader(splitAct, self.name)
-					action.read()
-					action.getOptions(self.opts)
-					self.actions.append(action)
+					ret = action.read()
+					if ret:
+						action.getOptions(self.opts)
+						self.actions.append(action)
+					else:
+						raise AttributeError("Unable to read action")
 				except AttributeError, e:
 					logSys.error("Error in action definition " + act)
 					logSys.debug(e)
+					return False
+		return True
 	
 	def convert(self):
 		stream = [["add", self.name]]
diff --git a/client/jailsreader.py b/client/jailsreader.py
index 7515597b..e94e0c3a 100644
--- a/client/jailsreader.py
+++ b/client/jailsreader.py
@@ -47,10 +47,13 @@ class JailsReader(ConfigReader):
 		for sec in self.sections():
 			jail = JailReader(sec)
 			jail.read()
-			jail.getOptions()
-			if jail.isEnabled():
-				# We only add enabled jails
-				self.jails.append(jail)
+			ret = jail.getOptions()
+			if ret:
+				if jail.isEnabled():
+					# We only add enabled jails
+					self.jails.append(jail)
+			else:
+				logSys.error("Errors in jail '" + sec + "'. Skipping...")
 	
 	def getFilterOptions(self, file):
 		filter = FilterReader(file)

From c7747d1f17a66cf288887c02db20a23074f430e0 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Sep 2006 22:24:17 +0000
Subject: [PATCH 298/549] - Improved server communication. Start a new thread
 for each incoming request. Allow concurrent accesses to the server. However,
 the server is not really thread-safe yet...

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@337 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client   |  5 +++++
 server/ssocket.py | 40 +++++++++++++++++++++++-----------------
 2 files changed, 28 insertions(+), 17 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 2135aa62..746e8821 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -181,6 +181,11 @@ class Fail2banClient:
 			else:
 				logSys.error("Could not find server")
 				return False
+		elif len(cmd) == 1 and cmd[0] == "stop":
+			# Workaround for the shutdown
+			ret = self.processCmd([cmd])
+			self.ping()
+			return ret
 		else:
 			return self.processCmd([cmd])
 	
diff --git a/server/ssocket.py b/server/ssocket.py
index 57bf26c8..78330afc 100644
--- a/server/ssocket.py
+++ b/server/ssocket.py
@@ -54,31 +54,22 @@ class SSocket(Thread):
 		#self.ssock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 		self.ssock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
 		#self.ssock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-		self.ssock.setblocking(False)
+		#self.ssock.setblocking(False)
+		self.ssock.setblocking(True)
 		# Bind the socket to a public host and a well-known port
 		#self.ssock.bind(("localhost", 2222))
 		self.ssock.bind(SSocket.SOCKET_FILE)
 		# Become a server socket
-		self.ssock.listen(1)
+		self.ssock.listen(5)
 	
 	def run(self):
 		self.isRunning = True
-		stime = 1.0
 		while self.isRunning:
-			try:
-				# Accept connections from outside
-				(csock, address) = self.ssock.accept()
-				stime /= 10
-				logSys.debug("Connection accepted")
-				msg = self.receive(csock)
-				msg = self.transmit.proceed(msg)
-				self.send(csock, msg)
-				csock.close()
-			except Exception:
-				time.sleep(stime)
-				stime += 0.05
-				if stime > 1.0:
-					stime = 1.0
+			# TODO Fix shutdown. A new request is required because accept()
+			# is blocking.
+			(csock, address) = self.ssock.accept()
+			thread = SocketWorker(csock, self.transmit)
+			thread.start()
 		self.ssock.close()
 		# Remove socket
 		if os.path.exists(SSocket.SOCKET_FILE):
@@ -95,6 +86,21 @@ class SSocket(Thread):
 	
 	def stop(self):
 		self.isRunning = False
+
+
+class SocketWorker(Thread):
+	
+	def __init__(self, csock, transmitter):
+		Thread.__init__(self)
+		self.csock = csock
+		self.transmit = transmitter
+		
+	def run(self):
+		logSys.debug("Starting new thread to handle the request")
+		msg = self.receive(self.csock)
+		msg = self.transmit.proceed(msg)
+		self.send(self.csock, msg)
+		self.csock.close()
 	
 	def send(self, socket, msg):
 		obj = pickle.dumps(msg)

From 500d203a2a3b32e2d232a488bab37902b0e836c5 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Sep 2006 22:25:49 +0000
Subject: [PATCH 299/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@338 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index 298d9b98..e213aa31 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -20,6 +20,8 @@ ver. 0.7.2 (2006/??/??) - ???
   more needed
 - Added "fail2ban-regex". This is a tool to help finding
   "failregex"
+- Improved server communication. Start a new thread for each
+  incoming request
 
 ver. 0.7.1 (2006/08/23) - alpha
 ----------

From 5c020b99da97e73a2559912a09073029211411ba Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Sep 2006 20:41:57 +0000
Subject: [PATCH 300/549] - mail-report.conf is not a good idea as the jail is
 already deleted when creating the report

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@339 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/mail-report.conf | 55 --------------------------------
 1 file changed, 55 deletions(-)
 delete mode 100644 config/action.d/mail-report.conf

diff --git a/config/action.d/mail-report.conf b/config/action.d/mail-report.conf
deleted file mode 100644
index c5994e59..00000000
--- a/config/action.d/mail-report.conf
+++ /dev/null
@@ -1,55 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Cyril Jaquier
-#
-# $Revision: 254 $
-#
-
-[Definition]
-
-# Option:  fwstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD  Default:
-#
-actionstart = 
-
-# Option:  fwend
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
-#
-actionstop = fail2ban-client status|mail -s "[Fail2Ban] Status report" <dest>
-
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
-#
-actioncheck = 
-
-# Option:  fwban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
-# Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
-#
-actionban = 
-
-# Option:  fwunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
-# Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
-#
-actionunban = 
-
-[Init]
-
-# Destinataire of the mail
-#
-dest = root

From 77eef14ed85fcad9befd2de70f387ecd0c032248 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Sep 2006 20:43:13 +0000
Subject: [PATCH 301/549] - Improved date detector

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@340 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/datedetector.py | 53 +++++++++++++++++++++++++++++++-----------
 server/dateepoch.py    | 44 +++++++++++++++++++++++++++++++++++
 server/datestrptime.py | 49 ++++++++++++++++++++++++++++++++++++++
 server/datetai64n.py   | 46 ++++++++++++++++++++++++++++++++++++
 server/datetemplate.py | 25 +++++++++-----------
 server/filter.py       |  1 +
 6 files changed, 191 insertions(+), 27 deletions(-)
 create mode 100644 server/dateepoch.py
 create mode 100644 server/datestrptime.py
 create mode 100644 server/datetai64n.py

diff --git a/server/datedetector.py b/server/datedetector.py
index 5b52326e..1513bd48 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -24,26 +24,45 @@ __date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time
+import time, logging
 
 from datetemplate import DateTemplate
+from datestrptime import DateStrptime
+from datetai64n	import DateTai64n
+from dateepoch import DateEpoch
+from threading import Lock
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.filter.datedetector")
 
 class DateDetector:
 	
 	def __init__(self):
+		self.lock = Lock()
 		self.templates = list()
 		self.defTemplate = DateTemplate()
 	
 	def addDefaultTemplate(self):
-		template = DateTemplate()
-		template.setRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+		# standard
+		template = DateStrptime()
+		template.setName("Month Day Hour:Minute:Second")
+		template.setRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 		template.setPattern("%b %d %H:%M:%S")
 		self.templates.append(template)
-		
-		template = DateTemplate()
-		template.setRegex("\S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}")
+		# asctime
+		template = DateStrptime()
+		template.setName("Weekday Month Day Hour:Minute:Second Year")
+		template.setRegex("^\S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}")
 		template.setPattern("%a %b %d %H:%M:%S %Y")
 		self.templates.append(template)
+		# TAI64N
+		template = DateTai64n()
+		template.setName("TAI64N")
+		self.templates.append(template)
+		# Epoch
+		template = DateEpoch()
+		template.setName("Epoch")
+		self.templates.append(template)
 	
 	def setDefaultRegex(self, value):
 		self.defTemplate.setRegex(value)
@@ -57,18 +76,17 @@ class DateDetector:
 	def getDefaultPattern(self):
 		return self.defTemplate.getPattern()
 	
-	#def addTemplate(self, template):
-	#	self.templates.append(template)
-	
 	def matchTime(self, line):
 		if self.defTemplate.isValid():
 			return self.defTemplate.matchDate(line)
 		else:
-			# TODO Should be called from outside. Add locking
+			self.lock.acquire()
 			for template in self.templates:
 				match = template.matchDate(line)
 				if match <> None:
+					self.lock.release()
 					return match
+			self.lock.release()
 			return None
 
 	def getTime(self, line):
@@ -79,15 +97,18 @@ class DateDetector:
 			except ValueError:
 				return None
 		else:
-			# TODO Should be called from outside. Add locking
-			self.sortTemplate()
+			self.lock.acquire()
 			for template in self.templates:
 				try:
 					date = template.getDate(line)
+					if date == None:
+						continue
 					template.incHits()
+					self.lock.release()
 					return date
 				except ValueError:
 					pass
+			self.lock.release()
 			return None
 
 	def getUnixTime(self, line):
@@ -97,7 +118,13 @@ class DateDetector:
 		else:
 			return time.mktime(date)
 
+	##
+	# Sort the template lists using the hits score. This method is not called
+	# in this object and thus should be called from time to time.
+	
 	def sortTemplate(self):
+		self.lock.acquire()
+		logSys.debug("Sorting the template list")
 		self.templates.sort(cmp = lambda x, y: cmp(x.getHits(), y.getHits()), 
 							reverse=True)
-		
\ No newline at end of file
+		self.lock.release()
diff --git a/server/dateepoch.py b/server/dateepoch.py
new file mode 100644
index 00000000..ef5cb2ba
--- /dev/null
+++ b/server/dateepoch.py
@@ -0,0 +1,44 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 321 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 321 $"
+__date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import re, time
+
+from datetemplate import DateTemplate
+
+class DateEpoch(DateTemplate):
+	
+	def __init__(self):
+		DateTemplate.__init__(self)
+		# We already know the format for TAI64N
+		self.setRegex("^\d{10}(\.\d{6})?")
+	
+	def getDate(self, line):
+		date = None
+		dateMatch = self.matchDate(line)
+		if dateMatch:
+			# extract part of format which represents seconds since epoch
+			date = list(time.gmtime(float(dateMatch.group())))
+		return date
diff --git a/server/datestrptime.py b/server/datestrptime.py
new file mode 100644
index 00000000..ef115722
--- /dev/null
+++ b/server/datestrptime.py
@@ -0,0 +1,49 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 321 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 321 $"
+__date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import re, time
+
+from datetemplate import DateTemplate
+
+class DateStrptime(DateTemplate):
+	
+	def __init__(self):
+		DateTemplate.__init__(self)
+	
+	def getDate(self, line):
+		date = None
+		dateMatch = self.matchDate(line)
+		if dateMatch:
+			date = list(time.strptime(dateMatch.group(), self.pattern))
+			if date[0] < 2000:
+				# There is probably no year field in the logs
+				date[0] = time.gmtime()[0]
+				# Bug fix for #1241756
+				# If the date is greater than the current time, we suppose
+				# that the log is not from this year but from the year before
+				if time.mktime(date) > time.time():
+					date[0] -= 1
+		return date
diff --git a/server/datetai64n.py b/server/datetai64n.py
new file mode 100644
index 00000000..064b6643
--- /dev/null
+++ b/server/datetai64n.py
@@ -0,0 +1,46 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 321 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 321 $"
+__date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import re, time
+
+from datetemplate import DateTemplate
+
+class DateTai64n(DateTemplate):
+	
+	def __init__(self):
+		DateTemplate.__init__(self)
+		# We already know the format for TAI64N
+		self.setRegex("@[0-9a-f]{24}")
+	
+	def getDate(self, line):
+		date = None
+		dateMatch = self.matchDate(line)
+		if dateMatch:
+			# extract part of format which represents seconds since epoch
+			value = dateMatch.group()
+			seconds_since_epoch = value[2:17]
+			date = list(time.gmtime(int(seconds_since_epoch, 16)))
+		return date
diff --git a/server/datetemplate.py b/server/datetemplate.py
index 5944adca..eae730ee 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -29,12 +29,21 @@ import re, time
 class DateTemplate:
 	
 	def __init__(self):
+		self.name = ""
 		self.regex = ""
+		self.cRegex = None
 		self.pattern = ""
 		self.hits = 0
 	
+	def setName(self, name):
+		self.name = name
+		
+	def getName(self):
+		return self.name
+	
 	def setRegex(self, regex):
 		self.regex = regex
+		self.cRegex = re.compile(regex)
 		
 	def getRegex(self):
 		return self.regex
@@ -55,20 +64,8 @@ class DateTemplate:
 		return self.hits
 	
 	def matchDate(self, line):
-		dateMatch = re.search(self.regex, line)
+		dateMatch = self.cRegex.search(line)
 		return dateMatch
 	
 	def getDate(self, line):
-		date = None
-		dateMatch = self.matchDate(line)
-		if dateMatch:
-			date = list(time.strptime(dateMatch.group(), self.pattern))
-			if date[0] < 2000:
-				# There is probably no year field in the logs
-				date[0] = time.gmtime()[0]
-				# Bug fix for #1241756
-				# If the date is greater than the current time, we suppose
-				# that the log is not from this year but from the year before
-				if time.mktime(date) > time.time():
-					date[0] -= 1
-		return date
+		raise Exception("matchDate() is abstract")
diff --git a/server/filter.py b/server/filter.py
index 9f81bc8d..a4bbe3db 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -217,6 +217,7 @@ class Filter(JailThread):
 			if not self.isIdle:
 				if self.isModified():
 					self.getFailures()
+					self.dateDetector.sortTemplate()
 				try:
 					ticket = self.failManager.toBan()
 					self.jail.putFailTicket(ticket)

From 8df771ce6b663a05b4ab04c0fe86a181872b3332 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Sep 2006 20:44:36 +0000
Subject: [PATCH 302/549] - Added one more test for the date detector

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@341 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 testcases/datedetectortestcase.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 64d703d8..d5e554d0 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -38,6 +38,14 @@ class DateDetectorTest(unittest.TestCase):
 	def tearDown(self):
 		"""Call after every test case."""
 	
+	def testGetEpochTime(self):
+		log = "1138049999 [sshd] error: PAM: Authentication failure"
+		date = [2006, 1, 23, 20, 59, 59, 0, 23, 0]
+		dateUnix = 1138046399.0
+		
+		self.assertEqual(self.datedetector.getTime(log), date)
+		self.assertEqual(self.datedetector.getUnixTime(log), dateUnix)
+	
 	def testGetTime(self):
 		log = "Jan 23 21:59:59 [sshd] error: PAM: Authentication failure"
 		date = [2006, 1, 23, 21, 59, 59, 1, 23, -1]

From b38e0dfb1e5fd707792b9c85a3d3a5a8e643295f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Sep 2006 20:46:19 +0000
Subject: [PATCH 303/549] - Better output when server is not started

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@342 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 746e8821..599804c0 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -25,7 +25,8 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import sys, string, os, pickle, re, logging, getopt, time, readline, shlex
+import sys, string, os, pickle, re, logging
+import getopt, time, readline, shlex, socket
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
@@ -132,20 +133,23 @@ class Fail2banClient:
 			beautifier.setInputCmd(c)
 			try:
 				client = CSocket()
+				ret = client.send(c)
+				if ret[0] == 0:
+					logSys.debug("OK : " + `ret[1]`)
+					if showRet:
+						print beautifier.beautify(ret[1])
+				else:
+					logSys.debug("NOK: " + `ret[1].args`)
+					print beautifier.beautifyError(ret[1])
+					return False
+			except socket.error:
+				logSys.error("Unable to contact server. Is it running?")
+				return False
 			except Exception, e:
 				if showRet:
 					logSys.error(e)
 					logSys.error("Arrggh... Start the server first")
 				return False
-			ret = client.send(c)
-			if ret[0] == 0:
-				logSys.debug("OK : " + `ret[1]`)
-				if showRet:
-					print beautifier.beautify(ret[1])
-			else:
-				logSys.debug("NOK: " + `ret[1].args`)
-				print beautifier.beautifyError(ret[1])
-				return False
 		return True
 		
 	##
@@ -181,11 +185,6 @@ class Fail2banClient:
 			else:
 				logSys.error("Could not find server")
 				return False
-		elif len(cmd) == 1 and cmd[0] == "stop":
-			# Workaround for the shutdown
-			ret = self.processCmd([cmd])
-			self.ping()
-			return ret
 		else:
 			return self.processCmd([cmd])
 	

From 86b07457cd7e892b69c0043d4227e17ad459f633 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Sep 2006 20:46:59 +0000
Subject: [PATCH 304/549] - Implemented SYSLOG logging target

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@343 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/server.py | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/server/server.py b/server/server.py
index 97d84245..974d04f1 100644
--- a/server/server.py
+++ b/server/server.py
@@ -26,7 +26,7 @@ __license__ = "GPL"
 
 from jail import Jail
 from transmitter import Transmitter
-import locale, logging, sys, os, signal
+import locale, logging, logging.handlers, sys, os, signal
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.server")
@@ -38,7 +38,7 @@ class Server:
 		self.daemon = daemon
 		self.transm = Transmitter(self)
 		self.logLevel = 3
-		self.logTarget = "STDERR"
+		self.logTarget = "STDOUT"
 		# Set logging level
 		self.setLogLevel(self.logLevel)
 		self.setLogTarget(self.logTarget)
@@ -278,8 +278,9 @@ class Server:
 		logging.getLogger("fail2ban").handlers = []
 		self.logTarget = target
 		if target == "SYSLOG":
-			logSys.error("Not yet implemented")
-			return False
+			hdlr = logging.handlers.SysLogHandler()
+		elif target == "STDOUT":
+			hdlr = logging.StreamHandler(sys.stdout)
 		elif target == "STDERR":
 			hdlr = logging.StreamHandler(sys.stderr)
 		else:

From 068dea8971ac2f35cc25e9e50e49b6a39eae653f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Sep 2006 20:50:07 +0000
Subject: [PATCH 305/549] - Fixed the shutdown issue with timeout on socket

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@344 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/ssocket.py | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/server/ssocket.py b/server/ssocket.py
index 78330afc..4146082c 100644
--- a/server/ssocket.py
+++ b/server/ssocket.py
@@ -55,7 +55,10 @@ class SSocket(Thread):
 		self.ssock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
 		#self.ssock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
 		#self.ssock.setblocking(False)
-		self.ssock.setblocking(True)
+		# Do not use a blocking socket as there is problem at shutdown.
+		# Use a timeout instead. Daemon exits at most 'timeout' seconds
+		# after the command.
+		self.ssock.settimeout(1)
 		# Bind the socket to a public host and a well-known port
 		#self.ssock.bind(("localhost", 2222))
 		self.ssock.bind(SSocket.SOCKET_FILE)
@@ -65,11 +68,13 @@ class SSocket(Thread):
 	def run(self):
 		self.isRunning = True
 		while self.isRunning:
-			# TODO Fix shutdown. A new request is required because accept()
-			# is blocking.
-			(csock, address) = self.ssock.accept()
-			thread = SocketWorker(csock, self.transmit)
-			thread.start()
+			try:
+				(csock, address) = self.ssock.accept()
+				thread = SocketWorker(csock, self.transmit)
+				thread.start()
+			except socket.timeout:
+				# Do nothing here
+				pass
 		self.ssock.close()
 		# Remove socket
 		if os.path.exists(SSocket.SOCKET_FILE):
@@ -101,6 +106,7 @@ class SocketWorker(Thread):
 		msg = self.transmit.proceed(msg)
 		self.send(self.csock, msg)
 		self.csock.close()
+		logSys.debug("Connection closed")
 	
 	def send(self, socket, msg):
 		obj = pickle.dumps(msg)

From 4eb611dd469b3fe3943eb48c5c9b0bfa3d560244 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Sep 2006 20:52:22 +0000
Subject: [PATCH 306/549] - Added date template hits summary - Desactivated
 garbage collector while benchmarking

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@345 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-regex | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fail2ban-regex b/fail2ban-regex
index 6aab952b..b30d1e33 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -25,7 +25,7 @@ __date__ = "$Date: 2006-08-23 21:53:09 +0200 (Wed, 23 Aug 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import locale, getopt, sys, time, logging
+import locale, getopt, sys, time, logging, gc
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
@@ -67,7 +67,12 @@ class Fail2banRegex:
 				ipList = ipList + " " + i[0]
 			print "IP  :" + ipList
 			print
+			print "Date template hits:"
+			for template in self.filter.dateDetector.templates:
+				print `template.getHits()` + " hit: " + template.getName()
+			print
 			print "Benchmark. Executing 1000..."
+			gc.disable()
 			total = 0
 			maxValue = 0
 			maxPos = 0
@@ -85,6 +90,7 @@ class Fail2banRegex:
 				maxValue = max(maxValue, diff)
 				if maxValue == diff:
 					maxPos = i
+			gc.enable()
 			print "Performance"
 			print "Avg: " + `total / 1000` + " ms"
 			print "Max: " + `maxValue` + " ms (Run " + `maxPos` + ")"

From df26a74d53c448e187ebff1ec326be39f1dc1902 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Sep 2006 20:53:21 +0000
Subject: [PATCH 307/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@346 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG |  6 +++---
 MANIFEST  | 23 ++++++++++++-----------
 README    | 51 ++++++++-------------------------------------------
 TODO      | 10 ++++++----
 4 files changed, 29 insertions(+), 61 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index e213aa31..7385fe44 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.2)                           2006/??/??
+Fail2Ban (version 0.7.2)                           2006/09/10
 =============================================================
 
-ver. 0.7.2 (2006/??/??) - ???
+ver. 0.7.2 (2006/09/10) - beta
 ----------
 - Refactoring and code cleanup
 - Improved client output
@@ -21,7 +21,7 @@ ver. 0.7.2 (2006/??/??) - ???
 - Added "fail2ban-regex". This is a tool to help finding
   "failregex"
 - Improved server communication. Start a new thread for each
-  incoming request
+  incoming request. Fail2ban is not really thread-safe yet
 
 ver. 0.7.1 (2006/08/23) - alpha
 ----------
diff --git a/MANIFEST b/MANIFEST
index f3880d47..62101b22 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -5,11 +5,11 @@ fail2ban-client
 fail2ban-server
 fail2ban-testcases
 fail2ban-regex
-client/beautifier.py
 client/configreader.py
 client/jailreader.py
 client/fail2banreader.py
 client/jailsreader.py
+client/beautifier.py
 client/filterreader.py
 client/actionreader.py
 client/__init__.py
@@ -18,43 +18,44 @@ client/csocket.py
 server/ssocket.py
 server/banticket.py
 server/filter.py
-server/datedetector.py
-server/datetemplate.py
 server/server.py
+server/datestrptime.py
 server/failticket.py
 server/actions.py
+server/datetai64n.py
 server/faildata.py
 server/failmanager.py
+server/datedetector.py
 server/jailthread.py
 server/transmitter.py
 server/action.py
 server/ticket.py
 server/jail.py
 server/__init__.py
+server/dateepoch.py
 server/banmanager.py
-setup.py
-setup.cfg
+server/datetemplate.py
 testcases/banmanagertestcase.py
 testcases/failmanagertestcase.py
 testcases/clientreadertestcase.py
 testcases/filtertestcase.py
 testcases/__init__.py
+testcases/datedetectortestcase.py
 testcases/servertestcase.py
-testcases/files/testcase01.log
-testcases/files/testcase02.log
+setup.py
+setup.cfg
 version.py
 config/jail.conf
+config/filter.d/postfix.conf
 config/filter.d/vsftpd.conf
 config/filter.d/apache-auth.conf
-config/filter.d/sshd.conf
-config/filter.d/couriersmtp.conf
 config/filter.d/qmail.conf
-config/filter.d/postfix.conf
+config/filter.d/couriersmtp.conf
+config/filter.d/sshd.conf
 config/action.d/iptables.conf
 config/action.d/mail-whois.conf
 config/action.d/dummy.conf
 config/action.d/mail.conf
-config/action.d/mail-report.conf
 config/action.d/hostsdeny.conf
 config/fail2ban.conf
 files/gentoo-initd
diff --git a/README b/README
index e5516b60..e80123c1 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.1)                           2006/08/23
+Fail2Ban (version 0.7.2)                           2006/09/10
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -13,43 +13,8 @@ rules to reject the IP address. These rules can be defined by
 the user. Fail2Ban can read multiple log files such as sshd
 or Apache web server ones.
 
-This is my first Python program. Moreover, English is not my
-mother tongue...
-
-
-More details:
--------------
-
-Fail2Ban is rather simple. I have a home server connected to
-the Internet which runs apache, samba, sshd, ... I see in my
-logs that people are trying to log into my box using "manual"
-brute force or scripts. They try 10, 20 and sometimes more
-user/password (without success anyway). In order to
-discourage these script kiddies, I wanted that sshd refuse
-login from a specific ip after 3 password failures. After
-some Google searches, I found that sshd was not able of that.
-So I search for a script or program that do it. I found
-nothing :-( So I decide to write mine and to learn Python :-)
-
-For each sections defined in the configuration file, Fail2Ban
-tries to find lines which match the failregex. Then it
-retrieves the message time using timeregex and timepattern.
-It finally gets the ip and if it has already done 3 or more
-password failures in the last banTime, the ip is banned for
-banTime using a firewall rule. This rule is set by the user
-in the configuration file. Thus, Fail2Ban can be adapted for
-lots of firewall. After banTime, the rule is deleted. Notice
-that if no "plain" ip is available, Fail2Ban try to do DNS
-lookup in order to found one or several ip's to ban.
-
-Sections can be freely added so it is possible to monitor
-several daemons at the same time.
-
-Runs on my server and does its job rather well :-) The idea
-is to make fail2ban usable with daemons and services that
-require a login (sshd, telnetd, ...) and with different
-firewalls.
-
+Documentation, FAQ, HOWTOs are available on the project
+website: http://fail2ban.sourceforge.net
 
 Installation:
 -------------
@@ -58,8 +23,8 @@ Require: python-2.4 (http://www.python.org)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.7.1.tar.bz2
-> cd fail2ban-0.7.1
+> tar xvfj fail2ban-0.7.2.tar.bz2
+> cd fail2ban-0.7.2
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The
@@ -106,6 +71,7 @@ options (not complete yet):
 
     -c <DIR>                configuration directory
     -d                      dump configuration. For debugging
+    -i                      interactive mode
     -v                      increase verbosity
     -q                      decrease verbosity
     -x                      force execution of the server
@@ -121,14 +87,13 @@ Website: http://fail2ban.sourceforge.net
 
 Cyril Jaquier: <lostcontrol@users.sourceforge.net>
 
-
 Thanks:
 -------
 
-Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
+Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
 Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
 Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
-Edgington, Patrick Börjesson, kojiro, zugeschmiert
+Edgington, Patrick Börjesson, kojiro, zugeschmiert
 
 License:
 --------
diff --git a/TODO b/TODO
index 5e9be5e0..3a9d37d3 100644
--- a/TODO
+++ b/TODO
@@ -13,7 +13,9 @@ Legend:
 # partially done
 * done
 
-- Is there a do...while loop in Python? For interactive mode
+- Verify TAI64N
+
+* Is there a do...while loop in Python? For interactive mode
 
 # implement all get/set functions
 
@@ -23,7 +25,7 @@ Legend:
 
 * add a reload option to fail2ban-client
 
-- see Feature Request Tracking System at SourceForge.net
+# see Feature Request Tracking System at SourceForge.net
 
 * findall in dns.py should be no more needed
 
@@ -39,7 +41,7 @@ Legend:
 
 * better configuration files
 
-- add a check to see if the time of the log messages is
+* add a check to see if the time of the log messages is
   correctly detected (valid regexp)
 
 * remove debug mode (root check)
@@ -95,7 +97,7 @@ Legend:
   Should we start one thread per file or just one thread per
   serivce?
 
-- autodetect date format in log file. Match the most popular
+# autodetect date format in log file. Match the most popular
   format and sort them using the hit ratio. Should avoid
   user problem with regex and not have a big impact on perfs.
 

From 1c0386c3ea0ac21a675ec913f17a94e9bd3057dc Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Sep 2006 20:53:55 +0000
Subject: [PATCH 308/549] - Updated for 0.7.2

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@347 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.py b/version.py
index 0181c320..015ed021 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.1-SVN"
+version = "0.7.2"

From d1cdfdaf0148e85742804cd40b097dd910052c00 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Sep 2006 21:06:15 +0000
Subject: [PATCH 309/549] - Small fixes

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@348 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 599804c0..d4ae216b 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -143,12 +143,12 @@ class Fail2banClient:
 					print beautifier.beautifyError(ret[1])
 					return False
 			except socket.error:
-				logSys.error("Unable to contact server. Is it running?")
+				if showRet:
+					logSys.error("Unable to contact server. Is it running?")
 				return False
 			except Exception, e:
 				if showRet:
 					logSys.error(e)
-					logSys.error("Arrggh... Start the server first")
 				return False
 		return True
 		

From 25664605aa5f1e99b2b1f7d8b0c81f1e823edd00 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 11 Sep 2006 21:15:24 +0000
Subject: [PATCH 310/549] - Apache date start with '['

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@349 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/datedetector.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/datedetector.py b/server/datedetector.py
index 1513bd48..65c575b0 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -52,7 +52,7 @@ class DateDetector:
 		# asctime
 		template = DateStrptime()
 		template.setName("Weekday Month Day Hour:Minute:Second Year")
-		template.setRegex("^\S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}")
+		template.setRegex("\S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}")
 		template.setPattern("%a %b %d %H:%M:%S %Y")
 		self.templates.append(template)
 		# TAI64N

From 700c1b26a68cb538ecd359264223d5550d541c26 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Sep 2006 21:33:00 +0000
Subject: [PATCH 311/549] - Added man pages - Added --version option - Adapted
 help output to meet help2man requirements

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@350 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client         | 40 ++++++++++++------
 fail2ban-server         | 23 ++++++++--
 man/fail2ban-client.1   | 94 +++++++++++++++++++++++++++++++++++++++++
 man/fail2ban-client.h2m | 15 +++++++
 man/fail2ban-client.man | 94 +++++++++++++++++++++++++++++++++++++++++
 man/fail2ban-server.1   | 41 ++++++++++++++++++
 man/fail2ban-server.h2m | 15 +++++++
 man/generate-man        |  5 +++
 8 files changed, 310 insertions(+), 17 deletions(-)
 create mode 100644 man/fail2ban-client.1
 create mode 100644 man/fail2ban-client.h2m
 create mode 100644 man/fail2ban-client.man
 create mode 100644 man/fail2ban-server.1
 create mode 100644 man/fail2ban-server.h2m
 create mode 100755 man/generate-man

diff --git a/fail2ban-client b/fail2ban-client
index d4ae216b..a5fd4eb7 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -58,17 +58,36 @@ class Fail2banClient:
 		self.conf["force"] = False
 		self.conf["verbose"] = 2
 		self.conf["interactive"] = False
+		
+	def dispVersion(self):
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2006 Cyril Jaquier"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
 	
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
-		print "Usage: "+self.argv[0]+" [OPTIONS] <COMMAND>"
+		print "Usage: "+self.argv[0]+" [OPTIONS]... <COMMAND>"
 		print
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
 		print
-		print "  <COMMAND>"
+		print "Options:"
+		print "    -c <DIR>                configuration directory"
+		print "    -d                      dump configuration. For debugging"
+		print "    -i                      interactive mode"
+		print "    -v                      increase verbosity"
+		print "    -q                      decrease verbosity"
+		print "    -x                      force execution of the server"
+		print "    -h, --help              display this help message"
+		print "    -V, --version           print the version"
 		print
+		print "Command:"
 		print "    start                   start the server and the jails"
 		print "    reload                  reload the configuration"
 		print "    stop                    stop all jails and terminate the server"
@@ -86,16 +105,6 @@ class Fail2banClient:
 		print "    stop <JAIL>             stop <JAIL>. The jail is removed"
 		print "    status <JAIL>           get the current status of <JAIL>"
 		print
-		print "  [OPTIONS]"
-		print
-		print "    -c <DIR>                configuration directory"
-		print "    -d                      dump configuration. For debugging"
-		print "    -i                      interactive mode"
-		print "    -v                      increase verbosity"
-		print "    -q                      decrease verbosity"
-		print "    -x                      force execution of the server"
-		print "    -h                      display this help message"
-		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	
 	def dispInteractive(self):
@@ -122,6 +131,9 @@ class Fail2banClient:
 			elif opt[0] in ["-h", "--help"]:
 	 			self.dispUsage()
 	 			sys.exit(0)
+	 		elif opt[0] in ["-V", "--version"]:
+	 			self.dispVersion()
+	 			sys.exit(0)
 	
 	def ping(self):
 		return self.processCmd([["ping"]], False)
@@ -232,8 +244,8 @@ class Fail2banClient:
 		
 		# Reads the command line options.
 		try:
-			cmdOpts = 'hc:xdviq'
-			cmdLongOpts = ['help']
+			cmdOpts = 'hc:xdviqV'
+			cmdLongOpts = ['help', 'version']
 			optList, args = getopt.getopt(self.argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
 			self.dispUsage()
diff --git a/fail2ban-server b/fail2ban-server
index 67a14144..e3f91162 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -51,6 +51,16 @@ class Fail2banServer:
 		self.conf["background"] = True
 		self.conf["force"] = False
 	
+	def dispVersion(self):
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2006 Cyril Jaquier"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+	
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
@@ -59,13 +69,16 @@ class Fail2banServer:
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
 		print
+		print "Only use this command for debugging purpose. Start the server with"
+		print "fail2ban-client instead."
+		print
+		print "Options:"
 		print "  -b         start in background"
 		print "  -f         start in foreground"
 		print "  -x         force execution of the server"
 		print "  -h         display this help message"
 		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
-		sys.exit(0)
 	
 	def getCmdLineOptions(self, optList):
 		""" Gets the command line options
@@ -79,6 +92,10 @@ class Fail2banServer:
 				self.conf["force"] = True
 			if opt[0] in ["-h", "--help"]:
 	 			self.dispUsage()
+				sys.exit(0)
+			if opt[0] in ["-V", "--version"]:
+	 			self.dispVersion()
+				sys.exit(0)
 	
 	#def sigTERMhandler(signum, frame):
 	#	""" Handles the TERM signal when in daemon mode in order to
@@ -93,8 +110,8 @@ class Fail2banServer:
 		
 		# Reads the command line options.
 		try:
-			cmdOpts = 'bfxh'
-			cmdLongOpts = ['help']
+			cmdOpts = 'bfxhV'
+			cmdLongOpts = ['help', 'version']
 			optList, args = getopt.getopt(self.argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
 			self.dispUsage()
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
new file mode 100644
index 00000000..da6ca5bc
--- /dev/null
+++ b/man/fail2ban-client.1
@@ -0,0 +1,94 @@
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
+.TH FAIL2BAN-CLIENT "1" "September 2006" "fail2ban-client v0.7.2" "User Commands"
+.SH NAME
+fail2ban-client \- configure and control the server
+.SH SYNOPSIS
+.B fail2ban-client
+[\fIOPTIONS\fR]... \fI<COMMAND>\fR
+.SH DESCRIPTION
+Fail2Ban v0.7.2 reads log file that contains password failure report
+and bans the corresponding IP addresses using firewall rules.
+.SH OPTIONS
+.TP
+\fB\-c\fR <DIR>
+configuration directory
+.TP
+\fB\-d\fR
+dump configuration. For debugging
+.TP
+\fB\-i\fR
+interactive mode
+.TP
+\fB\-v\fR
+increase verbosity
+.TP
+\fB\-q\fR
+decrease verbosity
+.TP
+\fB\-x\fR
+force execution of the server
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+display this help message
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+print the version
+.SH COMMAND
+.SS "Command:"
+.TP
+start
+start the server and the jails
+.TP
+reload
+reload the configuration
+.TP
+stop
+stop all jails and terminate the server
+.TP
+status
+get the current status
+.TP
+set loglevel <LEVEL>
+set loglevel to <LEVEL>
+.TP
+get loglevel
+get loglevel
+.TP
+set logtarget <TARGET>
+set log target to <TARGET>
+.TP
+get logtarget
+get log target
+.TP
+add <JAIL>
+create <JAIL>
+.TP
+set <JAIL> <CMD>
+set the <CMD> value for <JAIL>
+.TP
+get <JAIL> <CMD>
+get the <CMD> value for <JAIL>
+.TP
+start <JAIL>
+start <JAIL>
+.TP
+stop <JAIL>
+stop <JAIL>. The jail is removed
+.TP
+status <JAIL>
+get the current status of <JAIL>
+.SH FILES
+\fI/etc/fail2ban/*\fR
+.SH AUTHOR
+Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
+Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
+.SH "REPORTING BUGS"
+Report bugs to <lostcontrol@users.sourceforge.net>
+.SH COPYRIGHT
+Copyright \(co 2004-2006 Cyril Jaquier
+.br
+Copyright of modifications held by their respective authors.
+Licensed under the GNU General Public License v2 (GPL).
+.SH "SEE ALSO"
+.br 
+fail2ban-server(1)
diff --git a/man/fail2ban-client.h2m b/man/fail2ban-client.h2m
new file mode 100644
index 00000000..eedb7eb5
--- /dev/null
+++ b/man/fail2ban-client.h2m
@@ -0,0 +1,15 @@
+Include file for help2man man page
+$Id:  $
+
+[name]
+fail2ban-client \- configure and control the server
+
+/print the version/
+.SH COMMAND
+
+[files]
+\fI/etc/fail2ban/*\fR
+
+[see also]
+.br 
+fail2ban-server(1)
diff --git a/man/fail2ban-client.man b/man/fail2ban-client.man
new file mode 100644
index 00000000..c390c2f9
--- /dev/null
+++ b/man/fail2ban-client.man
@@ -0,0 +1,94 @@
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
+.TH FAIL2BAN-CLIENT "1" "September 2006" "fail2ban-client v0.7.2" "User Commands"
+.SH NAME
+fail2ban-client \- Ban IPs that make too many password failure
+.SH SYNOPSIS
+.B fail2ban-client
+[\fIOPTIONS\fR]... \fI<COMMAND>\fR
+.SH DESCRIPTION
+Fail2Ban v0.7.2 reads log file that contains password failure report
+and bans the corresponding IP addresses using firewall rules.
+.SH OPTIONS
+.TP
+\fB\-c\fR <DIR>
+configuration directory
+.TP
+\fB\-d\fR
+dump configuration. For debugging
+.TP
+\fB\-i\fR
+interactive mode
+.TP
+\fB\-v\fR
+increase verbosity
+.TP
+\fB\-q\fR
+decrease verbosity
+.TP
+\fB\-x\fR
+force execution of the server
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+display this help message
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+print the version
+.SH COMMAND
+.SS "Command:"
+.TP
+start
+start the server and the jails
+.TP
+reload
+reload the configuration
+.TP
+stop
+stop all jails and terminate the server
+.TP
+status
+get the current status
+.TP
+set loglevel <LEVEL>
+set loglevel to <LEVEL>
+.TP
+get loglevel
+get loglevel
+.TP
+set logtarget <TARGET>
+set log target to <TARGET>
+.TP
+get logtarget
+get log target
+.TP
+add <JAIL>
+create <JAIL>
+.TP
+set <JAIL> <CMD>
+set the <CMD> value for <JAIL>
+.TP
+get <JAIL> <CMD>
+get the <CMD> value for <JAIL>
+.TP
+start <JAIL>
+start <JAIL>
+.TP
+stop <JAIL>
+stop <JAIL>. The jail is removed
+.TP
+status <JAIL>
+get the current status of <JAIL>
+.SH FILES
+\fI/etc/fail2ban/*\fR
+.SH AUTHOR
+Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
+Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
+.SH "REPORTING BUGS"
+Report bugs to <lostcontrol@users.sourceforge.net>
+.SH COPYRIGHT
+Copyright \(co 2004-2006 Cyril Jaquier
+.br
+Copyright of modifications held by their respective authors.
+Licensed under the GNU General Public License v2 (GPL).
+.SH "SEE ALSO"
+.br 
+fail2ban-server(1x)
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
new file mode 100644
index 00000000..a7743a0c
--- /dev/null
+++ b/man/fail2ban-server.1
@@ -0,0 +1,41 @@
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
+.TH FAIL2BAN-SERVER "1" "September 2006" "fail2ban-server v0.7.2" "User Commands"
+.SH NAME
+fail2ban-server \- start the server
+.SH SYNOPSIS
+.B fail2ban-server
+[\fIOPTIONS\fR]
+.SH DESCRIPTION
+Fail2Ban v0.7.2 reads log file that contains password failure report
+and bans the corresponding IP addresses using firewall rules.
+.PP
+Only use this command for debugging purpose. Start the server with
+fail2ban\-client instead.
+.SH OPTIONS
+.TP
+\fB\-b\fR
+start in background
+.TP
+\fB\-f\fR
+start in foreground
+.TP
+\fB\-x\fR
+force execution of the server
+.TP
+\fB\-h\fR
+display this help message
+.SH FILES
+\fI/etc/fail2ban/*\fR
+.SH AUTHOR
+Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
+Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
+.SH "REPORTING BUGS"
+Report bugs to <lostcontrol@users.sourceforge.net>
+.SH COPYRIGHT
+Copyright \(co 2004-2006 Cyril Jaquier
+.br
+Copyright of modifications held by their respective authors.
+Licensed under the GNU General Public License v2 (GPL).
+.SH "SEE ALSO"
+.br 
+fail2ban-client(1)
diff --git a/man/fail2ban-server.h2m b/man/fail2ban-server.h2m
new file mode 100644
index 00000000..d58a00f1
--- /dev/null
+++ b/man/fail2ban-server.h2m
@@ -0,0 +1,15 @@
+Include file for help2man man page
+$Id:  $
+
+[name]
+fail2ban-server \- start the server
+
+/print the version/
+.SH COMMAND
+
+[files]
+\fI/etc/fail2ban/*\fR
+
+[see also]
+.br 
+fail2ban-client(1)
diff --git a/man/generate-man b/man/generate-man
new file mode 100755
index 00000000..7794b556
--- /dev/null
+++ b/man/generate-man
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+help2man --section=1 --no-info --include=fail2ban-client.h2m --output fail2ban-client.1 ../fail2ban-client
+help2man --section=1 --no-info --include=fail2ban-server.h2m --output fail2ban-server.1 ../fail2ban-server
+

From b03d4d38bf6a7a6418a948d05310c38e554bdf6e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Sep 2006 21:40:19 +0000
Subject: [PATCH 312/549] - Updated (man pages)

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@351 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  | 6 +++++-
 MANIFEST   | 2 ++
 version.py | 2 +-
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 7385fe44..bdb37efb 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,13 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.2)                           2006/09/10
+Fail2Ban (version 0.7.3)                           2006/??/??
 =============================================================
 
+ver. 0.7.3 (2006/??/??) - beta
+----------
+- Added man pages. Thanks to Yaroslav Halchenko
+
 ver. 0.7.2 (2006/09/10) - beta
 ----------
 - Refactoring and code cleanup
diff --git a/MANIFEST b/MANIFEST
index 62101b22..0bdff79c 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -58,4 +58,6 @@ config/action.d/dummy.conf
 config/action.d/mail.conf
 config/action.d/hostsdeny.conf
 config/fail2ban.conf
+man/fail2ban-client.1
+man/fail2ban-server.1
 files/gentoo-initd
diff --git a/version.py b/version.py
index 015ed021..faadc12e 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.2"
+version = "0.7.2-SVN"

From 1d9bc1152d7ad74570fdd33c23e48b70af0b913f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Sep 2006 21:58:28 +0000
Subject: [PATCH 313/549] - Added --version in help

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@352 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-server | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/fail2ban-server b/fail2ban-server
index e3f91162..ddfb499d 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -73,10 +73,11 @@ class Fail2banServer:
 		print "fail2ban-client instead."
 		print
 		print "Options:"
-		print "  -b         start in background"
-		print "  -f         start in foreground"
-		print "  -x         force execution of the server"
-		print "  -h         display this help message"
+		print "  -b             start in background"
+		print "  -f             start in foreground"
+		print "  -x             force execution of the server"
+		print "  -h, --help     display this help message"
+		print "  -V, --version  print the version"
 		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	

From 96297b7cf3721c855f0896e4b2d148a82efe66f9 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 12 Sep 2006 21:59:32 +0000
Subject: [PATCH 314/549] - Fixed Command description with sed. Thanks to
 Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@353 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 man/fail2ban-client.1   | 5 ++---
 man/fail2ban-client.h2m | 3 ---
 man/fail2ban-server.1   | 9 ++++++---
 man/fail2ban-server.h2m | 3 ---
 man/generate-man        | 4 ++++
 5 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index da6ca5bc..0a63dd50 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "September 2006" "fail2ban-client v0.7.2" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "September 2006" "fail2ban-client v0.7.2-SVN" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH SYNOPSIS
 .B fail2ban-client
 [\fIOPTIONS\fR]... \fI<COMMAND>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.2 reads log file that contains password failure report
+Fail2Ban v0.7.2\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
@@ -34,7 +34,6 @@ display this help message
 \fB\-V\fR, \fB\-\-version\fR
 print the version
 .SH COMMAND
-.SS "Command:"
 .TP
 start
 start the server and the jails
diff --git a/man/fail2ban-client.h2m b/man/fail2ban-client.h2m
index eedb7eb5..9ae9c3f2 100644
--- a/man/fail2ban-client.h2m
+++ b/man/fail2ban-client.h2m
@@ -4,9 +4,6 @@ $Id:  $
 [name]
 fail2ban-client \- configure and control the server
 
-/print the version/
-.SH COMMAND
-
 [files]
 \fI/etc/fail2ban/*\fR
 
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index a7743a0c..3e9848b2 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "September 2006" "fail2ban-server v0.7.2" "User Commands"
+.TH FAIL2BAN-SERVER "1" "September 2006" "fail2ban-server v0.7.2-SVN" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.7.2 reads log file that contains password failure report
+Fail2Ban v0.7.2\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with
@@ -22,8 +22,11 @@ start in foreground
 \fB\-x\fR
 force execution of the server
 .TP
-\fB\-h\fR
+\fB\-h\fR, \fB\-\-help\fR
 display this help message
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+print the version
 .SH FILES
 \fI/etc/fail2ban/*\fR
 .SH AUTHOR
diff --git a/man/fail2ban-server.h2m b/man/fail2ban-server.h2m
index d58a00f1..3e856a51 100644
--- a/man/fail2ban-server.h2m
+++ b/man/fail2ban-server.h2m
@@ -4,9 +4,6 @@ $Id:  $
 [name]
 fail2ban-server \- start the server
 
-/print the version/
-.SH COMMAND
-
 [files]
 \fI/etc/fail2ban/*\fR
 
diff --git a/man/generate-man b/man/generate-man
index 7794b556..730a31d2 100755
--- a/man/generate-man
+++ b/man/generate-man
@@ -1,5 +1,9 @@
 #!/bin/bash
 
+# fail2ban-client
 help2man --section=1 --no-info --include=fail2ban-client.h2m --output fail2ban-client.1 ../fail2ban-client
+sed -i -e 's/.SS "Command:"/.SH COMMAND/' fail2ban-client.1
+
+# fail2ban-server
 help2man --section=1 --no-info --include=fail2ban-server.h2m --output fail2ban-server.1 ../fail2ban-server
 

From e146d0739443e7474b08017efbac410db9cb42c3 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 13 Sep 2006 21:31:22 +0000
Subject: [PATCH 315/549] - Added wildcards support for "logpath" - Added "set
 <jail> addlogpath <path>" and "set <jail> dellogpath <path>" - Adapted pyunit
 test

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@354 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                   |   1 +
 TODO                        |   3 +-
 client/beautifier.py        |  16 +++--
 client/jailreader.py        |   9 ++-
 server/actions.py           |   2 -
 server/filter.py            | 126 +++++++++++++++++++++++-------------
 server/server.py            |   8 ++-
 server/transmitter.py       |   9 ++-
 testcases/filtertestcase.py |  11 ++--
 9 files changed, 120 insertions(+), 65 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index bdb37efb..a4a0241c 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -10,6 +10,7 @@ Fail2Ban (version 0.7.3)                           2006/??/??
 ver. 0.7.3 (2006/??/??) - beta
 ----------
 - Added man pages. Thanks to Yaroslav Halchenko
+- Added wildcard support for "logpath"
 
 ver. 0.7.2 (2006/09/10) - beta
 ----------
diff --git a/TODO b/TODO
index 3a9d37d3..97337c60 100644
--- a/TODO
+++ b/TODO
@@ -92,10 +92,11 @@ Legend:
 
 * remove most of the command lines options if possible.
 
-- add the possibility to specify wildcard in log files.
+* add the possibility to specify wildcard in log files.
   Example: logfile = /var/log/apache2/access-*.log
   Should we start one thread per file or just one thread per
   serivce?
+  We use just one thread per service
 
 # autodetect date format in log file. Match the most popular
   format and sort them using the hit ratio. Should avoid
diff --git a/client/beautifier.py b/client/beautifier.py
index c2443e8d..916a3f6b 100644
--- a/client/beautifier.py
+++ b/client/beautifier.py
@@ -50,10 +50,11 @@ class Beautifier:
 		
 	def beautify(self, response):
 		logSys.debug("Beautify " + `response` + " with " + `self.inputCmd`)
+		inC = self.inputCmd
 		msg = response
-		if self.inputCmd[0:1] == ['status']:
-			if len(self.inputCmd) > 1:
-				msg = "Status for the jail: " + self.inputCmd[1] + "\n"
+		if inC[0:1] == ['status']:
+			if len(inC) > 1:
+				msg = "Status for the jail: " + inC[1] + "\n"
 				msg = msg + "|- " + response[0][0] + "\n"
 				msg = msg + "|  |- " + response[0][1][0][0] + ":\t\t" + `response[0][1][0][1]` + "\n"
 				msg = msg + "|  `- " + response[0][1][1][0] + ":\t\t" + `response[0][1][1][1]` + "\n"
@@ -64,7 +65,7 @@ class Beautifier:
 				msg = "Status\n"
 				msg = msg + "|- " + response[0][0] + ":\t" + `response[0][1]` + "\n"
 				msg = msg + "`- " + response[1][0] + ":\t\t" + response[1][1]
-		elif self.inputCmd[1:2] == ['loglevel']:
+		elif inC[1:2] == ['loglevel']:
 			msg = "Current logging level is "
 			if response == 1:
 				msg = msg + "ERROR"
@@ -76,9 +77,14 @@ class Beautifier:
 				msg = msg + "DEBUG"
 			else:
 				msg = msg + `response`
-		elif self.inputCmd == ["stop"]:
+		elif inC == ["stop"]:
 			if response == None:
 				msg = "Shutdown successful"
+		elif inC[2] == "logpath" or inC[2] == "addlogpath" or inC[2] == "dellogpath":
+			msg = "Current monitored log file(s):\n"
+			for path in response[:-1]:
+				msg = msg + "|- " + path + "\n"
+			msg = msg + "`- " + response[len(response)-1]
 		return msg
 
 	def beautifyError(self, response):
diff --git a/client/jailreader.py b/client/jailreader.py
index 986f3645..4df4ecc8 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -24,7 +24,8 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import logging, re
+import logging, re, glob
+
 from configreader import ConfigReader
 from filterreader import FilterReader
 from actionreader import ActionReader
@@ -95,7 +96,11 @@ class JailReader(ConfigReader):
 		stream = [["add", self.name]]
 		for opt in self.opts:
 			if opt == "logpath":
-				stream.append(["set", self.name, "logpath", self.opts[opt]])
+				pathList = glob.glob(self.opts[opt])
+				if len(pathList) == 0:
+					logSys.error("No file found for " + self.opts[opt])
+				for path in pathList:
+					stream.append(["set", self.name, "addlogpath", path])
 			elif opt == "maxretry":
 				stream.append(["set", self.name, "maxretry", self.opts[opt]])
 			elif opt == "maxtime":
diff --git a/server/actions.py b/server/actions.py
index 7cf7d692..66a0eecd 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -128,7 +128,6 @@ class Actions(JailThread):
 	# @return True if an IP address get banned
 	
 	def checkBan(self):
-		logSys.debug("Check for IP address to ban")
 		ticket = self.jail.getFailTicket()
 		if ticket != False:
 			aInfo = dict()
@@ -148,7 +147,6 @@ class Actions(JailThread):
 	# Unban IP address which are outdated.
 	
 	def checkUnBan(self):
-		logSys.debug("Check for IP address to unban")
 		for ticket in self.banManager.unBanList(time.time()):
 			aInfo = dict()
 			aInfo["ip"] = ticket.getIP()
diff --git a/server/filter.py b/server/filter.py
index a4bbe3db..a83a66c7 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -57,9 +57,10 @@ class Filter(JailThread):
 		## The failures manager.
 		self.failManager = FailManager()
 		## The log file handler.
-		self.fileHandler = None
+		self.crtHandler = None
+		self.crtFilename = None
 		## The log file path.
-		self.logPath = ''
+		self.logPath = []
 		## The regular expression matching the failure.
 		self.failRegex = ''
 		self.failRegexObj = None
@@ -68,26 +69,49 @@ class Filter(JailThread):
 		## The ignore IP list.
 		self.ignoreIpList = []
 		## The time of the last modification of the file.
-		self.lastModTime = 0
+		self.lastModTime = dict()
 		## The last position of the file.
-		self.lastPos = 0
+		self.lastPos = dict()
 		## The last date in tht log file.
-		self.lastDate = 0
-		## The file statistics.
-		self.logStats = None
+		self.lastDate = dict()
+		self.file404Cnt = dict()
+		
 		self.dateDetector = DateDetector()
 		self.dateDetector.addDefaultTemplate()
-		self.fileNotFoundCnt = 0
 		logSys.info("Created Filter")
 
 	##
-	# Set the log file path
+	# Add a log file path
 	#
-	# @param value log file path
+	# @param path log file path
 
-	def setLogPath(self, value):
-		self.logPath = value
-		logSys.info("Set logfile = %s" % value)
+	def addLogPath(self, path):
+		try:
+			self.logPath.index(path)
+			logSys.error(path + " already exists")
+		except ValueError:
+			self.logPath.append(path)
+			# Initialize default values
+			self.lastDate[path] = 0
+			self.lastModTime[path] = 0
+			self.lastPos[path] = 0
+			self.file404Cnt[path] = 0
+			logSys.info("Added logfile = %s" % path)
+	
+	##
+	# Delete a log path
+	#
+	# @param path the log file to delete
+	
+	def delLogPath(self, path):
+		try:
+			self.logPath.remove(path)
+			del self.lastDate[path]
+			del self.lastModTime[path]
+			del self.lastPos[path]
+			logSys.info("Removed logfile = %s" % path)
+		except ValueError:
+			logSys.error(path + " is not monitored")
 
 	##
 	# Get the log file path
@@ -213,11 +237,16 @@ class Filter(JailThread):
 
 	def run(self):
 		self.setActive(True)
+		prevModified = False
 		while self.isActive():
 			if not self.isIdle:
-				if self.isModified():
-					self.getFailures()
+				if prevModified:
 					self.dateDetector.sortTemplate()
+				prevModified = False
+				for file in self.logPath:
+					if self.isModified(file):
+						self.getFailures(file)
+						prevModified = True
 				try:
 					ticket = self.failManager.toBan()
 					self.jail.putFailTicket(ticket)
@@ -267,19 +296,21 @@ class Filter(JailThread):
 	##
 	# Open the log file.
 	
-	def openLogFile(self):
+	def openLogFile(self, filename):
 		""" Opens the log file specified on init.
 		"""
 		try:
-			self.fileHandler = open(self.logPath)
+			self.crtFilename = filename
+			self.crtHandler = open(filename)
 		except OSError:
-			logSys.error("Unable to open "+self.logPath)
+			logSys.error("Unable to open " + filename)
 	
 	##
 	# Close the log file.
 	
 	def closeLogFile(self):
-		self.fileHandler.close()
+		self.crtFilename = None
+		self.crtHandler.close()
 	
 	##
 	# Checks if the log file has been modified.
@@ -287,23 +318,23 @@ class Filter(JailThread):
 	# Checks if the log file has been modified using os.stat().
 	# @return True if log file has been modified
 	
-	def isModified(self):
+	def isModified(self, filename):
 		try:
-			self.logStats = os.stat(self.logPath)
-			self.fileNotFoundCnt = 0
-			if self.lastModTime == self.logStats.st_mtime:
+			logStats = os.stat(filename)
+			self.file404Cnt[filename] = 0
+			if self.lastModTime[filename] == logStats.st_mtime:
 				return False
 			else:
-				logSys.debug(self.logPath + " has been modified")
-				self.lastModTime = self.logStats.st_mtime
+				logSys.debug(filename + " has been modified")
+				self.lastModTime[filename] = logStats.st_mtime
 				return True
 		except OSError:
-			logSys.error("Unable to get stat on " + self.logPath)
-			self.fileNotFoundCnt = self.fileNotFoundCnt + 1
-			if self.fileNotFoundCnt > 2:
+			logSys.error("Unable to get stat on " + filename)
+			self.file404Cnt[filename] = self.file404Cnt[filename] + 1
+			if self.file404Cnt[filename] > 2:
 				logSys.warn("Too much read error. Set the jail idle")
 				self.jail.setIdle(True)
-				self.fileNotFoundCnt = 0
+				self.file404Cnt[filename] = 0
 			return False
 
 	##
@@ -314,22 +345,23 @@ class Filter(JailThread):
 	# timestamp in order to detect this.
 	
 	def setFilePos(self):
-		line = self.fileHandler.readline()
-		if self.lastDate < self.dateDetector.getTime(line):
-			logSys.debug("Date " + `self.lastDate` + " is " + "smaller than " +
-							`self.dateDetector.getTime(line)`)
-			logSys.debug("Log rotation detected for " + self.logPath)
-			self.lastPos = 0
-		
-		logSys.debug("Setting file position to " + `self.lastPos` + " for " +
-						self.logPath)
-		self.fileHandler.seek(self.lastPos)
+		line = self.crtHandler.readline()
+		lastDate = self.lastDate[self.crtFilename]
+		lineDate = self.dateDetector.getUnixTime(line)
+		if lastDate < lineDate:
+			logSys.debug("Date " + `lastDate` + " is smaller than " + `lineDate`)
+			logSys.debug("Log rotation detected for " + self.crtFilename)
+			self.lastPos[self.crtFilename] = 0
+		lastPos = self.lastPos[self.crtFilename]
+		logSys.debug("Setting file position to " + `lastPos` + " for " +
+					 self.crtFilename)
+		self.crtHandler.seek(lastPos)
 
 	##
 	# Get the file position.
 	
 	def getFilePos(self):
-		return self.fileHandler.tell()
+		return self.crtHandler.tell()
 
 	##
 	# Gets all the failure in the log file.
@@ -338,18 +370,20 @@ class Filter(JailThread):
 	# time.time()-self.findTime. When a failure is detected, a FailTicket
 	# is created and is added to the FailManager.
 	
-	def getFailures(self):
+	def getFailures(self, filename):
 		ipList = dict()
-		logSys.debug(self.logPath)
-		self.openLogFile()
+		logSys.debug(filename)
+		self.openLogFile(filename)
 		self.setFilePos()
 		lastLine = None
-		for line in self.fileHandler:
+		for line in self.crtHandler:
 			try:
 				# Try to convert UTF-8 string to Latin-1
 				line = line.decode('utf-8').encode('latin-1')
 			except UnicodeDecodeError:
 				pass
+			except UnicodeEncodeError:
+				logSys.warn("Mmhh... Are you sure you watch the correct file?")
 			if not self.dateDetector.matchTime(line):
 				# There is no valid time in this line
 				continue
@@ -364,9 +398,9 @@ class Filter(JailThread):
 					continue
 				logSys.debug("Found "+ip)
 				self.failManager.addFailure(FailTicket(ip, unixTime))
-		self.lastPos = self.getFilePos()
+		self.lastPos[filename] = self.getFilePos()
 		if lastLine:
-			self.lastDate = self.dateDetector.getTime(lastLine)
+			self.lastDate[filename] = self.dateDetector.getTime(lastLine)
 		self.closeLogFile()
 
 	##
diff --git a/server/server.py b/server/server.py
index 974d04f1..0b39a417 100644
--- a/server/server.py
+++ b/server/server.py
@@ -123,9 +123,13 @@ class Server:
 			raise ServerUnknownJail(name)
 	
 	# Filter
-	def setLogPath(self, name, file):
+	def addLogPath(self, name, file):
 		if self.jails.has_key(name):
-			self.jails[name].getFilter().setLogPath(file)
+			self.jails[name].getFilter().addLogPath(file)
+	
+	def delLogPath(self, name, file):
+		if self.jails.has_key(name):
+			self.jails[name].getFilter().delLogPath(file)
 	
 	def getLogPath(self, name):
 		return self.getFilter(name).getLogPath()
diff --git a/server/transmitter.py b/server/transmitter.py
index 2415cf73..c01c0e7f 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -129,9 +129,14 @@ class Transmitter:
 				self.server.setIdleJail(name, False)
 			return self.server.getIdleJail(name)
 		# Filter
-		elif action[1] == "logpath":
+		elif action[1] == "addlogpath":
+			value = action[2:]
+			for path in value:
+				self.server.addLogPath(name, path)
+			return self.server.getLogPath(name)
+		elif action[1] == "dellogpath":
 			value = action[2]
-			self.server.setLogPath(name, value)
+			self.server.delLogPath(name, value)
 			return self.server.getLogPath(name)
 		elif action[1] == "timeregex":
 			value = action[2]
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index f23cfd10..be62fc5a 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -52,20 +52,21 @@ class IgnoreIP(unittest.TestCase):
 
 class LogFile(unittest.TestCase):
 
+	filename = "testcases/files/testcase01.log"
+
 	def setUp(self):
 		"""Call before every test case."""
 		self.filter = Filter(None)
-		self.filter.setLogPath("testcases/files/testcase01.log")
+		self.filter.addLogPath(LogFile.filename)
 
 	def tearDown(self):
 		"""Call after every test case."""
 		
 	def testOpen(self):
-		self.filter.openLogFile()
+		self.filter.openLogFile(LogFile.filename)
 	
 	def testIsModified(self):
-		self.filter.openLogFile()
-		self.assertTrue(self.filter.isModified())
+		self.assertTrue(self.filter.isModified(LogFile.filename))
 
 
 class GetFailures(unittest.TestCase):
@@ -73,7 +74,7 @@ class GetFailures(unittest.TestCase):
 	def setUp(self):
 		"""Call before every test case."""
 		self.filter = Filter(None)
-		self.filter.setLogPath("testcases/files/testcase01.log")
+		self.filter.addLogPath("testcases/files/testcase01.log")
 		self.filter.setTimeRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 		self.filter.setTimePattern("%b %d %H:%M:%S")
 		self.filter.setFailRegex("(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)")

From 7f7361a2829896a4056d3cc4129cc2ce1bcdcede Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 14 Sep 2006 22:05:32 +0000
Subject: [PATCH 316/549] - Added Gamin (file and directory monitoring system)
 support - If Gamin is not available, polling is used

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@355 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                   |   1 +
 MANIFEST                    |   2 +
 README                      |   6 +-
 server/filter.py            |  71 ++---------------
 server/filtergamin.py       | 132 ++++++++++++++++++++++++++++++++
 server/filterpoll.py        | 149 ++++++++++++++++++++++++++++++++++++
 server/jail.py              |  18 ++++-
 testcases/filtertestcase.py |   8 +-
 8 files changed, 312 insertions(+), 75 deletions(-)
 create mode 100644 server/filtergamin.py
 create mode 100644 server/filterpoll.py

diff --git a/CHANGELOG b/CHANGELOG
index a4a0241c..09687626 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -11,6 +11,7 @@ ver. 0.7.3 (2006/??/??) - beta
 ----------
 - Added man pages. Thanks to Yaroslav Halchenko
 - Added wildcard support for "logpath"
+- Added Gamin (file and directory monitoring system) support
 
 ver. 0.7.2 (2006/09/10) - beta
 ----------
diff --git a/MANIFEST b/MANIFEST
index 0bdff79c..9e1f6e0b 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -18,6 +18,8 @@ client/csocket.py
 server/ssocket.py
 server/banticket.py
 server/filter.py
+server/filtergamin.py
+server/filterpoll.py
 server/server.py
 server/datestrptime.py
 server/failticket.py
diff --git a/README b/README
index e80123c1..8e32f1a3 100644
--- a/README
+++ b/README
@@ -19,7 +19,11 @@ website: http://fail2ban.sourceforge.net
 Installation:
 -------------
 
-Require: python-2.4 (http://www.python.org)
+Required:
+   >=python-2.4 (http://www.python.org)
+
+Optional:
+   >=gamin-0.0.21 (http://www.gnome.org/~veillard/gamin)
 
 To install, just do:
 
diff --git a/server/filter.py b/server/filter.py
index a83a66c7..4e5fc8b4 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -68,35 +68,26 @@ class Filter(JailThread):
 		self.findTime = 6000
 		## The ignore IP list.
 		self.ignoreIpList = []
+		self.modified = False
 		## The time of the last modification of the file.
 		self.lastModTime = dict()
 		## The last position of the file.
 		self.lastPos = dict()
 		## The last date in tht log file.
 		self.lastDate = dict()
-		self.file404Cnt = dict()
 		
 		self.dateDetector = DateDetector()
 		self.dateDetector.addDefaultTemplate()
 		logSys.info("Created Filter")
 
+
 	##
 	# Add a log file path
 	#
 	# @param path log file path
 
 	def addLogPath(self, path):
-		try:
-			self.logPath.index(path)
-			logSys.error(path + " already exists")
-		except ValueError:
-			self.logPath.append(path)
-			# Initialize default values
-			self.lastDate[path] = 0
-			self.lastModTime[path] = 0
-			self.lastPos[path] = 0
-			self.file404Cnt[path] = 0
-			logSys.info("Added logfile = %s" % path)
+		raise Exception("addLogPath() is abstract")
 	
 	##
 	# Delete a log path
@@ -104,14 +95,7 @@ class Filter(JailThread):
 	# @param path the log file to delete
 	
 	def delLogPath(self, path):
-		try:
-			self.logPath.remove(path)
-			del self.lastDate[path]
-			del self.lastModTime[path]
-			del self.lastPos[path]
-			logSys.info("Removed logfile = %s" % path)
-		except ValueError:
-			logSys.error(path + " is not monitored")
+		raise Exception("delLogPath() is abstract")
 
 	##
 	# Get the log file path
@@ -236,27 +220,7 @@ class Filter(JailThread):
 	# @return True when the thread exits nicely
 
 	def run(self):
-		self.setActive(True)
-		prevModified = False
-		while self.isActive():
-			if not self.isIdle:
-				if prevModified:
-					self.dateDetector.sortTemplate()
-				prevModified = False
-				for file in self.logPath:
-					if self.isModified(file):
-						self.getFailures(file)
-						prevModified = True
-				try:
-					ticket = self.failManager.toBan()
-					self.jail.putFailTicket(ticket)
-				except FailManagerEmpty:
-					self.failManager.cleanup(time.time())
-					time.sleep(self.sleepTime)
-			else:
-				time.sleep(self.sleepTime)
-		logSys.debug(self.jail.getName() + ": filter terminated")
-		return True
+		raise Exception("run() is abstract")
 	
 	##
 	# Add an IP to the ignore list.
@@ -311,31 +275,6 @@ class Filter(JailThread):
 	def closeLogFile(self):
 		self.crtFilename = None
 		self.crtHandler.close()
-	
-	##
-	# Checks if the log file has been modified.
-	#
-	# Checks if the log file has been modified using os.stat().
-	# @return True if log file has been modified
-	
-	def isModified(self, filename):
-		try:
-			logStats = os.stat(filename)
-			self.file404Cnt[filename] = 0
-			if self.lastModTime[filename] == logStats.st_mtime:
-				return False
-			else:
-				logSys.debug(filename + " has been modified")
-				self.lastModTime[filename] = logStats.st_mtime
-				return True
-		except OSError:
-			logSys.error("Unable to get stat on " + filename)
-			self.file404Cnt[filename] = self.file404Cnt[filename] + 1
-			if self.file404Cnt[filename] > 2:
-				logSys.warn("Too much read error. Set the jail idle")
-				self.jail.setIdle(True)
-				self.file404Cnt[filename] = 0
-			return False
 
 	##
 	# Set the file position.
diff --git a/server/filtergamin.py b/server/filtergamin.py
new file mode 100644
index 00000000..1ec453bb
--- /dev/null
+++ b/server/filtergamin.py
@@ -0,0 +1,132 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from failmanager import FailManager
+from failmanager import FailManagerEmpty
+from failticket import FailTicket
+from datedetector import DateDetector
+from filter import Filter
+
+import time, logging, gamin
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.filter")
+
+##
+# Log reader class.
+#
+# This class reads a log file and detects login failures or anything else
+# that matches a given regular expression. This class is instanciated by
+# a Jail object.
+
+class FilterGamin(Filter):
+
+	##
+	# Constructor.
+	#
+	# Initialize the filter object with default values.
+	# @param jail the jail object
+	
+	def __init__(self, jail):
+		Filter.__init__(self, jail)
+		
+		self.monitor = gamin.WatchMonitor()
+		
+		logSys.info("Created FilterGamin")
+
+
+	def callback(self, path, event):
+		logSys.debug("Got event: " + `event` + " for " + path)
+		if event in (gamin.GAMCreated, gamin.GAMChanged, gamin.GAMExists):
+			logSys.debug("File changed: " + path)
+			self.getFailures(path)
+			self.modified = True
+
+
+	##
+	# Add a log file path
+	#
+	# @param path log file path
+
+	def addLogPath(self, path):
+		try:
+			self.logPath.index(path)
+			logSys.error(path + " already exists")
+		except ValueError:
+			self.monitor.watch_file(path, self.callback)
+			self.logPath.append(path)
+			# Initialize default values
+			self.lastDate[path] = 0
+			self.lastModTime[path] = 0
+			self.lastPos[path] = 0
+			logSys.info("Added logfile = %s" % path)
+	
+	##
+	# Delete a log path
+	#
+	# @param path the log file to delete
+	
+	def delLogPath(self, path):
+		try:
+			self.monitor.stop_watch(path)
+			self.logPath.remove(path)
+			del self.lastDate[path]
+			del self.lastModTime[path]
+			del self.lastPos[path]
+			logSys.info("Removed logfile = %s" % path)
+		except ValueError:
+			logSys.error(path + " is not monitored")
+
+
+	##
+	# Main loop.
+	#
+	# This function is the main loop of the thread. It checks if the
+	# file has been modified and looks for failures.
+	# @return True when the thread exits nicely
+
+	def run(self):
+		self.setActive(True)
+		while self.isActive():
+			if not self.isIdle:
+				# We cannot block here because we want to be able to
+				# exit.
+				if self.monitor.event_pending():
+					self.monitor.handle_events()
+
+				if self.modified:
+					try:
+						ticket = self.failManager.toBan()
+						self.jail.putFailTicket(ticket)
+					except FailManagerEmpty:
+						self.failManager.cleanup(time.time())
+					self.dateDetector.sortTemplate()
+					self.modified = False
+				time.sleep(self.sleepTime)
+			else:
+				time.sleep(self.sleepTime)
+		logSys.debug(self.jail.getName() + ": filter terminated")
+		return True
diff --git a/server/filterpoll.py b/server/filterpoll.py
new file mode 100644
index 00000000..c53ffa5a
--- /dev/null
+++ b/server/filterpoll.py
@@ -0,0 +1,149 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 354 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 354 $"
+__date__ = "$Date: 2006-09-13 23:31:22 +0200 (Wed, 13 Sep 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from failmanager import FailManager
+from failmanager import FailManagerEmpty
+from failticket import FailTicket
+from datedetector import DateDetector
+from filter import Filter
+
+import time, logging, os
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.filter")
+
+##
+# Log reader class.
+#
+# This class reads a log file and detects login failures or anything else
+# that matches a given regular expression. This class is instanciated by
+# a Jail object.
+
+class FilterPoll(Filter):
+
+	##
+	# Constructor.
+	#
+	# Initialize the filter object with default values.
+	# @param jail the jail object
+	
+	def __init__(self, jail):
+		Filter.__init__(self, jail)
+		
+		self.file404Cnt = dict()
+		
+		logSys.info("Created FilterPoll")
+
+	##
+	# Add a log file path
+	#
+	# @param path log file path
+
+	def addLogPath(self, path):
+		try:
+			self.logPath.index(path)
+			logSys.error(path + " already exists")
+		except ValueError:
+			self.logPath.append(path)
+			# Initialize default values
+			self.lastDate[path] = 0
+			self.lastModTime[path] = 0
+			self.lastPos[path] = 0
+			self.file404Cnt[path] = 0
+			logSys.info("Added logfile = %s" % path)
+	
+	##
+	# Delete a log path
+	#
+	# @param path the log file to delete
+	
+	def delLogPath(self, path):
+		try:
+			self.logPath.remove(path)
+			del self.lastDate[path]
+			del self.lastModTime[path]
+			del self.lastPos[path]
+			del self.file404Cnt[path]
+			logSys.info("Removed logfile = %s" % path)
+		except ValueError:
+			logSys.error(path + " is not monitored")
+
+	
+	##
+	# Main loop.
+	#
+	# This function is the main loop of the thread. It checks if the
+	# file has been modified and looks for failures.
+	# @return True when the thread exits nicely
+
+	def run(self):
+		self.setActive(True)
+		while self.isActive():
+			if not self.isIdle:
+				# Get file modification
+				for file in self.logPath:
+					if self.isModified(file):
+						self.getFailures(file)
+						prevModified = True
+
+				if self.modified:
+					try:
+						ticket = self.failManager.toBan()
+						self.jail.putFailTicket(ticket)
+					except FailManagerEmpty:
+						self.failManager.cleanup(time.time())
+					self.dateDetector.sortTemplate()
+					prevModified = False
+				time.sleep(self.sleepTime)
+			else:
+				time.sleep(self.sleepTime)
+		logSys.debug(self.jail.getName() + ": filter terminated")
+		return True
+
+	##
+	# Checks if the log file has been modified.
+	#
+	# Checks if the log file has been modified using os.stat().
+	# @return True if log file has been modified
+	
+	def isModified(self, filename):
+		try:
+			logStats = os.stat(filename)
+			self.file404Cnt[filename] = 0
+			if self.lastModTime[filename] == logStats.st_mtime:
+				return False
+			else:
+				logSys.debug(filename + " has been modified")
+				self.lastModTime[filename] = logStats.st_mtime
+				return True
+		except OSError:
+			logSys.error("Unable to get stat on " + filename)
+			self.file404Cnt[filename] = self.file404Cnt[filename] + 1
+			if self.file404Cnt[filename] > 2:
+				logSys.warn("Too much read error. Set the jail idle")
+				self.jail.setIdle(True)
+				self.file404Cnt[filename] = 0
+			return False
diff --git a/server/jail.py b/server/jail.py
index 1c77ca6c..d5f11671 100644
--- a/server/jail.py
+++ b/server/jail.py
@@ -24,17 +24,27 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from actions import Actions
-from filter import Filter
-import Queue
+import Queue, logging
 
+from actions import Actions
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.jail")
 
 class Jail:
 	
 	def __init__(self, name):
 		self.name = name
 		self.queue = Queue.Queue()
-		self.filter = Filter(self)
+		try:
+			import gamin
+			logSys.info("Gamin available. Using it instead of poller")
+			from filtergamin import FilterGamin
+			self.filter = FilterGamin(self)
+		except ImportError:
+			logSys.info("Gamin not available. Using poller")
+			from filterpoll import FilterPoll
+			self.filter = FilterPoll(self)
 		self.action = Actions(self)
 	
 	def setName(self, name):
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index be62fc5a..2aa92ee1 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -25,14 +25,14 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 import unittest, socket
-from server.filter import Filter
+from server.filterpoll import FilterPoll
 from server.failmanager import FailManager
 
 class IgnoreIP(unittest.TestCase):
 
 	def setUp(self):
 		"""Call before every test case."""
-		self.filter = Filter(None)
+		self.filter = FilterPoll(None)
 
 	def tearDown(self):
 		"""Call after every test case."""
@@ -56,7 +56,7 @@ class LogFile(unittest.TestCase):
 
 	def setUp(self):
 		"""Call before every test case."""
-		self.filter = Filter(None)
+		self.filter = FilterPoll(None)
 		self.filter.addLogPath(LogFile.filename)
 
 	def tearDown(self):
@@ -73,7 +73,7 @@ class GetFailures(unittest.TestCase):
 
 	def setUp(self):
 		"""Call before every test case."""
-		self.filter = Filter(None)
+		self.filter = FilterPoll(None)
 		self.filter.addLogPath("testcases/files/testcase01.log")
 		self.filter.setTimeRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 		self.filter.setTimePattern("%b %d %H:%M:%S")

From 6333298fd72fb70bd6c295b8d1847a7539443a54 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 14 Sep 2006 22:39:41 +0000
Subject: [PATCH 317/549] - Replaced ... or ... or ... with ... in ...

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@356 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/beautifier.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/beautifier.py b/client/beautifier.py
index 916a3f6b..8f20d452 100644
--- a/client/beautifier.py
+++ b/client/beautifier.py
@@ -80,7 +80,7 @@ class Beautifier:
 		elif inC == ["stop"]:
 			if response == None:
 				msg = "Shutdown successful"
-		elif inC[2] == "logpath" or inC[2] == "addlogpath" or inC[2] == "dellogpath":
+		elif inC[2] in ("logpath", "addlogpath", "dellogpath"):
 			msg = "Current monitored log file(s):\n"
 			for path in response[:-1]:
 				msg = msg + "|- " + path + "\n"

From 88b68c0ad2b8aa9398ff074e6881b9e5716801c1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 17 Sep 2006 21:59:29 +0000
Subject: [PATCH 318/549] - Replaced jails = dict() with a Jails class for
 better concurrency control - Set umask to 0077 at startup for security reason

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@357 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST         |   1 +
 server/jails.py  | 107 ++++++++++++++++++++++++++++++++
 server/server.py | 155 +++++++++++++++++++----------------------------
 3 files changed, 170 insertions(+), 93 deletions(-)
 create mode 100644 server/jails.py

diff --git a/MANIFEST b/MANIFEST
index 9e1f6e0b..de220d23 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -33,6 +33,7 @@ server/transmitter.py
 server/action.py
 server/ticket.py
 server/jail.py
+server/jails.py
 server/__init__.py
 server/dateepoch.py
 server/banmanager.py
diff --git a/server/jails.py b/server/jails.py
new file mode 100644
index 00000000..30d61b48
--- /dev/null
+++ b/server/jails.py
@@ -0,0 +1,107 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 354 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 354 $"
+__date__ = "$Date: 2006-09-13 23:31:22 +0200 (Wed, 13 Sep 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+
+from jail import Jail
+from threading import Lock
+
+class Jails:
+	
+	def __init__(self):
+		self.lock = Lock()
+		self.jails = dict()
+	
+	def add(self, name):
+		self.lock.acquire()
+		if self.jails.has_key(name):
+			self.lock.release()
+			raise DuplicateJailException(name)
+		else:
+			self.jails[name] = Jail(name)
+			self.lock.release()
+	
+	def remove(self, name):
+		self.lock.acquire()
+		if self.jails.has_key(name):
+			del self.jails[name]
+			self.lock.release()
+		else:
+			self.lock.release()
+			raise UnknownJailException(name)
+	
+	def get(self, name):
+		try:
+			self.lock.acquire()
+			if self.jails.has_key(name):
+				jail = self.jails[name]
+				return jail
+			else:
+				raise UnknownJailException(name)
+		finally:
+			self.lock.release()
+	
+	def getAction(self, name):
+		try:
+			self.lock.acquire()
+			if self.jails.has_key(name):
+				action = self.jails[name].getAction()
+				return action
+			else:
+				raise UnknownJailException(name)
+		finally:
+			self.lock.release()
+	
+	def getFilter(self, name):
+		try:
+			self.lock.acquire()
+			if self.jails.has_key(name):
+				action = self.jails[name].getFilter()
+				return action
+			else:
+				raise UnknownJailException(name)
+		finally:
+			self.lock.release()
+	
+	def getAll(self):
+		try:
+			self.lock.acquire()
+			return self.jails.copy()
+		finally:
+			self.lock.release()
+	
+	def size(self):
+		try:
+			self.lock.acquire()
+			return len(self.jails)
+		finally:
+			self.lock.release()
+
+
+class DuplicateJailException(Exception):
+	pass
+
+class UnknownJailException(Exception):
+	pass
diff --git a/server/server.py b/server/server.py
index 0b39a417..dac4f5e2 100644
--- a/server/server.py
+++ b/server/server.py
@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from jail import Jail
+from jails import Jails
 from transmitter import Transmitter
 import locale, logging, logging.handlers, sys, os, signal
 
@@ -34,7 +34,7 @@ logSys = logging.getLogger("fail2ban.server")
 class Server:
 	
 	def __init__(self, daemon = False):
-		self.jails = dict()
+		self.jails = Jails()
 		self.daemon = daemon
 		self.transm = Transmitter(self)
 		self.logLevel = 3
@@ -45,6 +45,8 @@ class Server:
 	
 	def start(self, force):
 		logSys.info("Starting Fail2ban")
+		# First set the mask to only allow access to owner
+		os.umask(0077)
 		if self.daemon:
 			ret = self.createDaemon()
 			if ret:
@@ -62,185 +64,158 @@ class Server:
 		self.transm.stop()
 	
 	def addJail(self, name):
-		if self.jails.has_key(name):
-			raise ServerDuplicateJail(name)
-		else:
-			self.jails[name] = Jail(name)
+		self.jails.add(name)
 		
 	def delJail(self, name):
-		if self.jails.has_key(name):
-			del self.jails[name]
-		else:
-			raise ServerUnknownJail(name)
+		self.jails.remove(name)
 	
 	def startJail(self, name):
-		if self.jails.has_key(name):
-			self.jails[name].start()
-		else:
-			raise ServerUnknownJail(name)
+		if not self.isActive(name):
+			self.jails.get(name).start()
 	
 	def stopJail(self, name):
-		if self.jails.has_key(name):
-			if self.isActive(name):
-				self.jails[name].stop()
-				self.delJail(name)
-		else:
-			raise ServerUnknownJail(name)
+		if self.isActive(name):
+			self.jails.get(name).stop()
+			self.delJail(name)
 	
 	def stopAllJail(self):
-		for jail in self.jails.copy():
+		for jail in self.jails.getAll():
 			self.stopJail(jail)
 	
-	def getAction(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getAction()
-		else:
-			raise ServerUnknownJail(name)
-	
-	def getFilter(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getFilter()
-		else:
-			raise ServerUnknownJail(name)
-	
 	def isActive(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].isActive()
-		else:
-			raise ServerUnknownJail(name)
+		return self.jails.get(name).isActive()
 	
 	def setIdleJail(self, name, value):
-		if self.jails.has_key(name):
-			self.jails[name].setIdle(value)
-			return True
-		else:
-			raise ServerUnknownJail(name)
+		self.jails.get(name).setIdle(value)
+		return True
 
 	def getIdleJail(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getIdle()
-		else:
-			raise ServerUnknownJail(name)
+		return self.jails.get(name).getIdle()
 	
 	# Filter
+	def addIgnoreIP(self, name, ip):
+		self.jails.getFilter(name).addIgnoreIP(ip)
+	
+	def delIgnoreIP(self, name, ip):
+		self.jails.getFilter(name).delIgnoreIP(ip)
+	
+	def getIgnoreIP(self, name):
+		return self.jails.getFilter(name).getIgnoreIP()
+	
 	def addLogPath(self, name, file):
-		if self.jails.has_key(name):
-			self.jails[name].getFilter().addLogPath(file)
+		self.jails.getFilter(name).addLogPath(file)
 	
 	def delLogPath(self, name, file):
-		if self.jails.has_key(name):
-			self.jails[name].getFilter().delLogPath(file)
+		self.jails.getFilter(name).delLogPath(file)
 	
 	def getLogPath(self, name):
-		return self.getFilter(name).getLogPath()
+		return self.jails.getFilter(name).getLogPath()
 	
 	def setTimeRegex(self, name, value):
-		self.getFilter(name).setTimeRegex(value)
+		self.jails.getFilter(name).setTimeRegex(value)
 	
 	def getTimeRegex(self, name):
-		return self.getFilter(name).getTimeRegex()
+		return self.jails.getFilter(name).getTimeRegex()
 
 	def setTimePattern(self, name, value):
-		self.getFilter(name).setTimePattern(value)
+		self.jails.getFilter(name).setTimePattern(value)
 	
 	def getTimePattern(self, name):
-		return self.getFilter(name).getTimePattern()
+		return self.jails.getFilter(name).getTimePattern()
 	
 	def setFindTime(self, name, value):
-		self.getFilter(name).setFindTime(value)
+		self.jails.getFilter(name).setFindTime(value)
 	
 	def getFindTime(self):
-		return self.getFilter(name).getFindTime()
+		return self.jails.getFilter(name).getFindTime()
 
 	def setFailRegex(self, name, value):
-		self.getFilter(name).setFailRegex(value)
+		self.jails.getFilter(name).setFailRegex(value)
 	
 	def getFailRegex(self, name):
-		return self.getFilter(name).getFailRegex()
+		return self.jails.getFilter(name).getFailRegex()
 	
 	def setMaxRetry(self, name, value):
-		self.getFilter(name).setMaxRetry(value)
+		self.jails.getFilter(name).setMaxRetry(value)
 	
 	def getMaxRetry(self, name):
-		return self.getFilter(name).getMaxRetry()
+		return self.jails.getFilter(name).getMaxRetry()
 	
 	def setMaxTime(self, name, value):
-		self.getFilter(name).setMaxTime(value)
+		self.jails.getFilter(name).setMaxTime(value)
 	
 	def getMaxTime(self, name):
-		return self.getFilter(name).getMaxTime()
+		return self.jails.getFilter(name).getMaxTime()
 	
 	# Action
 	def addAction(self, name, value):
-		self.getAction(name).addAction(value)
+		self.jails.getAction(name).addAction(value)
 	
 	def getLastAction(self, name):
-		return self.getAction(name).getLastAction()
+		return self.jails.getAction(name).getLastAction()
 	
 	def delAction(self, name, value):
-		self.getAction(name).delAction(value)
+		self.jails.getAction(name).delAction(value)
 	
 	def setCInfo(self, name, action, key, value):
-		self.getAction(name).getAction(action).setCInfo(key, value)
+		self.jails.getAction(name).getAction(action).setCInfo(key, value)
 	
 	def getCInfo(self, name, action, key):
-		return self.getAction(name).getAction(action).getCInfo(key)
+		return self.jails.getAction(name).getAction(action).getCInfo(key)
 	
 	def delCInfo(self, name, action, key):
-		self.getAction(name).getAction(action).delCInfo(key)
+		self.jails.getAction(name).getAction(action).delCInfo(key)
 	
 	def setBanTime(self, name, value):
-		self.getAction(name).setBanTime(value)
+		self.jails.getAction(name).setBanTime(value)
 	
 	def getBanTime(self, name):
-		return self.getAction(name).getBanTime()
+		return self.jails.getAction(name).getBanTime()
 	
 	def setActionStart(self, name, action, value):
-		self.getAction(name).getAction(action).setActionStart(value)
+		self.jails.getAction(name).getAction(action).setActionStart(value)
 	
 	def getActionStart(self, name, action):
-		return self.getAction(name).getAction(action).getActionStart()
+		return self.jails.getAction(name).getAction(action).getActionStart()
 		
 	def setActionStop(self, name, action, value):
-		self.getAction(name).getAction(action).setActionStop(value)
+		self.jails.getAction(name).getAction(action).setActionStop(value)
 	
 	def getActionStop(self, name, action):
-		return self.getAction(name).getAction(action).getActionStop()
+		return self.jails.getAction(name).getAction(action).getActionStop()
 	
 	def setActionCheck(self, name, action, value):
-		self.getAction(name).getAction(action).setActionCheck(value)
+		self.jails.getAction(name).getAction(action).setActionCheck(value)
 	
 	def getActionCheck(self, name, action):
-		return self.getAction(name).getAction(action).getActionCheck()
+		return self.jails.getAction(name).getAction(action).getActionCheck()
 	
 	def setActionBan(self, name, action, value):
-		self.getAction(name).getAction(action).setActionBan(value)
+		self.jails.getAction(name).getAction(action).setActionBan(value)
 	
 	def getActionBan(self, name, action):
-		return self.getAction(name).getAction(action).getActionBan()
+		return self.jails.getAction(name).getAction(action).getActionBan()
 	
 	def setActionUnban(self, name, action, value):
-		self.getAction(name).getAction(action).setActionUnban(value)
+		self.jails.getAction(name).getAction(action).setActionUnban(value)
 	
 	def getActionUnban(self, name, action):
-		return self.getAction(name).getAction(action).getActionUnban()
+		return self.jails.getAction(name).getAction(action).getActionUnban()
 		
 	# Status
 	def status(self):
 		jailList = ''
-		for jail in self.jails:
+		for jail in self.jails.getAll():
 			jailList += jail + ', '
 		length = len(jailList)
 		if not length == 0:
 			jailList = jailList[:length-2]
-		ret = [("Number of jail", len(self.jails)), 
+		ret = [("Number of jail", self.jails.size()), 
 			   ("Jail list", jailList)]
 		return ret
 	
 	def statusJail(self, name):
-		if self.jails.has_key(name):
-			return self.jails[name].getStatus()
-		raise ServerUnknownJail(name)
+		return self.jails.get(name).getStatus()
 	
 	# Logging
 	
@@ -378,11 +353,5 @@ class Server:
 		return True
 
 
-class ServerDuplicateJail(Exception):
-	pass
-
-class ServerUnknownJail(Exception):
-	pass
-
 class ServerInitializationError(Exception):
-	pass
\ No newline at end of file
+	pass

From bd2b94cc8427c637200eb371ac710655428dc00e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 17 Sep 2006 22:00:20 +0000
Subject: [PATCH 319/549] - Added smmmaaallll comment

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@358 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filtergamin.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/server/filtergamin.py b/server/filtergamin.py
index 1ec453bb..2f757258 100644
--- a/server/filtergamin.py
+++ b/server/filtergamin.py
@@ -52,9 +52,8 @@ class FilterGamin(Filter):
 	
 	def __init__(self, jail):
 		Filter.__init__(self, jail)
-		
+		# Gamin monitor
 		self.monitor = gamin.WatchMonitor()
-		
 		logSys.info("Created FilterGamin")
 
 

From a6183132068d7f222ff8dc3f16dd77171acb11a7 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 17 Sep 2006 22:01:14 +0000
Subject: [PATCH 320/549] - Added "ignoreip" feature

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@359 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/jailreader.py |  3 +++
 server/filter.py     | 14 ++++++++++++--
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/client/jailreader.py b/client/jailreader.py
index 4df4ecc8..635f62d6 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -61,6 +61,7 @@ class JailReader(ConfigReader):
 				["int", "maxretry", 3],
 				["int", "maxtime", 600],
 				["int", "bantime", 600],
+				["string", "ignoreip", None],
 				["string", "filter", ""],
 				["string", "action", ""]]
 		self.opts = ConfigReader.getOptions(self, self.name, opts)
@@ -103,6 +104,8 @@ class JailReader(ConfigReader):
 					stream.append(["set", self.name, "addlogpath", path])
 			elif opt == "maxretry":
 				stream.append(["set", self.name, "maxretry", self.opts[opt]])
+			elif opt == "ignoreip":
+				stream.append(["set", self.name, "addignoreip", self.opts[opt]])
 			elif opt == "maxtime":
 				stream.append(["set", self.name, "maxtime", self.opts[opt]])
 			elif opt == "bantime":
diff --git a/server/filter.py b/server/filter.py
index 4e5fc8b4..d7467761 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -230,8 +230,18 @@ class Filter(JailThread):
 	# @param ip IP address to ignore
 	
 	def addIgnoreIP(self, ip):
-		logSys.debug("Add " + ip + " to ignore list")
-		self.ignoreIpList.append(ip)
+		if DNSUtils.isValidIP(ip):
+			logSys.debug("Add " + ip + " to ignore list")
+			self.ignoreIpList.append(ip)
+		else:
+			logSys.warn(ip + " is not a valid address")
+		
+	def delIgnoreIP(self, ip):
+		logSys.debug("Remove " + ip + " from ignore list")
+		self.ignoreIpList.remove(ip)
+		
+	def getIgnoreIP(self):
+		return self.ignoreIpList
 	
 	##
 	# Check if IP address is in the ignore list.

From 94d167e620547ec439673ed2527b630dd7166017 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 17 Sep 2006 22:01:37 +0000
Subject: [PATCH 321/549] - Improved beautifier

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@360 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/beautifier.py | 102 +++++++++++++++++++++++++++----------------
 1 file changed, 65 insertions(+), 37 deletions(-)

diff --git a/client/beautifier.py b/client/beautifier.py
index 8f20d452..75ea05ca 100644
--- a/client/beautifier.py
+++ b/client/beautifier.py
@@ -24,8 +24,8 @@ __date__ = "$Date: 2006-08-22 23:59:51 +0200 (Tue, 22 Aug 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from server.server import ServerUnknownJail
-from server.server import ServerDuplicateJail
+from server.jails import UnknownJailException
+from server.jails import DuplicateJailException
 import logging
 
 # Gets the instance of the logger.
@@ -52,48 +52,76 @@ class Beautifier:
 		logSys.debug("Beautify " + `response` + " with " + `self.inputCmd`)
 		inC = self.inputCmd
 		msg = response
-		if inC[0:1] == ['status']:
-			if len(inC) > 1:
-				msg = "Status for the jail: " + inC[1] + "\n"
-				msg = msg + "|- " + response[0][0] + "\n"
-				msg = msg + "|  |- " + response[0][1][0][0] + ":\t\t" + `response[0][1][0][1]` + "\n"
-				msg = msg + "|  `- " + response[0][1][1][0] + ":\t\t" + `response[0][1][1][1]` + "\n"
-				msg = msg + "`- " + response[1][0] + "\n"
-				msg = msg + "   |- " + response[1][1][0][0] + ":\t\t" + `response[1][1][0][1]` + "\n"
-				msg = msg + "   `- " + response[1][1][1][0] + ":\t\t" + `response[1][1][1][1]`
-			else:
-				msg = "Status\n"
-				msg = msg + "|- " + response[0][0] + ":\t" + `response[0][1]` + "\n"
-				msg = msg + "`- " + response[1][0] + ":\t\t" + response[1][1]
-		elif inC[1:2] == ['loglevel']:
-			msg = "Current logging level is "
-			if response == 1:
-				msg = msg + "ERROR"
-			elif response == 2:
-				msg = msg + "WARN"
-			elif response == 3:
-				msg = msg + "INFO"
-			elif response == 4:
-				msg = msg + "DEBUG"
-			else:
-				msg = msg + `response`
-		elif inC == ["stop"]:
-			if response == None:
-				msg = "Shutdown successful"
-		elif inC[2] in ("logpath", "addlogpath", "dellogpath"):
-			msg = "Current monitored log file(s):\n"
-			for path in response[:-1]:
-				msg = msg + "|- " + path + "\n"
-			msg = msg + "`- " + response[len(response)-1]
+		try:
+			if inC[0] == "start":
+				msg = "Jail started"
+			elif inC[0] == "stop":
+				if len(inC) == 1:
+					if response == None:
+						msg = "Shutdown successful"
+				else:
+					if response == None:
+						msg = "Jail stopped"
+			elif inC[0] == "add":
+				msg = "Added jail " + response
+			elif inC[0:1] == ['status']:
+				if len(inC) > 1:
+					msg = "Status for the jail: " + inC[1] + "\n"
+					msg = msg + "|- " + response[0][0] + "\n"
+					msg = msg + "|  |- " + response[0][1][0][0] + ":\t\t" + `response[0][1][0][1]` + "\n"
+					msg = msg + "|  `- " + response[0][1][1][0] + ":\t\t" + `response[0][1][1][1]` + "\n"
+					msg = msg + "`- " + response[1][0] + "\n"
+					msg = msg + "   |- " + response[1][1][0][0] + ":\t\t" + `response[1][1][0][1]` + "\n"
+					msg = msg + "   `- " + response[1][1][1][0] + ":\t\t" + `response[1][1][1][1]`
+				else:
+					msg = "Status\n"
+					msg = msg + "|- " + response[0][0] + ":\t" + `response[0][1]` + "\n"
+					msg = msg + "`- " + response[1][0] + ":\t\t" + response[1][1]
+			elif inC[1] == "logtarget":
+				msg = "Current logging target is:\n"
+				msg = msg + "`- " + response
+			elif inC[1:2] == ['loglevel']:
+				msg = "Current logging level is "
+				if response == 1:
+					msg = msg + "ERROR"
+				elif response == 2:
+					msg = msg + "WARN"
+				elif response == 3:
+					msg = msg + "INFO"
+				elif response == 4:
+					msg = msg + "DEBUG"
+				else:
+					msg = msg + `response`
+			elif inC[2] in ("logpath", "addlogpath", "dellogpath"):
+				if len(response) == 0:
+					msg = "No file is currently monitored"
+				else:
+					msg = "Current monitored log file(s):\n"
+					for path in response[:-1]:
+						msg = msg + "|- " + path + "\n"
+					msg = msg + "`- " + response[len(response)-1]
+			elif inC[2] in ("ignoreip", "addignoreip", "delignoreip"):
+				if len(response) == 0:
+					msg = "No IP address/network is ignored"
+				else:
+					msg = "These IP addresses/networks are ignored:\n"
+					for ip in response[:-1]:
+						msg = msg + "|- " + ip + "\n"
+					msg = msg + "`- " + response[len(response)-1]				
+		except Exception:
+			logSys.warn("Beautifier error. Please report the error")
+			logSys.error("Beautify " + `response` + " with " + `self.inputCmd` +
+						 " failed")
+			msg = msg + `response`
 		return msg
 
 	def beautifyError(self, response):
 		logSys.debug("Beautify (error) " + `response` + " with " + `self.inputCmd`)
 		msg = response
-		if isinstance(response, ServerUnknownJail):
+		if isinstance(response, UnknownJailException):
 			msg = "Sorry but the jail '" + response[0] + "' does not exist"
 		elif isinstance(response, IndexError):
 			msg = "Sorry but the command is invalid"
-		elif isinstance(response, ServerDuplicateJail):
+		elif isinstance(response, DuplicateJailException):
 			msg = "The jail '" + response[0] + "' already exists"
 		return msg

From c80164b329db7a0dd6acefb1332c3d81362d876a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 17 Sep 2006 22:02:22 +0000
Subject: [PATCH 322/549] - Added more locking

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@361 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/banmanager.py  | 98 +++++++++++++++++++++++++++----------------
 server/failmanager.py | 59 ++++++++++++++++++--------
 server/jail.py        | 75 ++++++++++++++++++++++++++-------
 server/transmitter.py | 40 ++++++++++++++----
 4 files changed, 194 insertions(+), 78 deletions(-)

diff --git a/server/banmanager.py b/server/banmanager.py
index fc18f55d..1e123f7c 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -61,7 +61,9 @@ class BanManager:
 	# @param value the time
 	
 	def setBanTime(self, value):
+		self.lock.acquire()
 		self.banTime = int(value)
+		self.lock.release()
 	
 	##
 	# Get the ban time.
@@ -70,7 +72,11 @@ class BanManager:
 	# @return the time
 	
 	def getBanTime(self):
-		return self.banTime
+		try:
+			self.lock.acquire()
+			return self.banTime
+		finally:
+			self.lock.release()
 	
 	##
 	# Set the total number of banned address.
@@ -78,7 +84,9 @@ class BanManager:
 	# @param value total number
 	
 	def setBanTotal(self, value):
+		self.lock.acquire()
 		self.banTotal = value
+		self.lock.release()
 	
 	##
 	# Get the total number of banned address.
@@ -86,7 +94,11 @@ class BanManager:
 	# @return the total number
 	
 	def getBanTotal(self):
-		return self.banTotal
+		try:
+			self.lock.acquire()
+			return self.banTotal
+		finally:
+			self.lock.release()
 	
 	##
 	# Create a ban ticket.
@@ -98,12 +110,16 @@ class BanManager:
 	
 	@staticmethod
 	def createBanTicket(ticket):
-		ip = ticket.getIP()
-		#lastTime = ticket.getTime()
-		lastTime = time.time()
-		banTicket = BanTicket(ip, lastTime)
-		banTicket.setAttempt(ticket.getAttempt())
-		return banTicket
+		try:
+			self.lock.acquire()
+			ip = ticket.getIP()
+			#lastTime = ticket.getTime()
+			lastTime = time.time()
+			banTicket = BanTicket(ip, lastTime)
+			banTicket.setAttempt(ticket.getAttempt())
+			return banTicket
+		finally:
+			self.lock.release()
 	
 	##
 	# Add a ban ticket.
@@ -113,14 +129,15 @@ class BanManager:
 	# @return True if the IP address is not in the ban list
 	
 	def addBanTicket(self, ticket):
-		self.lock.acquire()
-		if not self.inBanList(ticket):
-			self.banList.append(ticket)
-			self.banTotal += 1
+		try:
+			self.lock.acquire()
+			if not self.inBanList(ticket):
+				self.banList.append(ticket)
+				self.banTotal += 1
+				return True
+			return False
+		finally:
 			self.lock.release()
-			return True
-		self.lock.release()
-		return False
 	
 	##
 	# Delete a ban ticket.
@@ -128,7 +145,7 @@ class BanManager:
 	# Remove a BanTicket from the ban list.
 	# @param ticket the ticket
 	
-	def delBanTicket(self, ticket):
+	def __delBanTicket(self, ticket):
 		self.banList.remove(ticket)
 	
 	##
@@ -137,7 +154,11 @@ class BanManager:
 	# @return the size
 	
 	def size(self):
-		return len(self.banList)
+		try:
+			self.lock.acquire()
+			return len(self.banList)
+		finally:
+			self.lock.release()
 	
 	##
 	# Check if a ticket is in the list.
@@ -148,10 +169,14 @@ class BanManager:
 	# @return True if a ticket already exists
 	
 	def inBanList(self, ticket):
-		for i in self.banList:
-			if ticket.getIP() == i.getIP():
-				return True
-		return False
+		try:
+			self.lock.acquire()
+			for i in self.banList:
+				if ticket.getIP() == i.getIP():
+					return True
+			return False
+		finally:
+			self.lock.release()
 	
 	##
 	# Get the list of IP address to unban.
@@ -162,14 +187,16 @@ class BanManager:
 	# @todo Check the delete operation
 	
 	def unBanList(self, time):
-		uBList = list()
-		self.lock.acquire()
-		for ticket in self.banList:
-			if ticket.getTime() < time - self.banTime:
-				uBList.append(ticket)
-				self.delBanTicket(ticket)
-		self.lock.release()
-		return uBList
+		try:
+			self.lock.acquire()
+			uBList = list()
+			for ticket in self.banList:
+				if ticket.getTime() < time - self.banTime:
+					uBList.append(ticket)
+					self.__delBanTicket(ticket)
+			return uBList
+		finally:
+			self.lock.release()
 	
 	##
 	# Flush the ban list.
@@ -178,9 +205,10 @@ class BanManager:
 	# @return the complete ban list
 	
 	def flushBanList(self):
-		self.lock.acquire()
-		uBList = self.banList
-		self.banList = list()
-		self.lock.release()
-		return uBList
-	
\ No newline at end of file
+		try:
+			self.lock.acquire()
+			uBList = self.banList
+			self.banList = list()
+			return uBList
+		finally:
+			self.lock.release()
diff --git a/server/failmanager.py b/server/failmanager.py
index 18ea5a86..46dbe258 100644
--- a/server/failmanager.py
+++ b/server/failmanager.py
@@ -42,22 +42,40 @@ class FailManager:
 		self.failTotal = 0
 	
 	def setFailTotal(self, value):
+		self.lock.acquire()
 		self.failTotal = value
+		self.lock.release()
 		
 	def getFailTotal(self):
-		return self.failTotal
+		try:
+			self.lock.acquire()
+			return self.failTotal
+		finally:
+			self.lock.release()
 	
 	def setMaxRetry(self, value):
+		self.lock.acquire()
 		self.maxRetry = value
+		self.lock.release()
 	
 	def getMaxRetry(self):
-		return self.maxRetry
+		try:
+			self.lock.acquire()
+			return self.maxRetry
+		finally:
+			self.lock.release()
 	
 	def setMaxTime(self, value):
+		self.lock.acquire()
 		self.maxTime = value
+		self.lock.release()
 	
 	def getMaxTime(self):
-		return self.maxTime
+		try:
+			self.lock.acquire()
+			return self.maxTime
+		finally:
+			self.lock.release()
 
 	def addFailure(self, ticket):
 		self.lock.acquire()
@@ -76,33 +94,38 @@ class FailManager:
 		self.lock.release()
 	
 	def size(self):
-		return len(self.failList)
+		try:
+			self.lock.acquire()
+			return len(self.failList)
+		finally:
+			self.lock.release()
 	
 	def cleanup(self, time):
 		self.lock.acquire()
 		tmp = self.failList.copy()
 		for item in tmp:
 			if tmp[item].getLastTime() < time - self.maxTime:
-				self.delFailure(item)
+				self.__delFailure(item)
 		self.lock.release()
 	
-	def delFailure(self, ip):
+	def __delFailure(self, ip):
 		if self.failList.has_key(ip):
 			del self.failList[ip]
 	
 	def toBan(self):
-		self.lock.acquire()
-		for ip in self.failList:
-			data = self.failList[ip]
-			if data.getRetry() >= self.maxRetry:
-				self.delFailure(ip)
-				self.lock.release()
-				# Create a FailTicket from BanData
-				failTicket = FailTicket(ip, data.getLastTime())
-				failTicket.setAttempt(data.getRetry())
-				return failTicket
-		self.lock.release()
-		raise FailManagerEmpty
+		try:
+			self.lock.acquire()
+			for ip in self.failList:
+				data = self.failList[ip]
+				if data.getRetry() >= self.maxRetry:
+					self.delFailure(ip)
+					# Create a FailTicket from BanData
+					failTicket = FailTicket(ip, data.getLastTime())
+					failTicket.setAttempt(data.getRetry())
+					return failTicket
+			raise FailManagerEmpty
+		finally:
+			self.lock.release()
 
 class FailManagerEmpty(Exception):
 	pass
diff --git a/server/jail.py b/server/jail.py
index d5f11671..b48dea20 100644
--- a/server/jail.py
+++ b/server/jail.py
@@ -27,6 +27,7 @@ __license__ = "GPL"
 import Queue, logging
 
 from actions import Actions
+from threading import Lock
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.jail")
@@ -34,6 +35,7 @@ logSys = logging.getLogger("fail2ban.jail")
 class Jail:
 	
 	def __init__(self, name):
+		self.lock = Lock()
 		self.name = name
 		self.queue = Queue.Queue()
 		try:
@@ -48,58 +50,99 @@ class Jail:
 		self.action = Actions(self)
 	
 	def setName(self, name):
+		self.lock.acquire()
 		self.name = name
+		self.lock.release()
 	
 	def getName(self):
-		return self.name
+		try:
+			self.lock.acquire()
+			return self.name
+		finally:
+			self.lock.release()
 	
 	def setFilter(self, filter):
+		self.lock.acquire()
 		self.filter = filter
+		self.lock.release()
 	
 	def getFilter(self):
-		return self.filter
+		try:
+			self.lock.acquire()
+			return self.filter
+		finally:
+			self.lock.release()
 	
 	def setAction(self, action):
+		self.lock.acquire()
 		self.action = action
+		self.lock.release()
 	
 	def getAction(self):
-		return self.action
+		try:
+			self.lock.acquire()
+			return self.action
+		finally:
+			self.lock.release()
 	
 	def putFailTicket(self, ticket):
+		self.lock.acquire()
 		self.queue.put(ticket)
+		self.lock.release()
 	
 	def getFailTicket(self):
 		try:
-			return self.queue.get(False)
-		except Queue.Empty:
-			return False
+			try:
+				self.lock.acquire()
+				return self.queue.get(False)
+			except Queue.Empty:
+				return False
+		finally:
+			self.lock.release()
 	
 	def start(self):
+		self.lock.acquire()
 		self.filter.start()
 		self.action.start()
+		self.lock.release()
 	
 	def stop(self):
+		self.lock.acquire()
 		self.filter.stop()
 		self.action.stop()
+		self.lock.release()
 		self.filter.join()
 		self.action.join()
 	
 	def isActive(self):
-		isActive0 = self.filter.isActive()
-		isActive1 = self.action.isActive()
-		return isActive0 or isActive1
+		try:
+			self.lock.acquire()
+			isActive0 = self.filter.isActive()
+			isActive1 = self.action.isActive()
+			return isActive0 or isActive1
+		finally:
+			self.lock.release()
 	
 	def setIdle(self, value):
+		self.lock.acquire()
 		self.filter.setIdle(value)
 		self.action.setIdle(value)
+		self.lock.release()
 	
 	def getIdle(self):
-		return self.filter.getIdle() or self.action.getIdle()
+		try:
+			self.lock.acquire()
+			return self.filter.getIdle() or self.action.getIdle()
+		finally:
+			self.lock.release()
 	
 	def getStatus(self):
-		fStatus = self.filter.status()
-		aStatus = self.action.status()
-		ret = [("filter", fStatus),
-			   ("action", aStatus)]
-		return ret
-	
\ No newline at end of file
+		try:
+			self.lock.acquire()
+			fStatus = self.filter.status()
+			aStatus = self.action.status()
+			ret = [("filter", fStatus),
+				   ("action", aStatus)]
+			return ret
+		finally:
+			self.lock.release()
diff --git a/server/transmitter.py b/server/transmitter.py
index c01c0e7f..07132875 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -26,6 +26,7 @@ __license__ = "GPL"
 
 from ssocket import SSocket
 from ssocket import SSocketErrorException
+from threading import Lock
 import re, pickle, logging
 
 # Gets the instance of the logger.
@@ -34,6 +35,7 @@ logSys = logging.getLogger("fail2ban.comm")
 class Transmitter:
 	
 	def __init__(self, server):
+		self.lock = Lock()
 		self.server = server
 		self.socket = SSocket(self)
 	
@@ -44,11 +46,14 @@ class Transmitter:
 	
 	def start(self, force):
 		try:
+			self.lock.acquire()
 			self.socket.initialize(force)
 			self.socket.start()
+			self.lock.release()
 			self.socket.join()
 		except SSocketErrorException:
 			logSys.error("Could not start server")
+			self.lock.release()
 	
 	##
 	# Stop the transmitter.
@@ -58,18 +63,22 @@ class Transmitter:
 	
 	def stop(self):
 		self.socket.stop()
-		#self.socket.join()
+		self.socket.join()
 		
 	def proceed(self, action):
 		# Deserialize object
-		logSys.debug("Action: " + `action`)
 		try:
-			ret = self.actionHandler(action)
-			ack = 0, ret
-		except Exception, e:
-			logSys.warn("Invalid command: " + `action`)
-			ack = 1, e
-		return ack
+			self.lock.acquire()
+			logSys.debug("Action: " + `action`)
+			try:
+				ret = self.actionHandler(action)
+				ack = 0, ret
+			except Exception, e:
+				logSys.warn("Invalid command: " + `action`)
+				ack = 1, e
+			return ack
+		finally:
+			self.lock.release()
 	
 	##
 	# Handle an action.
@@ -129,6 +138,14 @@ class Transmitter:
 				self.server.setIdleJail(name, False)
 			return self.server.getIdleJail(name)
 		# Filter
+		elif action[1] == "addignoreip":
+			value = action[2]
+			self.server.addIgnoreIP(name, value)
+			return self.server.getIgnoreIP(name)
+		elif action[1] == "delignoreip":
+			value = action[2]
+			self.server.delIgnoreIP(name, value)
+			return self.server.getIgnoreIP(name)
 		elif action[1] == "addlogpath":
 			value = action[2:]
 			for path in value:
@@ -217,8 +234,13 @@ class Transmitter:
 		# Logging
 		if name == "loglevel":
 			return self.server.getLogLevel()
+		elif name == "logtarget":
+			return self.server.getLogTarget()
+		# Filter
 		elif action[1] == "logpath":
 			return self.server.getLogPath(name)
+		elif action[1] == "ignoreip":
+			return self.server.getIgnoreIP(name)
 		elif action[1] == "timeregex":
 			return self.server.getTimeRegex(name)
 		elif action[1] == "timepattern":
@@ -231,7 +253,7 @@ class Transmitter:
 			return self.server.getFindTime(name)
 		elif action[1] == "maxretry":
 			return self.server.getMaxRetry(name)
-		# Filter
+		# Action
 		elif action[1] == "bantime":
 			return self.server.getBanTime(name)
 		elif action[1] == "addaction":

From f3a90b9021731a7fd537a7d172a75a65cca64f78 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 17 Sep 2006 22:03:07 +0000
Subject: [PATCH 323/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@362 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG |  2 ++
 TODO      | 63 ++++---------------------------------------------------
 2 files changed, 6 insertions(+), 59 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 09687626..1f6c2072 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -12,6 +12,8 @@ ver. 0.7.3 (2006/??/??) - beta
 - Added man pages. Thanks to Yaroslav Halchenko
 - Added wildcard support for "logpath"
 - Added Gamin (file and directory monitoring system) support
+- (Re)added "ignoreip" option
+- Added more concurrency protection
 
 ver. 0.7.2 (2006/09/10) - beta
 ----------
diff --git a/TODO b/TODO
index 97337c60..cdba4028 100644
--- a/TODO
+++ b/TODO
@@ -13,39 +13,25 @@ Legend:
 # partially done
 * done
 
-- Verify TAI64N
+- Prefix all private functions with "__"
 
-* Is there a do...while loop in Python? For interactive mode
+- Verify TAI64N
 
 # implement all get/set functions
 
-- correct handling of threads (join???)
+# correct handling of threads (join???), concurrency, etc
+  protect "jails" in server.py
 
 - signal handling (ctrl-c, etc)
 
-* add a reload option to fail2ban-client
-
 # see Feature Request Tracking System at SourceForge.net
 
-* findall in dns.py should be no more needed
-
-* remove utils/ directory
-
 - improve installation process (better prefix support)
 
 # improve documentation and website for user
 
-* use Doxygen
-
 - use PyLint to check the code
 
-* better configuration files
-
-* add a check to see if the time of the log messages is
-  correctly detected (valid regexp)
-
-* remove debug mode (root check)
-
 # better return values in function
 
 ? use more email.Utils in mail.py
@@ -53,51 +39,10 @@ Legend:
 ? add gettext support. Is this really needed for a server
   utility?
 
-* send an email when fail2ban is running
-
-* add multithreading. Python threading is not really
-  efficient. However, fail2ban could benefit of it. We could
-  use threads like this:
-  - one thread which check for host to unban.
-  - one thread per file to watch. This will allow things like
-    different polling time for each file.
-  <srv> is read-only (we only read log files) thus no locks
-  are required. However, <meth> is read-write and must take
-  care of concurrency in case of multithreading.
-
-- add FAM/Gamin support. Should be quite efficient with
-  threading. Take care that handle_one_event() release the
-  Python lock.
-
 # add a test framework. We could use unittest which is in
   Python since 2.1. It should be possible to run all tests
   automatically.
 
-* add client/server using socket. Something similar to
-  gdesklets. DBUS seems to be designed for desktop use.
-  - fail2ban start -> start the daemon.
-  - fail2ban stop -> stop the daemon.
-  - fail2ban add <srv> <meth> -> add <srv> monitoring with
-    <meth> ban method (iptables, hosts.deny, etc).
-  - fail2ban del <srv> -> remove <srv> monitoring.
-  - fail2ban status <srv> -> query current fail2ban status.
-    Should return infos like a ban counter. Could be graph
-    with rrdtool.
-  - fail2ban pause <srv> -> suspend monitoring.
-  - fail2ban resume <srv> -> resume monitoring.
-  - fail2ban list -> list available services.
-  - fail2ban flush <srv> -> flush the <srv> ban list.
-  
-* remove PID file.
-
-* remove most of the command lines options if possible.
-
-* add the possibility to specify wildcard in log files.
-  Example: logfile = /var/log/apache2/access-*.log
-  Should we start one thread per file or just one thread per
-  serivce?
-  We use just one thread per service
-
 # autodetect date format in log file. Match the most popular
   format and sort them using the hit ratio. Should avoid
   user problem with regex and not have a big impact on perfs.

From 2bcf1bb35968ef5b950bda7d99c972c8ababac1c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 17 Sep 2006 22:31:55 +0000
Subject: [PATCH 324/549] - Fixed some bugs

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@363 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/banmanager.py  | 16 ++++++----------
 server/failmanager.py |  2 +-
 2 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/server/banmanager.py b/server/banmanager.py
index 1e123f7c..252fac3a 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -131,7 +131,7 @@ class BanManager:
 	def addBanTicket(self, ticket):
 		try:
 			self.lock.acquire()
-			if not self.inBanList(ticket):
+			if not self.__inBanList(ticket):
 				self.banList.append(ticket)
 				self.banTotal += 1
 				return True
@@ -168,15 +168,11 @@ class BanManager:
 	# @param ticket the ticket
 	# @return True if a ticket already exists
 	
-	def inBanList(self, ticket):
-		try:
-			self.lock.acquire()
-			for i in self.banList:
-				if ticket.getIP() == i.getIP():
-					return True
-			return False
-		finally:
-			self.lock.release()
+	def __inBanList(self, ticket):
+		for i in self.banList:
+			if ticket.getIP() == i.getIP():
+				return True
+		return False
 	
 	##
 	# Get the list of IP address to unban.
diff --git a/server/failmanager.py b/server/failmanager.py
index 46dbe258..aa2a1b0d 100644
--- a/server/failmanager.py
+++ b/server/failmanager.py
@@ -118,7 +118,7 @@ class FailManager:
 			for ip in self.failList:
 				data = self.failList[ip]
 				if data.getRetry() >= self.maxRetry:
-					self.delFailure(ip)
+					self.__delFailure(ip)
 					# Create a FailTicket from BanData
 					failTicket = FailTicket(ip, data.getLastTime())
 					failTicket.setAttempt(data.getRetry())

From c7451fa2503aa1ec11dbe73d13a8cabab15bb5a0 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 17 Sep 2006 22:32:18 +0000
Subject: [PATCH 325/549] - Updated test cases

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@364 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 testcases/banmanagertestcase.py  | 4 ++--
 testcases/failmanagertestcase.py | 2 +-
 testcases/filtertestcase.py      | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/testcases/banmanagertestcase.py b/testcases/banmanagertestcase.py
index f1393537..0f375a11 100644
--- a/testcases/banmanagertestcase.py
+++ b/testcases/banmanagertestcase.py
@@ -46,11 +46,11 @@ class AddFailure(unittest.TestCase):
 		self.assertFalse(self.banManager.addBanTicket(self.ticket))
 		self.assertEqual(self.banManager.size(), 1)
 		
-	def testInListOK(self):
+	def _testInListOK(self):
 		ticket = BanTicket('193.168.0.128', 1167605999.0)
 		self.assertTrue(self.banManager.inBanList(ticket))
 	
-	def testInListNOK(self):
+	def _testInListNOK(self):
 		ticket = BanTicket('111.111.1.111', 1167605999.0)
 		self.assertFalse(self.banManager.inBanList(ticket))
 		
\ No newline at end of file
diff --git a/testcases/failmanagertestcase.py b/testcases/failmanagertestcase.py
index 56d82f7a..e4a101e7 100644
--- a/testcases/failmanagertestcase.py
+++ b/testcases/failmanagertestcase.py
@@ -52,7 +52,7 @@ class AddFailure(unittest.TestCase):
 	def testAdd(self):
 		self.assertEqual(self.failManager.size(), 2)
 	
-	def testDel(self):
+	def _testDel(self):
 		self.failManager.delFailure('193.168.0.128')
 		self.failManager.delFailure('111.111.1.111')
 		
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 2aa92ee1..6fdabf3b 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -44,7 +44,7 @@ class IgnoreIP(unittest.TestCase):
 			self.assertTrue(self.filter.inIgnoreIPList(ip))
 	
 	def testIgnoreIPNOK(self):
-		ipList = "", "999.999.999.999", "abcdef", "192.168.0"
+		ipList = "", "999.999.999.999", "abcdef", "192.168.0."
 		for ip in ipList:
 			self.filter.addIgnoreIP(ip)
 			self.assertFalse(self.filter.inIgnoreIPList(ip))

From 0d68fc9ef1ecd73b7533739bd8cbf70e09d8608c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 17 Sep 2006 22:38:44 +0000
Subject: [PATCH 326/549] - Added "ignoreip" and a few other options in
 [DEFAULT]

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@365 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/jail.conf | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/config/jail.conf b/config/jail.conf
index a35414d9..6eaedcee 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -5,6 +5,16 @@
 # $Revision$
 #
 
+# The DEFAULT allows a global definition of the options. They can be override
+# in each jail afterwards.
+
+[DEFAULT]
+
+ignoreip = 127.0.0.1
+bantime  = 600
+maxretry = 3
+
+
 # This jail corresponds to the standard configuration in Fail2ban 0.6.
 # The mail-whois action send a notification e-mail with a whois request
 # in the body.
@@ -17,7 +27,6 @@ action   = iptables[name=SSH, port=ssh, protocol=tcp]
            mail-whois[name=SSH, dest=yourmail@mail.com]
 logpath  = /var/log/sshd.log
 maxretry = 5
-bantime  = 600
 
 # This one behaves like the previous and sends a report when the jail
 # is stopped.
@@ -31,7 +40,6 @@ action   = iptables[name=SSH, port=ssh, protocol=tcp]
            mail-report[dest=yourmail@mail.com]
 logpath  = /var/log/sshd.log
 maxretry = 5
-bantime  = 600
 
 # Here we use TCP-Wrappers instead of Netfilter/Iptables.
 
@@ -42,8 +50,7 @@ filter   = sshd
 action   = hostsdeny
            mail-whois[name=SSH, dest=yourmail@mail.com]
 logpath  = /var/log/sshd.log
-maxretry = 3
-bantime  = 600
+
 
 # The hosts.deny path can be defined with the "file" argument if it is
 # not in /etc.
@@ -55,7 +62,6 @@ filter   = postfix
 action   = hostsdeny[file=/not/a/standard/path/hosts.deny]
            mail[name=Postfix, dest=yourmail@mail.com]
 logpath  = /var/log/postfix.log
-maxretry = 6
 bantime  = 300
 
 # Do not ban anybody. Just report information about the remote host.
@@ -67,5 +73,5 @@ enabled  = false
 filter   = vsftpd
 action   = mail-whois[name=VSFTPD, dest=yourmail@mail.com]
 logpath  = /var/log/vsftpd.log
-maxretry = 3
-bantime  = 600
+maxretry = 5
+bantime  = 1800

From acb2fc2c2b151665884798e7cc60c9072a2c58b0 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 17 Sep 2006 22:53:59 +0000
Subject: [PATCH 327/549] - Fixes in locking

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@366 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/banmanager.py | 16 ++++++----------
 server/jail.py       |  2 +-
 2 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/server/banmanager.py b/server/banmanager.py
index 252fac3a..bd731e38 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -110,16 +110,12 @@ class BanManager:
 	
 	@staticmethod
 	def createBanTicket(ticket):
-		try:
-			self.lock.acquire()
-			ip = ticket.getIP()
-			#lastTime = ticket.getTime()
-			lastTime = time.time()
-			banTicket = BanTicket(ip, lastTime)
-			banTicket.setAttempt(ticket.getAttempt())
-			return banTicket
-		finally:
-			self.lock.release()
+		ip = ticket.getIP()
+		#lastTime = ticket.getTime()
+		lastTime = time.time()
+		banTicket = BanTicket(ip, lastTime)
+		banTicket.setAttempt(ticket.getAttempt())
+		return banTicket
 	
 	##
 	# Add a ban ticket.
diff --git a/server/jail.py b/server/jail.py
index b48dea20..359d08d4 100644
--- a/server/jail.py
+++ b/server/jail.py
@@ -92,8 +92,8 @@ class Jail:
 	
 	def getFailTicket(self):
 		try:
+			self.lock.acquire()
 			try:
-				self.lock.acquire()
 				return self.queue.get(False)
 			except Queue.Empty:
 				return False

From dac67d6ea680dcd3cd3e67e98de55321eae9dc9b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 18 Sep 2006 21:52:28 +0000
Subject: [PATCH 328/549] - Removed "mail-report.conf" from setup.py

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@367 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 setup.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/setup.py b/setup.py
index 28f75bc9..8cdbcde8 100755
--- a/setup.py
+++ b/setup.py
@@ -81,7 +81,6 @@ setup(
 								'config/action.d/mail-whois.conf',
 								'config/action.d/dummy.conf',
 								'config/action.d/mail.conf',
-								'config/action.d/mail-report.conf',
 								'config/action.d/hostsdeny.conf'
 							]
 						)

From 126807dea8fd7f8535d5dc34a5f19348c3f4d99f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 19 Sep 2006 20:38:32 +0000
Subject: [PATCH 329/549] - Made private fields prefixed with "__"

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@368 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/actionreader.py   |  44 +++++-----
 client/beautifier.py     |  14 ++--
 client/configreader.py   |   4 +-
 client/configurator.py   |  24 +++---
 client/csocket.py        |  10 +--
 client/fail2banreader.py |   8 +-
 client/filterreader.py   |  24 +++---
 client/jailreader.py     |  50 +++++------
 client/jailsreader.py    |  12 +--
 fail2ban-client          |  86 +++++++++----------
 fail2ban-regex           |  10 +--
 fail2ban-server          |  32 +++----
 server/action.py         |  62 +++++++-------
 server/actions.py        |  58 ++++++-------
 server/banmanager.py     |  66 +++++++--------
 server/datedetector.py   |  52 ++++++------
 server/datestrptime.py   |   2 +-
 server/datetemplate.py   |  32 +++----
 server/faildata.py       |  16 ++--
 server/failmanager.py    |  86 +++++++++----------
 server/filter.py         |  10 +--
 server/filtergamin.py    |  14 ++--
 server/filterpoll.py     |  30 +++----
 server/jail.py           | 110 ++++++++++++------------
 server/jails.py          |  60 ++++++-------
 server/jailthread.py     |  22 ++---
 server/server.py         | 126 ++++++++++++++--------------
 server/ssocket.py        |  28 +++----
 server/ticket.py         |  18 ++--
 server/transmitter.py    | 176 +++++++++++++++++++--------------------
 30 files changed, 643 insertions(+), 643 deletions(-)

diff --git a/client/actionreader.py b/client/actionreader.py
index d069fc39..13ef3d85 100644
--- a/client/actionreader.py
+++ b/client/actionreader.py
@@ -34,24 +34,24 @@ class ActionReader(ConfigReader):
 	
 	def __init__(self, action, name):
 		ConfigReader.__init__(self)
-		self.file = action[0]
-		self.cInfo = action[1]
-		self.name = name
+		self.__file = action[0]
+		self.__cInfo = action[1]
+		self.__name = name
 	
 	def setFile(self, file):
-		self.file = file
+		self.__file = file
 	
 	def getFile(self):
-		return self.file
+		return self.__file
 	
 	def setName(self, name):
-		self.name = name
+		self.__name = name
 	
 	def getName(self):
-		return self.name
+		return self.__name
 	
 	def read(self):
-		return ConfigReader.read(self, "action.d/" + self.file)
+		return ConfigReader.read(self, "action.d/" + self.__file)
 	
 	def getOptions(self, pOpts):
 		opts = [["string", "actionstart", ""],
@@ -59,32 +59,32 @@ class ActionReader(ConfigReader):
 				["string", "actioncheck", ""],
 				["string", "actionban", ""],
 				["string", "actionunban", ""]]
-		self.opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
 		
 		if self.has_section("Init"):
 			for opt in self.options("Init"):
-				if not self.cInfo.has_key(opt):
-					self.cInfo[opt] = self.get("Init", opt)
+				if not self.__cInfo.has_key(opt):
+					self.__cInfo[opt] = self.get("Init", opt)
 	
 	def convert(self):
-		head = ["set", self.name]
+		head = ["set", self.__name]
 		stream = list()
-		stream.append(head + ["addaction", self.file])
-		for opt in self.opts:
+		stream.append(head + ["addaction", self.__file])
+		for opt in self.__opts:
 			if opt == "actionstart":
-				stream.append(head + ["actionstart", self.file, self.opts[opt]])
+				stream.append(head + ["actionstart", self.__file, self.__opts[opt]])
 			elif opt == "actionstop":
-				stream.append(head + ["actionstop", self.file, self.opts[opt]])
+				stream.append(head + ["actionstop", self.__file, self.__opts[opt]])
 			elif opt == "actioncheck":
-				stream.append(head + ["actioncheck", self.file, self.opts[opt]])
+				stream.append(head + ["actioncheck", self.__file, self.__opts[opt]])
 			elif opt == "actionban":
-				stream.append(head + ["actionban", self.file, self.opts[opt]])
+				stream.append(head + ["actionban", self.__file, self.__opts[opt]])
 			elif opt == "actionunban":
-				stream.append(head + ["actionunban", self.file, self.opts[opt]])
+				stream.append(head + ["actionunban", self.__file, self.__opts[opt]])
 		# cInfo
-		if self.cInfo:
-			for p in self.cInfo:
-				stream.append(head + ["setcinfo", self.file, p, self.cInfo[p]])
+		if self.__cInfo:
+			for p in self.__cInfo:
+				stream.append(head + ["setcinfo", self.__file, p, self.__cInfo[p]])
 
 		return stream
 		
\ No newline at end of file
diff --git a/client/beautifier.py b/client/beautifier.py
index 75ea05ca..bb41f174 100644
--- a/client/beautifier.py
+++ b/client/beautifier.py
@@ -40,17 +40,17 @@ logSys = logging.getLogger("fail2ban.client.config")
 class Beautifier:
 	
 	def __init__(self, cmd = None):
-		self.inputCmd = cmd
+		self.__inputCmd = cmd
 
 	def setInputCmd(self, cmd):
-		self.inputCmd = cmd
+		self.__inputCmd = cmd
 		
 	def getInputCmd(self):
-		return self.inputCmd
+		return self.__inputCmd
 		
 	def beautify(self, response):
-		logSys.debug("Beautify " + `response` + " with " + `self.inputCmd`)
-		inC = self.inputCmd
+		logSys.debug("Beautify " + `response` + " with " + `self.__inputCmd`)
+		inC = self.__inputCmd
 		msg = response
 		try:
 			if inC[0] == "start":
@@ -110,13 +110,13 @@ class Beautifier:
 					msg = msg + "`- " + response[len(response)-1]				
 		except Exception:
 			logSys.warn("Beautifier error. Please report the error")
-			logSys.error("Beautify " + `response` + " with " + `self.inputCmd` +
+			logSys.error("Beautify " + `response` + " with " + `self.__inputCmd` +
 						 " failed")
 			msg = msg + `response`
 		return msg
 
 	def beautifyError(self, response):
-		logSys.debug("Beautify (error) " + `response` + " with " + `self.inputCmd`)
+		logSys.debug("Beautify (error) " + `response` + " with " + `self.__inputCmd`)
 		msg = response
 		if isinstance(response, UnknownJailException):
 			msg = "Sorry but the jail '" + response[0] + "' does not exist"
diff --git a/client/configreader.py b/client/configreader.py
index d9322aff..07eca339 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -36,7 +36,7 @@ class ConfigReader(SafeConfigParser):
 	
 	def __init__(self):
 		SafeConfigParser.__init__(self)
-		self.opts = None
+		self.__opts = None
 	
 	@staticmethod
 	def setBaseDir(dir):
@@ -95,4 +95,4 @@ class ConfigReader(SafeConfigParser):
 				logSys.warn("Wrong value for '" + option[1] + "' in '" + sec +
 							"'. Using default one: '" + `option[2]` + "'")
 				values[option[1]] = option[2]
-		return values
\ No newline at end of file
+		return values
diff --git a/client/configurator.py b/client/configurator.py
index 88d6d0ee..4802dd52 100644
--- a/client/configurator.py
+++ b/client/configurator.py
@@ -35,10 +35,10 @@ logSys = logging.getLogger("fail2ban.client.config")
 class Configurator:
 	
 	def __init__(self):
-		self.settings = dict()
-		self.streams = dict()
-		self.fail2ban = Fail2banReader()
-		self.jails = JailsReader()
+		self.__settings = dict()
+		self.__streams = dict()
+		self.__fail2ban = Fail2banReader()
+		self.__jails = JailsReader()
 	
 	def setBaseDir(self, dir):
 		ConfigReader.setBaseDir(dir)
@@ -47,22 +47,22 @@ class Configurator:
 		return ConfigReader.getBaseDir()
 	
 	def readAll(self):
-		self.fail2ban.read()
-		self.jails.read()
+		self.__fail2ban.read()
+		self.__jails.read()
 	
 	def getAllOptions(self):
-		self.settings["general"] = self.fail2ban.getOptions()
-		self.settings["jails"] = self.jails.getOptions()
+		self.__settings["general"] = self.__fail2ban.getOptions()
+		self.__settings["jails"] = self.__jails.getOptions()
 		
 	def convertToProtocol(self):
-		self.streams["general"] = self.fail2ban.convert()
-		self.streams["jails"] = self.jails.convert()
+		self.__streams["general"] = self.__fail2ban.convert()
+		self.__streams["jails"] = self.__jails.convert()
 	
 	def getConfigStream(self):
 		cmds = list()
-		for opt in self.streams["general"]:
+		for opt in self.__streams["general"]:
 			cmds.append(opt)
-		for opt in self.streams["jails"]:
+		for opt in self.__streams["jails"]:
 			cmds.append(opt)
 		return cmds
 	
\ No newline at end of file
diff --git a/client/csocket.py b/client/csocket.py
index ae53a50b..7f795c65 100644
--- a/client/csocket.py
+++ b/client/csocket.py
@@ -34,16 +34,16 @@ class CSocket:
 	def __init__(self):
 		# Create an INET, STREAMing socket
 		#self.csock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-		self.csock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+		self.__csock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
 		#self.csock.connect(("localhost", 2222))
-		self.csock.connect(CSocket.SOCKET_FILE)
+		self.__csock.connect(CSocket.SOCKET_FILE)
 	
 	def send(self, msg):
 		# Convert every list member to string
 		obj = pickle.dumps(map(str, msg))
-		self.csock.send(obj + CSocket.END_STRING)
-		ret = self.receive(self.csock)
-		self.csock.close()
+		self.__csock.send(obj + CSocket.END_STRING)
+		ret = self.receive(self.__csock)
+		self.__csock.close()
 		return ret
 	
 	def receive(self, socket):
diff --git a/client/fail2banreader.py b/client/fail2banreader.py
index 8a210d57..e8242cf4 100644
--- a/client/fail2banreader.py
+++ b/client/fail2banreader.py
@@ -41,14 +41,14 @@ class Fail2banReader(ConfigReader):
 	def getOptions(self):
 		opts = [["int", "loglevel", 1],
 				["string", "logtarget", "STDERR"]]
-		self.opts = ConfigReader.getOptions(self, "Definition", opts)
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts)
 	
 	def convert(self):
 		stream = list()
-		for opt in self.opts:
+		for opt in self.__opts:
 			if opt == "loglevel":
-				stream.append(["set", "loglevel", self.opts[opt]])
+				stream.append(["set", "loglevel", self.__opts[opt]])
 			elif opt == "logtarget":
-				stream.append(["set", "logtarget", self.opts[opt]])
+				stream.append(["set", "logtarget", self.__opts[opt]])
 		return stream
 	
\ No newline at end of file
diff --git a/client/filterreader.py b/client/filterreader.py
index e746292d..d666128f 100644
--- a/client/filterreader.py
+++ b/client/filterreader.py
@@ -34,38 +34,38 @@ class FilterReader(ConfigReader):
 	
 	def __init__(self, file, name):
 		ConfigReader.__init__(self)
-		self.file = file
-		self.name = name
+		self.__file = file
+		self.__name = name
 	
 	def setFile(self, file):
-		self.file = file
+		self.__file = file
 	
 	def getFile(self):
-		return self.file
+		return self.__file
 	
 	def setName(self, name):
-		self.name = name
+		self.__name = name
 	
 	def getName(self):
-		return self.name
+		return self.__name
 	
 	def read(self):
-		return ConfigReader.read(self, "filter.d/" + self.file)
+		return ConfigReader.read(self, "filter.d/" + self.__file)
 	
 	def getOptions(self, pOpts):
 		opts = [["string", "timeregex", None],
 				["string", "timepattern", None],
 				["string", "failregex", ""]]
-		self.opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
 	
 	def convert(self):
 		stream = list()
-		for opt in self.opts:
+		for opt in self.__opts:
 			if opt == "timeregex":
-				stream.append(["set", self.name, "timeregex", self.opts[opt]])
+				stream.append(["set", self.__name, "timeregex", self.__opts[opt]])
 			elif opt == "timepattern":
-				stream.append(["set", self.name, "timepattern", self.opts[opt]])
+				stream.append(["set", self.__name, "timepattern", self.__opts[opt]])
 			elif opt == "failregex":
-				stream.append(["set", self.name, "failregex", self.opts[opt]])		
+				stream.append(["set", self.__name, "failregex", self.__opts[opt]])		
 		return stream
 		
\ No newline at end of file
diff --git a/client/jailreader.py b/client/jailreader.py
index 635f62d6..bf8dc431 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -39,21 +39,21 @@ class JailReader(ConfigReader):
 	
 	def __init__(self, name):
 		ConfigReader.__init__(self)
-		self.name = name
-		self.filter = None
-		self.actions = list()
+		self.__name = name
+		self.__filter = None
+		self.__actions = list()
 	
 	def setName(self, value):
-		self.name = value
+		self.__name = value
 	
 	def getName(self):
-		return self.name
+		return self.__name
 	
 	def read(self):
 		ConfigReader.read(self, "jail")
 	
 	def isEnabled(self):
-		return self.opts["enabled"]
+		return self.__opts["enabled"]
 	
 	def getOptions(self):
 		opts = [["bool", "enabled", "false"],
@@ -64,27 +64,27 @@ class JailReader(ConfigReader):
 				["string", "ignoreip", None],
 				["string", "filter", ""],
 				["string", "action", ""]]
-		self.opts = ConfigReader.getOptions(self, self.name, opts)
+		self.__opts = ConfigReader.getOptions(self, self.__name, opts)
 		
 		if self.isEnabled():
 			# Read filter
-			self.filter = FilterReader(self.opts["filter"], self.name)
-			ret = self.filter.read()
+			self.__filter = FilterReader(self.__opts["filter"], self.__name)
+			ret = self.__filter.read()
 			if ret:
-				self.filter.getOptions(self.opts)
+				self.__filter.getOptions(self.__opts)
 			else:
 				logSys.error("Unable to read the filter")
 				return False
 			
 			# Read action
-			for act in self.opts["action"].split('\n'):
+			for act in self.__opts["action"].split('\n'):
 				try:
 					splitAct = JailReader.splitAction(act)
-					action = ActionReader(splitAct, self.name)
+					action = ActionReader(splitAct, self.__name)
 					ret = action.read()
 					if ret:
-						action.getOptions(self.opts)
-						self.actions.append(action)
+						action.getOptions(self.__opts)
+						self.__actions.append(action)
 					else:
 						raise AttributeError("Unable to read action")
 				except AttributeError, e:
@@ -94,24 +94,24 @@ class JailReader(ConfigReader):
 		return True
 	
 	def convert(self):
-		stream = [["add", self.name]]
-		for opt in self.opts:
+		stream = [["add", self.__name]]
+		for opt in self.__opts:
 			if opt == "logpath":
-				pathList = glob.glob(self.opts[opt])
+				pathList = glob.glob(self.__opts[opt])
 				if len(pathList) == 0:
-					logSys.error("No file found for " + self.opts[opt])
+					logSys.error("No file found for " + self.__opts[opt])
 				for path in pathList:
-					stream.append(["set", self.name, "addlogpath", path])
+					stream.append(["set", self.__name, "addlogpath", path])
 			elif opt == "maxretry":
-				stream.append(["set", self.name, "maxretry", self.opts[opt]])
+				stream.append(["set", self.__name, "maxretry", self.__opts[opt]])
 			elif opt == "ignoreip":
-				stream.append(["set", self.name, "addignoreip", self.opts[opt]])
+				stream.append(["set", self.__name, "addignoreip", self.__opts[opt]])
 			elif opt == "maxtime":
-				stream.append(["set", self.name, "maxtime", self.opts[opt]])
+				stream.append(["set", self.__name, "maxtime", self.__opts[opt]])
 			elif opt == "bantime":
-				stream.append(["set", self.name, "bantime", self.opts[opt]])
-		stream.extend(self.filter.convert())
-		for action in self.actions:
+				stream.append(["set", self.__name, "bantime", self.__opts[opt]])
+		stream.extend(self.__filter.convert())
+		for action in self.__actions:
 			stream.extend(action.convert())
 		return stream
 	
diff --git a/client/jailsreader.py b/client/jailsreader.py
index e94e0c3a..d48da92e 100644
--- a/client/jailsreader.py
+++ b/client/jailsreader.py
@@ -35,14 +35,14 @@ class JailsReader(ConfigReader):
 	
 	def __init__(self):
 		ConfigReader.__init__(self)
-		self.jails = list()
+		self.__jails = list()
 	
 	def read(self):
 		ConfigReader.read(self, "jail")
 	
 	def getOptions(self):
 		opts = []
-		self.opts = ConfigReader.getOptions(self, "Definition", opts)
+		self.__opts = ConfigReader.getOptions(self, "Definition", opts)
 
 		for sec in self.sections():
 			jail = JailReader(sec)
@@ -51,7 +51,7 @@ class JailsReader(ConfigReader):
 			if ret:
 				if jail.isEnabled():
 					# We only add enabled jails
-					self.jails.append(jail)
+					self.__jails.append(jail)
 			else:
 				logSys.error("Errors in jail '" + sec + "'. Skipping...")
 	
@@ -62,14 +62,14 @@ class JailsReader(ConfigReader):
 	
 	def convert(self):
 		stream = list()
-		for opt in self.opts:
+		for opt in self.__opts:
 			if opt == "":
 				stream.append([])
 		# Convert jails
-		for jail in self.jails:
+		for jail in self.__jails:
 			stream.extend(jail.convert())
 		# Start jails
-		for jail in self.jails:
+		for jail in self.__jails:
 			stream.append(["start", jail.getName()])
 		
 		return stream
diff --git a/fail2ban-client b/fail2ban-client
index a5fd4eb7..450f5cf4 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -50,14 +50,14 @@ class Fail2banClient:
 	prompt = "fail2ban> "
 
 	def __init__(self):
-		self.argv = None
-		self.stream = None
-		self.conf = dict()
-		self.conf["conf"] = "/etc/fail2ban"
-		self.conf["dump"] = False
-		self.conf["force"] = False
-		self.conf["verbose"] = 2
-		self.conf["interactive"] = False
+		self.__argv = None
+		self.__stream = None
+		self.__conf = dict()
+		self.__conf["conf"] = "/etc/fail2ban"
+		self.__conf["dump"] = False
+		self.__conf["force"] = False
+		self.__conf["verbose"] = 2
+		self.__conf["interactive"] = False
 		
 	def dispVersion(self):
 		print "Fail2Ban v" + version
@@ -72,7 +72,7 @@ class Fail2banClient:
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
-		print "Usage: "+self.argv[0]+" [OPTIONS]... <COMMAND>"
+		print "Usage: "+self.__argv[0]+" [OPTIONS]... <COMMAND>"
 		print
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
@@ -112,22 +112,22 @@ class Fail2banClient:
 		print "and bans the corresponding IP addresses using firewall rules."
 		print 
 	
-	def getCmdLineOptions(self, optList):
+	def __getCmdLineOptions(self, optList):
 		""" Gets the command line options
 		"""
 		for opt in optList:
 			if opt[0] == "-c":
-				self.conf["conf"] = opt[1]
+				self.__conf["conf"] = opt[1]
 			elif opt[0] == "-d":
-				self.conf["dump"] = True
+				self.__conf["dump"] = True
 			elif opt[0] == "-v":
-				self.conf["verbose"] = self.conf["verbose"] + 1
+				self.__conf["verbose"] = self.__conf["verbose"] + 1
 			elif opt[0] == "-q":
-				self.conf["verbose"] = self.conf["verbose"] - 1
+				self.__conf["verbose"] = self.__conf["verbose"] - 1
 			elif opt[0] == "-x":
-				self.conf["force"] = True
+				self.__conf["force"] = True
 			elif opt[0] == "-i":
-				self.conf["interactive"] = True
+				self.__conf["interactive"] = True
 			elif opt[0] in ["-h", "--help"]:
 	 			self.dispUsage()
 	 			sys.exit(0)
@@ -135,7 +135,7 @@ class Fail2banClient:
 	 			self.dispVersion()
 	 			sys.exit(0)
 	
-	def ping(self):
+	def __ping(self):
 		return self.processCmd([["ping"]], False)
 	
 	@staticmethod
@@ -170,30 +170,30 @@ class Fail2banClient:
 	# Process one command line and exit.
 	# @param cmd the command line
 
-	def processCommand(self, cmd):
+	def __processCommand(self, cmd):
 		if len(cmd) == 1 and cmd[0] == "start":
-			if self.ping():
+			if self.__ping():
 				logSys.info("Server already running")
 				return False
 			else:
-				self.startServerAsync(self.conf["force"])
+				self.__startServerAsync(self.__conf["force"])
 				# Read the config while the server is starting
-				self.readConfig()
+				self.__readConfig()
 				try:
 					# Wait for the server to start
-					self.waitOnServer()
+					self.__waitOnServer()
 					# Configure the server
-					self.processCmd(self.stream, False)
+					self.processCmd(self.__stream, False)
 					return True
 				except ServerExecutionException:
 					logSys.error("Could not start server. Try -x option")
 					return False
 		elif len(cmd) == 1 and cmd[0] == "reload":
-			if self.ping():
-				self.readConfig()
+			if self.__ping():
+				self.__readConfig()
 				self.processCmd([['stop', 'all']], False)
 				# Configure the server
-				return self.processCmd(self.stream, False)
+				return self.processCmd(self.__stream, False)
 			else:
 				logSys.error("Could not find server")
 				return False
@@ -206,7 +206,7 @@ class Fail2banClient:
 	#
 	# Start the Fail2ban server in daemon mode.
 	
-	def startServerAsync(self, force = False):
+	def __startServerAsync(self, force = False):
 		args = list()
 		
 		args.append("fail2ban-server")
@@ -228,10 +228,10 @@ class Fail2banClient:
 					os.exit(-1)
 						
 			
-	def waitOnServer(self):
+	def __waitOnServer(self):
 		# Wait for the server to start
 		cnt = 0
-		while not self.ping():
+		while not self.__ping():
 			if cnt > 10:
 				raise ServerExecutionException("Failed to start server")
 			time.sleep(0.1)
@@ -240,20 +240,20 @@ class Fail2banClient:
 	
 	def start(self, argv):
 		# Command line options
-		self.argv = argv
+		self.__argv = argv
 		
 		# Reads the command line options.
 		try:
 			cmdOpts = 'hc:xdviqV'
 			cmdLongOpts = ['help', 'version']
-			optList, args = getopt.getopt(self.argv[1:], cmdOpts, cmdLongOpts)
+			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
 			self.dispUsage()
 			return False
 			
-		self.getCmdLineOptions(optList)
+		self.__getCmdLineOptions(optList)
 		
-		verbose = self.conf["verbose"]
+		verbose = self.__conf["verbose"]
 		if verbose <= 0:
 			logSys.setLevel(logging.ERROR)
 		elif verbose == 1:
@@ -270,17 +270,17 @@ class Fail2banClient:
 		stdout.setFormatter(formatter)
 		logSys.addHandler(stdout)
 
-		if self.conf["dump"]:
-			self.readConfig()
-			self.dumpConfig(self.stream)
+		if self.__conf["dump"]:
+			self.__readConfig()
+			self.dumpConfig(self.__stream)
 			return True
 		
 		# Interactive mode
-		if self.conf["interactive"]:
+		if self.__conf["interactive"]:
 			try:
 				ret = True
 				if len(args) > 0:
-					ret = self.processCommand(args)
+					ret = self.__processCommand(args)
 				if ret:
 					readline.parse_and_bind("tab: complete")
 					self.dispInteractive()
@@ -290,7 +290,7 @@ class Fail2banClient:
 							# Exit
 							return True
 						if not cmd == "":
-							self.processCommand(shlex.split(cmd))
+							self.__processCommand(shlex.split(cmd))
 			except (EOFError, KeyboardInterrupt):
 				print
 				return True
@@ -299,16 +299,16 @@ class Fail2banClient:
 			if len(args) < 1:
 				self.dispUsage()
 				return False
-			return self.processCommand(args)
+			return self.__processCommand(args)
 
-	def readConfig(self):
+	def __readConfig(self):
 		# Read the configuration
 		cfg = Configurator()
-		cfg.setBaseDir(self.conf["conf"])
+		cfg.setBaseDir(self.__conf["conf"])
 		cfg.readAll()
 		cfg.getAllOptions()
 		cfg.convertToProtocol()
-		self.stream = cfg.getConfigStream()
+		self.__stream = cfg.getConfigStream()
 	
 	@staticmethod
 	def dumpConfig(cmd):
diff --git a/fail2ban-regex b/fail2ban-regex
index b30d1e33..d814d508 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -37,7 +37,7 @@ from server.filter import Filter
 class Fail2banRegex:
 	
 	def __init__(self):
-		self.filter = Filter(None)
+		self.__filter = Filter(None)
 	
 	def dispUsage(self):
 		print "Usage: "+sys.argv[0]+" <logline> <failregex>"
@@ -46,12 +46,12 @@ class Fail2banRegex:
 		print "and bans the corresponding IP addresses using firewall rules."
 	
 	def setRegex(self, value):
-		self.filter.setFailRegex(value)
+		self.__filter.setFailRegex(value)
 	
 	def testRegex(self, line):
 		print
 		try:
-			ret = self.filter.findFailure(line)
+			ret = self.__filter.findFailure(line)
 		except IndexError:
 			print "Sorry, but no <host> found in regex"
 			return False
@@ -68,7 +68,7 @@ class Fail2banRegex:
 			print "IP  :" + ipList
 			print
 			print "Date template hits:"
-			for template in self.filter.dateDetector.templates:
+			for template in self.__filter.dateDetector.templates:
 				print `template.getHits()` + " hit: " + template.getName()
 			print
 			print "Benchmark. Executing 1000..."
@@ -80,7 +80,7 @@ class Fail2banRegex:
 			minPos = 0
 			for i in range(1000):
 				start = time.time()
-				ret = self.filter.findFailure(line)
+				ret = self.__filter.findFailure(line)
 				end = time.time()
 				diff = (end - start) * 1000
 				total = total + diff
diff --git a/fail2ban-server b/fail2ban-server
index ddfb499d..0b5cae06 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -45,11 +45,11 @@ from server.server import Server
 class Fail2banServer:
 	
 	def __init__(self):
-		self.server = None
-		self.argv = None
-		self.conf = dict()
-		self.conf["background"] = True
-		self.conf["force"] = False
+		self.__server = None
+		self.__argv = None
+		self.__conf = dict()
+		self.__conf["background"] = True
+		self.__conf["force"] = False
 	
 	def dispVersion(self):
 		print "Fail2Ban v" + version
@@ -64,7 +64,7 @@ class Fail2banServer:
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
-		print "Usage: "+self.argv[0]+" [OPTIONS]"
+		print "Usage: "+self.__argv[0]+" [OPTIONS]"
 		print
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
@@ -81,16 +81,16 @@ class Fail2banServer:
 		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	
-	def getCmdLineOptions(self, optList):
+	def __getCmdLineOptions(self, optList):
 		""" Gets the command line options
 		"""
 		for opt in optList:
 			if opt[0] == "-b":
-				self.conf["background"] = True
+				self.__conf["background"] = True
 			if opt[0] == "-f":
-				self.conf["background"] = False
+				self.__conf["background"] = False
 			if opt[0] == "-x":
-				self.conf["force"] = True
+				self.__conf["force"] = True
 			if opt[0] in ["-h", "--help"]:
 	 			self.dispUsage()
 				sys.exit(0)
@@ -107,25 +107,25 @@ class Fail2banServer:
 	
 	def start(self, argv):
 		# Command line options
-		self.argv = argv
+		self.__argv = argv
 		
 		# Reads the command line options.
 		try:
 			cmdOpts = 'bfxhV'
 			cmdLongOpts = ['help', 'version']
-			optList, args = getopt.getopt(self.argv[1:], cmdOpts, cmdLongOpts)
+			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
 			self.dispUsage()
 			
-		self.getCmdLineOptions(optList)
+		self.__getCmdLineOptions(optList)
 		
 		try:
-			self.server = Server(self.conf["background"])
-			self.server.start(self.conf["force"])
+			self.__server = Server(self.__conf["background"])
+			self.__server.start(self.__conf["force"])
 			return True
 		except Exception, e:
 			print e
-			self.server.quit()
+			self.__server.quit()
 			return False
 		
 if __name__ == "__main__":
diff --git a/server/action.py b/server/action.py
index 3944c389..e648c355 100644
--- a/server/action.py
+++ b/server/action.py
@@ -39,34 +39,34 @@ logSys = logging.getLogger("fail2ban.actions.action")
 class Action:
 	
 	def __init__(self, name):
-		self.name = name
-		self.cInfo = dict()
+		self.__name = name
+		self.__cInfo = dict()
 		## Command executed in order to initialize the system.
-		self.actionStart = ''
+		self.__actionStart = ''
 		## Command executed when an IP address gets banned.
-		self.actionBan = ''
+		self.__actionBan = ''
 		## Command executed when an IP address gets removed.
-		self.actionUnban = ''
+		self.__actionUnban = ''
 		## Command executed in order to check requirements.
-		self.actionCheck = ''
+		self.__actionCheck = ''
 		## Command executed in order to stop the system.
-		self.actionStop = ''
+		self.__actionStop = ''
 		logSys.debug("Created Action")
 	
 	def setName(self, name):
-		self.name = name
+		self.__name = name
 	
 	def getName(self):
-		return self.name
+		return self.__name
 	
 	def setCInfo(self, key, value):
-		self.cInfo[key] = value
+		self.__cInfo[key] = value
 	
 	def getCInfo(self, key):
-		return self.cInfo[key]
+		return self.__cInfo[key]
 	
 	def delCInfo(self, key):
-		del self.cInfo[key]
+		del self.__cInfo[key]
 	
 	##
 	# Set the "start" command.
@@ -74,7 +74,7 @@ class Action:
 	# @param value the command
 		
 	def setActionStart(self, value):
-		self.actionStart = value
+		self.__actionStart = value
 		logSys.info("Set actionStart = %s" % value)
 	
 	##
@@ -83,10 +83,10 @@ class Action:
 	# @return the command
 	
 	def getActionStart(self):
-		return self.actionStart
+		return self.__actionStart
 	
 	def execActionStart(self):
-		startCmd = Action.replaceTag(self.actionStart, self.cInfo)
+		startCmd = Action.replaceTag(self.__actionStart, self.__cInfo)
 		return Action.executeCmd(startCmd)
 	
 	##
@@ -95,7 +95,7 @@ class Action:
 	# @param value the command
 	
 	def setActionBan(self, value):
-		self.actionBan = value
+		self.__actionBan = value
 		logSys.info("Set actionBan = %s" % value)
 	
 	##
@@ -104,10 +104,10 @@ class Action:
 	# @return the command
 	
 	def getActionBan(self):
-		return self.actionBan
+		return self.__actionBan
 	
 	def execActionBan(self, aInfo):
-		return self.processCmd(self.actionBan, aInfo);
+		return self.__processCmd(self.__actionBan, aInfo);
 	
 	##
 	# Set the "unban" command.
@@ -115,7 +115,7 @@ class Action:
 	# @param value the command
 	
 	def setActionUnban(self, value):
-		self.actionUnban = value
+		self.__actionUnban = value
 		logSys.info("Set actionUnban = %s" % value)
 	
 	##
@@ -124,10 +124,10 @@ class Action:
 	# @return the command
 	
 	def getActionUnban(self):
-		return self.actionUnban
+		return self.__actionUnban
 	
 	def execActionUnban(self, aInfo):
-		return self.processCmd(self.actionUnban, aInfo);
+		return self.__processCmd(self.__actionUnban, aInfo);
 	
 	##
 	# Set the "check" command.
@@ -135,7 +135,7 @@ class Action:
 	# @param value the command
 	
 	def setActionCheck(self, value):
-		self.actionCheck = value
+		self.__actionCheck = value
 		logSys.info("Set actionCheck = %s" % value)
 	
 	##
@@ -144,7 +144,7 @@ class Action:
 	# @return the command
 	
 	def getActionCheck(self):
-		return self.actionCheck
+		return self.__actionCheck
 	
 	##
 	# Set the "stop" command.
@@ -152,7 +152,7 @@ class Action:
 	# @param value the command
 	
 	def setActionStop(self, value):
-		self.actionStop = value
+		self.__actionStop = value
 		logSys.info("Set actionStop = %s" % value)
 	
 	##
@@ -161,10 +161,10 @@ class Action:
 	# @return the command
 	
 	def getActionStop(self):
-		return self.actionStop
+		return self.__actionStop
 	
 	def execActionStop(self):
-		stopCmd = Action.replaceTag(self.actionStop, self.cInfo)
+		stopCmd = Action.replaceTag(self.__actionStop, self.__cInfo)
 		return Action.executeCmd(stopCmd)
 	
 	@staticmethod
@@ -178,20 +178,20 @@ class Action:
 		string = string.replace("<br>", '\n')
 		return string
 	
-	def processCmd(self, cmd, aInfo = None):
+	def __processCmd(self, cmd, aInfo = None):
 		""" Executes an OS command.
 		"""
 		if cmd == "":
 			logSys.debug("Nothing to do")
 			return True
 		
-		checkCmd = Action.replaceTag(self.actionCheck, self.cInfo)
+		checkCmd = Action.replaceTag(self.__actionCheck, self.__cInfo)
 		if not Action.executeCmd(checkCmd):
 			logSys.error("Invariant check failed. Trying to restore a sane" +
 						 " environment")
-			stopCmd = Action.replaceTag(self.actionStop, self.cInfo)
+			stopCmd = Action.replaceTag(self.__actionStop, self.__cInfo)
 			Action.executeCmd(stopCmd)
-			startCmd = Action.replaceTag(self.actionStart, self.cInfo)
+			startCmd = Action.replaceTag(self.__actionStart, self.__cInfo)
 			Action.executeCmd(startCmd)
 			if not Action.executeCmd(checkCmd):
 				logSys.fatal("Unable to restore environment")
@@ -204,7 +204,7 @@ class Action:
 			realCmd = cmd
 		
 		# Replace static fields
-		realCmd = Action.replaceTag(realCmd, self.cInfo)
+		realCmd = Action.replaceTag(realCmd, self.__cInfo)
 		
   		return Action.executeCmd(realCmd)
 
diff --git a/server/actions.py b/server/actions.py
index 66a0eecd..e9cc2d3e 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -52,29 +52,29 @@ class Actions(JailThread):
 		JailThread.__init__(self, jail)
 		## The jail which contains this action.
 		self.jail = jail
-		self.actions = list()
+		self.__actions = list()
 		## The ban manager.
-		self.banManager = BanManager()
+		self.__banManager = BanManager()
 	
 	def addAction(self, name):
 		action = Action(name)
-		self.actions.append(action)
+		self.__actions.append(action)
 	
 	def delAction(self, name):
-		for action in self.actions:
+		for action in self.__actions:
 			if action.getName() == name:
-				self.actions.remove(action)
+				self.__actions.remove(action)
 				break
 	
 	def getAction(self, name):
-		for action in self.actions:
+		for action in self.__actions:
 			if action.getName() == name:
 				return action
 		raise KeyError
 	
 	def getLastAction(self):
-		action = self.actions.pop()
-		self.actions.append(action)
+		action = self.__actions.pop()
+		self.__actions.append(action)
 		return action
 	
 	##
@@ -83,7 +83,7 @@ class Actions(JailThread):
 	# @param value the time
 	
 	def setBanTime(self, value):
-		self.banManager.setBanTime(value)
+		self.__banManager.setBanTime(value)
 		logSys.info("Set banTime = %s" % value)
 	
 	##
@@ -92,7 +92,7 @@ class Actions(JailThread):
 	# @return the time
 	
 	def getBanTime(self):
-		return self.banManager.getBanTime()
+		return self.__banManager.getBanTime()
 	
 	##
 	# Main loop.
@@ -102,20 +102,20 @@ class Actions(JailThread):
 	# @return True when the thread exits nicely
 	
 	def run(self):
-		for action in self.actions:
+		for action in self.__actions:
 			action.execActionStart()
 		self.setActive(True)
 		while self.isActive():
-			if not self.isIdle:
+			if not self.getIdle():
 				#logSys.debug(self.jail.getName() + ": action")
-				ret = self.checkBan()
+				ret = self.__checkBan()
 				if not ret:
-					self.checkUnBan()
-					time.sleep(self.sleepTime)
+					self.__checkUnBan()
+					time.sleep(self.getSleepTime())
 			else:
-				time.sleep(self.sleepTime)
-		self.flushBan()
-		for action in self.actions:
+				time.sleep(self.getSleepTime())
+		self.__flushBan()
+		for action in self.__actions:
 			action.execActionStop()
 		logSys.debug(self.jail.getName() + ": action terminated")
 		return True
@@ -127,7 +127,7 @@ class Actions(JailThread):
 	# it executes the "ban" command and add a ticket to the BanManager.
 	# @return True if an IP address get banned
 	
-	def checkBan(self):
+	def __checkBan(self):
 		ticket = self.jail.getFailTicket()
 		if ticket != False:
 			aInfo = dict()
@@ -135,9 +135,9 @@ class Actions(JailThread):
 			aInfo["ip"] = bTicket.getIP()
 			aInfo["failures"] = bTicket.getAttempt()
 			logSys.info("Ban %s" % aInfo["ip"])
-			for action in self.actions:
+			for action in self.__actions:
 				action.execActionBan(aInfo)
-			self.banManager.addBanTicket(bTicket)
+			self.__banManager.addBanTicket(bTicket)
 			return True
 		return False
 	
@@ -146,12 +146,12 @@ class Actions(JailThread):
 	#
 	# Unban IP address which are outdated.
 	
-	def checkUnBan(self):
-		for ticket in self.banManager.unBanList(time.time()):
+	def __checkUnBan(self):
+		for ticket in self.__banManager.unBanList(time.time()):
 			aInfo = dict()
 			aInfo["ip"] = ticket.getIP()
 			logSys.info("Unban %s" % aInfo["ip"])
-			for action in self.actions:
+			for action in self.__actions:
 				action.execActionUnban(aInfo)
 	
 	##
@@ -159,13 +159,13 @@ class Actions(JailThread):
 	#
 	# Unban all IP address which are still in the banning list.
 	
-	def flushBan(self):
+	def __flushBan(self):
 		logSys.debug("Flush ban list")
-		for ticket in self.banManager.flushBanList():
+		for ticket in self.__banManager.flushBanList():
 			aInfo = dict()
 			aInfo["ip"] = ticket.getIP()
 			logSys.info("Unban %s" % aInfo["ip"])
-			for action in self.actions:
+			for action in self.__actions:
 				action.execActionUnban(aInfo)
 	
 	##
@@ -176,7 +176,7 @@ class Actions(JailThread):
 	# @return a list with tuple
 	
 	def status(self):
-		ret = [("Currently banned", self.banManager.size()),
-			   ("Total banned", self.banManager.getBanTotal())]
+		ret = [("Currently banned", self.__banManager.size()),
+			   ("Total banned", self.__banManager.getBanTotal())]
 		return ret
 		
\ No newline at end of file
diff --git a/server/banmanager.py b/server/banmanager.py
index bd731e38..9c89a3fb 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -46,13 +46,13 @@ class BanManager:
 	
 	def __init__(self):
 		## Mutex used to protect the ban list.
-		self.lock = Lock()
+		self.__lock = Lock()
 		## The ban list.
-		self.banList = list()
+		self.__banList = list()
 		## The amount of time an IP address gets banned.
-		self.banTime = 600
+		self.__banTime = 600
 		## Total number of banned IP address
-		self.banTotal = 0
+		self.__banTotal = 0
 	
 	##
 	# Set the ban time.
@@ -61,9 +61,9 @@ class BanManager:
 	# @param value the time
 	
 	def setBanTime(self, value):
-		self.lock.acquire()
-		self.banTime = int(value)
-		self.lock.release()
+		self.__lock.acquire()
+		self.__banTime = int(value)
+		self.__lock.release()
 	
 	##
 	# Get the ban time.
@@ -73,10 +73,10 @@ class BanManager:
 	
 	def getBanTime(self):
 		try:
-			self.lock.acquire()
-			return self.banTime
+			self.__lock.acquire()
+			return self.__banTime
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	##
 	# Set the total number of banned address.
@@ -84,9 +84,9 @@ class BanManager:
 	# @param value total number
 	
 	def setBanTotal(self, value):
-		self.lock.acquire()
-		self.banTotal = value
-		self.lock.release()
+		self.__lock.acquire()
+		self.__banTotal = value
+		self.__lock.release()
 	
 	##
 	# Get the total number of banned address.
@@ -95,10 +95,10 @@ class BanManager:
 	
 	def getBanTotal(self):
 		try:
-			self.lock.acquire()
-			return self.banTotal
+			self.__lock.acquire()
+			return self.__banTotal
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	##
 	# Create a ban ticket.
@@ -126,14 +126,14 @@ class BanManager:
 	
 	def addBanTicket(self, ticket):
 		try:
-			self.lock.acquire()
+			self.__lock.acquire()
 			if not self.__inBanList(ticket):
-				self.banList.append(ticket)
-				self.banTotal += 1
+				self.__banList.append(ticket)
+				self.__banTotal += 1
 				return True
 			return False
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	##
 	# Delete a ban ticket.
@@ -142,7 +142,7 @@ class BanManager:
 	# @param ticket the ticket
 	
 	def __delBanTicket(self, ticket):
-		self.banList.remove(ticket)
+		self.__banList.remove(ticket)
 	
 	##
 	# Get the size of the ban list.
@@ -151,10 +151,10 @@ class BanManager:
 	
 	def size(self):
 		try:
-			self.lock.acquire()
-			return len(self.banList)
+			self.__lock.acquire()
+			return len(self.__banList)
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	##
 	# Check if a ticket is in the list.
@@ -165,7 +165,7 @@ class BanManager:
 	# @return True if a ticket already exists
 	
 	def __inBanList(self, ticket):
-		for i in self.banList:
+		for i in self.__banList:
 			if ticket.getIP() == i.getIP():
 				return True
 		return False
@@ -180,15 +180,15 @@ class BanManager:
 	
 	def unBanList(self, time):
 		try:
-			self.lock.acquire()
+			self.__lock.acquire()
 			uBList = list()
-			for ticket in self.banList:
-				if ticket.getTime() < time - self.banTime:
+			for ticket in self.__banList:
+				if ticket.getTime() < time - self.__banTime:
 					uBList.append(ticket)
 					self.__delBanTicket(ticket)
 			return uBList
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	##
 	# Flush the ban list.
@@ -198,9 +198,9 @@ class BanManager:
 	
 	def flushBanList(self):
 		try:
-			self.lock.acquire()
-			uBList = self.banList
-			self.banList = list()
+			self.__lock.acquire()
+			uBList = self.__banList
+			self.__banList = list()
 			return uBList
 		finally:
-			self.lock.release()
+			self.__lock.release()
diff --git a/server/datedetector.py b/server/datedetector.py
index 65c575b0..04126b18 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -38,9 +38,9 @@ logSys = logging.getLogger("fail2ban.filter.datedetector")
 class DateDetector:
 	
 	def __init__(self):
-		self.lock = Lock()
-		self.templates = list()
-		self.defTemplate = DateTemplate()
+		self.__lock = Lock()
+		self.__templates = list()
+		self.__defTemplate = DateTemplate()
 	
 	def addDefaultTemplate(self):
 		# standard
@@ -48,67 +48,67 @@ class DateDetector:
 		template.setName("Month Day Hour:Minute:Second")
 		template.setRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 		template.setPattern("%b %d %H:%M:%S")
-		self.templates.append(template)
+		self.__templates.append(template)
 		# asctime
 		template = DateStrptime()
 		template.setName("Weekday Month Day Hour:Minute:Second Year")
 		template.setRegex("\S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}")
 		template.setPattern("%a %b %d %H:%M:%S %Y")
-		self.templates.append(template)
+		self.__templates.append(template)
 		# TAI64N
 		template = DateTai64n()
 		template.setName("TAI64N")
-		self.templates.append(template)
+		self.__templates.append(template)
 		# Epoch
 		template = DateEpoch()
 		template.setName("Epoch")
-		self.templates.append(template)
+		self.__templates.append(template)
 	
 	def setDefaultRegex(self, value):
-		self.defTemplate.setRegex(value)
+		self.__defTemplate.setRegex(value)
 	
 	def getDefaultRegex(self):
-		return self.defTemplate.getRegex()
+		return self.__defTemplate.getRegex()
 	
 	def setDefaultPattern(self, value):
-		self.defTemplate.setPattern(value)
+		self.__defTemplate.setPattern(value)
 	
 	def getDefaultPattern(self):
-		return self.defTemplate.getPattern()
+		return self.__defTemplate.getPattern()
 	
 	def matchTime(self, line):
-		if self.defTemplate.isValid():
-			return self.defTemplate.matchDate(line)
+		if self.__defTemplate.isValid():
+			return self.__defTemplate.matchDate(line)
 		else:
-			self.lock.acquire()
-			for template in self.templates:
+			self.__lock.acquire()
+			for template in self.__templates:
 				match = template.matchDate(line)
 				if match <> None:
-					self.lock.release()
+					self.__lock.release()
 					return match
-			self.lock.release()
+			self.__lock.release()
 			return None
 
 	def getTime(self, line):
-		if self.defTemplate.isValid():
+		if self.__defTemplate.isValid():
 			try:
-				date = self.defTemplate.getDate(line)
+				date = self.__defTemplate.getDate(line)
 				return date
 			except ValueError:
 				return None
 		else:
-			self.lock.acquire()
-			for template in self.templates:
+			self.__lock.acquire()
+			for template in self.__templates:
 				try:
 					date = template.getDate(line)
 					if date == None:
 						continue
 					template.incHits()
-					self.lock.release()
+					self.__lock.release()
 					return date
 				except ValueError:
 					pass
-			self.lock.release()
+			self.__lock.release()
 			return None
 
 	def getUnixTime(self, line):
@@ -123,8 +123,8 @@ class DateDetector:
 	# in this object and thus should be called from time to time.
 	
 	def sortTemplate(self):
-		self.lock.acquire()
+		self.__lock.acquire()
 		logSys.debug("Sorting the template list")
-		self.templates.sort(cmp = lambda x, y: cmp(x.getHits(), y.getHits()), 
+		self.__templates.sort(cmp = lambda x, y: cmp(x.getHits(), y.getHits()), 
 							reverse=True)
-		self.lock.release()
+		self.__lock.release()
diff --git a/server/datestrptime.py b/server/datestrptime.py
index ef115722..9c9ccfde 100644
--- a/server/datestrptime.py
+++ b/server/datestrptime.py
@@ -37,7 +37,7 @@ class DateStrptime(DateTemplate):
 		date = None
 		dateMatch = self.matchDate(line)
 		if dateMatch:
-			date = list(time.strptime(dateMatch.group(), self.pattern))
+			date = list(time.strptime(dateMatch.group(), self.getPattern()))
 			if date[0] < 2000:
 				# There is probably no year field in the logs
 				date[0] = time.gmtime()[0]
diff --git a/server/datetemplate.py b/server/datetemplate.py
index eae730ee..69b945d7 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -29,42 +29,42 @@ import re, time
 class DateTemplate:
 	
 	def __init__(self):
-		self.name = ""
-		self.regex = ""
-		self.cRegex = None
-		self.pattern = ""
-		self.hits = 0
+		self.__name = ""
+		self.__regex = ""
+		self.__cRegex = None
+		self.__pattern = ""
+		self.__hits = 0
 	
 	def setName(self, name):
-		self.name = name
+		self.__name = name
 		
 	def getName(self):
-		return self.name
+		return self.__name
 	
 	def setRegex(self, regex):
-		self.regex = regex
-		self.cRegex = re.compile(regex)
+		self.__regex = regex
+		self.__cRegex = re.compile(regex)
 		
 	def getRegex(self):
-		return self.regex
+		return self.__regex
 	
 	def setPattern(self, pattern):
-		self.pattern = pattern
+		self.__pattern = pattern
 		
 	def getPattern(self):
-		return self.pattern
+		return self.__pattern
 	
 	def isValid(self):
-		return self.regex != "" and self.pattern != ""
+		return self.__regex != "" and self.__pattern != ""
 	
 	def incHits(self):
-		self.hits = self.hits + 1
+		self.__hits = self.__hits + 1
 	
 	def getHits(self):
-		return self.hits
+		return self.__hits
 	
 	def matchDate(self, line):
-		dateMatch = self.cRegex.search(line)
+		dateMatch = self.__cRegex.search(line)
 		return dateMatch
 	
 	def getDate(self, line):
diff --git a/server/faildata.py b/server/faildata.py
index 8d6c0de9..391e6b6e 100644
--- a/server/faildata.py
+++ b/server/faildata.py
@@ -32,22 +32,22 @@ logSys = logging.getLogger("fail2ban")
 class FailData:
 	
 	def __init__(self):
-		self.retry = 0
-		self.lastTime = 0
+		self.__retry = 0
+		self.__lastTime = 0
 	
 	def setRetry(self, value):
-		self.retry = value
+		self.__retry = value
 	
 	def getRetry(self):
-		return self.retry
+		return self.__retry
 	
 	def inc(self):
-		self.retry += 1
+		self.__retry += 1
 	
 	def setLastTime(self, value):
-		if value > self.lastTime:
-			self.lastTime = value
+		if value > self.__lastTime:
+			self.__lastTime = value
 	
 	def getLastTime(self):
-		return self.lastTime
+		return self.__lastTime
 	
\ No newline at end of file
diff --git a/server/failmanager.py b/server/failmanager.py
index aa2a1b0d..1c931b82 100644
--- a/server/failmanager.py
+++ b/server/failmanager.py
@@ -35,89 +35,89 @@ logSys = logging.getLogger("fail2ban.filter")
 class FailManager:
 	
 	def __init__(self):
-		self.lock = Lock()
-		self.failList = dict()
-		self.maxRetry = 3
-		self.maxTime = 600
-		self.failTotal = 0
+		self.__lock = Lock()
+		self.__failList = dict()
+		self.__maxRetry = 3
+		self.__maxTime = 600
+		self.__failTotal = 0
 	
 	def setFailTotal(self, value):
-		self.lock.acquire()
-		self.failTotal = value
-		self.lock.release()
+		self.__lock.acquire()
+		self.__failTotal = value
+		self.__lock.release()
 		
 	def getFailTotal(self):
 		try:
-			self.lock.acquire()
-			return self.failTotal
+			self.__lock.acquire()
+			return self.__failTotal
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	def setMaxRetry(self, value):
-		self.lock.acquire()
-		self.maxRetry = value
-		self.lock.release()
+		self.__lock.acquire()
+		self.__maxRetry = value
+		self.__lock.release()
 	
 	def getMaxRetry(self):
 		try:
-			self.lock.acquire()
-			return self.maxRetry
+			self.__lock.acquire()
+			return self.__maxRetry
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	def setMaxTime(self, value):
-		self.lock.acquire()
-		self.maxTime = value
-		self.lock.release()
+		self.__lock.acquire()
+		self.__maxTime = value
+		self.__lock.release()
 	
 	def getMaxTime(self):
 		try:
-			self.lock.acquire()
-			return self.maxTime
+			self.__lock.acquire()
+			return self.__maxTime
 		finally:
-			self.lock.release()
+			self.__lock.release()
 
 	def addFailure(self, ticket):
-		self.lock.acquire()
+		self.__lock.acquire()
 		ip = ticket.getIP()
 		unixTime = ticket.getTime()
-		if self.failList.has_key(ip):
-			fData = self.failList[ip]
+		if self.__failList.has_key(ip):
+			fData = self.__failList[ip]
 			fData.inc()
 			fData.setLastTime(unixTime)
 		else:
 			fData = FailData()
 			fData.inc()
 			fData.setLastTime(unixTime)
-			self.failList[ip] = fData
-		self.failTotal += 1
-		self.lock.release()
+			self.__failList[ip] = fData
+		self.__failTotal += 1
+		self.__lock.release()
 	
 	def size(self):
 		try:
-			self.lock.acquire()
-			return len(self.failList)
+			self.__lock.acquire()
+			return len(self.__failList)
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	def cleanup(self, time):
-		self.lock.acquire()
-		tmp = self.failList.copy()
+		self.__lock.acquire()
+		tmp = self.__failList.copy()
 		for item in tmp:
-			if tmp[item].getLastTime() < time - self.maxTime:
+			if tmp[item].getLastTime() < time - self.__maxTime:
 				self.__delFailure(item)
-		self.lock.release()
+		self.__lock.release()
 	
 	def __delFailure(self, ip):
-		if self.failList.has_key(ip):
-			del self.failList[ip]
+		if self.__failList.has_key(ip):
+			del self.__failList[ip]
 	
 	def toBan(self):
 		try:
-			self.lock.acquire()
-			for ip in self.failList:
-				data = self.failList[ip]
-				if data.getRetry() >= self.maxRetry:
+			self.__lock.acquire()
+			for ip in self.__failList:
+				data = self.__failList[ip]
+				if data.getRetry() >= self.__maxRetry:
 					self.__delFailure(ip)
 					# Create a FailTicket from BanData
 					failTicket = FailTicket(ip, data.getLastTime())
@@ -125,7 +125,7 @@ class FailManager:
 					return failTicket
 			raise FailManagerEmpty
 		finally:
-			self.lock.release()
+			self.__lock.release()
 
 class FailManagerEmpty(Exception):
 	pass
diff --git a/server/filter.py b/server/filter.py
index d7467761..9a0f4dab 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -293,7 +293,7 @@ class Filter(JailThread):
 	# and reset the position to 0 in that case. Use the log message
 	# timestamp in order to detect this.
 	
-	def setFilePos(self):
+	def __setFilePos(self):
 		line = self.crtHandler.readline()
 		lastDate = self.lastDate[self.crtFilename]
 		lineDate = self.dateDetector.getUnixTime(line)
@@ -309,7 +309,7 @@ class Filter(JailThread):
 	##
 	# Get the file position.
 	
-	def getFilePos(self):
+	def __getFilePos(self):
 		return self.crtHandler.tell()
 
 	##
@@ -319,11 +319,11 @@ class Filter(JailThread):
 	# time.time()-self.findTime. When a failure is detected, a FailTicket
 	# is created and is added to the FailManager.
 	
-	def getFailures(self, filename):
+	def __getFailures(self, filename):
 		ipList = dict()
 		logSys.debug(filename)
 		self.openLogFile(filename)
-		self.setFilePos()
+		self.__setFilePos()
 		lastLine = None
 		for line in self.crtHandler:
 			try:
@@ -347,7 +347,7 @@ class Filter(JailThread):
 					continue
 				logSys.debug("Found "+ip)
 				self.failManager.addFailure(FailTicket(ip, unixTime))
-		self.lastPos[filename] = self.getFilePos()
+		self.lastPos[filename] = self.__getFilePos()
 		if lastLine:
 			self.lastDate[filename] = self.dateDetector.getTime(lastLine)
 		self.closeLogFile()
diff --git a/server/filtergamin.py b/server/filtergamin.py
index 2f757258..dc85429b 100644
--- a/server/filtergamin.py
+++ b/server/filtergamin.py
@@ -61,7 +61,7 @@ class FilterGamin(Filter):
 		logSys.debug("Got event: " + `event` + " for " + path)
 		if event in (gamin.GAMCreated, gamin.GAMChanged, gamin.GAMExists):
 			logSys.debug("File changed: " + path)
-			self.getFailures(path)
+			self.__getFailures(path)
 			self.modified = True
 
 
@@ -72,11 +72,11 @@ class FilterGamin(Filter):
 
 	def addLogPath(self, path):
 		try:
-			self.logPath.index(path)
+			self.getLogPath().index(path)
 			logSys.error(path + " already exists")
 		except ValueError:
 			self.monitor.watch_file(path, self.callback)
-			self.logPath.append(path)
+			self.getLogPath().append(path)
 			# Initialize default values
 			self.lastDate[path] = 0
 			self.lastModTime[path] = 0
@@ -91,7 +91,7 @@ class FilterGamin(Filter):
 	def delLogPath(self, path):
 		try:
 			self.monitor.stop_watch(path)
-			self.logPath.remove(path)
+			self.getLogPath().remove(path)
 			del self.lastDate[path]
 			del self.lastModTime[path]
 			del self.lastPos[path]
@@ -110,7 +110,7 @@ class FilterGamin(Filter):
 	def run(self):
 		self.setActive(True)
 		while self.isActive():
-			if not self.isIdle:
+			if not self.getIdle():
 				# We cannot block here because we want to be able to
 				# exit.
 				if self.monitor.event_pending():
@@ -124,8 +124,8 @@ class FilterGamin(Filter):
 						self.failManager.cleanup(time.time())
 					self.dateDetector.sortTemplate()
 					self.modified = False
-				time.sleep(self.sleepTime)
+				time.sleep(self.getSleepTime())
 			else:
-				time.sleep(self.sleepTime)
+				time.sleep(self.getSleepTime())
 		logSys.debug(self.jail.getName() + ": filter terminated")
 		return True
diff --git a/server/filterpoll.py b/server/filterpoll.py
index c53ffa5a..68e8f5c6 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -53,7 +53,7 @@ class FilterPoll(Filter):
 	def __init__(self, jail):
 		Filter.__init__(self, jail)
 		
-		self.file404Cnt = dict()
+		self.__file404Cnt = dict()
 		
 		logSys.info("Created FilterPoll")
 
@@ -64,15 +64,15 @@ class FilterPoll(Filter):
 
 	def addLogPath(self, path):
 		try:
-			self.logPath.index(path)
+			self.getLogPath().index(path)
 			logSys.error(path + " already exists")
 		except ValueError:
-			self.logPath.append(path)
+			self.getLogPath().append(path)
 			# Initialize default values
 			self.lastDate[path] = 0
 			self.lastModTime[path] = 0
 			self.lastPos[path] = 0
-			self.file404Cnt[path] = 0
+			self.__file404Cnt[path] = 0
 			logSys.info("Added logfile = %s" % path)
 	
 	##
@@ -82,11 +82,11 @@ class FilterPoll(Filter):
 	
 	def delLogPath(self, path):
 		try:
-			self.logPath.remove(path)
+			self.getLogPath().remove(path)
 			del self.lastDate[path]
 			del self.lastModTime[path]
 			del self.lastPos[path]
-			del self.file404Cnt[path]
+			del self.__file404Cnt[path]
 			logSys.info("Removed logfile = %s" % path)
 		except ValueError:
 			logSys.error(path + " is not monitored")
@@ -102,11 +102,11 @@ class FilterPoll(Filter):
 	def run(self):
 		self.setActive(True)
 		while self.isActive():
-			if not self.isIdle:
+			if not self.getIdle():
 				# Get file modification
-				for file in self.logPath:
+				for file in self.getLogPath():
 					if self.isModified(file):
-						self.getFailures(file)
+						self.__getFailures(file)
 						prevModified = True
 
 				if self.modified:
@@ -117,9 +117,9 @@ class FilterPoll(Filter):
 						self.failManager.cleanup(time.time())
 					self.dateDetector.sortTemplate()
 					prevModified = False
-				time.sleep(self.sleepTime)
+				time.sleep(self.getSleepTime())
 			else:
-				time.sleep(self.sleepTime)
+				time.sleep(self.getSleepTime())
 		logSys.debug(self.jail.getName() + ": filter terminated")
 		return True
 
@@ -132,7 +132,7 @@ class FilterPoll(Filter):
 	def isModified(self, filename):
 		try:
 			logStats = os.stat(filename)
-			self.file404Cnt[filename] = 0
+			self.__file404Cnt[filename] = 0
 			if self.lastModTime[filename] == logStats.st_mtime:
 				return False
 			else:
@@ -141,9 +141,9 @@ class FilterPoll(Filter):
 				return True
 		except OSError:
 			logSys.error("Unable to get stat on " + filename)
-			self.file404Cnt[filename] = self.file404Cnt[filename] + 1
-			if self.file404Cnt[filename] > 2:
+			self.__file404Cnt[filename] = self.__file404Cnt[filename] + 1
+			if self.__file404Cnt[filename] > 2:
 				logSys.warn("Too much read error. Set the jail idle")
 				self.jail.setIdle(True)
-				self.file404Cnt[filename] = 0
+				self.__file404Cnt[filename] = 0
 			return False
diff --git a/server/jail.py b/server/jail.py
index 359d08d4..38035b79 100644
--- a/server/jail.py
+++ b/server/jail.py
@@ -35,114 +35,114 @@ logSys = logging.getLogger("fail2ban.jail")
 class Jail:
 	
 	def __init__(self, name):
-		self.lock = Lock()
-		self.name = name
-		self.queue = Queue.Queue()
+		self.__lock = Lock()
+		self.__name = name
+		self.__queue = Queue.Queue()
 		try:
 			import gamin
 			logSys.info("Gamin available. Using it instead of poller")
 			from filtergamin import FilterGamin
-			self.filter = FilterGamin(self)
+			self.__filter = FilterGamin(self)
 		except ImportError:
 			logSys.info("Gamin not available. Using poller")
 			from filterpoll import FilterPoll
-			self.filter = FilterPoll(self)
-		self.action = Actions(self)
+			self.__filter = FilterPoll(self)
+		self.__action = Actions(self)
 	
 	def setName(self, name):
-		self.lock.acquire()
-		self.name = name
-		self.lock.release()
+		self.__lock.acquire()
+		self.__name = name
+		self.__lock.release()
 	
 	def getName(self):
 		try:
-			self.lock.acquire()
-			return self.name
+			self.__lock.acquire()
+			return self.__name
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	def setFilter(self, filter):
-		self.lock.acquire()
-		self.filter = filter
-		self.lock.release()
+		self.__lock.acquire()
+		self.__filter = filter
+		self.__lock.release()
 	
 	def getFilter(self):
 		try:
-			self.lock.acquire()
-			return self.filter
+			self.__lock.acquire()
+			return self.__filter
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	def setAction(self, action):
-		self.lock.acquire()
-		self.action = action
-		self.lock.release()
+		self.__lock.acquire()
+		self.__action = action
+		self.__lock.release()
 	
 	def getAction(self):
 		try:
-			self.lock.acquire()
-			return self.action
+			self.__lock.acquire()
+			return self.__action
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	def putFailTicket(self, ticket):
-		self.lock.acquire()
-		self.queue.put(ticket)
-		self.lock.release()
+		self.__lock.acquire()
+		self.__queue.put(ticket)
+		self.__lock.release()
 	
 	def getFailTicket(self):
 		try:
-			self.lock.acquire()
+			self.__lock.acquire()
 			try:
-				return self.queue.get(False)
+				return self.__queue.get(False)
 			except Queue.Empty:
 				return False
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	def start(self):
-		self.lock.acquire()
-		self.filter.start()
-		self.action.start()
-		self.lock.release()
+		self.__lock.acquire()
+		self.__filter.start()
+		self.__action.start()
+		self.__lock.release()
 	
 	def stop(self):
-		self.lock.acquire()
-		self.filter.stop()
-		self.action.stop()
-		self.lock.release()
-		self.filter.join()
-		self.action.join()
+		self.__lock.acquire()
+		self.__filter.stop()
+		self.__action.stop()
+		self.__lock.release()
+		self.__filter.join()
+		self.__action.join()
 	
 	def isActive(self):
 		try:
-			self.lock.acquire()
-			isActive0 = self.filter.isActive()
-			isActive1 = self.action.isActive()
+			self.__lock.acquire()
+			isActive0 = self.__filter.isActive()
+			isActive1 = self.__action.isActive()
 			return isActive0 or isActive1
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	def setIdle(self, value):
-		self.lock.acquire()
-		self.filter.setIdle(value)
-		self.action.setIdle(value)
-		self.lock.release()
+		self.__lock.acquire()
+		self.__filter.setIdle(value)
+		self.__action.setIdle(value)
+		self.__lock.release()
 	
 	def getIdle(self):
 		try:
-			self.lock.acquire()
-			return self.filter.getIdle() or self.action.getIdle()
+			self.__lock.acquire()
+			return self.__filter.getIdle() or self.__action.getIdle()
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	def getStatus(self):
 		try:
-			self.lock.acquire()
-			fStatus = self.filter.status()
-			aStatus = self.action.status()
+			self.__lock.acquire()
+			fStatus = self.__filter.status()
+			aStatus = self.__action.status()
 			ret = [("filter", fStatus),
 				   ("action", aStatus)]
 			return ret
 		finally:
-			self.lock.release()
+			self.__lock.release()
diff --git a/server/jails.py b/server/jails.py
index 30d61b48..b4dbb4ed 100644
--- a/server/jails.py
+++ b/server/jails.py
@@ -31,73 +31,73 @@ from threading import Lock
 class Jails:
 	
 	def __init__(self):
-		self.lock = Lock()
-		self.jails = dict()
+		self.__lock = Lock()
+		self.__jails = dict()
 	
 	def add(self, name):
-		self.lock.acquire()
-		if self.jails.has_key(name):
-			self.lock.release()
+		self.__lock.acquire()
+		if self.__jails.has_key(name):
+			self.__lock.release()
 			raise DuplicateJailException(name)
 		else:
-			self.jails[name] = Jail(name)
-			self.lock.release()
+			self.__jails[name] = Jail(name)
+			self.__lock.release()
 	
 	def remove(self, name):
-		self.lock.acquire()
-		if self.jails.has_key(name):
-			del self.jails[name]
-			self.lock.release()
+		self.__lock.acquire()
+		if self.__jails.has_key(name):
+			del self.__jails[name]
+			self.__lock.release()
 		else:
-			self.lock.release()
+			self.__lock.release()
 			raise UnknownJailException(name)
 	
 	def get(self, name):
 		try:
-			self.lock.acquire()
-			if self.jails.has_key(name):
-				jail = self.jails[name]
+			self.__lock.acquire()
+			if self.__jails.has_key(name):
+				jail = self.__jails[name]
 				return jail
 			else:
 				raise UnknownJailException(name)
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	def getAction(self, name):
 		try:
-			self.lock.acquire()
-			if self.jails.has_key(name):
-				action = self.jails[name].getAction()
+			self.__lock.acquire()
+			if self.__jails.has_key(name):
+				action = self.__jails[name].getAction()
 				return action
 			else:
 				raise UnknownJailException(name)
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	def getFilter(self, name):
 		try:
-			self.lock.acquire()
-			if self.jails.has_key(name):
-				action = self.jails[name].getFilter()
+			self.__lock.acquire()
+			if self.__jails.has_key(name):
+				action = self.__jails[name].getFilter()
 				return action
 			else:
 				raise UnknownJailException(name)
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	def getAll(self):
 		try:
-			self.lock.acquire()
-			return self.jails.copy()
+			self.__lock.acquire()
+			return self.__jails.copy()
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	def size(self):
 		try:
-			self.lock.acquire()
-			return len(self.jails)
+			self.__lock.acquire()
+			return len(self.__jails)
 		finally:
-			self.lock.release()
+			self.__lock.release()
 
 
 class DuplicateJailException(Exception):
diff --git a/server/jailthread.py b/server/jailthread.py
index a8ff1cc4..6bc0c397 100644
--- a/server/jailthread.py
+++ b/server/jailthread.py
@@ -37,11 +37,11 @@ class JailThread(Thread):
 	def __init__(self, jail):
 		Thread.__init__(self)
 		## Control the state of the thread.
-		self.isRunning = False
+		self.__isRunning = False
 		## Control the idle state of the thread.
-		self.isIdle = False
+		self.__isIdle = False
 		## The time the thread sleeps in the loop.
-		self.sleepTime = 1
+		self.__sleepTime = 1
 	
 	##
 	# Set the time that the thread sleeps.
@@ -51,7 +51,7 @@ class JailThread(Thread):
 	# @param value the polling time (second)
 	
 	def setSleepTime(self, value):
-		self.sleepTime = value
+		self.__sleepTime = value
 		logSys.info("Set sleeptime = " + value)
 	
 	##
@@ -60,7 +60,7 @@ class JailThread(Thread):
 	# @return the polling time
 	
 	def getSleepTime(self):
-		return self.sleeptime
+		return self.__sleepTime
 	
 	##
 	# Set the idle flag.
@@ -69,7 +69,7 @@ class JailThread(Thread):
 	# @param value boolean value
 	
 	def setIdle(self, value):
-		self.isIdle = value
+		self.__isIdle = value
 	
 	##
 	# Get the idle state.
@@ -77,7 +77,7 @@ class JailThread(Thread):
 	# @return the idle state
 	
 	def getIdle(self):
-		return self.isIdle
+		return self.__isIdle
 	
 	##
 	# Stop the thread.
@@ -85,7 +85,7 @@ class JailThread(Thread):
 	# Stop the exection of the thread and quit.
 	
 	def stop(self):
-		self.isRunning = False
+		self.__isRunning = False
 	
 	##
 	# Set the isRunning flag.
@@ -93,7 +93,7 @@ class JailThread(Thread):
 	# @param value True if the thread is running
 	
 	def setActive(self, value):
-		self.isRunning = value
+		self.__isRunning = value
 	
 	##
 	# Check if the thread is active.
@@ -102,7 +102,7 @@ class JailThread(Thread):
 	# @return True if the thread is running
 	
 	def isActive(self):
-		return self.isRunning
+		return self.__isRunning
 	
 	##
 	# Get the status of the thread
@@ -111,4 +111,4 @@ class JailThread(Thread):
 	# @return a list with tuple
 	
 	def status(self):
-		pass
\ No newline at end of file
+		pass
diff --git a/server/server.py b/server/server.py
index dac4f5e2..97747db3 100644
--- a/server/server.py
+++ b/server/server.py
@@ -34,21 +34,21 @@ logSys = logging.getLogger("fail2ban.server")
 class Server:
 	
 	def __init__(self, daemon = False):
-		self.jails = Jails()
-		self.daemon = daemon
-		self.transm = Transmitter(self)
-		self.logLevel = 3
-		self.logTarget = "STDOUT"
+		self.__jails = Jails()
+		self.__daemon = daemon
+		self.__transm = Transmitter(self)
+		self.__logLevel = 3
+		self.__logTarget = "STDOUT"
 		# Set logging level
-		self.setLogLevel(self.logLevel)
-		self.setLogTarget(self.logTarget)
+		self.setLogLevel(self.__logLevel)
+		self.setLogTarget(self.__logTarget)
 	
 	def start(self, force):
 		logSys.info("Starting Fail2ban")
 		# First set the mask to only allow access to owner
 		os.umask(0077)
-		if self.daemon:
-			ret = self.createDaemon()
+		if self.__daemon:
+			ret = self.__createDaemon()
 			if ret:
 				logSys.info("Daemon started")
 			else:
@@ -56,166 +56,166 @@ class Server:
 				raise ServerInitializationError("Could not create daemon")
 		# Start the communication
 		logSys.debug("Starting communication")
-		self.transm.start(force)
+		self.__transm.start(force)
 		logSys.info("Exiting Fail2ban")
 	
 	def quit(self):
 		self.stopAllJail()
-		self.transm.stop()
+		self.__transm.stop()
 	
 	def addJail(self, name):
-		self.jails.add(name)
+		self.__jails.add(name)
 		
 	def delJail(self, name):
-		self.jails.remove(name)
+		self.__jails.remove(name)
 	
 	def startJail(self, name):
 		if not self.isActive(name):
-			self.jails.get(name).start()
+			self.__jails.get(name).start()
 	
 	def stopJail(self, name):
 		if self.isActive(name):
-			self.jails.get(name).stop()
+			self.__jails.get(name).stop()
 			self.delJail(name)
 	
 	def stopAllJail(self):
-		for jail in self.jails.getAll():
+		for jail in self.__jails.getAll():
 			self.stopJail(jail)
 	
 	def isActive(self, name):
-		return self.jails.get(name).isActive()
+		return self.__jails.get(name).isActive()
 	
 	def setIdleJail(self, name, value):
-		self.jails.get(name).setIdle(value)
+		self.__jails.get(name).setIdle(value)
 		return True
 
 	def getIdleJail(self, name):
-		return self.jails.get(name).getIdle()
+		return self.__jails.get(name).getIdle()
 	
 	# Filter
 	def addIgnoreIP(self, name, ip):
-		self.jails.getFilter(name).addIgnoreIP(ip)
+		self.__jails.getFilter(name).addIgnoreIP(ip)
 	
 	def delIgnoreIP(self, name, ip):
-		self.jails.getFilter(name).delIgnoreIP(ip)
+		self.__jails.getFilter(name).delIgnoreIP(ip)
 	
 	def getIgnoreIP(self, name):
-		return self.jails.getFilter(name).getIgnoreIP()
+		return self.__jails.getFilter(name).getIgnoreIP()
 	
 	def addLogPath(self, name, file):
-		self.jails.getFilter(name).addLogPath(file)
+		self.__jails.getFilter(name).addLogPath(file)
 	
 	def delLogPath(self, name, file):
-		self.jails.getFilter(name).delLogPath(file)
+		self.__jails.getFilter(name).delLogPath(file)
 	
 	def getLogPath(self, name):
-		return self.jails.getFilter(name).getLogPath()
+		return self.__jails.getFilter(name).getLogPath()
 	
 	def setTimeRegex(self, name, value):
-		self.jails.getFilter(name).setTimeRegex(value)
+		self.__jails.getFilter(name).setTimeRegex(value)
 	
 	def getTimeRegex(self, name):
-		return self.jails.getFilter(name).getTimeRegex()
+		return self.__jails.getFilter(name).getTimeRegex()
 
 	def setTimePattern(self, name, value):
-		self.jails.getFilter(name).setTimePattern(value)
+		self.__jails.getFilter(name).setTimePattern(value)
 	
 	def getTimePattern(self, name):
-		return self.jails.getFilter(name).getTimePattern()
+		return self.__jails.getFilter(name).getTimePattern()
 	
 	def setFindTime(self, name, value):
-		self.jails.getFilter(name).setFindTime(value)
+		self.__jails.getFilter(name).setFindTime(value)
 	
 	def getFindTime(self):
-		return self.jails.getFilter(name).getFindTime()
+		return self.__jails.getFilter(name).getFindTime()
 
 	def setFailRegex(self, name, value):
-		self.jails.getFilter(name).setFailRegex(value)
+		self.__jails.getFilter(name).setFailRegex(value)
 	
 	def getFailRegex(self, name):
-		return self.jails.getFilter(name).getFailRegex()
+		return self.__jails.getFilter(name).getFailRegex()
 	
 	def setMaxRetry(self, name, value):
-		self.jails.getFilter(name).setMaxRetry(value)
+		self.__jails.getFilter(name).setMaxRetry(value)
 	
 	def getMaxRetry(self, name):
-		return self.jails.getFilter(name).getMaxRetry()
+		return self.__jails.getFilter(name).getMaxRetry()
 	
 	def setMaxTime(self, name, value):
-		self.jails.getFilter(name).setMaxTime(value)
+		self.__jails.getFilter(name).setMaxTime(value)
 	
 	def getMaxTime(self, name):
-		return self.jails.getFilter(name).getMaxTime()
+		return self.__jails.getFilter(name).getMaxTime()
 	
 	# Action
 	def addAction(self, name, value):
-		self.jails.getAction(name).addAction(value)
+		self.__jails.getAction(name).addAction(value)
 	
 	def getLastAction(self, name):
-		return self.jails.getAction(name).getLastAction()
+		return self.__jails.getAction(name).getLastAction()
 	
 	def delAction(self, name, value):
-		self.jails.getAction(name).delAction(value)
+		self.__jails.getAction(name).delAction(value)
 	
 	def setCInfo(self, name, action, key, value):
-		self.jails.getAction(name).getAction(action).setCInfo(key, value)
+		self.__jails.getAction(name).getAction(action).setCInfo(key, value)
 	
 	def getCInfo(self, name, action, key):
-		return self.jails.getAction(name).getAction(action).getCInfo(key)
+		return self.__jails.getAction(name).getAction(action).getCInfo(key)
 	
 	def delCInfo(self, name, action, key):
-		self.jails.getAction(name).getAction(action).delCInfo(key)
+		self.__jails.getAction(name).getAction(action).delCInfo(key)
 	
 	def setBanTime(self, name, value):
-		self.jails.getAction(name).setBanTime(value)
+		self.__jails.getAction(name).setBanTime(value)
 	
 	def getBanTime(self, name):
-		return self.jails.getAction(name).getBanTime()
+		return self.__jails.getAction(name).getBanTime()
 	
 	def setActionStart(self, name, action, value):
-		self.jails.getAction(name).getAction(action).setActionStart(value)
+		self.__jails.getAction(name).getAction(action).setActionStart(value)
 	
 	def getActionStart(self, name, action):
-		return self.jails.getAction(name).getAction(action).getActionStart()
+		return self.__jails.getAction(name).getAction(action).getActionStart()
 		
 	def setActionStop(self, name, action, value):
-		self.jails.getAction(name).getAction(action).setActionStop(value)
+		self.__jails.getAction(name).getAction(action).setActionStop(value)
 	
 	def getActionStop(self, name, action):
-		return self.jails.getAction(name).getAction(action).getActionStop()
+		return self.__jails.getAction(name).getAction(action).getActionStop()
 	
 	def setActionCheck(self, name, action, value):
-		self.jails.getAction(name).getAction(action).setActionCheck(value)
+		self.__jails.getAction(name).getAction(action).setActionCheck(value)
 	
 	def getActionCheck(self, name, action):
-		return self.jails.getAction(name).getAction(action).getActionCheck()
+		return self.__jails.getAction(name).getAction(action).getActionCheck()
 	
 	def setActionBan(self, name, action, value):
-		self.jails.getAction(name).getAction(action).setActionBan(value)
+		self.__jails.getAction(name).getAction(action).setActionBan(value)
 	
 	def getActionBan(self, name, action):
-		return self.jails.getAction(name).getAction(action).getActionBan()
+		return self.__jails.getAction(name).getAction(action).getActionBan()
 	
 	def setActionUnban(self, name, action, value):
-		self.jails.getAction(name).getAction(action).setActionUnban(value)
+		self.__jails.getAction(name).getAction(action).setActionUnban(value)
 	
 	def getActionUnban(self, name, action):
-		return self.jails.getAction(name).getAction(action).getActionUnban()
+		return self.__jails.getAction(name).getAction(action).getActionUnban()
 		
 	# Status
 	def status(self):
 		jailList = ''
-		for jail in self.jails.getAll():
+		for jail in self.__jails.getAll():
 			jailList += jail + ', '
 		length = len(jailList)
 		if not length == 0:
 			jailList = jailList[:length-2]
-		ret = [("Number of jail", self.jails.size()), 
+		ret = [("Number of jail", self.__jails.size()), 
 			   ("Jail list", jailList)]
 		return ret
 	
 	def statusJail(self, name):
-		return self.jails.get(name).getStatus()
+		return self.__jails.get(name).getStatus()
 	
 	# Logging
 	
@@ -231,7 +231,7 @@ class Server:
 	# @param value the level
 	
 	def setLogLevel(self, value):
-		self.logLevel = value
+		self.__logLevel = value
 		logLevel = logging.DEBUG
 		if value == 0:
 			logLevel = logging.FATAL
@@ -250,12 +250,12 @@ class Server:
 	# @return the log level
 	
 	def getLogLevel(self):
-		return self.logLevel
+		return self.__logLevel
 	
 	def setLogTarget(self, target):
 		# Remove previous handler
 		logging.getLogger("fail2ban").handlers = []
-		self.logTarget = target
+		self.__logTarget = target
 		if target == "SYSLOG":
 			hdlr = logging.handlers.SysLogHandler()
 		elif target == "STDOUT":
@@ -278,9 +278,9 @@ class Server:
 		return True
 	
 	def getLogTarget(self):
-		return self.logTarget
+		return self.__logTarget
 	
-	def createDaemon(self):
+	def __createDaemon(self):
 		""" Detach a process from the controlling terminal and run it in the
 			background as a daemon.
 		
diff --git a/server/ssocket.py b/server/ssocket.py
index 4146082c..59ff8670 100644
--- a/server/ssocket.py
+++ b/server/ssocket.py
@@ -37,8 +37,8 @@ class SSocket(Thread):
 	
 	def __init__(self, transmitter):
 		Thread.__init__(self)
-		self.transmit = transmitter
-		self.isRunning = False
+		self.__transmit = transmitter
+		self.__isRunning = False
 		logSys.debug("Created SSocket")
 	
 	def initialize(self, force = False):
@@ -66,11 +66,11 @@ class SSocket(Thread):
 		self.ssock.listen(5)
 	
 	def run(self):
-		self.isRunning = True
-		while self.isRunning:
+		self.__isRunning = True
+		while self.__isRunning:
 			try:
 				(csock, address) = self.ssock.accept()
-				thread = SocketWorker(csock, self.transmit)
+				thread = SocketWorker(csock, self.__transmit)
 				thread.start()
 			except socket.timeout:
 				# Do nothing here
@@ -90,29 +90,29 @@ class SSocket(Thread):
 	# @bug It seems to be some concurrency problem with this flag
 	
 	def stop(self):
-		self.isRunning = False
+		self.__isRunning = False
 
 
 class SocketWorker(Thread):
 	
 	def __init__(self, csock, transmitter):
 		Thread.__init__(self)
-		self.csock = csock
-		self.transmit = transmitter
+		self.__csock = csock
+		self.__transmit = transmitter
 		
 	def run(self):
 		logSys.debug("Starting new thread to handle the request")
-		msg = self.receive(self.csock)
-		msg = self.transmit.proceed(msg)
-		self.send(self.csock, msg)
-		self.csock.close()
+		msg = self.__receive(self.__csock)
+		msg = self.__transmit.proceed(msg)
+		self.__send(self.__csock, msg)
+		self.__csock.close()
 		logSys.debug("Connection closed")
 	
-	def send(self, socket, msg):
+	def __send(self, socket, msg):
 		obj = pickle.dumps(msg)
 		socket.send(obj + SSocket.END_STRING)
 	
-	def receive(self, socket):
+	def __receive(self, socket):
 		msg = ''
 		while msg.rfind(SSocket.END_STRING) == -1:
 			chunk = socket.recv(6)
diff --git a/server/ticket.py b/server/ticket.py
index 1ca3f725..fd06b781 100644
--- a/server/ticket.py
+++ b/server/ticket.py
@@ -32,25 +32,25 @@ logSys = logging.getLogger("fail2ban")
 class Ticket:
 	
 	def __init__(self, ip, time):
-		self.ip = ip
-		self.time = time
-		self.attempt = 0
+		self.__ip = ip
+		self.__time = time
+		self.__attempt = 0
 	
 	def setIP(self, value):
-		self.ip = value
+		self.__ip = value
 	
 	def getIP(self):
-		return self.ip
+		return self.__ip
 	
 	def setTime(self, value):
-		self.time = value
+		self.__time = value
 	
 	def getTime(self):
-		return self.time
+		return self.__time
 	
 	def setAttempt(self, value):
-		self.attempt = value
+		self.__attempt = value
 	
 	def getAttempt(self):
-		return self.attempt
+		return self.__attempt
 	
\ No newline at end of file
diff --git a/server/transmitter.py b/server/transmitter.py
index 07132875..487c6593 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -35,9 +35,9 @@ logSys = logging.getLogger("fail2ban.comm")
 class Transmitter:
 	
 	def __init__(self, server):
-		self.lock = Lock()
-		self.server = server
-		self.socket = SSocket(self)
+		self.__lock = Lock()
+		self.__server = server
+		self.__socket = SSocket(self)
 	
 	##
 	# Start the transmittion server.
@@ -46,14 +46,14 @@ class Transmitter:
 	
 	def start(self, force):
 		try:
-			self.lock.acquire()
-			self.socket.initialize(force)
-			self.socket.start()
-			self.lock.release()
-			self.socket.join()
+			self.__lock.acquire()
+			self.__socket.initialize(force)
+			self.__socket.start()
+			self.__lock.release()
+			self.__socket.join()
 		except SSocketErrorException:
 			logSys.error("Could not start server")
-			self.lock.release()
+			self.__lock.release()
 	
 	##
 	# Stop the transmitter.
@@ -62,224 +62,224 @@ class Transmitter:
 	# happen which disappear when using join() in this function.
 	
 	def stop(self):
-		self.socket.stop()
-		self.socket.join()
+		self.__socket.stop()
+		self.__socket.join()
 		
 	def proceed(self, action):
 		# Deserialize object
 		try:
-			self.lock.acquire()
+			self.__lock.acquire()
 			logSys.debug("Action: " + `action`)
 			try:
-				ret = self.actionHandler(action)
+				ret = self.__actionHandler(action)
 				ack = 0, ret
 			except Exception, e:
 				logSys.warn("Invalid command: " + `action`)
 				ack = 1, e
 			return ack
 		finally:
-			self.lock.release()
+			self.__lock.release()
 	
 	##
 	# Handle an action.
 	#
 	# 
 	
-	def actionHandler(self, action):
+	def __actionHandler(self, action):
 		if action[0] == "ping":
 			return "pong"
 		elif action[0] == "add":
 			name = action[1]
 			if name == "all":
 				raise Exception("Reserved name")
-			self.server.addJail(name)
+			self.__server.addJail(name)
 			return name
 		elif action[0] == "start":
 			name = action[1]
-			self.server.startJail(name)
+			self.__server.startJail(name)
 			return None
 		elif action[0] == "stop":
 			if len(action) == 1:
-				self.server.quit()
+				self.__server.quit()
 			elif action[1] == "all":
-				self.server.stopAllJail()
+				self.__server.stopAllJail()
 			else:
 				name = action[1]
-				self.server.stopJail(name)
+				self.__server.stopJail(name)
 			return None
 		elif action[0] == "sleep":
 			value = action[1]
 			time.sleep(int(value))
 			return None
 		elif action[0] == "set":
-			return self.actionSet(action[1:])
+			return self.__actionSet(action[1:])
 		elif action[0] == "get":
-			return self.actionGet(action[1:])
+			return self.__actionGet(action[1:])
 		elif action[0] == "status":
 			return self.status(action[1:])			
 		raise Exception("Invalid command")
 	
-	def actionSet(self, action):
+	def __actionSet(self, action):
 		name = action[0]
 		# Logging
 		if name == "loglevel":
 			value = int(action[1])
-			self.server.setLogLevel(value)
-			return self.server.getLogLevel()
+			self.__server.setLogLevel(value)
+			return self.__server.getLogLevel()
 		elif name == "logtarget":
 			value = action[1]
-			self.server.setLogTarget(value)
-			return self.server.getLogTarget()
+			self.__server.setLogTarget(value)
+			return self.__server.getLogTarget()
 		# Jail
 		elif action[1] == "idle":
 			if action[2] == "on":
-				self.server.setIdleJail(name, True)
+				self.__server.setIdleJail(name, True)
 			elif action[2] == "off":
-				self.server.setIdleJail(name, False)
-			return self.server.getIdleJail(name)
+				self.__server.setIdleJail(name, False)
+			return self.__server.getIdleJail(name)
 		# Filter
 		elif action[1] == "addignoreip":
 			value = action[2]
-			self.server.addIgnoreIP(name, value)
-			return self.server.getIgnoreIP(name)
+			self.__server.addIgnoreIP(name, value)
+			return self.__server.getIgnoreIP(name)
 		elif action[1] == "delignoreip":
 			value = action[2]
-			self.server.delIgnoreIP(name, value)
-			return self.server.getIgnoreIP(name)
+			self.__server.delIgnoreIP(name, value)
+			return self.__server.getIgnoreIP(name)
 		elif action[1] == "addlogpath":
 			value = action[2:]
 			for path in value:
-				self.server.addLogPath(name, path)
-			return self.server.getLogPath(name)
+				self.__server.addLogPath(name, path)
+			return self.__server.getLogPath(name)
 		elif action[1] == "dellogpath":
 			value = action[2]
-			self.server.delLogPath(name, value)
-			return self.server.getLogPath(name)
+			self.__server.delLogPath(name, value)
+			return self.__server.getLogPath(name)
 		elif action[1] == "timeregex":
 			value = action[2]
-			self.server.setTimeRegex(name, value)
-			return self.server.getTimeRegex(name)
+			self.__server.setTimeRegex(name, value)
+			return self.__server.getTimeRegex(name)
 		elif action[1] == "timepattern":
 			value = action[2]
-			self.server.setTimePattern(name, value)
-			return self.server.getTimePattern(name)
+			self.__server.setTimePattern(name, value)
+			return self.__server.getTimePattern(name)
 		elif action[1] == "failregex":
 			value = action[2]
-			self.server.setFailRegex(name, value)
-			return self.server.getFailRegex(name)
+			self.__server.setFailRegex(name, value)
+			return self.__server.getFailRegex(name)
 		elif action[1] == "maxtime":
 			value = action[2]
-			self.server.setMaxTime(name, int(value))
-			return self.server.getMaxTime(name)
+			self.__server.setMaxTime(name, int(value))
+			return self.__server.getMaxTime(name)
 		elif action[1] == "findtime":
 			value = action[2]
-			self.server.setFindTime(name, int(value))
-			return self.server.getFindTime(name)
+			self.__server.setFindTime(name, int(value))
+			return self.__server.getFindTime(name)
 		elif action[1] == "maxretry":
 			value = action[2]
-			self.server.setMaxRetry(name, int(value))
-			return self.server.getMaxRetry(name)
+			self.__server.setMaxRetry(name, int(value))
+			return self.__server.getMaxRetry(name)
 		# Action
 		elif action[1] == "bantime":
 			value = action[2]
-			self.server.setBanTime(name, int(value))
-			return self.server.getBanTime(name)
+			self.__server.setBanTime(name, int(value))
+			return self.__server.getBanTime(name)
 		elif action[1] == "addaction":
 			value = action[2]
-			self.server.addAction(name, value)
-			return self.server.getLastAction(name).getName()
+			self.__server.addAction(name, value)
+			return self.__server.getLastAction(name).getName()
 		elif action[1] == "delaction":
-			self.server.delAction(name, value)
+			self.__server.delAction(name, value)
 			return None
 		elif action[1] == "setcinfo":
 			act = action[2]
 			key = action[3]
 			value = action[4]
-			self.server.setCInfo(name, act, key, value)
-			return self.server.getCInfo(name, act, key)
+			self.__server.setCInfo(name, act, key, value)
+			return self.__server.getCInfo(name, act, key)
 		elif action[1] == "delcinfo":
 			act = action[2]
 			key = action[3]
-			self.server.delCInfo(name, act, key)
+			self.__server.delCInfo(name, act, key)
 			return None
 		elif action[1] == "actionstart":
 			act = action[2]
 			value = action[3]
-			self.server.setActionStart(name, act, value)
-			return self.server.getActionStart(name, act)
+			self.__server.setActionStart(name, act, value)
+			return self.__server.getActionStart(name, act)
 		elif action[1] == "actionstop":
 			act = action[2]
 			value = action[3]
-			self.server.setActionStop(name, act, value)
-			return self.server.getActionStop(name, act)
+			self.__server.setActionStop(name, act, value)
+			return self.__server.getActionStop(name, act)
 		elif action[1] == "actioncheck":
 			act = action[2]
 			value = action[3]
-			self.server.setActionCheck(name, act, value)
-			return self.server.getActionCheck(name, act)
+			self.__server.setActionCheck(name, act, value)
+			return self.__server.getActionCheck(name, act)
 		elif action[1] == "actionban":
 			act = action[2]
 			value = action[3]
-			self.server.setActionBan(name, act, value)
-			return self.server.getActionBan(name, act)
+			self.__server.setActionBan(name, act, value)
+			return self.__server.getActionBan(name, act)
 		elif action[1] == "actionunban":
 			act = action[2]
 			value = action[3]
-			self.server.setActionUnban(name, act, value)
-			return self.server.getActionUnban(name, act)
+			self.__server.setActionUnban(name, act, value)
+			return self.__server.getActionUnban(name, act)
 		raise Exception("Invalid command (no set action or not yet implemented)")
 	
-	def actionGet(self, action):
+	def __actionGet(self, action):
 		name = action[0]
 		# Logging
 		if name == "loglevel":
-			return self.server.getLogLevel()
+			return self.__server.getLogLevel()
 		elif name == "logtarget":
-			return self.server.getLogTarget()
+			return self.__server.getLogTarget()
 		# Filter
 		elif action[1] == "logpath":
-			return self.server.getLogPath(name)
+			return self.__server.getLogPath(name)
 		elif action[1] == "ignoreip":
-			return self.server.getIgnoreIP(name)
+			return self.__server.getIgnoreIP(name)
 		elif action[1] == "timeregex":
-			return self.server.getTimeRegex(name)
+			return self.__server.getTimeRegex(name)
 		elif action[1] == "timepattern":
-			return self.server.getTimePattern(name)
+			return self.__server.getTimePattern(name)
 		elif action[1] == "failregex":
-			return self.server.getFailRegex(name)
+			return self.__server.getFailRegex(name)
 		elif action[1] == "maxtime":
-			return self.server.getMaxTime(name)
+			return self.__server.getMaxTime(name)
 		elif action[1] == "findtime":
-			return self.server.getFindTime(name)
+			return self.__server.getFindTime(name)
 		elif action[1] == "maxretry":
-			return self.server.getMaxRetry(name)
+			return self.__server.getMaxRetry(name)
 		# Action
 		elif action[1] == "bantime":
-			return self.server.getBanTime(name)
+			return self.__server.getBanTime(name)
 		elif action[1] == "addaction":
-			return self.server.getLastAction(name).getName()
+			return self.__server.getLastAction(name).getName()
 		elif action[1] == "actionstart":
 			act = action[2]
-			return self.server.getActionStart(name, act)
+			return self.__server.getActionStart(name, act)
 		elif action[1] == "actionstop":
 			act = action[2]
-			return self.server.getActionStop(name, act)
+			return self.__server.getActionStop(name, act)
 		elif action[1] == "actioncheck":
 			act = action[2]
-			return self.server.getActionCheck(name, act)
+			return self.__server.getActionCheck(name, act)
 		elif action[1] == "actionban":
 			act = action[2]
-			return self.server.getActionBan(name, act)
+			return self.__server.getActionBan(name, act)
 		elif action[1] == "actionunban":
 			act = action[2]
-			return self.server.getActionUnban(name, act)
+			return self.__server.getActionUnban(name, act)
 		raise Exception("Invalid command (no get action or not yet implemented)")
 	
 	def status(self, action):
 		if len(action) == 0:
-			return self.server.status()
+			return self.__server.status()
 		else:
 			name = action[0]
-			return self.server.statusJail(name)
+			return self.__server.statusJail(name)
 		raise Exception("Invalid command (no status)")
 	
\ No newline at end of file

From 4b80546f10f0a4bdf213e5d2f896ce0b964359c9 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 19 Sep 2006 21:22:27 +0000
Subject: [PATCH 330/549] - Fixed bugs introduced by refactoring

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@369 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py      | 6 +++---
 server/filtergamin.py | 2 +-
 server/filterpoll.py  | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index 9a0f4dab..b03527c5 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -282,7 +282,7 @@ class Filter(JailThread):
 	##
 	# Close the log file.
 	
-	def closeLogFile(self):
+	def __closeLogFile(self):
 		self.crtFilename = None
 		self.crtHandler.close()
 
@@ -319,7 +319,7 @@ class Filter(JailThread):
 	# time.time()-self.findTime. When a failure is detected, a FailTicket
 	# is created and is added to the FailManager.
 	
-	def __getFailures(self, filename):
+	def getFailures(self, filename):
 		ipList = dict()
 		logSys.debug(filename)
 		self.openLogFile(filename)
@@ -350,7 +350,7 @@ class Filter(JailThread):
 		self.lastPos[filename] = self.__getFilePos()
 		if lastLine:
 			self.lastDate[filename] = self.dateDetector.getTime(lastLine)
-		self.closeLogFile()
+		self.__closeLogFile()
 
 	##
 	# Finds the failure in a line.
diff --git a/server/filtergamin.py b/server/filtergamin.py
index dc85429b..66f7d30c 100644
--- a/server/filtergamin.py
+++ b/server/filtergamin.py
@@ -61,7 +61,7 @@ class FilterGamin(Filter):
 		logSys.debug("Got event: " + `event` + " for " + path)
 		if event in (gamin.GAMCreated, gamin.GAMChanged, gamin.GAMExists):
 			logSys.debug("File changed: " + path)
-			self.__getFailures(path)
+			self.getFailures(path)
 			self.modified = True
 
 
diff --git a/server/filterpoll.py b/server/filterpoll.py
index 68e8f5c6..3b5ad8c7 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -106,7 +106,7 @@ class FilterPoll(Filter):
 				# Get file modification
 				for file in self.getLogPath():
 					if self.isModified(file):
-						self.__getFailures(file)
+						self.getFailures(file)
 						prevModified = True
 
 				if self.modified:

From 97a1e5b79f5af61978cf5f8a41c989d9447b2325 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 19 Sep 2006 22:20:21 +0000
Subject: [PATCH 331/549] - Removed unneeded import

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@370 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-server | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban-server b/fail2ban-server
index 0b5cae06..2ce71212 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -25,7 +25,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import locale, getopt, sys
+import getopt, sys
 
 # Inserts our own modules path first in the list
 # fix for bug #343821

From 9f5f6812f5ee29f44e821e1e95a0cc48c0c6be89 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 19 Sep 2006 22:21:20 +0000
Subject: [PATCH 332/549] - Added a getTemplates() method because
 self.__templates can not be accessed directly anymore

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@371 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-regex         | 2 +-
 server/datedetector.py | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/fail2ban-regex b/fail2ban-regex
index d814d508..2f38d882 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -68,7 +68,7 @@ class Fail2banRegex:
 			print "IP  :" + ipList
 			print
 			print "Date template hits:"
-			for template in self.__filter.dateDetector.templates:
+			for template in self.__filter.dateDetector.getTemplates():
 				print `template.getHits()` + " hit: " + template.getName()
 			print
 			print "Benchmark. Executing 1000..."
diff --git a/server/datedetector.py b/server/datedetector.py
index 04126b18..666bdc8c 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -64,6 +64,9 @@ class DateDetector:
 		template.setName("Epoch")
 		self.__templates.append(template)
 	
+	def getTemplates(self):
+		return self.__templates
+	
 	def setDefaultRegex(self, value):
 		self.__defTemplate.setRegex(value)
 	

From f3df224ec455ca88b1ee7e964e9b9efec718e72f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 19 Sep 2006 22:23:41 +0000
Subject: [PATCH 333/549] - First attempt at solving bug #1457620 - Always use
 the 'C' locale and try to convert date representation like month names to
 this locale

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@372 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/datestrptime.py | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/server/datestrptime.py b/server/datestrptime.py
index 9c9ccfde..23280d39 100644
--- a/server/datestrptime.py
+++ b/server/datestrptime.py
@@ -28,16 +28,39 @@ import re, time
 
 from datetemplate import DateTemplate
 
+##
+# Use strptime() to parse a date. Our current locale is the 'C'
+# one because we do not set the locale explicitly. This is POSIX
+# standard.
+
 class DateStrptime(DateTemplate):
 	
+	TABLE = dict()
+	TABLE["Oct"] = ["Okt"]
+	TABLE["Dec"] = ["Dez"]
+	
 	def __init__(self):
 		DateTemplate.__init__(self)
 	
+	@staticmethod
+	def convertLocale(date):
+		for t in DateStrptime.TABLE:
+			for m in DateStrptime.TABLE[t]:
+				if date.find(m) >= 0:
+					return date.replace(m, t)
+		return date
+	
 	def getDate(self, line):
 		date = None
 		dateMatch = self.matchDate(line)
 		if dateMatch:
-			date = list(time.strptime(dateMatch.group(), self.getPattern()))
+			try:
+				# Try first with 'C' locale
+				date = list(time.strptime(dateMatch.group(), self.getPattern()))
+			except ValueError:
+				# Try to convert date string to 'C' locale
+				conv = self.convertLocale(dateMatch.group())
+				date = list(time.strptime(conv, self.getPattern()))
 			if date[0] < 2000:
 				# There is probably no year field in the logs
 				date[0] = time.gmtime()[0]

From f12d0fab61609c553ef7aeead02fb1545e5f5afc Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 19 Sep 2006 22:25:07 +0000
Subject: [PATCH 334/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@373 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG b/CHANGELOG
index 1f6c2072..16f08261 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -14,6 +14,7 @@ ver. 0.7.3 (2006/??/??) - beta
 - Added Gamin (file and directory monitoring system) support
 - (Re)added "ignoreip" option
 - Added more concurrency protection
+- First attempt at solving bug #1457620
 
 ver. 0.7.2 (2006/09/10) - beta
 ----------

From 3ca397922d0e6ceba5f8def36d639bdb5e430fa7 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 20 Sep 2006 22:39:16 +0000
Subject: [PATCH 335/549] - Catch IOError when file can not be read - Do not
 convert line to latin-1 but to utf8

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@374 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index b03527c5..79b40eaf 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -276,8 +276,14 @@ class Filter(JailThread):
 		try:
 			self.crtFilename = filename
 			self.crtHandler = open(filename)
+			logSys.debug("Opened " + filename)
+			return True
 		except OSError:
 			logSys.error("Unable to open " + filename)
+		except IOError:
+			logSys.error("Unable to read " + filename +
+						 ". Please check permissions")
+		return False
 	
 	##
 	# Close the log file.
@@ -321,18 +327,21 @@ class Filter(JailThread):
 	
 	def getFailures(self, filename):
 		ipList = dict()
-		logSys.debug(filename)
-		self.openLogFile(filename)
+		ret = self.openLogFile(filename)
+		if not ret:
+			logSys.error("Unable to get failures in " + filename)
+			return False
 		self.__setFilePos()
 		lastLine = None
 		for line in self.crtHandler:
 			try:
 				# Try to convert UTF-8 string to Latin-1
-				line = line.decode('utf-8').encode('latin-1')
+				#line = line.decode('utf-8').encode('latin-1')
+				line = line.decode('utf-8')
 			except UnicodeDecodeError:
 				pass
-			except UnicodeEncodeError:
-				logSys.warn("Mmhh... Are you sure you watch the correct file?")
+			#except UnicodeEncodeError:
+			#	logSys.warn("Mmhh... Are you sure you watch the correct file?")
 			if not self.dateDetector.matchTime(line):
 				# There is no valid time in this line
 				continue
@@ -351,6 +360,7 @@ class Filter(JailThread):
 		if lastLine:
 			self.lastDate[filename] = self.dateDetector.getTime(lastLine)
 		self.__closeLogFile()
+		return True
 
 	##
 	# Finds the failure in a line.

From d61690fd9e020ee49c72dd3c6ce5aebe723f20ff Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 20 Sep 2006 22:41:10 +0000
Subject: [PATCH 336/549] - Added encoding tag (utf8) - Added some translations

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@375 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/datestrptime.py | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/server/datestrptime.py b/server/datestrptime.py
index 23280d39..4cbc32db 100644
--- a/server/datestrptime.py
+++ b/server/datestrptime.py
@@ -1,3 +1,4 @@
+# -*- coding: utf8 -*-
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -36,8 +37,18 @@ from datetemplate import DateTemplate
 class DateStrptime(DateTemplate):
 	
 	TABLE = dict()
+	TABLE["Jan"] = []
+	TABLE["Feb"] = ["Fév"]
+	TABLE["Mar"] = ["Mär"]
+	TABLE["Apr"] = ["Avr"]
+	TABLE["May"] = ["Mai"]
+	TABLE["Jun"] = []
+	TABLE["Jul"] = []
+	TABLE["Aug"] = ["Aou"]
+	TABLE["Sep"] = []
 	TABLE["Oct"] = ["Okt"]
-	TABLE["Dec"] = ["Dez"]
+	TABLE["Nov"] = []
+	TABLE["Dec"] = ["Déc", "Dez"]
 	
 	def __init__(self):
 		DateTemplate.__init__(self)

From 6ab1d132344f333dc12623b521fb101e9430c8fa Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 21 Sep 2006 20:55:45 +0000
Subject: [PATCH 337/549] - Fixed log rotation bug - Refactoring

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@376 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py      | 108 ++++++++++++++++++++++++------------------
 server/filtergamin.py |  29 ++++--------
 server/filterpoll.py  |  41 +++++++---------
 3 files changed, 90 insertions(+), 88 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index 79b40eaf..62825212 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -56,25 +56,23 @@ class Filter(JailThread):
 		self.jail = jail
 		## The failures manager.
 		self.failManager = FailManager()
-		## The log file handler.
-		self.crtHandler = None
-		self.crtFilename = None
-		## The log file path.
-		self.logPath = []
-		## The regular expression matching the failure.
-		self.failRegex = ''
-		self.failRegexObj = None
-		## The amount of time to look back.
-		self.findTime = 6000
-		## The ignore IP list.
-		self.ignoreIpList = []
 		self.modified = False
-		## The time of the last modification of the file.
-		self.lastModTime = dict()
+		## The log file handler.
+		self.__crtHandler = None
+		self.__crtFilename = None
+		## The log file path.
+		self.__logPath = []
+		## The regular expression matching the failure.
+		self.__failRegex = ''
+		self.__failRegexObj = None
+		## The amount of time to look back.
+		self.__findTime = 6000
+		## The ignore IP list.
+		self.__ignoreIpList = []
 		## The last position of the file.
-		self.lastPos = dict()
+		self.__lastPos = dict()
 		## The last date in tht log file.
-		self.lastDate = dict()
+		self.__lastDate = dict()
 		
 		self.dateDetector = DateDetector()
 		self.dateDetector.addDefaultTemplate()
@@ -87,7 +85,10 @@ class Filter(JailThread):
 	# @param path log file path
 
 	def addLogPath(self, path):
-		raise Exception("addLogPath() is abstract")
+		self.getLogPath().append(path)
+		# Initialize default values
+		self.__lastDate[path] = 0
+		self.__lastPos[path] = 0
 	
 	##
 	# Delete a log path
@@ -95,7 +96,9 @@ class Filter(JailThread):
 	# @param path the log file to delete
 	
 	def delLogPath(self, path):
-		raise Exception("delLogPath() is abstract")
+		self.getLogPath().remove(path)
+		del self.__lastDate[path]
+		del self.__lastPos[path]
 
 	##
 	# Get the log file path
@@ -103,7 +106,20 @@ class Filter(JailThread):
 	# @return log file path
 		
 	def getLogPath(self):
-		return self.logPath
+		return self.__logPath
+	
+	##
+	# Check whether path is already monitored.
+	#
+	# @param path The path
+	# @return True if the path is already monitored else False
+	
+	def containsLogPath(self, path):
+		try:
+			self.getLogPath().index(path)
+			return True
+		except ValueError:
+			return False
 	
 	##
 	# Set the regular expression which matches the time.
@@ -147,8 +163,8 @@ class Filter(JailThread):
 	# @param value the regular expression
 	
 	def setFailRegex(self, value):
-		self.failRegex = value
-		self.failRegexObj = re.compile(value)
+		self.__failRegex = value
+		self.__failRegexObj = re.compile(value)
 		logSys.info("Set failregex = %s" % value)
 	
 	##
@@ -157,7 +173,7 @@ class Filter(JailThread):
 	# @return the regular expression
 	
 	def getFailRegex(self):
-		return self.failRegex
+		return self.__failRegex
 	
 	##
 	# Set the time needed to find a failure.
@@ -167,7 +183,7 @@ class Filter(JailThread):
 	# @param value the time
 	
 	def setFindTime(self, value):
-		self.findTime = value
+		self.__findTime = value
 		logSys.info("Set findtime = %s" % value)
 	
 	##
@@ -176,7 +192,7 @@ class Filter(JailThread):
 	# @return the time
 	
 	def getFindTime(self):
-		return self.findTime
+		return self.__findTime
 	
 	##
 	# Set the maximum retry value.
@@ -232,16 +248,16 @@ class Filter(JailThread):
 	def addIgnoreIP(self, ip):
 		if DNSUtils.isValidIP(ip):
 			logSys.debug("Add " + ip + " to ignore list")
-			self.ignoreIpList.append(ip)
+			self.__ignoreIpList.append(ip)
 		else:
 			logSys.warn(ip + " is not a valid address")
 		
 	def delIgnoreIP(self, ip):
 		logSys.debug("Remove " + ip + " from ignore list")
-		self.ignoreIpList.remove(ip)
+		self.__ignoreIpList.remove(ip)
 		
 	def getIgnoreIP(self):
-		return self.ignoreIpList
+		return self.__ignoreIpList
 	
 	##
 	# Check if IP address is in the ignore list.
@@ -252,7 +268,7 @@ class Filter(JailThread):
 	# @return True if IP address is in ignore list
 	
 	def inIgnoreIPList(self, ip):
-		for i in self.ignoreIpList:
+		for i in self.__ignoreIpList:
 			s = i.split('/', 1)
 			# IP address without CIDR mask
 			if len(s) == 1:
@@ -274,8 +290,8 @@ class Filter(JailThread):
 		""" Opens the log file specified on init.
 		"""
 		try:
-			self.crtFilename = filename
-			self.crtHandler = open(filename)
+			self.__crtFilename = filename
+			self.__crtHandler = open(filename)
 			logSys.debug("Opened " + filename)
 			return True
 		except OSError:
@@ -289,8 +305,8 @@ class Filter(JailThread):
 	# Close the log file.
 	
 	def __closeLogFile(self):
-		self.crtFilename = None
-		self.crtHandler.close()
+		self.__crtFilename = None
+		self.__crtHandler.close()
 
 	##
 	# Set the file position.
@@ -300,23 +316,25 @@ class Filter(JailThread):
 	# timestamp in order to detect this.
 	
 	def __setFilePos(self):
-		line = self.crtHandler.readline()
-		lastDate = self.lastDate[self.crtFilename]
+		line = self.__crtHandler.readline()
+		lastDate = self.__lastDate[self.__crtFilename]
 		lineDate = self.dateDetector.getUnixTime(line)
+		print lastDate
+		print lineDate
 		if lastDate < lineDate:
 			logSys.debug("Date " + `lastDate` + " is smaller than " + `lineDate`)
-			logSys.debug("Log rotation detected for " + self.crtFilename)
-			self.lastPos[self.crtFilename] = 0
-		lastPos = self.lastPos[self.crtFilename]
+			logSys.debug("Log rotation detected for " + self.__crtFilename)
+			self.__lastPos[self.__crtFilename] = 0
+		lastPos = self.__lastPos[self.__crtFilename]
 		logSys.debug("Setting file position to " + `lastPos` + " for " +
-					 self.crtFilename)
-		self.crtHandler.seek(lastPos)
+					 self.__crtFilename)
+		self.__crtHandler.seek(lastPos)
 
 	##
 	# Get the file position.
 	
 	def __getFilePos(self):
-		return self.crtHandler.tell()
+		return self.__crtHandler.tell()
 
 	##
 	# Gets all the failure in the log file.
@@ -333,7 +351,7 @@ class Filter(JailThread):
 			return False
 		self.__setFilePos()
 		lastLine = None
-		for line in self.crtHandler:
+		for line in self.__crtHandler:
 			try:
 				# Try to convert UTF-8 string to Latin-1
 				#line = line.decode('utf-8').encode('latin-1')
@@ -349,16 +367,16 @@ class Filter(JailThread):
 			for element in self.findFailure(line):
 				ip = element[0]
 				unixTime = element[1]
-				if unixTime < time.time()-self.findTime:
+				if unixTime < time.time()-self.__findTime:
 					break
 				if self.inIgnoreIPList(ip):
 					logSys.debug("Ignore "+ip)
 					continue
 				logSys.debug("Found "+ip)
 				self.failManager.addFailure(FailTicket(ip, unixTime))
-		self.lastPos[filename] = self.__getFilePos()
+		self.__lastPos[filename] = self.__getFilePos()
 		if lastLine:
-			self.lastDate[filename] = self.dateDetector.getTime(lastLine)
+			self.__lastDate[filename] = self.dateDetector.getUnixTime(lastLine)
 		self.__closeLogFile()
 		return True
 
@@ -371,7 +389,7 @@ class Filter(JailThread):
 
 	def findFailure(self, line):
 		failList = list()
-		match = self.failRegexObj.search(line)
+		match = self.__failRegexObj.search(line)
 		if match:
 			date = self.dateDetector.getUnixTime(match.string)
 			if date <> None:
diff --git a/server/filtergamin.py b/server/filtergamin.py
index 66f7d30c..670518ee 100644
--- a/server/filtergamin.py
+++ b/server/filtergamin.py
@@ -71,17 +71,12 @@ class FilterGamin(Filter):
 	# @param path log file path
 
 	def addLogPath(self, path):
-		try:
-			self.getLogPath().index(path)
+		if self.containsLogPath(path):
 			logSys.error(path + " already exists")
-		except ValueError:
+		else:
 			self.monitor.watch_file(path, self.callback)
-			self.getLogPath().append(path)
-			# Initialize default values
-			self.lastDate[path] = 0
-			self.lastModTime[path] = 0
-			self.lastPos[path] = 0
-			logSys.info("Added logfile = %s" % path)
+			Filter.addLogPath(self, path)
+			logSys.info("Added logfile = %s" % path)			
 	
 	##
 	# Delete a log path
@@ -89,17 +84,13 @@ class FilterGamin(Filter):
 	# @param path the log file to delete
 	
 	def delLogPath(self, path):
-		try:
-			self.monitor.stop_watch(path)
-			self.getLogPath().remove(path)
-			del self.lastDate[path]
-			del self.lastModTime[path]
-			del self.lastPos[path]
-			logSys.info("Removed logfile = %s" % path)
-		except ValueError:
+		if not self.containsLogPath(path):
 			logSys.error(path + " is not monitored")
-
-
+		else:
+			self.monitor.stop_watch(path)
+			Filter.delLogPath(self, path)
+			logSys.info("Removed logfile = %s" % path)
+		
 	##
 	# Main loop.
 	#
diff --git a/server/filterpoll.py b/server/filterpoll.py
index 3b5ad8c7..0950046d 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -52,9 +52,9 @@ class FilterPoll(Filter):
 	
 	def __init__(self, jail):
 		Filter.__init__(self, jail)
-		
+		## The time of the last modification of the file.
+		self.__lastModTime = dict()
 		self.__file404Cnt = dict()
-		
 		logSys.info("Created FilterPoll")
 
 	##
@@ -63,17 +63,13 @@ class FilterPoll(Filter):
 	# @param path log file path
 
 	def addLogPath(self, path):
-		try:
-			self.getLogPath().index(path)
+		if self.containsLogPath(path):
 			logSys.error(path + " already exists")
-		except ValueError:
-			self.getLogPath().append(path)
-			# Initialize default values
-			self.lastDate[path] = 0
-			self.lastModTime[path] = 0
-			self.lastPos[path] = 0
+		else:
+			self.__lastModTime[path] = 0
 			self.__file404Cnt[path] = 0
-			logSys.info("Added logfile = %s" % path)
+			Filter.addLogPath(self, path)
+			logSys.info("Added logfile = %s" % path)	
 	
 	##
 	# Delete a log path
@@ -81,16 +77,13 @@ class FilterPoll(Filter):
 	# @param path the log file to delete
 	
 	def delLogPath(self, path):
-		try:
-			self.getLogPath().remove(path)
-			del self.lastDate[path]
-			del self.lastModTime[path]
-			del self.lastPos[path]
-			del self.__file404Cnt[path]
-			logSys.info("Removed logfile = %s" % path)
-		except ValueError:
+		if not self.containsLogPath(path):
 			logSys.error(path + " is not monitored")
-
+		else:
+			del self.__lastModTime[path]
+			del self.__file404Cnt[path]
+			Filter.delLogPath(self, path)
+			logSys.info("Removed logfile = %s" % path)
 	
 	##
 	# Main loop.
@@ -107,7 +100,7 @@ class FilterPoll(Filter):
 				for file in self.getLogPath():
 					if self.isModified(file):
 						self.getFailures(file)
-						prevModified = True
+						self.modified = True
 
 				if self.modified:
 					try:
@@ -116,7 +109,7 @@ class FilterPoll(Filter):
 					except FailManagerEmpty:
 						self.failManager.cleanup(time.time())
 					self.dateDetector.sortTemplate()
-					prevModified = False
+					self.modified = False
 				time.sleep(self.getSleepTime())
 			else:
 				time.sleep(self.getSleepTime())
@@ -133,11 +126,11 @@ class FilterPoll(Filter):
 		try:
 			logStats = os.stat(filename)
 			self.__file404Cnt[filename] = 0
-			if self.lastModTime[filename] == logStats.st_mtime:
+			if self.__lastModTime[filename] == logStats.st_mtime:
 				return False
 			else:
 				logSys.debug(filename + " has been modified")
-				self.lastModTime[filename] = logStats.st_mtime
+				self.__lastModTime[filename] = logStats.st_mtime
 				return True
 		except OSError:
 			logSys.error("Unable to get stat on " + filename)

From 2c737f77f15f54341f21bde3c83a4b5d13ad0a8f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 21 Sep 2006 20:59:28 +0000
Subject: [PATCH 338/549] - Oups... Forgot 2 debug output. Removed

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@377 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index 62825212..229496e5 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -319,8 +319,6 @@ class Filter(JailThread):
 		line = self.__crtHandler.readline()
 		lastDate = self.__lastDate[self.__crtFilename]
 		lineDate = self.dateDetector.getUnixTime(line)
-		print lastDate
-		print lineDate
 		if lastDate < lineDate:
 			logSys.debug("Date " + `lastDate` + " is smaller than " + `lineDate`)
 			logSys.debug("Log rotation detected for " + self.__crtFilename)

From bb6c14bfea961ac2cd5fc29c003ca2a7aaa59379 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 21 Sep 2006 21:20:29 +0000
Subject: [PATCH 339/549] - Use subprocess.call instead of os.system

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@378 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/action.py | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/server/action.py b/server/action.py
index e648c355..736163d9 100644
--- a/server/action.py
+++ b/server/action.py
@@ -24,7 +24,8 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, logging, os
+import time, logging
+from subprocess import call
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.actions.action")
@@ -211,13 +212,13 @@ class Action:
   	@staticmethod
 	def executeCmd(realCmd):
 		logSys.debug(realCmd)
-		retval = os.system(realCmd)
-		#if not retval == 0:
-		#	logSys.error("'" + cmd + "' returned " + `retval`)
-		#	raise Exception("Execution of command '%s' failed" % cmd)
-		if retval == 0:
-			return True
-		else:
-			logSys.error("%s returned %x" % (realCmd, retval))
-			return False
-		
\ No newline at end of file
+		try:
+			retcode = call(realCmd, shell=True)
+			if retcode < 0:
+				logSys.error("%s returned %x" % (realCmd, -retcode))
+			else:
+				logSys.debug("%s returned %x" % (realCmd, retcode))
+				return True
+		except OSError, e:
+			logSys.error("%s failed with %s" % (realCmd, e))
+		return False

From b5abd7f2f27ee0ed36edc8941c888ab22358e135 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 21 Sep 2006 21:25:18 +0000
Subject: [PATCH 340/549] - Use cPickle instead of pickle. cPickle can be up to
 1000 times faster

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@379 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/csocket.py | 6 +++---
 server/ssocket.py | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/client/csocket.py b/client/csocket.py
index 7f795c65..b64b8753 100644
--- a/client/csocket.py
+++ b/client/csocket.py
@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import socket, pickle
+import socket, cPickle
 
 class CSocket:
 	
@@ -40,7 +40,7 @@ class CSocket:
 	
 	def send(self, msg):
 		# Convert every list member to string
-		obj = pickle.dumps(map(str, msg))
+		obj = cPickle.dumps(map(str, msg))
 		self.__csock.send(obj + CSocket.END_STRING)
 		ret = self.receive(self.__csock)
 		self.__csock.close()
@@ -53,4 +53,4 @@ class CSocket:
 			if chunk == '':
 				raise RuntimeError, "socket connection broken"
 			msg = msg + chunk
-		return pickle.loads(msg)
+		return cPickle.loads(msg)
diff --git a/server/ssocket.py b/server/ssocket.py
index 59ff8670..01ca99c0 100644
--- a/server/ssocket.py
+++ b/server/ssocket.py
@@ -25,7 +25,7 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 from threading import Thread
-import socket, time, logging, pickle, os, os.path
+import socket, time, logging, cPickle, os, os.path
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.comm")
@@ -109,7 +109,7 @@ class SocketWorker(Thread):
 		logSys.debug("Connection closed")
 	
 	def __send(self, socket, msg):
-		obj = pickle.dumps(msg)
+		obj = cPickle.dumps(msg)
 		socket.send(obj + SSocket.END_STRING)
 	
 	def __receive(self, socket):
@@ -119,7 +119,7 @@ class SocketWorker(Thread):
 			if chunk == '':
 				raise RuntimeError, "socket connection broken"
 			msg = msg + chunk
-		return pickle.loads(msg)
+		return cPickle.loads(msg)
 
 
 class SSocketErrorException(Exception):

From d30cfd209598a7cb879f0b2958832659bf5ec8e9 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 21 Sep 2006 22:38:21 +0000
Subject: [PATCH 341/549] - subprocess.call deadlocks when execute action with
 multi-jails

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@380 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/action.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/server/action.py b/server/action.py
index 736163d9..6d10c3df 100644
--- a/server/action.py
+++ b/server/action.py
@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, logging
+import time, logging, os
 from subprocess import call
 
 # Gets the instance of the logger.
@@ -213,7 +213,9 @@ class Action:
 	def executeCmd(realCmd):
 		logSys.debug(realCmd)
 		try:
-			retcode = call(realCmd, shell=True)
+			# The following line gives deadlock with multiple jails
+			#retcode = call(realCmd, shell=True)
+			retcode = os.system(realCmd)
 			if retcode < 0:
 				logSys.error("%s returned %x" % (realCmd, -retcode))
 			else:

From 66526b550fbf77bd9d5d72fa7c5dc68ed9c49abf Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 21 Sep 2006 22:41:21 +0000
Subject: [PATCH 342/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@381 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 1 +
 TODO      | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 16f08261..87685a61 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -15,6 +15,7 @@ ver. 0.7.3 (2006/??/??) - beta
 - (Re)added "ignoreip" option
 - Added more concurrency protection
 - First attempt at solving bug #1457620
+- Performance improvements
 
 ver. 0.7.2 (2006/09/10) - beta
 ----------
diff --git a/TODO b/TODO
index cdba4028..ba8a5990 100644
--- a/TODO
+++ b/TODO
@@ -13,7 +13,10 @@ Legend:
 # partially done
 * done
 
-- Prefix all private functions with "__"
+- Improve execution of action. Why does subprocess.call
+  deadlock with multi-jails?
+
+# Prefix all private functions with "__"
 
 - Verify TAI64N
 

From 4502c0f6ba0af2b1d1d6ec41ce772c3e8927554a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Sep 2006 17:03:48 +0000
Subject: [PATCH 343/549] - Organized imports (pylint)

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@382 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/csocket.py                 |  7 +++--
 server/action.py                  |  4 +--
 server/actions.py                 |  3 +-
 server/banticket.py               |  2 +-
 server/dateepoch.py               |  2 +-
 server/datestrptime.py            |  2 +-
 server/datetai64n.py              |  2 +-
 server/datetemplate.py            |  2 +-
 server/faildata.py                |  2 +-
 server/failmanager.py             |  2 +-
 server/failticket.py              |  2 +-
 server/filter.py                  |  7 ++---
 server/filtergamin.py             |  3 --
 server/filterpoll.py              |  3 --
 server/jailthread.py              |  4 +++
 server/server.py                  |  4 +--
 server/ssocket.py                 |  7 +++--
 server/ticket.py                  |  2 +-
 server/transmitter.py             |  2 +-
 testcases/banmanagertestcase.py   | 16 +++++------
 testcases/datedetectortestcase.py | 20 +++++++-------
 testcases/failmanagertestcase.py  | 46 +++++++++++++++----------------
 testcases/filtertestcase.py       | 40 +++++++++++++--------------
 testcases/servertestcase.py       | 30 ++++++++++----------
 24 files changed, 106 insertions(+), 108 deletions(-)

diff --git a/client/csocket.py b/client/csocket.py
index b64b8753..4ab3da80 100644
--- a/client/csocket.py
+++ b/client/csocket.py
@@ -24,7 +24,8 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import socket, cPickle
+from cPickle import dumps, loads
+import socket
 
 class CSocket:
 	
@@ -40,7 +41,7 @@ class CSocket:
 	
 	def send(self, msg):
 		# Convert every list member to string
-		obj = cPickle.dumps(map(str, msg))
+		obj = dumps(map(str, msg))
 		self.__csock.send(obj + CSocket.END_STRING)
 		ret = self.receive(self.__csock)
 		self.__csock.close()
@@ -53,4 +54,4 @@ class CSocket:
 			if chunk == '':
 				raise RuntimeError, "socket connection broken"
 			msg = msg + chunk
-		return cPickle.loads(msg)
+		return loads(msg)
diff --git a/server/action.py b/server/action.py
index 6d10c3df..b69b0946 100644
--- a/server/action.py
+++ b/server/action.py
@@ -24,8 +24,8 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, logging, os
-from subprocess import call
+import logging, os
+#from subprocess import call
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.actions.action")
diff --git a/server/actions.py b/server/actions.py
index e9cc2d3e..ead21b65 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -25,10 +25,9 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 from banmanager import BanManager
-from failmanager import FailManager, FailManagerEmpty
 from jailthread import JailThread
 from action import Action
-import time, logging, os
+import time, logging
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.actions")
diff --git a/server/banticket.py b/server/banticket.py
index 94c03254..67e5def1 100644
--- a/server/banticket.py
+++ b/server/banticket.py
@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, logging
+import logging
 from ticket import Ticket
 
 # Gets the instance of the logger.
diff --git a/server/dateepoch.py b/server/dateepoch.py
index ef5cb2ba..bc0ca667 100644
--- a/server/dateepoch.py
+++ b/server/dateepoch.py
@@ -24,7 +24,7 @@ __date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import re, time
+import time
 
 from datetemplate import DateTemplate
 
diff --git a/server/datestrptime.py b/server/datestrptime.py
index 4cbc32db..21516d58 100644
--- a/server/datestrptime.py
+++ b/server/datestrptime.py
@@ -25,7 +25,7 @@ __date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import re, time
+import time
 
 from datetemplate import DateTemplate
 
diff --git a/server/datetai64n.py b/server/datetai64n.py
index 064b6643..d40a7f08 100644
--- a/server/datetai64n.py
+++ b/server/datetai64n.py
@@ -24,7 +24,7 @@ __date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import re, time
+import time
 
 from datetemplate import DateTemplate
 
diff --git a/server/datetemplate.py b/server/datetemplate.py
index 69b945d7..c4bb1d12 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -24,7 +24,7 @@ __date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import re, time
+import re
 
 class DateTemplate:
 	
diff --git a/server/faildata.py b/server/faildata.py
index 391e6b6e..bcd945d8 100644
--- a/server/faildata.py
+++ b/server/faildata.py
@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, logging
+import logging
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban")
diff --git a/server/failmanager.py b/server/failmanager.py
index 1c931b82..2a43c9f1 100644
--- a/server/failmanager.py
+++ b/server/failmanager.py
@@ -27,7 +27,7 @@ __license__ = "GPL"
 from faildata import FailData
 from failticket import FailTicket
 from threading import Lock
-import time, logging
+import logging
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.filter")
diff --git a/server/failticket.py b/server/failticket.py
index 8a14b8d9..bc8e6c4d 100644
--- a/server/failticket.py
+++ b/server/failticket.py
@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, logging
+import logging
 from ticket import Ticket
 
 # Gets the instance of the logger.
diff --git a/server/filter.py b/server/filter.py
index 229496e5..7b7c3c47 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -25,12 +25,11 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 from failmanager import FailManager
-from failmanager import FailManagerEmpty
 from failticket import FailTicket
 from jailthread import JailThread
 from datedetector import DateDetector
 
-import time, logging, os, re, sys, socket
+import time, logging, re, socket
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.filter")
@@ -286,7 +285,7 @@ class Filter(JailThread):
 	##
 	# Open the log file.
 	
-	def openLogFile(self, filename):
+	def __openLogFile(self, filename):
 		""" Opens the log file specified on init.
 		"""
 		try:
@@ -343,7 +342,7 @@ class Filter(JailThread):
 	
 	def getFailures(self, filename):
 		ipList = dict()
-		ret = self.openLogFile(filename)
+		ret = self.__openLogFile(filename)
 		if not ret:
 			logSys.error("Unable to get failures in " + filename)
 			return False
diff --git a/server/filtergamin.py b/server/filtergamin.py
index 670518ee..68b1f24e 100644
--- a/server/filtergamin.py
+++ b/server/filtergamin.py
@@ -24,10 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from failmanager import FailManager
 from failmanager import FailManagerEmpty
-from failticket import FailTicket
-from datedetector import DateDetector
 from filter import Filter
 
 import time, logging, gamin
diff --git a/server/filterpoll.py b/server/filterpoll.py
index 0950046d..78d37b58 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -24,10 +24,7 @@ __date__ = "$Date: 2006-09-13 23:31:22 +0200 (Wed, 13 Sep 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from failmanager import FailManager
 from failmanager import FailManagerEmpty
-from failticket import FailTicket
-from datedetector import DateDetector
 from filter import Filter
 
 import time, logging, os
diff --git a/server/jailthread.py b/server/jailthread.py
index 6bc0c397..02ebe449 100644
--- a/server/jailthread.py
+++ b/server/jailthread.py
@@ -25,6 +25,10 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 from threading import Thread
+import logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.server")
 
 class JailThread(Thread):
 	
diff --git a/server/server.py b/server/server.py
index 97747db3..932d8e86 100644
--- a/server/server.py
+++ b/server/server.py
@@ -26,7 +26,7 @@ __license__ = "GPL"
 
 from jails import Jails
 from transmitter import Transmitter
-import locale, logging, logging.handlers, sys, os, signal
+import logging, logging.handlers, sys, os, signal
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.server")
@@ -126,7 +126,7 @@ class Server:
 	def setFindTime(self, name, value):
 		self.__jails.getFilter(name).setFindTime(value)
 	
-	def getFindTime(self):
+	def getFindTime(self, name):
 		return self.__jails.getFilter(name).getFindTime()
 
 	def setFailRegex(self, name, value):
diff --git a/server/ssocket.py b/server/ssocket.py
index 01ca99c0..59d0c5e9 100644
--- a/server/ssocket.py
+++ b/server/ssocket.py
@@ -25,7 +25,8 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 from threading import Thread
-import socket, time, logging, cPickle, os, os.path
+from cPickle import dumps, loads
+import socket, logging, os, os.path
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.comm")
@@ -109,7 +110,7 @@ class SocketWorker(Thread):
 		logSys.debug("Connection closed")
 	
 	def __send(self, socket, msg):
-		obj = cPickle.dumps(msg)
+		obj = dumps(msg)
 		socket.send(obj + SSocket.END_STRING)
 	
 	def __receive(self, socket):
@@ -119,7 +120,7 @@ class SocketWorker(Thread):
 			if chunk == '':
 				raise RuntimeError, "socket connection broken"
 			msg = msg + chunk
-		return cPickle.loads(msg)
+		return loads(msg)
 
 
 class SSocketErrorException(Exception):
diff --git a/server/ticket.py b/server/ticket.py
index fd06b781..ee274eab 100644
--- a/server/ticket.py
+++ b/server/ticket.py
@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time, logging
+import logging
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban")
diff --git a/server/transmitter.py b/server/transmitter.py
index 487c6593..8740fa55 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -27,7 +27,7 @@ __license__ = "GPL"
 from ssocket import SSocket
 from ssocket import SSocketErrorException
 from threading import Lock
-import re, pickle, logging
+import logging, time
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.comm")
diff --git a/testcases/banmanagertestcase.py b/testcases/banmanagertestcase.py
index 0f375a11..fee58631 100644
--- a/testcases/banmanagertestcase.py
+++ b/testcases/banmanagertestcase.py
@@ -32,25 +32,25 @@ class AddFailure(unittest.TestCase):
 
 	def setUp(self):
 		"""Call before every test case."""
-		self.ticket = BanTicket('193.168.0.128', 1167605999.0)
-		self.banManager = BanManager()
-		self.assertTrue(self.banManager.addBanTicket(self.ticket))
+		self.__ticket = BanTicket('193.168.0.128', 1167605999.0)
+		self.__banManager = BanManager()
+		self.assertTrue(self.__banManager.addBanTicket(self.__ticket))
 
 	def tearDown(self):
 		"""Call after every test case."""
 	
 	def testAdd(self):
-		self.assertEqual(self.banManager.size(), 1)
+		self.assertEqual(self.__banManager.size(), 1)
 	
 	def testAddDuplicate(self):
-		self.assertFalse(self.banManager.addBanTicket(self.ticket))
-		self.assertEqual(self.banManager.size(), 1)
+		self.assertFalse(self.__banManager.addBanTicket(self.__ticket))
+		self.assertEqual(self.__banManager.size(), 1)
 		
 	def _testInListOK(self):
 		ticket = BanTicket('193.168.0.128', 1167605999.0)
-		self.assertTrue(self.banManager.inBanList(ticket))
+		self.assertTrue(self.__banManager.inBanList(ticket))
 	
 	def _testInListNOK(self):
 		ticket = BanTicket('111.111.1.111', 1167605999.0)
-		self.assertFalse(self.banManager.inBanList(ticket))
+		self.assertFalse(self.__banManager.inBanList(ticket))
 		
\ No newline at end of file
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index d5e554d0..1c311c06 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -32,8 +32,8 @@ class DateDetectorTest(unittest.TestCase):
 
 	def setUp(self):
 		"""Call before every test case."""
-		self.datedetector = DateDetector()
-		self.datedetector.addDefaultTemplate()
+		self.__datedetector = DateDetector()
+		self.__datedetector.addDefaultTemplate()
 
 	def tearDown(self):
 		"""Call after every test case."""
@@ -43,18 +43,18 @@ class DateDetectorTest(unittest.TestCase):
 		date = [2006, 1, 23, 20, 59, 59, 0, 23, 0]
 		dateUnix = 1138046399.0
 		
-		self.assertEqual(self.datedetector.getTime(log), date)
-		self.assertEqual(self.datedetector.getUnixTime(log), dateUnix)
+		self.assertEqual(self.__datedetector.getTime(log), date)
+		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
 	
 	def testGetTime(self):
 		log = "Jan 23 21:59:59 [sshd] error: PAM: Authentication failure"
 		date = [2006, 1, 23, 21, 59, 59, 1, 23, -1]
 		dateUnix = 1138049999.0
 	
-		self.assertEqual(self.datedetector.getTime(log), date)
-		self.assertEqual(self.datedetector.getTime(log), date)
-		self.assertEqual(self.datedetector.getTime(log), date)
-		self.assertEqual(self.datedetector.getUnixTime(log), dateUnix)
-		self.assertEqual(self.datedetector.getUnixTime(log), dateUnix)
-		self.assertEqual(self.datedetector.getUnixTime(log), dateUnix)
+		self.assertEqual(self.__datedetector.getTime(log), date)
+		self.assertEqual(self.__datedetector.getTime(log), date)
+		self.assertEqual(self.__datedetector.getTime(log), date)
+		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
+		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
+		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
 		
\ No newline at end of file
diff --git a/testcases/failmanagertestcase.py b/testcases/failmanagertestcase.py
index e4a101e7..1e761b6c 100644
--- a/testcases/failmanagertestcase.py
+++ b/testcases/failmanagertestcase.py
@@ -33,47 +33,47 @@ class AddFailure(unittest.TestCase):
 
 	def setUp(self):
 		"""Call before every test case."""
-		self.items = [['193.168.0.128', 1167605999.0],
-					  ['193.168.0.128', 1167605999.0],
-					  ['193.168.0.128', 1167605999.0],
-					  ['193.168.0.128', 1167605999.0],
-					  ['193.168.0.128', 1167605999.0],
-					  ['87.142.124.10', 1167605999.0],
-					  ['87.142.124.10', 1167605999.0],
-					  ['87.142.124.10', 1167605999.0]]
+		self.__items = [['193.168.0.128', 1167605999.0],
+					    ['193.168.0.128', 1167605999.0],
+					    ['193.168.0.128', 1167605999.0],
+					    ['193.168.0.128', 1167605999.0],
+					    ['193.168.0.128', 1167605999.0],
+					    ['87.142.124.10', 1167605999.0],
+					    ['87.142.124.10', 1167605999.0],
+					    ['87.142.124.10', 1167605999.0]]
 		
-		self.failManager = FailManager()
-		for i in self.items:
-			self.failManager.addFailure(FailTicket(i[0], i[1]))
+		self.__failManager = FailManager()
+		for i in self.__items:
+			self.__failManager.addFailure(FailTicket(i[0], i[1]))
 
 	def tearDown(self):
 		"""Call after every test case."""
 	
 	def testAdd(self):
-		self.assertEqual(self.failManager.size(), 2)
+		self.assertEqual(self.__failManager.size(), 2)
 	
 	def _testDel(self):
-		self.failManager.delFailure('193.168.0.128')
-		self.failManager.delFailure('111.111.1.111')
+		self.__failManager.delFailure('193.168.0.128')
+		self.__failManager.delFailure('111.111.1.111')
 		
-		self.assertEqual(self.failManager.size(), 1)
+		self.assertEqual(self.__failManager.size(), 1)
 		
 	def testCleanupOK(self):
 		timestamp = 1167606999.0
-		self.failManager.cleanup(timestamp)
-		self.assertEqual(self.failManager.size(), 0)
+		self.__failManager.cleanup(timestamp)
+		self.assertEqual(self.__failManager.size(), 0)
 		
 	def testCleanupNOK(self):
 		timestamp = 1167605990.0
-		self.failManager.cleanup(timestamp)
-		self.assertEqual(self.failManager.size(), 2)
+		self.__failManager.cleanup(timestamp)
+		self.assertEqual(self.__failManager.size(), 2)
 	
 	def testbanOK(self):
-		self.failManager.setMaxRetry(5)
+		self.__failManager.setMaxRetry(5)
 		#ticket = FailTicket('193.168.0.128', None)
-		ticket = self.failManager.toBan()
+		ticket = self.__failManager.toBan()
 		self.assertEqual(ticket.getIP(), "193.168.0.128")
 	
 	def testbanNOK(self):
-		self.failManager.setMaxRetry(10)
-		self.assertRaises(FailManagerEmpty, self.failManager.toBan)
+		self.__failManager.setMaxRetry(10)
+		self.assertRaises(FailManagerEmpty, self.__failManager.toBan)
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 6fdabf3b..af1fbfba 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -32,7 +32,7 @@ class IgnoreIP(unittest.TestCase):
 
 	def setUp(self):
 		"""Call before every test case."""
-		self.filter = FilterPoll(None)
+		self.__filter = FilterPoll(None)
 
 	def tearDown(self):
 		"""Call after every test case."""
@@ -40,44 +40,44 @@ class IgnoreIP(unittest.TestCase):
 	def testIgnoreIPOK(self):
 		ipList = "127.0.0.1", "192.168.0.1", "255.255.255.255", "99.99.99.99"
 		for ip in ipList:
-			self.filter.addIgnoreIP(ip)
-			self.assertTrue(self.filter.inIgnoreIPList(ip))
+			self.__filter.addIgnoreIP(ip)
+			self.assertTrue(self.__filter.inIgnoreIPList(ip))
 	
 	def testIgnoreIPNOK(self):
 		ipList = "", "999.999.999.999", "abcdef", "192.168.0."
 		for ip in ipList:
-			self.filter.addIgnoreIP(ip)
-			self.assertFalse(self.filter.inIgnoreIPList(ip))
+			self.__filter.addIgnoreIP(ip)
+			self.assertFalse(self.__filter.inIgnoreIPList(ip))
 
 
 class LogFile(unittest.TestCase):
 
-	filename = "testcases/files/testcase01.log"
+	FILENAME = "testcases/files/testcase01.log"
 
 	def setUp(self):
 		"""Call before every test case."""
-		self.filter = FilterPoll(None)
-		self.filter.addLogPath(LogFile.filename)
+		self.__filter = FilterPoll(None)
+		self.__filter.addLogPath(LogFile.FILENAME)
 
 	def tearDown(self):
 		"""Call after every test case."""
 		
-	def testOpen(self):
-		self.filter.openLogFile(LogFile.filename)
+	#def testOpen(self):
+	#	self.__filter.openLogFile(LogFile.FILENAME)
 	
 	def testIsModified(self):
-		self.assertTrue(self.filter.isModified(LogFile.filename))
+		self.assertTrue(self.__filter.isModified(LogFile.FILENAME))
 
 
 class GetFailures(unittest.TestCase):
 
 	def setUp(self):
 		"""Call before every test case."""
-		self.filter = FilterPoll(None)
-		self.filter.addLogPath("testcases/files/testcase01.log")
-		self.filter.setTimeRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
-		self.filter.setTimePattern("%b %d %H:%M:%S")
-		self.filter.setFailRegex("(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)")
+		self.__filter = FilterPoll(None)
+		self.__filter.addLogPath("testcases/files/testcase01.log")
+		self.__filter.setTimeRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+		self.__filter.setTimePattern("%b %d %H:%M:%S")
+		self.__filter.setFailRegex("(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)")
 
 	def tearDown(self):
 		"""Call after every test case."""
@@ -86,12 +86,12 @@ class GetFailures(unittest.TestCase):
 		output = [('87.142.124.10', 3, 1167605999.0),
 				  ('193.168.0.128', 3, 1167605999.0)]
 
-		self.filter.openLogFile()
-		self.filter.getFailures()
+		self.__filter.openLogFile()
+		self.__filter.getFailures()
 		
 		found = []
-		for ip in self.filter.failManager.failList:
-			fData = self.filter.failManager.failList[ip]
+		for ip in self.__filter.failManager.failList:
+			fData = self.__filter.failManager.failList[ip]
 			retry = fData.getRetry()
 			lTime = fData.getLastTime()
 			found.append((ip, retry, lTime))
diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index 42627111..90ca92e4 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -31,33 +31,33 @@ class StartStop(unittest.TestCase):
 
 	def setUp(self):
 		"""Call before every test case."""
-		self.server = Server()
-		self.server.setLogLevel(0)
-		self.server.start(False)
+		self.__server = Server()
+		self.__server.setLogLevel(0)
+		self.__server.start(False)
 
 	def tearDown(self):
 		"""Call after every test case."""
-		self.server.quit()
+		self.__server.quit()
 	
 	def testStartStopJail(self):
 		name = "TestCase"
-		self.server.addJail(name)
-		self.server.startJail(name)
+		self.__server.addJail(name)
+		self.__server.startJail(name)
 		time.sleep(1)
-		self.server.stopJail(name)
+		self.__server.stopJail(name)
 
 
 class Transmitter(unittest.TestCase):
 	
 	def setUp(self):
 		"""Call before every test case."""
-		self.server = Server()
-		self.server.setLogLevel(0)
-		self.server.start(False)
+		self.__server = Server()
+		self.__server.setLogLevel(0)
+		self.__server.start(False)
 
 	def tearDown(self):
 		"""Call after every test case."""
-		self.server.quit()
+		self.__server.quit()
 	
 	def testSetActionOK(self):
 		name = "TestCase"
@@ -79,7 +79,7 @@ class Transmitter(unittest.TestCase):
 		
 		cnt = 0
 		for cmd in cmdList:
-			self.assertEqual(self.server.transm.proceed(cmd), outList[cnt])
+			self.assertEqual(self.__server.transm.proceed(cmd), outList[cnt])
 			cnt += 1
 	
 	def testSetActionNOK(self):
@@ -102,7 +102,7 @@ class Transmitter(unittest.TestCase):
 		
 		cnt = 0
 		for cmd in cmdList:
-			msg = self.server.transm.proceed(cmd)
+			msg = self.__server.transm.proceed(cmd)
 			self.assertEqual(msg[0], outList[cnt])
 			cnt += 1
 	
@@ -118,10 +118,10 @@ class Transmitter(unittest.TestCase):
 				   ["quit"]]
 				  
 		for cmd in cmdList:
-			self.server.transm.proceed(cmd)
+			self.__server.transm.proceed(cmd)
 			if cmd == ["start", name]:
 				time.sleep(2)
-				jail = self.server.jails[name]
+				jail = self.__server.jails[name]
 				self.assertEqual(jail.getFilter().failManager.size(), 0)
 				self.assertEqual(jail.getAction().banManager.size(), 2)
 		
\ No newline at end of file

From 91b1053c01ba27a6986de0f40109b631df1af15d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Sep 2006 17:05:38 +0000
Subject: [PATCH 344/549] - Fixed wrong arg

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@383 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/configreader.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/configreader.py b/client/configreader.py
index 07eca339..35a22aa9 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -49,7 +49,7 @@ class ConfigReader(SafeConfigParser):
 		global basedir
 		return basedir
 	
-	def read(self, filename):
+	def read(self, FILENAME):
 		global basedir
 		basename = basedir + filename
 		logSys.debug("Reading " + basename)

From b701e033c1e243f80d1e47fb09fedeaebde877aa Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Sep 2006 17:06:00 +0000
Subject: [PATCH 345/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@384 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 2 +-
 TODO      | 6 ------
 2 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 87685a61..5ecb7159 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -14,7 +14,7 @@ ver. 0.7.3 (2006/??/??) - beta
 - Added Gamin (file and directory monitoring system) support
 - (Re)added "ignoreip" option
 - Added more concurrency protection
-- First attempt at solving bug #1457620
+- First attempt at solving bug #1457620 (locale issue)
 - Performance improvements
 
 ver. 0.7.2 (2006/09/10) - beta
diff --git a/TODO b/TODO
index ba8a5990..ea3d36f8 100644
--- a/TODO
+++ b/TODO
@@ -16,8 +16,6 @@ Legend:
 - Improve execution of action. Why does subprocess.call
   deadlock with multi-jails?
 
-# Prefix all private functions with "__"
-
 - Verify TAI64N
 
 # implement all get/set functions
@@ -46,10 +44,6 @@ Legend:
   Python since 2.1. It should be possible to run all tests
   automatically.
 
-# autodetect date format in log file. Match the most popular
-  format and sort them using the hit ratio. Should avoid
-  user problem with regex and not have a big impact on perfs.
-
 ? restart automatically the daemon if an exception occurs.
 
 - do not close socket after a send

From 06161353504e6e841b63fb38a3c5f4839beeb95f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Sep 2006 20:44:47 +0000
Subject: [PATCH 346/549] - Removed unneeded import

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@385 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/filter.py b/server/filter.py
index 7b7c3c47..79a866b8 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -29,7 +29,7 @@ from failticket import FailTicket
 from jailthread import JailThread
 from datedetector import DateDetector
 
-import time, logging, re, socket
+import time, logging, re
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.filter")

From 26e5690a4b05245d6a7e98aa2c026df1bbf08305 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Sep 2006 20:45:23 +0000
Subject: [PATCH 347/549] - Beautified "ping" response

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@386 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/beautifier.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/client/beautifier.py b/client/beautifier.py
index bb41f174..2ef8d515 100644
--- a/client/beautifier.py
+++ b/client/beautifier.py
@@ -53,7 +53,9 @@ class Beautifier:
 		inC = self.__inputCmd
 		msg = response
 		try:
-			if inC[0] == "start":
+			if inC[0] == "ping":
+				msg = "Server replied: " + response
+			elif inC[0] == "start":
 				msg = "Jail started"
 			elif inC[0] == "stop":
 				if len(inC) == 1:

From bf3cd1d56d0c1105134573a729336b1d6091164b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Sep 2006 20:46:21 +0000
Subject: [PATCH 348/549] - (Re)added permanent banning (banTime < 0)

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@387 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/banmanager.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/server/banmanager.py b/server/banmanager.py
index 9c89a3fb..e345187a 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -182,6 +182,9 @@ class BanManager:
 		try:
 			self.__lock.acquire()
 			uBList = list()
+			# Permanent banning
+			if self.__banTime < 0:
+				return uBList
 			for ticket in self.__banList:
 				if ticket.getTime() < time - self.__banTime:
 					uBList.append(ticket)

From 5ea31760f544c9ff98e5d49e7b3c723175361d36 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Sep 2006 20:46:37 +0000
Subject: [PATCH 349/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@388 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG b/CHANGELOG
index 5ecb7159..86c18655 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -16,6 +16,7 @@ ver. 0.7.3 (2006/??/??) - beta
 - Added more concurrency protection
 - First attempt at solving bug #1457620 (locale issue)
 - Performance improvements
+- (Re)added permanent banning with banTime < 0
 
 ver. 0.7.2 (2006/09/10) - beta
 ----------

From 7b7d246a1929d7bdfaafcd0d0446fe9b8c2aba6e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 27 Sep 2006 20:32:30 +0000
Subject: [PATCH 350/549] - Added DNS support for "ignoreip"

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@389 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                   |  1 +
 config/jail.conf            |  1 +
 server/filter.py            | 33 +++++++++++++++++++--------------
 testcases/filtertestcase.py |  6 ++++++
 4 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 86c18655..8d2c1abd 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -17,6 +17,7 @@ ver. 0.7.3 (2006/??/??) - beta
 - First attempt at solving bug #1457620 (locale issue)
 - Performance improvements
 - (Re)added permanent banning with banTime < 0
+- Added DNS support to "ignoreip". Feature Request #1285859
 
 ver. 0.7.2 (2006/09/10) - beta
 ----------
diff --git a/config/jail.conf b/config/jail.conf
index 6eaedcee..ffb47fe7 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -10,6 +10,7 @@
 
 [DEFAULT]
 
+# "ignoreip" can be an IP address, a CIDR mask or a DNS host
 ignoreip = 127.0.0.1
 bantime  = 600
 maxretry = 3
diff --git a/server/filter.py b/server/filter.py
index 79a866b8..edd12828 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -238,18 +238,15 @@ class Filter(JailThread):
 		raise Exception("run() is abstract")
 	
 	##
-	# Add an IP to the ignore list.
+	# Add an IP/DNS to the ignore list.
 	#
 	# IP addresses in the ignore list are not taken into account
-	# when finding failures. CIDR mask are also accepted.
+	# when finding failures. CIDR mask and DNS are also accepted.
 	# @param ip IP address to ignore
 	
 	def addIgnoreIP(self, ip):
-		if DNSUtils.isValidIP(ip):
-			logSys.debug("Add " + ip + " to ignore list")
-			self.__ignoreIpList.append(ip)
-		else:
-			logSys.warn(ip + " is not a valid address")
+		logSys.debug("Add " + ip + " to ignore list")
+		self.__ignoreIpList.append(ip)
 		
 	def delIgnoreIP(self, ip):
 		logSys.debug("Remove " + ip + " from ignore list")
@@ -259,15 +256,18 @@ class Filter(JailThread):
 		return self.__ignoreIpList
 	
 	##
-	# Check if IP address is in the ignore list.
+	# Check if IP address/DNS is in the ignore list.
 	#
-	# Check if the given IP address matches an IP address or a CIDR
+	# Check if the given IP address matches an IP address/DNS or a CIDR
 	# mask in the ignore list.
 	# @param ip IP address
 	# @return True if IP address is in ignore list
 	
 	def inIgnoreIPList(self, ip):
 		for i in self.__ignoreIpList:
+			# An empty string is always false
+			if i == "":
+				return False
 			s = i.split('/', 1)
 			# IP address without CIDR mask
 			if len(s) == 1:
@@ -277,7 +277,12 @@ class Filter(JailThread):
 				a = DNSUtils.cidr(s[0], s[1])
 				b = DNSUtils.cidr(ip, s[1])
 			except Exception:
-				return False
+				# Check if IP in DNS
+				ips = DNSUtils.dnsToIp(i)
+				if ip in ips:
+					return True
+				else:
+					return False
 			if a == b:
 				return True
 		return False
@@ -424,8 +429,8 @@ import socket, struct
 
 class DNSUtils:
 	
-	dnsCRE = re.compile("(?:(?:\w|-)+\.){2,}\w+")
-	ipCRE = re.compile("(?:\d{1,3}\.){3}\d{1,3}")
+	DNS_CRE = re.compile("(?:(?:\w|-)+\.){2,}\w+")
+	IP_CRE = re.compile("(?:\d{1,3}\.){3}\d{1,3}")
 	
 	@staticmethod
 	def dnsToIp(dns):
@@ -442,7 +447,7 @@ class DNSUtils:
 		""" Search for possible DNS in an arbitrary text.
 			Thanks to Tom Pike.
 		"""
-		match = DNSUtils.dnsCRE.match(text)
+		match = DNSUtils.DNS_CRE.match(text)
 		if match:
 			return match
 		else:
@@ -453,7 +458,7 @@ class DNSUtils:
 		""" Search if an IP address if directly available and return
 			it.
 		"""
-		match = DNSUtils.ipCRE.match(text)
+		match = DNSUtils.IP_CRE.match(text)
 		if match:
 			return match
 		else:
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index af1fbfba..18ebcec1 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -42,12 +42,18 @@ class IgnoreIP(unittest.TestCase):
 		for ip in ipList:
 			self.__filter.addIgnoreIP(ip)
 			self.assertTrue(self.__filter.inIgnoreIPList(ip))
+		# Test DNS
+		self.__filter.addIgnoreIP("www.epfl.ch")
+		self.assertTrue(self.__filter.inIgnoreIPList("128.178.50.12"))
 	
 	def testIgnoreIPNOK(self):
 		ipList = "", "999.999.999.999", "abcdef", "192.168.0."
 		for ip in ipList:
 			self.__filter.addIgnoreIP(ip)
 			self.assertFalse(self.__filter.inIgnoreIPList(ip))
+		# Test DNS
+		self.__filter.addIgnoreIP("www.epfl.ch")
+		self.assertFalse(self.__filter.inIgnoreIPList("127.177.50.10"))
 
 
 class LogFile(unittest.TestCase):

From 897256f9f4c053a8240876bd1a8d94fd7cc34714 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 27 Sep 2006 21:01:31 +0000
Subject: [PATCH 351/549] - Fixed a refactoring bug. Thanks pydev :(

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@390 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/configreader.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/configreader.py b/client/configreader.py
index 35a22aa9..07eca339 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -49,7 +49,7 @@ class ConfigReader(SafeConfigParser):
 		global basedir
 		return basedir
 	
-	def read(self, FILENAME):
+	def read(self, filename):
 		global basedir
 		basename = basedir + filename
 		logSys.debug("Reading " + basename)

From 366584856da79c4dd5fe9bccd0e0d020e82a9966 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 28 Sep 2006 19:37:18 +0000
Subject: [PATCH 352/549] - Updated for 0.7.3

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@391 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG             |  4 ++--
 README                | 27 +++++++++++++--------------
 TODO                  |  4 ++--
 man/fail2ban-client.1 |  4 ++--
 man/fail2ban-server.1 |  4 ++--
 man/generate-man      |  6 ++++++
 version.py            |  2 +-
 7 files changed, 28 insertions(+), 23 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 8d2c1abd..5a84ff0d 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.3)                           2006/??/??
+Fail2Ban (version 0.7.3)                           2006/09/28
 =============================================================
 
-ver. 0.7.3 (2006/??/??) - beta
+ver. 0.7.3 (2006/09/28) - beta
 ----------
 - Added man pages. Thanks to Yaroslav Halchenko
 - Added wildcard support for "logpath"
diff --git a/README b/README
index 8e32f1a3..7afd0717 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.2)                           2006/09/10
+Fail2Ban (version 0.7.3)                           2006/09/28
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -27,8 +27,8 @@ Optional:
 
 To install, just do:
 
-> tar xvfj fail2ban-0.7.2.tar.bz2
-> cd fail2ban-0.7.2
+> tar xvfj fail2ban-0.7.3.tar.bz2
+> cd fail2ban-0.7.3
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The
@@ -51,8 +51,17 @@ You can configure fail2ban using the files in /etc/fail2ban
 or using command line. Here are the available command line
 options (not complete yet):
 
-  <COMMAND>
+Options:
+    -c <DIR>                configuration directory
+    -d                      dump configuration. For debugging
+    -i                      interactive mode
+    -v                      increase verbosity
+    -q                      decrease verbosity
+    -x                      force execution of the server
+    -h, --help              display this help message
+    -V, --version           print the version
 
+Command:
     start                   start the server and the jails
     reload                  reload the configuration
     stop                    stop all jails and terminate the
@@ -71,16 +80,6 @@ options (not complete yet):
     stop <JAIL>             stop <JAIL>. The jail is removed
     status <JAIL>           get the current status of <JAIL>
 
-  [OPTIONS]
-
-    -c <DIR>                configuration directory
-    -d                      dump configuration. For debugging
-    -i                      interactive mode
-    -v                      increase verbosity
-    -q                      decrease verbosity
-    -x                      force execution of the server
-    -h                      display this help message
-
 Contact:
 --------
 
diff --git a/TODO b/TODO
index ea3d36f8..6a5e2760 100644
--- a/TODO
+++ b/TODO
@@ -13,13 +13,13 @@ Legend:
 # partially done
 * done
 
+- Improve communication. (asyncore, asynchat??)
+
 - Improve execution of action. Why does subprocess.call
   deadlock with multi-jails?
 
 - Verify TAI64N
 
-# implement all get/set functions
-
 # correct handling of threads (join???), concurrency, etc
   protect "jails" in server.py
 
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 0a63dd50..eeddba8a 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "September 2006" "fail2ban-client v0.7.2-SVN" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "September 2006" "fail2ban-client v0.7.3" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH SYNOPSIS
 .B fail2ban-client
 [\fIOPTIONS\fR]... \fI<COMMAND>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.2\-SVN reads log file that contains password failure report
+Fail2Ban v0.7.3 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index 3e9848b2..d70bff01 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "September 2006" "fail2ban-server v0.7.2-SVN" "User Commands"
+.TH FAIL2BAN-SERVER "1" "September 2006" "fail2ban-server v0.7.3" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.7.2\-SVN reads log file that contains password failure report
+Fail2Ban v0.7.3 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with
diff --git a/man/generate-man b/man/generate-man
index 730a31d2..c415e4ea 100755
--- a/man/generate-man
+++ b/man/generate-man
@@ -1,9 +1,15 @@
 #!/bin/bash
 
 # fail2ban-client
+echo -n "Generating fail2ban-client "
 help2man --section=1 --no-info --include=fail2ban-client.h2m --output fail2ban-client.1 ../fail2ban-client
+echo "[done]"
+echo -n "Patching fail2ban-client   "
 sed -i -e 's/.SS "Command:"/.SH COMMAND/' fail2ban-client.1
+echo "[done]"
 
 # fail2ban-server
+echo -n "Generating fail2ban-server "
 help2man --section=1 --no-info --include=fail2ban-server.h2m --output fail2ban-server.1 ../fail2ban-server
+echo "[done]"
 
diff --git a/version.py b/version.py
index faadc12e..dcbedc39 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.2-SVN"
+version = "0.7.3"

From c5e8bcc7e69cb300c5ec46f14855567f19745610 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 1 Oct 2006 21:19:24 +0000
Subject: [PATCH 353/549] - Allow multiple log paths

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@393 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/jailreader.py | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/client/jailreader.py b/client/jailreader.py
index bf8dc431..b5a36bdd 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -97,11 +97,12 @@ class JailReader(ConfigReader):
 		stream = [["add", self.__name]]
 		for opt in self.__opts:
 			if opt == "logpath":
-				pathList = glob.glob(self.__opts[opt])
-				if len(pathList) == 0:
-					logSys.error("No file found for " + self.__opts[opt])
-				for path in pathList:
-					stream.append(["set", self.__name, "addlogpath", path])
+				for path in self.__opts[opt].split("\n"):
+					pathList = glob.glob(path)
+					if len(pathList) == 0:
+						logSys.error("No file found for " + path)
+					for p in pathList:
+						stream.append(["set", self.__name, "addlogpath", p])
 			elif opt == "maxretry":
 				stream.append(["set", self.__name, "maxretry", self.__opts[opt]])
 			elif opt == "ignoreip":

From 2bcc036cf2f56dbcc59c01a6df4e6fbcc7115a12 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 1 Oct 2006 21:19:56 +0000
Subject: [PATCH 354/549] - Improved configuration files

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@394 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/dummy.conf       |  9 ++++-----
 config/action.d/hostsdeny.conf   |  9 ++++-----
 config/action.d/iptables.conf    |  9 ++++-----
 config/action.d/mail-whois.conf  |  9 ++++-----
 config/action.d/mail.conf        |  9 ++++-----
 config/filter.d/apache-auth.conf |  4 ++--
 config/filter.d/couriersmtp.conf |  2 +-
 config/filter.d/postfix.conf     |  2 +-
 config/filter.d/qmail.conf       |  2 +-
 config/filter.d/sshd.conf        |  2 +-
 config/filter.d/vsftpd.conf      |  2 +-
 config/jail.conf                 | 11 +++++++++++
 12 files changed, 38 insertions(+), 32 deletions(-)

diff --git a/config/action.d/dummy.conf b/config/action.d/dummy.conf
index bfd9599d..21b7fa9d 100644
--- a/config/action.d/dummy.conf
+++ b/config/action.d/dummy.conf
@@ -9,20 +9,20 @@
 
 # Option:  fwstart
 # Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstart = touch /tmp/fail2ban.dummy
               echo "<init>" >> /tmp/fail2ban.dummy
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstop = rm /tmp/fail2ban.dummy
 
 # Option:  fwcheck
 # Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actioncheck = 
 
@@ -34,7 +34,6 @@ actioncheck =
 #          <failtime>  unix timestamp of the last failure
 #          <bantime>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
 #
 actionban = echo "+<ip>" >> /tmp/fail2ban.dummy
 
@@ -45,10 +44,10 @@ actionban = echo "+<ip>" >> /tmp/fail2ban.dummy
 #          <bantime>  unix timestamp of the ban time
 #          <unbantime>  unix timestamp of the unban time
 # Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
 #
 actionunban = echo "-<ip>" >> /tmp/fail2ban.dummy
 
 [Init]
 
 init = 123
+
diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf
index ba813ac8..f87ecb5a 100644
--- a/config/action.d/hostsdeny.conf
+++ b/config/action.d/hostsdeny.conf
@@ -9,19 +9,19 @@
 
 # Option:  fwstart
 # Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstart = touch <tmpfile>
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstop = rm -f <tmpfile>
 
 # Option:  fwcheck
 # Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actioncheck = 
 
@@ -33,7 +33,6 @@ actioncheck =
 #          <failtime>  unix timestamp of the last failure
 #          <bantime>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
 #
 actionban = IP=<ip> &&
             echo "ALL: $IP" >> <file>
@@ -45,7 +44,6 @@ actionban = IP=<ip> &&
 #          <bantime>  unix timestamp of the ban time
 #          <unbantime>  unix timestamp of the unban time
 # Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
 #
 actionunban = IP=<ip> &&
               grep -v "ALL: $IP" <file> > <tmpfile> &&
@@ -64,3 +62,4 @@ file = /etc/hosts.deny
 # Values:  STR  Default:  /etc/hostsdeny.failban
 #
 tmpfile = /tmp/hosts.deny.tmp
+
diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf
index 3d9083f1..fe55731f 100644
--- a/config/action.d/iptables.conf
+++ b/config/action.d/iptables.conf
@@ -9,7 +9,7 @@
 
 # Option:  fwstart
 # Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstart = iptables -N fail2ban-<name>
               iptables -A fail2ban-<name> -j RETURN
@@ -17,7 +17,7 @@ actionstart = iptables -N fail2ban-<name>
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstop = iptables -D INPUT -p <protocol> --dport <port> -j fail2ban-<name>
              iptables -F fail2ban-<name>
@@ -25,7 +25,7 @@ actionstop = iptables -D INPUT -p <protocol> --dport <port> -j fail2ban-<name>
 
 # Option:  fwcheck
 # Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actioncheck = iptables -L INPUT | grep -q fail2ban-<name>
 
@@ -37,7 +37,6 @@ actioncheck = iptables -L INPUT | grep -q fail2ban-<name>
 #          <failtime>  unix timestamp of the last failure
 #          <bantime>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
 #
 actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 
@@ -48,7 +47,6 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 #          <bantime>  unix timestamp of the ban time
 #          <unbantime>  unix timestamp of the unban time
 # Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
 #
 actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
 
@@ -69,3 +67,4 @@ port = ssh
 # Values:  [ tcp | udp | icmp | all ] Default: tcp
 #
 protocol = tcp
+
diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf
index 459fbf51..fc21065f 100644
--- a/config/action.d/mail-whois.conf
+++ b/config/action.d/mail-whois.conf
@@ -9,7 +9,7 @@
 
 # Option:  fwstart
 # Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstart = echo -en "Hi,\n
               The jail <name> has been started successfuly.\n
@@ -18,7 +18,7 @@ actionstart = echo -en "Hi,\n
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstop = echo -en "Hi,\n
              The jail <name> has been stopped.\n
@@ -27,7 +27,7 @@ actionstop = echo -en "Hi,\n
 
 # Option:  fwcheck
 # Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actioncheck = 
 
@@ -39,7 +39,6 @@ actioncheck =
 #          <failtime>  unix timestamp of the last failure
 #          <bantime>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
 #
 actionban = echo -en "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
@@ -56,7 +55,6 @@ actionban = echo -en "Hi,\n
 #          <bantime>  unix timestamp of the ban time
 #          <unbantime>  unix timestamp of the unban time
 # Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
 #
 actionunban = 
 
@@ -69,3 +67,4 @@ name = default
 # Destinataire of the mail
 #
 dest = root
+
diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf
index 88cbae25..90295906 100644
--- a/config/action.d/mail.conf
+++ b/config/action.d/mail.conf
@@ -9,7 +9,7 @@
 
 # Option:  fwstart
 # Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstart = echo -en "Hi,\n
               The jail <name> has been started successfuly.\n
@@ -18,7 +18,7 @@ actionstart = echo -en "Hi,\n
 
 # Option:  fwend
 # Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actionstop = echo -en "Hi,\n
              The jail <name> has been stopped.\n
@@ -27,7 +27,7 @@ actionstop = echo -en "Hi,\n
 
 # Option:  fwcheck
 # Notes.:  command executed once before each fwban command
-# Values:  CMD  Default:
+# Values:  CMD
 #
 actioncheck = 
 
@@ -39,7 +39,6 @@ actioncheck =
 #          <failtime>  unix timestamp of the last failure
 #          <bantime>  unix timestamp of the ban time
 # Values:  CMD
-# Default: iptables -I INPUT 1 -s <ip> -j DROP
 #
 actionban = echo -en "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
@@ -54,7 +53,6 @@ actionban = echo -en "Hi,\n
 #          <bantime>  unix timestamp of the ban time
 #          <unbantime>  unix timestamp of the unban time
 # Values:  CMD
-# Default: iptables -D INPUT -s <ip> -j DROP
 #
 actionunban = 
 
@@ -67,3 +65,4 @@ name = default
 # Destinataire of the mail
 #
 dest = root
+
diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index b4d5bb94..ac3a0256 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -9,6 +9,6 @@
 
 # Option:  failregex
 # Notes.:  regex to match the password failure messages in the logfile.
-# Values:  TEXT  Default:  authentication failure|user .* not found
+# Values:  TEXT
 #
-failregex = authentication failure|user .* not found
+failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
diff --git a/config/filter.d/couriersmtp.conf b/config/filter.d/couriersmtp.conf
index 92d942b6..29242a34 100644
--- a/config/filter.d/couriersmtp.conf
+++ b/config/filter.d/couriersmtp.conf
@@ -9,6 +9,6 @@
 
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile.
-# Values:  TEXT  Default:
+# Values:  TEXT
 #
 failregex = error,relay=(?:::f{4,6}:)?(?P<host>\S*),.*550 User unknown
diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf
index a226d28b..1fded787 100644
--- a/config/filter.d/postfix.conf
+++ b/config/filter.d/postfix.conf
@@ -9,6 +9,6 @@
 
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile.
-# Values:  TEXT  Default:
+# Values:  TEXT
 #
 failregex = reject: RCPT from (.*)\[(?P<host>\S*)\]: 554
diff --git a/config/filter.d/qmail.conf b/config/filter.d/qmail.conf
index 082f15cc..58c6bd05 100644
--- a/config/filter.d/qmail.conf
+++ b/config/filter.d/qmail.conf
@@ -9,6 +9,6 @@
 
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile.
-# Values:  TEXT  Default:
+# Values:  TEXT
 #
 failregex = (?:[\d,.]+[\d,.] rblsmtpd: |421 badiprbl: ip )(?P<host>\S*)
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 88b4cc50..92552674 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -9,7 +9,7 @@
 
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile.
-# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
+# Values:  TEXT
 #
 failregex = (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
 
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index 0c992359..0b7cd843 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -9,6 +9,6 @@
 
 # Option: failregex
 # Notes.: regex to match the password failures messages in the logfile.
-# Values: TEXT Default: Authentication failure|Failed password|Invalid user
+# Values: TEXT
 #
 failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S*)
diff --git a/config/jail.conf b/config/jail.conf
index ffb47fe7..c96dedb5 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -52,6 +52,17 @@ action   = hostsdeny
            mail-whois[name=SSH, dest=yourmail@mail.com]
 logpath  = /var/log/sshd.log
 
+# This jail demonstrates the use of wildcards in "logpath".
+# Moreover, it is possible to give other files on a new line.
+
+[apache-tcpwrapper]
+
+enabled  = false
+filter	 = apache-auth
+action   = hostsdeny
+logpath  = /var/log/apache*/*access.log
+           /home/www/myhomepage/access.log
+maxretry = 6
 
 # The hosts.deny path can be defined with the "file" argument if it is
 # not in /etc.

From 0f7502429ac61b2eedc852da700c32bccdc5b1fd Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 1 Oct 2006 21:20:42 +0000
Subject: [PATCH 355/549] - Added man page for fail2ban-regex

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@395 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 man/fail2ban-client.1   |  4 +-
 man/fail2ban-client.man | 94 -----------------------------------------
 man/fail2ban-regex.1    | 27 ++++++++++++
 man/fail2ban-regex.h2m  | 10 +++++
 man/fail2ban-server.1   |  6 +--
 man/fail2ban-server.h2m |  3 --
 man/generate-man        |  5 +++
 7 files changed, 46 insertions(+), 103 deletions(-)
 delete mode 100644 man/fail2ban-client.man
 create mode 100644 man/fail2ban-regex.1
 create mode 100644 man/fail2ban-regex.h2m

diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index eeddba8a..13abfd71 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "September 2006" "fail2ban-client v0.7.3" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "October 2006" "fail2ban-client v0.7.3-SVN" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH SYNOPSIS
 .B fail2ban-client
 [\fIOPTIONS\fR]... \fI<COMMAND>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.3 reads log file that contains password failure report
+Fail2Ban v0.7.3\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
diff --git a/man/fail2ban-client.man b/man/fail2ban-client.man
deleted file mode 100644
index c390c2f9..00000000
--- a/man/fail2ban-client.man
+++ /dev/null
@@ -1,94 +0,0 @@
-.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "September 2006" "fail2ban-client v0.7.2" "User Commands"
-.SH NAME
-fail2ban-client \- Ban IPs that make too many password failure
-.SH SYNOPSIS
-.B fail2ban-client
-[\fIOPTIONS\fR]... \fI<COMMAND>\fR
-.SH DESCRIPTION
-Fail2Ban v0.7.2 reads log file that contains password failure report
-and bans the corresponding IP addresses using firewall rules.
-.SH OPTIONS
-.TP
-\fB\-c\fR <DIR>
-configuration directory
-.TP
-\fB\-d\fR
-dump configuration. For debugging
-.TP
-\fB\-i\fR
-interactive mode
-.TP
-\fB\-v\fR
-increase verbosity
-.TP
-\fB\-q\fR
-decrease verbosity
-.TP
-\fB\-x\fR
-force execution of the server
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-display this help message
-.TP
-\fB\-V\fR, \fB\-\-version\fR
-print the version
-.SH COMMAND
-.SS "Command:"
-.TP
-start
-start the server and the jails
-.TP
-reload
-reload the configuration
-.TP
-stop
-stop all jails and terminate the server
-.TP
-status
-get the current status
-.TP
-set loglevel <LEVEL>
-set loglevel to <LEVEL>
-.TP
-get loglevel
-get loglevel
-.TP
-set logtarget <TARGET>
-set log target to <TARGET>
-.TP
-get logtarget
-get log target
-.TP
-add <JAIL>
-create <JAIL>
-.TP
-set <JAIL> <CMD>
-set the <CMD> value for <JAIL>
-.TP
-get <JAIL> <CMD>
-get the <CMD> value for <JAIL>
-.TP
-start <JAIL>
-start <JAIL>
-.TP
-stop <JAIL>
-stop <JAIL>. The jail is removed
-.TP
-status <JAIL>
-get the current status of <JAIL>
-.SH FILES
-\fI/etc/fail2ban/*\fR
-.SH AUTHOR
-Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
-Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
-.SH "REPORTING BUGS"
-Report bugs to <lostcontrol@users.sourceforge.net>
-.SH COPYRIGHT
-Copyright \(co 2004-2006 Cyril Jaquier
-.br
-Copyright of modifications held by their respective authors.
-Licensed under the GNU General Public License v2 (GPL).
-.SH "SEE ALSO"
-.br 
-fail2ban-server(1x)
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
new file mode 100644
index 00000000..5a80049a
--- /dev/null
+++ b/man/fail2ban-regex.1
@@ -0,0 +1,27 @@
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
+.TH FAIL2BAN-REGEX "1" "October 2006" "fail2ban-regex v0.7.3-SVN" "User Commands"
+.SH NAME
+fail2ban-regex \- test Fail2ban "failregex" option
+.SH SYNOPSIS
+.B fail2ban-regex
+\fI<logline> <failregex>\fR
+.SH DESCRIPTION
+Fail2Ban v0.7.3\-SVN reads log file that contains password failure report
+and bans the corresponding IP addresses using firewall rules.
+.PP
+This tools can test and benchmark your regular expressions for the "failregex"
+option.
+.SH AUTHOR
+Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
+Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
+.SH "REPORTING BUGS"
+Report bugs to <lostcontrol@users.sourceforge.net>
+.SH COPYRIGHT
+Copyright \(co 2004-2006 Cyril Jaquier
+.br
+Copyright of modifications held by their respective authors.
+Licensed under the GNU General Public License v2 (GPL).
+.SH "SEE ALSO"
+.br 
+fail2ban-client(1)
+fail2ban-server(1)
diff --git a/man/fail2ban-regex.h2m b/man/fail2ban-regex.h2m
new file mode 100644
index 00000000..dfbf9330
--- /dev/null
+++ b/man/fail2ban-regex.h2m
@@ -0,0 +1,10 @@
+Include file for help2man man page
+$Id:  $
+
+[name]
+fail2ban-regex \- test Fail2ban "failregex" option
+
+[see also]
+.br 
+fail2ban-client(1)
+fail2ban-server(1)
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index d70bff01..db9329c8 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "September 2006" "fail2ban-server v0.7.3" "User Commands"
+.TH FAIL2BAN-SERVER "1" "October 2006" "fail2ban-server v0.7.3-SVN" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.7.3 reads log file that contains password failure report
+Fail2Ban v0.7.3\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with
@@ -27,8 +27,6 @@ display this help message
 .TP
 \fB\-V\fR, \fB\-\-version\fR
 print the version
-.SH FILES
-\fI/etc/fail2ban/*\fR
 .SH AUTHOR
 Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
 Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
diff --git a/man/fail2ban-server.h2m b/man/fail2ban-server.h2m
index 3e856a51..260095ef 100644
--- a/man/fail2ban-server.h2m
+++ b/man/fail2ban-server.h2m
@@ -4,9 +4,6 @@ $Id:  $
 [name]
 fail2ban-server \- start the server
 
-[files]
-\fI/etc/fail2ban/*\fR
-
 [see also]
 .br 
 fail2ban-client(1)
diff --git a/man/generate-man b/man/generate-man
index c415e4ea..481999b3 100755
--- a/man/generate-man
+++ b/man/generate-man
@@ -13,3 +13,8 @@ echo -n "Generating fail2ban-server "
 help2man --section=1 --no-info --include=fail2ban-server.h2m --output fail2ban-server.1 ../fail2ban-server
 echo "[done]"
 
+# fail2ban-regex
+echo -n "Generating fail2ban-regex "
+help2man --section=1 --no-info --include=fail2ban-regex.h2m --output fail2ban-regex.1 ../fail2ban-regex
+echo "[done]"
+

From 4c315f36875adb12d2c505408f341f2be976d2a7 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 1 Oct 2006 21:22:01 +0000
Subject: [PATCH 356/549] - Moved ban/unban messages from "info" to "warn"
 level

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@396 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/actions.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/actions.py b/server/actions.py
index ead21b65..140f11a0 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -133,7 +133,7 @@ class Actions(JailThread):
 			bTicket = BanManager.createBanTicket(ticket)
 			aInfo["ip"] = bTicket.getIP()
 			aInfo["failures"] = bTicket.getAttempt()
-			logSys.info("Ban %s" % aInfo["ip"])
+			logSys.warn("Ban %s" % aInfo["ip"])
 			for action in self.__actions:
 				action.execActionBan(aInfo)
 			self.__banManager.addBanTicket(bTicket)
@@ -149,7 +149,7 @@ class Actions(JailThread):
 		for ticket in self.__banManager.unBanList(time.time()):
 			aInfo = dict()
 			aInfo["ip"] = ticket.getIP()
-			logSys.info("Unban %s" % aInfo["ip"])
+			logSys.warn("Unban %s" % aInfo["ip"])
 			for action in self.__actions:
 				action.execActionUnban(aInfo)
 	

From 040e47be5a98f7daa22242c02d918bf8db379f2f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 1 Oct 2006 21:22:27 +0000
Subject: [PATCH 357/549] - Added version and usage output

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@397 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-regex | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/fail2ban-regex b/fail2ban-regex
index 2f38d882..c8b42f8f 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -39,11 +39,37 @@ class Fail2banRegex:
 	def __init__(self):
 		self.__filter = Filter(None)
 	
+	def dispVersion(self):
+		print "Fail2Ban v" + version
+		print
+		print "Copyright (c) 2004-2006 Cyril Jaquier"
+		print "Copyright of modifications held by their respective authors."
+		print "Licensed under the GNU General Public License v2 (GPL)."
+		print
+		print "Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>."
+		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
+	
 	def dispUsage(self):
 		print "Usage: "+sys.argv[0]+" <logline> <failregex>"
 		print
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
+		print
+		print "This tools can test and benchmark your regular expressions for the \"failregex\""
+		print "option."
+		print
+		print "Report bugs to <lostcontrol@users.sourceforge.net>"
+	
+	def getCmdLineOptions(self, optList):
+		""" Gets the command line options
+		"""
+		for opt in optList:
+			if opt[0] in ["-h", "--help"]:
+	 			self.dispUsage()
+	 			sys.exit(0)
+	 		elif opt[0] in ["-V", "--version"]:
+	 			self.dispVersion()
+	 			sys.exit(0)
 	
 	def setRegex(self, value):
 		self.__filter.setFailRegex(value)
@@ -99,6 +125,17 @@ class Fail2banRegex:
 			
 if __name__ == "__main__":
 	regex = Fail2banRegex()
+	# Reads the command line options.
+	try:
+		cmdOpts = 'hV'
+		cmdLongOpts = ['help', 'version']
+		optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
+	except getopt.GetoptError:
+		regex.dispUsage()
+		sys.exit(-1)
+	# Process command line
+	regex.getCmdLineOptions(optList)
+	# We need exactly 3 parameters
 	if len(sys.argv) <> 3:
 		regex.dispUsage()
 		sys.exit(-1)

From b3ba5a81ced16b474563065bc3c916476047b46b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 1 Oct 2006 21:22:52 +0000
Subject: [PATCH 358/549] - Removed unused code

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@398 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-server | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/fail2ban-server b/fail2ban-server
index 2ce71212..41c0f4fb 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -97,14 +97,7 @@ class Fail2banServer:
 			if opt[0] in ["-V", "--version"]:
 	 			self.dispVersion()
 				sys.exit(0)
-	
-	#def sigTERMhandler(signum, frame):
-	#	""" Handles the TERM signal when in daemon mode in order to
-	#		exit properly.
-	#	"""
-	#	logSys.debug("Signal handler called with sig "+`signum`)
-	#	server.quit()
-	
+		
 	def start(self, argv):
 		# Command line options
 		self.__argv = argv

From 29a2b630e09a4a4f331c687b2fdfd4d791c01145 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 1 Oct 2006 21:23:22 +0000
Subject: [PATCH 359/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@399 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  | 8 +++++++-
 TODO       | 5 -----
 version.py | 2 +-
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 5a84ff0d..e9fac9e8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,15 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.3)                           2006/09/28
+Fail2Ban (version 0.7.4)                           2006/??/??
 =============================================================
 
+ver. 0.7.4 (2006/09/28) - beta
+----------
+- Improved configuration files. Thanks to Yaroslav Halchenko
+- Added man page for "fail2ban-regex"
+- Moved ban/unban messages from "info" level to "warn"
+
 ver. 0.7.3 (2006/09/28) - beta
 ----------
 - Added man pages. Thanks to Yaroslav Halchenko
diff --git a/TODO b/TODO
index 6a5e2760..203ac0a8 100644
--- a/TODO
+++ b/TODO
@@ -20,9 +20,6 @@ Legend:
 
 - Verify TAI64N
 
-# correct handling of threads (join???), concurrency, etc
-  protect "jails" in server.py
-
 - signal handling (ctrl-c, etc)
 
 # see Feature Request Tracking System at SourceForge.net
@@ -35,8 +32,6 @@ Legend:
 
 # better return values in function
 
-? use more email.Utils in mail.py
-
 ? add gettext support. Is this really needed for a server
   utility?
 
diff --git a/version.py b/version.py
index dcbedc39..1124e7e4 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.3"
+version = "0.7.3-SVN"

From f479b7155068ab482ef8ce084e2fe59470fdb212 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 1 Oct 2006 21:24:08 +0000
Subject: [PATCH 360/549] - Removed dummy.conf from build - Added
 fail2ban-regex and help2man files

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@400 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/MANIFEST b/MANIFEST
index de220d23..714f309f 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -57,10 +57,14 @@ config/filter.d/couriersmtp.conf
 config/filter.d/sshd.conf
 config/action.d/iptables.conf
 config/action.d/mail-whois.conf
-config/action.d/dummy.conf
 config/action.d/mail.conf
 config/action.d/hostsdeny.conf
 config/fail2ban.conf
 man/fail2ban-client.1
+man/fail2ban-client.h2m
 man/fail2ban-server.1
+man/fail2ban-server.h2m
+man/fail2ban-regex.1
+man/fail2ban-regex.h2m
+man/generate-man
 files/gentoo-initd

From 21b56bea33e506457aebb91f4541ef32b70528e5 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 1 Oct 2006 21:24:28 +0000
Subject: [PATCH 361/549] - Removed dummy.conf from install procedure

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@401 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 setup.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/setup.py b/setup.py
index 8cdbcde8..df480a2c 100755
--- a/setup.py
+++ b/setup.py
@@ -79,7 +79,6 @@ setup(
 							[
 								'config/action.d/iptables.conf',
 								'config/action.d/mail-whois.conf',
-								'config/action.d/dummy.conf',
 								'config/action.d/mail.conf',
 								'config/action.d/hostsdeny.conf'
 							]

From e39ef65e3a341f67c15a4f56c0f5bf344b082943 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 2 Oct 2006 13:42:36 +0000
Subject: [PATCH 362/549] added sections for sasl and proftpd authentications

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@402 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/proftpd.conf | 14 ++++++++++++++
 config/filter.d/sasl.conf    | 14 ++++++++++++++
 config/jail.conf             | 17 +++++++++++++++++
 3 files changed, 45 insertions(+)
 create mode 100644 config/filter.d/proftpd.conf
 create mode 100644 config/filter.d/sasl.conf

diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
new file mode 100644
index 00000000..3254e198
--- /dev/null
+++ b/config/filter.d/proftpd.conf
@@ -0,0 +1,14 @@
+# Fail2Ban configuration file
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision: 331 $
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = USER \S+: no such user found from \S* ?\[(?P<host>\S+)\] to \S+\s*$
diff --git a/config/filter.d/sasl.conf b/config/filter.d/sasl.conf
new file mode 100644
index 00000000..3a675fbd
--- /dev/null
+++ b/config/filter.d/sasl.conf
@@ -0,0 +1,14 @@
+# Fail2Ban configuration file
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision: 331 $
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = : warning: [-._\w]+\[(?P<host>[.\d]+)\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
diff --git a/config/jail.conf b/config/jail.conf
index c96dedb5..02c3576a 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -29,6 +29,23 @@ action   = iptables[name=SSH, port=ssh, protocol=tcp]
 logpath  = /var/log/sshd.log
 maxretry = 5
 
+[proftpd-iptables]
+
+enabled  = false
+filter   = proftpd
+action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
+           mail-whois[name=ProFTPD, dest=yourmail@mail.com]
+logpath  = /var/log/proftpd/proftpd.log
+maxretry = 6
+
+[sasl-iptables]
+
+enabled  = false
+filter   = sasl
+action   = iptables[name=sasl, port=smtp, protocol=tcp]
+           mail-whois[name=sasl, dest=yourmail@mail.com]
+logpath  = /var/log/mail.log
+
 # This one behaves like the previous and sends a report when the jail
 # is stopped.
 

From d231a8ca6f6d237b4833b4c745da416d549876ed Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 2 Oct 2006 21:15:32 +0000
Subject: [PATCH 363/549] - Added proftpd.conf and sasl.conf

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@403 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MANIFEST b/MANIFEST
index 714f309f..b6f79b54 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -55,6 +55,8 @@ config/filter.d/apache-auth.conf
 config/filter.d/qmail.conf
 config/filter.d/couriersmtp.conf
 config/filter.d/sshd.conf
+config/filter.d/proftpd.conf
+config/filter.d/sasl.conf
 config/action.d/iptables.conf
 config/action.d/mail-whois.conf
 config/action.d/mail.conf

From 033160eb96ed7fcf458c25c3446517aaf8c22032 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 2 Oct 2006 21:15:56 +0000
Subject: [PATCH 364/549] - Added jail name to ban/unban log

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@404 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/actions.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/server/actions.py b/server/actions.py
index 140f11a0..7b8f7a9f 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -133,7 +133,7 @@ class Actions(JailThread):
 			bTicket = BanManager.createBanTicket(ticket)
 			aInfo["ip"] = bTicket.getIP()
 			aInfo["failures"] = bTicket.getAttempt()
-			logSys.warn("Ban %s" % aInfo["ip"])
+			logSys.warn("[%s] Ban %s" % self.jail.getName(), aInfo["ip"])
 			for action in self.__actions:
 				action.execActionBan(aInfo)
 			self.__banManager.addBanTicket(bTicket)
@@ -149,7 +149,7 @@ class Actions(JailThread):
 		for ticket in self.__banManager.unBanList(time.time()):
 			aInfo = dict()
 			aInfo["ip"] = ticket.getIP()
-			logSys.warn("Unban %s" % aInfo["ip"])
+			logSys.warn("[%s] Unban %s" % self.jail.getName(), aInfo["ip"])
 			for action in self.__actions:
 				action.execActionUnban(aInfo)
 	
@@ -163,7 +163,7 @@ class Actions(JailThread):
 		for ticket in self.__banManager.flushBanList():
 			aInfo = dict()
 			aInfo["ip"] = ticket.getIP()
-			logSys.info("Unban %s" % aInfo["ip"])
+			logSys.warn("[%s] Unban %s" % self.jail.getName(), aInfo["ip"])
 			for action in self.__actions:
 				action.execActionUnban(aInfo)
 	

From 85293c63e419c4477454e8952242dd34c6bb7fb8 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 2 Oct 2006 21:23:48 +0000
Subject: [PATCH 365/549] - Fixed format string

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@405 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/actions.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/server/actions.py b/server/actions.py
index 7b8f7a9f..7e604703 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -133,7 +133,7 @@ class Actions(JailThread):
 			bTicket = BanManager.createBanTicket(ticket)
 			aInfo["ip"] = bTicket.getIP()
 			aInfo["failures"] = bTicket.getAttempt()
-			logSys.warn("[%s] Ban %s" % self.jail.getName(), aInfo["ip"])
+			logSys.warn("[%s] Ban %s" % (self.jail.getName(), aInfo["ip"]))
 			for action in self.__actions:
 				action.execActionBan(aInfo)
 			self.__banManager.addBanTicket(bTicket)
@@ -149,7 +149,7 @@ class Actions(JailThread):
 		for ticket in self.__banManager.unBanList(time.time()):
 			aInfo = dict()
 			aInfo["ip"] = ticket.getIP()
-			logSys.warn("[%s] Unban %s" % self.jail.getName(), aInfo["ip"])
+			logSys.warn("[%s] Unban %s" % (self.jail.getName(), aInfo["ip"]))
 			for action in self.__actions:
 				action.execActionUnban(aInfo)
 	
@@ -163,7 +163,7 @@ class Actions(JailThread):
 		for ticket in self.__banManager.flushBanList():
 			aInfo = dict()
 			aInfo["ip"] = ticket.getIP()
-			logSys.warn("[%s] Unban %s" % self.jail.getName(), aInfo["ip"])
+			logSys.warn("[%s] Unban %s" % (self.jail.getName(), aInfo["ip"]))
 			for action in self.__actions:
 				action.execActionUnban(aInfo)
 	

From 7989e662702c2c6897cf078e2a7e7346e6729872 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 4 Oct 2006 22:17:53 +0000
Subject: [PATCH 366/549] - Added "-s" option to specify the socket path -
 Modified the server server/socket/transmitter design

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@406 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG             |  1 +
 client/csocket.py     |  5 ++---
 fail2ban-client       | 22 ++++++++++++----------
 fail2ban-server       |  8 ++++++--
 man/fail2ban-client.1 |  3 +++
 man/fail2ban-server.1 |  3 +++
 server/server.py      | 15 ++++++++++++---
 server/ssocket.py     | 17 +++++++++--------
 server/transmitter.py | 29 -----------------------------
 9 files changed, 48 insertions(+), 55 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index e9fac9e8..4dfe51c4 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -12,6 +12,7 @@ ver. 0.7.4 (2006/09/28) - beta
 - Improved configuration files. Thanks to Yaroslav Halchenko
 - Added man page for "fail2ban-regex"
 - Moved ban/unban messages from "info" level to "warn"
+- Added "-s" option to specify the socket path
 
 ver. 0.7.3 (2006/09/28) - beta
 ----------
diff --git a/client/csocket.py b/client/csocket.py
index 4ab3da80..33477ecf 100644
--- a/client/csocket.py
+++ b/client/csocket.py
@@ -30,14 +30,13 @@ import socket
 class CSocket:
 	
 	END_STRING = "<F2B_END_COMMAND>"
-	SOCKET_FILE = "/tmp/fail2ban.sock"
 	
-	def __init__(self):
+	def __init__(self, sock = "/tmp/fail2ban.sock"):
 		# Create an INET, STREAMing socket
 		#self.csock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 		self.__csock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
 		#self.csock.connect(("localhost", 2222))
-		self.__csock.connect(CSocket.SOCKET_FILE)
+		self.__csock.connect(sock)
 	
 	def send(self, msg):
 		# Convert every list member to string
diff --git a/fail2ban-client b/fail2ban-client
index 450f5cf4..fdb6da39 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -58,6 +58,7 @@ class Fail2banClient:
 		self.__conf["force"] = False
 		self.__conf["verbose"] = 2
 		self.__conf["interactive"] = False
+		self.__conf["socket"] = "/tmp/fail2ban.sock"
 		
 	def dispVersion(self):
 		print "Fail2Ban v" + version
@@ -79,6 +80,7 @@ class Fail2banClient:
 		print
 		print "Options:"
 		print "    -c <DIR>                configuration directory"
+		print "    -s <FILE>               socket path"
 		print "    -d                      dump configuration. For debugging"
 		print "    -i                      interactive mode"
 		print "    -v                      increase verbosity"
@@ -118,6 +120,8 @@ class Fail2banClient:
 		for opt in optList:
 			if opt[0] == "-c":
 				self.__conf["conf"] = opt[1]
+			elif opt[0] == "-s":
+				self.__conf["socket"] = opt[1]
 			elif opt[0] == "-d":
 				self.__conf["dump"] = True
 			elif opt[0] == "-v":
@@ -136,15 +140,14 @@ class Fail2banClient:
 	 			sys.exit(0)
 	
 	def __ping(self):
-		return self.processCmd([["ping"]], False)
+		return self.__processCmd([["ping"]], False)
 	
-	@staticmethod
-	def processCmd(cmd, showRet = True):
+	def __processCmd(self, cmd, showRet = True):
 		beautifier = Beautifier()
 		for c in cmd:
 			beautifier.setInputCmd(c)
 			try:
-				client = CSocket()
+				client = CSocket(self.__conf["socket"])
 				ret = client.send(c)
 				if ret[0] == 0:
 					logSys.debug("OK : " + `ret[1]`)
@@ -183,7 +186,7 @@ class Fail2banClient:
 					# Wait for the server to start
 					self.__waitOnServer()
 					# Configure the server
-					self.processCmd(self.__stream, False)
+					self.__processCmd(self.__stream, False)
 					return True
 				except ServerExecutionException:
 					logSys.error("Could not start server. Try -x option")
@@ -191,14 +194,14 @@ class Fail2banClient:
 		elif len(cmd) == 1 and cmd[0] == "reload":
 			if self.__ping():
 				self.__readConfig()
-				self.processCmd([['stop', 'all']], False)
+				self.__processCmd([['stop', 'all']], False)
 				# Configure the server
-				return self.processCmd(self.__stream, False)
+				return self.__processCmd(self.__stream, False)
 			else:
 				logSys.error("Could not find server")
 				return False
 		else:
-			return self.processCmd([cmd])
+			return self.__processCmd([cmd])
 	
 	
 	##
@@ -244,7 +247,7 @@ class Fail2banClient:
 		
 		# Reads the command line options.
 		try:
-			cmdOpts = 'hc:xdviqV'
+			cmdOpts = 'hc:s:xdviqV'
 			cmdLongOpts = ['help', 'version']
 			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
@@ -327,4 +330,3 @@ if __name__ == "__main__":
 		sys.exit(0)
 	else:
 		sys.exit(-1)
-
diff --git a/fail2ban-server b/fail2ban-server
index 41c0f4fb..c7877971 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -50,6 +50,7 @@ class Fail2banServer:
 		self.__conf = dict()
 		self.__conf["background"] = True
 		self.__conf["force"] = False
+		self.__conf["socket"] = "/tmp/fail2ban.sock"
 	
 	def dispVersion(self):
 		print "Fail2Ban v" + version
@@ -75,6 +76,7 @@ class Fail2banServer:
 		print "Options:"
 		print "  -b             start in background"
 		print "  -f             start in foreground"
+		print "  -s <FILE>      socket path"
 		print "  -x             force execution of the server"
 		print "  -h, --help     display this help message"
 		print "  -V, --version  print the version"
@@ -89,6 +91,8 @@ class Fail2banServer:
 				self.__conf["background"] = True
 			if opt[0] == "-f":
 				self.__conf["background"] = False
+			if opt[0] == "-s":
+				self.__conf["socket"] = opt[1]
 			if opt[0] == "-x":
 				self.__conf["force"] = True
 			if opt[0] in ["-h", "--help"]:
@@ -104,7 +108,7 @@ class Fail2banServer:
 		
 		# Reads the command line options.
 		try:
-			cmdOpts = 'bfxhV'
+			cmdOpts = 'bfs:xhV'
 			cmdLongOpts = ['help', 'version']
 			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
@@ -114,7 +118,7 @@ class Fail2banServer:
 		
 		try:
 			self.__server = Server(self.__conf["background"])
-			self.__server.start(self.__conf["force"])
+			self.__server.start(self.__conf["socket"], self.__conf["force"])
 			return True
 		except Exception, e:
 			print e
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 13abfd71..6833de5d 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -13,6 +13,9 @@ and bans the corresponding IP addresses using firewall rules.
 \fB\-c\fR <DIR>
 configuration directory
 .TP
+\fB\-s\fR <FILE>
+socket path
+.TP
 \fB\-d\fR
 dump configuration. For debugging
 .TP
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index db9329c8..bcdcc0dd 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -19,6 +19,9 @@ start in background
 \fB\-f\fR
 start in foreground
 .TP
+\fB\-s\fR <FILE>
+socket path
+.TP
 \fB\-x\fR
 force execution of the server
 .TP
diff --git a/server/server.py b/server/server.py
index 932d8e86..fb035eb5 100644
--- a/server/server.py
+++ b/server/server.py
@@ -26,6 +26,8 @@ __license__ = "GPL"
 
 from jails import Jails
 from transmitter import Transmitter
+from ssocket import SSocket
+from ssocket import SSocketErrorException
 import logging, logging.handlers, sys, os, signal
 
 # Gets the instance of the logger.
@@ -37,13 +39,14 @@ class Server:
 		self.__jails = Jails()
 		self.__daemon = daemon
 		self.__transm = Transmitter(self)
+		self.__socket = SSocket(self.__transm)
 		self.__logLevel = 3
 		self.__logTarget = "STDOUT"
 		# Set logging level
 		self.setLogLevel(self.__logLevel)
 		self.setLogTarget(self.__logTarget)
 	
-	def start(self, force):
+	def start(self, sock, force = False):
 		logSys.info("Starting Fail2ban")
 		# First set the mask to only allow access to owner
 		os.umask(0077)
@@ -56,12 +59,18 @@ class Server:
 				raise ServerInitializationError("Could not create daemon")
 		# Start the communication
 		logSys.debug("Starting communication")
-		self.__transm.start(force)
+		try:
+			self.__socket.initialize(sock, force)
+			self.__socket.start()
+			self.__socket.join()
+		except SSocketErrorException:
+			logSys.error("Could not start server")
 		logSys.info("Exiting Fail2ban")
 	
 	def quit(self):
 		self.stopAllJail()
-		self.__transm.stop()
+		# Stop communication
+		self.__socket.stop()
 	
 	def addJail(self, name):
 		self.__jails.add(name)
diff --git a/server/ssocket.py b/server/ssocket.py
index 59d0c5e9..26511d29 100644
--- a/server/ssocket.py
+++ b/server/ssocket.py
@@ -34,21 +34,22 @@ logSys = logging.getLogger("fail2ban.comm")
 class SSocket(Thread):
 	
 	END_STRING = "<F2B_END_COMMAND>"
-	SOCKET_FILE = "/tmp/fail2ban.sock"
 	
 	def __init__(self, transmitter):
 		Thread.__init__(self)
 		self.__transmit = transmitter
 		self.__isRunning = False
+		self.__socket = "/tmp/fail2ban.sock"
 		logSys.debug("Created SSocket")
 	
-	def initialize(self, force = False):
+	def initialize(self, sock = "/tmp/fail2ban.sock", force = False):
+		self.__socket = sock
 		# Remove socket
-		if os.path.exists(SSocket.SOCKET_FILE):
+		if os.path.exists(sock):
 			logSys.error("Fail2ban seems to be already running")
 			if force:
 				logSys.warn("Forcing execution of the server")
-				os.remove(SSocket.SOCKET_FILE)
+				os.remove(sock)
 			else:
 				raise SSocketErrorException("Server already running")
 		# Create an INET, STREAMing socket
@@ -62,7 +63,7 @@ class SSocket(Thread):
 		self.ssock.settimeout(1)
 		# Bind the socket to a public host and a well-known port
 		#self.ssock.bind(("localhost", 2222))
-		self.ssock.bind(SSocket.SOCKET_FILE)
+		self.ssock.bind(sock)
 		# Become a server socket
 		self.ssock.listen(5)
 	
@@ -78,9 +79,9 @@ class SSocket(Thread):
 				pass
 		self.ssock.close()
 		# Remove socket
-		if os.path.exists(SSocket.SOCKET_FILE):
-			logSys.debug("Removed socket file " + SSocket.SOCKET_FILE)
-			os.remove(SSocket.SOCKET_FILE)
+		if os.path.exists(self.__socket):
+			logSys.debug("Removed socket file " + self.__socket)
+			os.remove(self.__socket)
 		logSys.debug("Socket shutdown")
 		return True
 	
diff --git a/server/transmitter.py b/server/transmitter.py
index 8740fa55..a326fccf 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -24,8 +24,6 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from ssocket import SSocket
-from ssocket import SSocketErrorException
 from threading import Lock
 import logging, time
 
@@ -37,33 +35,6 @@ class Transmitter:
 	def __init__(self, server):
 		self.__lock = Lock()
 		self.__server = server
-		self.__socket = SSocket(self)
-	
-	##
-	# Start the transmittion server.
-	#
-	# This function wait for the socket thread.
-	
-	def start(self, force):
-		try:
-			self.__lock.acquire()
-			self.__socket.initialize(force)
-			self.__socket.start()
-			self.__lock.release()
-			self.__socket.join()
-		except SSocketErrorException:
-			logSys.error("Could not start server")
-			self.__lock.release()
-	
-	##
-	# Stop the transmitter.
-	#
-	# @bug Fix the issue with join(). When using servertestcase.py, errors
-	# happen which disappear when using join() in this function.
-	
-	def stop(self):
-		self.__socket.stop()
-		self.__socket.join()
 		
 	def proceed(self, action):
 		# Deserialize object

From c8fdabf0018dfdad30f0f935fcfd266affbe19e5 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 9 Oct 2006 18:05:13 +0000
Subject: [PATCH 367/549] - Added "socket" option in "fail2ban.conf"

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@407 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                |  3 ++-
 client/configurator.py   |  8 +++++++-
 client/fail2banreader.py |  4 ++++
 fail2ban-client          | 23 ++++++++++++++++-------
 4 files changed, 29 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 4dfe51c4..148b8d4d 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -12,7 +12,8 @@ ver. 0.7.4 (2006/09/28) - beta
 - Improved configuration files. Thanks to Yaroslav Halchenko
 - Added man page for "fail2ban-regex"
 - Moved ban/unban messages from "info" level to "warn"
-- Added "-s" option to specify the socket path
+- Added "-s" option to specify the socket path and "socket"
+  option in "fail2ban.conf"
 
 ver. 0.7.3 (2006/09/28) - beta
 ----------
diff --git a/client/configurator.py b/client/configurator.py
index 4802dd52..b59f5192 100644
--- a/client/configurator.py
+++ b/client/configurator.py
@@ -46,9 +46,15 @@ class Configurator:
 	def getBaseDir(self):
 		return ConfigReader.getBaseDir()
 	
-	def readAll(self):
+	def readEarly(self):
 		self.__fail2ban.read()
+	
+	def readAll(self):
+		self.readEarly()
 		self.__jails.read()
+		
+	def getEarlyOptions(self):
+		return self.__fail2ban.getEarlyOptions()
 	
 	def getAllOptions(self):
 		self.__settings["general"] = self.__fail2ban.getOptions()
diff --git a/client/fail2banreader.py b/client/fail2banreader.py
index e8242cf4..99bc522e 100644
--- a/client/fail2banreader.py
+++ b/client/fail2banreader.py
@@ -38,6 +38,10 @@ class Fail2banReader(ConfigReader):
 	def read(self):
 		ConfigReader.read(self, "fail2ban")
 	
+	def getEarlyOptions(self):
+		opts = [["string", "socket", "/tmp/fail2ban.sock"]]
+		return ConfigReader.getOptions(self, "Definition", opts)
+	
 	def getOptions(self):
 		opts = [["int", "loglevel", 1],
 				["string", "logtarget", "STDERR"]]
diff --git a/fail2ban-client b/fail2ban-client
index fdb6da39..fd88d6e1 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -52,13 +52,14 @@ class Fail2banClient:
 	def __init__(self):
 		self.__argv = None
 		self.__stream = None
+		self.__configurator = Configurator()
 		self.__conf = dict()
 		self.__conf["conf"] = "/etc/fail2ban"
 		self.__conf["dump"] = False
 		self.__conf["force"] = False
 		self.__conf["verbose"] = 2
 		self.__conf["interactive"] = False
-		self.__conf["socket"] = "/tmp/fail2ban.sock"
+		self.__conf["socket"] = None
 		
 	def dispVersion(self):
 		print "Fail2Ban v" + version
@@ -273,6 +274,16 @@ class Fail2banClient:
 		stdout.setFormatter(formatter)
 		logSys.addHandler(stdout)
 
+		# Set the configuration path
+		self.__configurator.setBaseDir(self.__conf["conf"])
+		
+		# Set socket path
+		self.__configurator.readEarly()
+		socket = self.__configurator.getEarlyOptions()
+		if self.__conf["socket"] == None:
+			self.__conf["socket"] = socket["socket"]
+		logSys.warn("Using socket file " + self.__conf["socket"])
+
 		if self.__conf["dump"]:
 			self.__readConfig()
 			self.dumpConfig(self.__stream)
@@ -306,12 +317,10 @@ class Fail2banClient:
 
 	def __readConfig(self):
 		# Read the configuration
-		cfg = Configurator()
-		cfg.setBaseDir(self.__conf["conf"])
-		cfg.readAll()
-		cfg.getAllOptions()
-		cfg.convertToProtocol()
-		self.__stream = cfg.getConfigStream()
+		self.__configurator.readAll()
+		self.__configurator.getAllOptions()
+		self.__configurator.convertToProtocol()
+		self.__stream = self.__configurator.getConfigStream()
 	
 	@staticmethod
 	def dumpConfig(cmd):

From e28fec6d5d3ed3474b7ef9869beed9708b45f56d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 14 Oct 2006 14:35:46 +0000
Subject: [PATCH 368/549] - Added Fedora/RedHat initd script. Thanks to Tyler

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@408 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST           |  1 +
 README             |  2 +-
 files/redhat-initd | 89 ++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 91 insertions(+), 1 deletion(-)
 create mode 100644 files/redhat-initd

diff --git a/MANIFEST b/MANIFEST
index b6f79b54..18a11609 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -70,3 +70,4 @@ man/fail2ban-regex.1
 man/fail2ban-regex.h2m
 man/generate-man
 files/gentoo-initd
+files/redhat-initd
diff --git a/README b/README
index 7afd0717..4e4a3c8f 100644
--- a/README
+++ b/README
@@ -96,7 +96,7 @@ Thanks:
 Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
 Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
 Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
-Edgington, Patrick Börjesson, kojiro, zugeschmiert
+Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler
 
 License:
 --------
diff --git a/files/redhat-initd b/files/redhat-initd
new file mode 100644
index 00000000..0dfd0d2c
--- /dev/null
+++ b/files/redhat-initd
@@ -0,0 +1,89 @@
+#!/bin/bash
+#
+# chkconfig: 345 92 08
+# description: Fail2ban daemon
+#              http://fail2ban.sourceforge.net/wiki/index.php/Main_Page
+# process name: fail2ban-server
+#
+#
+# Author: Tyler Owen
+#
+
+# Source function library.
+. /etc/init.d/functions
+
+# Check that the config file exists
+[ -f /etc/fail2ban/fail2ban.conf ] || exit 0
+
+FAIL2BAN="/usr/bin/fail2ban-client"
+
+RETVAL=0
+
+getpid() {
+        #pid=`ps -ef | grep fail2ban-|grep -v grep|grep -v bash|awk '{print $2}'`
+        pid=`ps -ef | grep fail2ban-|grep -v grep|awk '{print $2}'`
+}
+
+start() {
+    echo -n $"Starting fail2ban: "
+    getpid
+    if [ -z "$pid"]; then
+        $FAIL2BAN start > /dev/null
+        RETVAL=$?
+    fi
+    if [ $RETVAL -eq 0 ]; then
+        touch /var/lock/subsys/fail2ban
+        echo_success
+    else
+        echo_failure
+    fi
+    echo
+    return $RETVAL
+}
+
+stop() {
+    echo -n $"Stopping fail2ban: "
+    getpid
+    RETVAL=$?
+    if [ -n "$pid" ]; then
+        $FAIL2BAN stop > /dev/null
+    fi
+    getpid
+    if [ -z "$pid" ]; then
+        rm -f /var/lock/subsys/fail2ban
+        echo_success
+    else
+        echo_failure
+    fi
+    echo
+    return $RETVAL
+}
+
+# See how we were called.
+case "$1" in
+  start)
+        start
+        ;;
+  stop)
+        stop
+        ;;
+  status)
+        getpid
+        if [ -n "$pid" ]; then
+                echo "Fail2ban (pid $pid) is running..."
+        else
+                RETVAL=1
+                echo "Fail2ban is stopped"
+        fi
+        ;;
+  restart)
+        start
+        stop
+        ;;
+  *)
+        echo $"Usage: $0 {start|stop|status|restart}"
+        exit 1
+        ;;
+esac
+
+exit $RETVAL

From 0fab1bbf01c76edfaae5f42705c867aedb43ae84 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 16 Oct 2006 19:42:50 +0000
Subject: [PATCH 369/549] - Added "backend" option

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@409 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG             |  3 ++-
 client/jailreader.py  |  6 +++++-
 server/jail.py        | 42 +++++++++++++++++++++---------------------
 server/jails.py       |  4 ++--
 server/server.py      |  4 ++--
 server/transmitter.py |  6 +++++-
 6 files changed, 37 insertions(+), 28 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 148b8d4d..368e85fd 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,13 +7,14 @@
 Fail2Ban (version 0.7.4)                           2006/??/??
 =============================================================
 
-ver. 0.7.4 (2006/09/28) - beta
+ver. 0.7.4 (2006/??/??) - beta
 ----------
 - Improved configuration files. Thanks to Yaroslav Halchenko
 - Added man page for "fail2ban-regex"
 - Moved ban/unban messages from "info" level to "warn"
 - Added "-s" option to specify the socket path and "socket"
   option in "fail2ban.conf"
+- Added "backend" option in "jail.conf"
 
 ver. 0.7.3 (2006/09/28) - beta
 ----------
diff --git a/client/jailreader.py b/client/jailreader.py
index b5a36bdd..35510749 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -58,6 +58,7 @@ class JailReader(ConfigReader):
 	def getOptions(self):
 		opts = [["bool", "enabled", "false"],
 				["string", "logpath", "/var/log/messages"],
+				["string", "backend", "auto"],
 				["int", "maxretry", 3],
 				["int", "maxtime", 600],
 				["int", "bantime", 600],
@@ -94,7 +95,7 @@ class JailReader(ConfigReader):
 		return True
 	
 	def convert(self):
-		stream = [["add", self.__name]]
+		stream = []
 		for opt in self.__opts:
 			if opt == "logpath":
 				for path in self.__opts[opt].split("\n"):
@@ -103,6 +104,8 @@ class JailReader(ConfigReader):
 						logSys.error("No file found for " + path)
 					for p in pathList:
 						stream.append(["set", self.__name, "addlogpath", p])
+			elif opt == "backend":
+				backend = self.__opts[opt]
 			elif opt == "maxretry":
 				stream.append(["set", self.__name, "maxretry", self.__opts[opt]])
 			elif opt == "ignoreip":
@@ -114,6 +117,7 @@ class JailReader(ConfigReader):
 		stream.extend(self.__filter.convert())
 		for action in self.__actions:
 			stream.extend(action.convert())
+		stream.insert(0, ["add", self.__name, backend])
 		return stream
 	
 	@staticmethod
diff --git a/server/jail.py b/server/jail.py
index 38035b79..bdbc0f41 100644
--- a/server/jail.py
+++ b/server/jail.py
@@ -34,21 +34,31 @@ logSys = logging.getLogger("fail2ban.jail")
 
 class Jail:
 	
-	def __init__(self, name):
+	def __init__(self, name, backend = "auto"):
 		self.__lock = Lock()
 		self.__name = name
 		self.__queue = Queue.Queue()
-		try:
-			import gamin
-			logSys.info("Gamin available. Using it instead of poller")
-			from filtergamin import FilterGamin
-			self.__filter = FilterGamin(self)
-		except ImportError:
-			logSys.info("Gamin not available. Using poller")
-			from filterpoll import FilterPoll
-			self.__filter = FilterPoll(self)
+		self.__filter = None
+		if backend == "polling":
+			self.__initPoller()
+		else:
+			try:
+				self.__initGamin()
+			except ImportError:
+				self.__initPoller()
 		self.__action = Actions(self)
 	
+	def __initPoller(self):
+		logSys.info("Using poller")
+		from filterpoll import FilterPoll
+		self.__filter = FilterPoll(self)
+	
+	def __initGamin(self):
+		import gamin
+		logSys.info("Using Gamin")
+		from filtergamin import FilterGamin
+		self.__filter = FilterGamin(self)
+	
 	def setName(self, name):
 		self.__lock.acquire()
 		self.__name = name
@@ -61,11 +71,6 @@ class Jail:
 		finally:
 			self.__lock.release()
 	
-	def setFilter(self, filter):
-		self.__lock.acquire()
-		self.__filter = filter
-		self.__lock.release()
-	
 	def getFilter(self):
 		try:
 			self.__lock.acquire()
@@ -73,11 +78,6 @@ class Jail:
 		finally:
 			self.__lock.release()
 	
-	def setAction(self, action):
-		self.__lock.acquire()
-		self.__action = action
-		self.__lock.release()
-	
 	def getAction(self):
 		try:
 			self.__lock.acquire()
@@ -141,7 +141,7 @@ class Jail:
 			self.__lock.acquire()
 			fStatus = self.__filter.status()
 			aStatus = self.__action.status()
-			ret = [("filter", fStatus),
+			ret = [("filter", fStatus), 
 				   ("action", aStatus)]
 			return ret
 		finally:
diff --git a/server/jails.py b/server/jails.py
index b4dbb4ed..8ae2ab67 100644
--- a/server/jails.py
+++ b/server/jails.py
@@ -34,13 +34,13 @@ class Jails:
 		self.__lock = Lock()
 		self.__jails = dict()
 	
-	def add(self, name):
+	def add(self, name, backend):
 		self.__lock.acquire()
 		if self.__jails.has_key(name):
 			self.__lock.release()
 			raise DuplicateJailException(name)
 		else:
-			self.__jails[name] = Jail(name)
+			self.__jails[name] = Jail(name, backend)
 			self.__lock.release()
 	
 	def remove(self, name):
diff --git a/server/server.py b/server/server.py
index fb035eb5..ce495989 100644
--- a/server/server.py
+++ b/server/server.py
@@ -72,8 +72,8 @@ class Server:
 		# Stop communication
 		self.__socket.stop()
 	
-	def addJail(self, name):
-		self.__jails.add(name)
+	def addJail(self, name, backend):
+		self.__jails.add(name, backend)
 		
 	def delJail(self, name):
 		self.__jails.remove(name)
diff --git a/server/transmitter.py b/server/transmitter.py
index a326fccf..64ad3919 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -63,7 +63,11 @@ class Transmitter:
 			name = action[1]
 			if name == "all":
 				raise Exception("Reserved name")
-			self.__server.addJail(name)
+			try:
+				backend = action[2]
+			except IndexError:
+				backend = "auto"
+			self.__server.addJail(name, backend)
 			return name
 		elif action[0] == "start":
 			name = action[1]

From 50e4eb6395deef0a88d1574fb5d785842f29bfd5 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 16 Oct 2006 19:47:47 +0000
Subject: [PATCH 370/549] - Modified Doxygen settings

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@410 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 doc/Doxyfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/Doxyfile b/doc/Doxyfile
index 94725a96..1c571f36 100644
--- a/doc/Doxyfile
+++ b/doc/Doxyfile
@@ -233,7 +233,7 @@ EXTRACT_ALL            = YES
 # If the EXTRACT_PRIVATE tag is set to YES all private members of a class 
 # will be included in the documentation.
 
-EXTRACT_PRIVATE        = YES
+EXTRACT_PRIVATE        = NO
 
 # If the EXTRACT_STATIC tag is set to YES all static members of a file 
 # will be included in the documentation.

From ebae6d70aa0667724e975d81a73227b327732ed4 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 17 Oct 2006 19:05:27 +0000
Subject: [PATCH 371/549] - Added "apache-noscript" filter. Thanks to Pander

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@411 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST                             |  1 +
 config/filter.d/apache-noscript.conf | 14 ++++++++++++++
 setup.py                             |  3 +++
 3 files changed, 18 insertions(+)
 create mode 100644 config/filter.d/apache-noscript.conf

diff --git a/MANIFEST b/MANIFEST
index 18a11609..8471b676 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -52,6 +52,7 @@ config/jail.conf
 config/filter.d/postfix.conf
 config/filter.d/vsftpd.conf
 config/filter.d/apache-auth.conf
+config/filter.d/apache-noscript.conf
 config/filter.d/qmail.conf
 config/filter.d/couriersmtp.conf
 config/filter.d/sshd.conf
diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
new file mode 100644
index 00000000..1d366045
--- /dev/null
+++ b/config/filter.d/apache-noscript.conf
@@ -0,0 +1,14 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 394 $
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile.
+# Values:  TEXT
+#
+failregex = [[]client (?P<host>\S*)[]] File does not exist: .*(\.php|\.asp)
diff --git a/setup.py b/setup.py
index df480a2c..588dfc7c 100755
--- a/setup.py
+++ b/setup.py
@@ -69,6 +69,9 @@ setup(
 							[
 								'config/filter.d/vsftpd.conf',
 								'config/filter.d/apache-auth.conf',
+								'config/filter.d/apache-noscript.conf',
+								'config/filter.d/proftpd.conf',
+								'config/filter.d/sasl.conf',
 								'config/filter.d/sshd.conf',
 								'config/filter.d/couriersmtp.conf',
 								'config/filter.d/postfix.conf',

From 9a96428bd2e989993d5e7a39737da90f9fad00fe Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 17 Oct 2006 21:12:22 +0000
Subject: [PATCH 372/549] - Added "socket" option

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@412 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/fail2ban.conf | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/config/fail2ban.conf b/config/fail2ban.conf
index d3b91464..90439d0c 100644
--- a/config/fail2ban.conf
+++ b/config/fail2ban.conf
@@ -22,3 +22,11 @@ loglevel = 3
 # Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
 #
 logtarget = /var/log/fail2ban.log
+
+# Option: socket
+# Notes.: Set the socket file. This is used to communication with the
+#         daemon.
+# Values: FILE  Default:  /tmp/fail2ban.sock
+#
+socket = /tmp/fail2ban.sock
+

From 15a4634c3802dc00a087e757025291fac4b267bb Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 17 Oct 2006 21:13:11 +0000
Subject: [PATCH 373/549] - Added "shorewall" action - Use glob in setup.py

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@413 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                      |  1 +
 MANIFEST                       |  1 +
 config/action.d/shorewall.conf | 47 ++++++++++++++++++++++++++++++++++
 config/jail.conf               | 17 ++++++++++++
 setup.py                       | 25 +++---------------
 5 files changed, 70 insertions(+), 21 deletions(-)
 create mode 100644 config/action.d/shorewall.conf

diff --git a/CHANGELOG b/CHANGELOG
index 368e85fd..640637a0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -15,6 +15,7 @@ ver. 0.7.4 (2006/??/??) - beta
 - Added "-s" option to specify the socket path and "socket"
   option in "fail2ban.conf"
 - Added "backend" option in "jail.conf"
+- Added more filters/actions and jail samples
 
 ver. 0.7.3 (2006/09/28) - beta
 ----------
diff --git a/MANIFEST b/MANIFEST
index 8471b676..3a93f473 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -62,6 +62,7 @@ config/action.d/iptables.conf
 config/action.d/mail-whois.conf
 config/action.d/mail.conf
 config/action.d/hostsdeny.conf
+config/action.d/shorewall.conf
 config/fail2ban.conf
 man/fail2ban-client.1
 man/fail2ban-client.h2m
diff --git a/config/action.d/shorewall.conf b/config/action.d/shorewall.conf
new file mode 100644
index 00000000..984f91b2
--- /dev/null
+++ b/config/action.d/shorewall.conf
@@ -0,0 +1,47 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 394 $
+#
+
+[Definition]
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = 
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = 
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = shorewall reject <ip>
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+#
+actionunban = shorewall allow <ip>
diff --git a/config/jail.conf b/config/jail.conf
index 02c3576a..3716d783 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -15,6 +15,10 @@ ignoreip = 127.0.0.1
 bantime  = 600
 maxretry = 3
 
+# "backend" specifies the backend used to get files modification. Available
+# options are "gamin", "polling" and "auto".
+backend = auto
+
 
 # This jail corresponds to the standard configuration in Fail2ban 0.6.
 # The mail-whois action send a notification e-mail with a whois request
@@ -38,10 +42,13 @@ action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
 logpath  = /var/log/proftpd/proftpd.log
 maxretry = 6
 
+# This jail forces the backend to "polling".
+
 [sasl-iptables]
 
 enabled  = false
 filter   = sasl
+backend  = polling
 action   = iptables[name=sasl, port=smtp, protocol=tcp]
            mail-whois[name=sasl, dest=yourmail@mail.com]
 logpath  = /var/log/mail.log
@@ -104,3 +111,13 @@ action   = mail-whois[name=VSFTPD, dest=yourmail@mail.com]
 logpath  = /var/log/vsftpd.log
 maxretry = 5
 bantime  = 1800
+
+# Use shorewall instead of iptables.
+
+[apache-shorewall]
+
+enabled  = false
+filter   = apache-noscript
+action   = shorewall
+           mail[name=Postfix, dest=yourmail@mail.com]
+logpath  = /var/log/apache2/error_log
diff --git a/setup.py b/setup.py
index 588dfc7c..b9896166 100755
--- a/setup.py
+++ b/setup.py
@@ -30,6 +30,7 @@ from distutils.core import setup
 from version import version
 from os.path import isfile, join
 from sys import exit, argv
+from glob import glob
 
 longdesc = '''
 Fail2Ban scans log files like /var/log/pwdfail or
@@ -60,31 +61,13 @@ setup(
 				],
 	data_files =	[
 						('/etc/fail2ban',
-							[
-								'config/fail2ban.conf',
-								'config/jail.conf'
-							]
+							glob("config/*.conf")
 						),
 						('/etc/fail2ban/filter.d',
-							[
-								'config/filter.d/vsftpd.conf',
-								'config/filter.d/apache-auth.conf',
-								'config/filter.d/apache-noscript.conf',
-								'config/filter.d/proftpd.conf',
-								'config/filter.d/sasl.conf',
-								'config/filter.d/sshd.conf',
-								'config/filter.d/couriersmtp.conf',
-								'config/filter.d/postfix.conf',
-								'config/filter.d/qmail.conf'
-							]
+							glob("config/filter.d/*.conf")
 						),
 						('/etc/fail2ban/action.d',
-							[
-								'config/action.d/iptables.conf',
-								'config/action.d/mail-whois.conf',
-								'config/action.d/mail.conf',
-								'config/action.d/hostsdeny.conf'
-							]
+							glob("config/action.d/*.conf")
 						)
 					]
 )

From 0866e000210949dc4c4f901b639d87ea1083cd45 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 17 Oct 2006 21:13:54 +0000
Subject: [PATCH 374/549] - Added "[BACKEND]" parameter to doc

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@414 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client       | 2 +-
 man/fail2ban-client.1 | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index fd88d6e1..3cb7830c 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -101,7 +101,7 @@ class Fail2banClient:
 		print "    set logtarget <TARGET>  set log target to <TARGET>"
 		print "    get logtarget           get log target"
 		print
-		print "    add <JAIL>              create <JAIL>"
+		print "    add <JAIL> [BACKEND]    create <JAIL> using [BACKEND]"
 		print "    set <JAIL> <CMD>        set the <CMD> value for <JAIL>"
 		print "    get <JAIL> <CMD>        get the <CMD> value for <JAIL>"
 		print "    start <JAIL>            start <JAIL>"
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 6833de5d..8785f867 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -62,8 +62,8 @@ set log target to <TARGET>
 get logtarget
 get log target
 .TP
-add <JAIL>
-create <JAIL>
+add <JAIL> [BACKEND]
+create <JAIL> using [BACKEND]
 .TP
 set <JAIL> <CMD>
 set the <CMD> value for <JAIL>

From ee0edf3763ead0a24621a12aff4720554d618d8e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 17 Oct 2006 21:24:27 +0000
Subject: [PATCH 376/549] - Added Eclipse project file

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@416 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 .project | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 .project

diff --git a/.project b/.project
new file mode 100644
index 00000000..6d59cd24
--- /dev/null
+++ b/.project
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>fail2ban-unstable</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.python.pydev.PyDevBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.python.pydev.pythonNature</nature>
+	</natures>
+</projectDescription>

From 7cae060ec5a70842cfc90adfe9e7fa9af48f0b2e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 18 Oct 2006 20:10:18 +0000
Subject: [PATCH 377/549] - If section does not exist, use default value

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@417 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/configreader.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/client/configreader.py b/client/configreader.py
index 07eca339..f804b0bb 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -87,6 +87,7 @@ class ConfigReader(SafeConfigParser):
 			except NoSectionError, e:
 				# No "Definition" section or wrong basedir
 				logSys.error(e)
+				values[option[1]] = option[2]
 			except NoOptionError:
 				if not option[2] == None:
 					logSys.warn("No '" + option[1] + "' defined in '" + sec + "'")

From af41290fc6e7a98d81b081461e4adc03aa43278a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 18 Oct 2006 22:30:57 +0000
Subject: [PATCH 378/549] - Added the class MyTime. Replaces call to
 time.time() and time.gmtime(). A fixed time value can be set for testing
 purpose

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@418 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST               |  1 +
 server/actions.py      |  3 ++-
 server/banmanager.py   |  3 ++-
 server/datestrptime.py |  5 +++--
 server/filter.py       |  5 +++--
 server/filtergamin.py  |  3 ++-
 server/filterpoll.py   |  3 ++-
 server/mytime.py       | 50 ++++++++++++++++++++++++++++++++++++++++++
 8 files changed, 65 insertions(+), 8 deletions(-)
 create mode 100644 server/mytime.py

diff --git a/MANIFEST b/MANIFEST
index 3a93f473..4fb36593 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -38,6 +38,7 @@ server/__init__.py
 server/dateepoch.py
 server/banmanager.py
 server/datetemplate.py
+server/mytime.py
 testcases/banmanagertestcase.py
 testcases/failmanagertestcase.py
 testcases/clientreadertestcase.py
diff --git a/server/actions.py b/server/actions.py
index 7e604703..a76edbda 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -27,6 +27,7 @@ __license__ = "GPL"
 from banmanager import BanManager
 from jailthread import JailThread
 from action import Action
+from mytime import MyTime
 import time, logging
 
 # Gets the instance of the logger.
@@ -146,7 +147,7 @@ class Actions(JailThread):
 	# Unban IP address which are outdated.
 	
 	def __checkUnBan(self):
-		for ticket in self.__banManager.unBanList(time.time()):
+		for ticket in self.__banManager.unBanList(MyTime.time()):
 			aInfo = dict()
 			aInfo["ip"] = ticket.getIP()
 			logSys.warn("[%s] Unban %s" % (self.jail.getName(), aInfo["ip"]))
diff --git a/server/banmanager.py b/server/banmanager.py
index e345187a..c88fa9da 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -26,6 +26,7 @@ __license__ = "GPL"
 
 from banticket import BanTicket
 from threading import Lock
+from mytime import MyTime
 import time, logging
 
 # Gets the instance of the logger.
@@ -112,7 +113,7 @@ class BanManager:
 	def createBanTicket(ticket):
 		ip = ticket.getIP()
 		#lastTime = ticket.getTime()
-		lastTime = time.time()
+		lastTime = MyTime.time()
 		banTicket = BanTicket(ip, lastTime)
 		banTicket.setAttempt(ticket.getAttempt())
 		return banTicket
diff --git a/server/datestrptime.py b/server/datestrptime.py
index 21516d58..31ee892c 100644
--- a/server/datestrptime.py
+++ b/server/datestrptime.py
@@ -25,6 +25,7 @@ __date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
+from mytime import MyTime
 import time
 
 from datetemplate import DateTemplate
@@ -74,10 +75,10 @@ class DateStrptime(DateTemplate):
 				date = list(time.strptime(conv, self.getPattern()))
 			if date[0] < 2000:
 				# There is probably no year field in the logs
-				date[0] = time.gmtime()[0]
+				date[0] = MyTime.gmtime()[0]
 				# Bug fix for #1241756
 				# If the date is greater than the current time, we suppose
 				# that the log is not from this year but from the year before
-				if time.mktime(date) > time.time():
+				if time.mktime(date) > MyTime.time():
 					date[0] -= 1
 		return date
diff --git a/server/filter.py b/server/filter.py
index edd12828..1b29510d 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -28,6 +28,7 @@ from failmanager import FailManager
 from failticket import FailTicket
 from jailthread import JailThread
 from datedetector import DateDetector
+from mytime import MyTime
 
 import time, logging, re
 
@@ -342,7 +343,7 @@ class Filter(JailThread):
 	# Gets all the failure in the log file.
 	#
 	# Gets all the failure in the log file which are newer than
-	# time.time()-self.findTime. When a failure is detected, a FailTicket
+	# MyTime.time()-self.findTime. When a failure is detected, a FailTicket
 	# is created and is added to the FailManager.
 	
 	def getFailures(self, filename):
@@ -369,7 +370,7 @@ class Filter(JailThread):
 			for element in self.findFailure(line):
 				ip = element[0]
 				unixTime = element[1]
-				if unixTime < time.time()-self.__findTime:
+				if unixTime < MyTime.time()-self.__findTime:
 					break
 				if self.inIgnoreIPList(ip):
 					logSys.debug("Ignore "+ip)
diff --git a/server/filtergamin.py b/server/filtergamin.py
index 68b1f24e..54c66d74 100644
--- a/server/filtergamin.py
+++ b/server/filtergamin.py
@@ -26,6 +26,7 @@ __license__ = "GPL"
 
 from failmanager import FailManagerEmpty
 from filter import Filter
+from mytime import MyTime
 
 import time, logging, gamin
 
@@ -109,7 +110,7 @@ class FilterGamin(Filter):
 						ticket = self.failManager.toBan()
 						self.jail.putFailTicket(ticket)
 					except FailManagerEmpty:
-						self.failManager.cleanup(time.time())
+						self.failManager.cleanup(MyTime.time())
 					self.dateDetector.sortTemplate()
 					self.modified = False
 				time.sleep(self.getSleepTime())
diff --git a/server/filterpoll.py b/server/filterpoll.py
index 78d37b58..47fb1bf1 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -26,6 +26,7 @@ __license__ = "GPL"
 
 from failmanager import FailManagerEmpty
 from filter import Filter
+from mytime import MyTime
 
 import time, logging, os
 
@@ -104,7 +105,7 @@ class FilterPoll(Filter):
 						ticket = self.failManager.toBan()
 						self.jail.putFailTicket(ticket)
 					except FailManagerEmpty:
-						self.failManager.cleanup(time.time())
+						self.failManager.cleanup(MyTime.time())
 					self.dateDetector.sortTemplate()
 					self.modified = False
 				time.sleep(self.getSleepTime())
diff --git a/server/mytime.py b/server/mytime.py
new file mode 100644
index 00000000..a7930813
--- /dev/null
+++ b/server/mytime.py
@@ -0,0 +1,50 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 321 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 321 $"
+__date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time
+
+class MyTime:
+	
+	myTime = None
+	
+	@staticmethod
+	def setTime(t):
+		MyTime.myTime = t
+	
+	@staticmethod
+	def time():
+		if MyTime.myTime == None:
+			return time.time()
+		else:
+			return MyTime.myTime
+	
+	@staticmethod
+	def gmtime():
+		if MyTime.myTime == None:
+			return time.gmtime()
+		else:
+			return time.gmtime(MyTime.myTime)
+	
\ No newline at end of file

From ee862124357df11afeaf43ae0faa94bd0064b403 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 18 Oct 2006 22:35:32 +0000
Subject: [PATCH 379/549] - Updated testcases to fix the time using MyTime

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@419 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                         |  1 +
 fail2ban-testcases                |  7 +++++-
 testcases/datedetectortestcase.py |  8 ++-----
 testcases/files/testcase01.log    | 37 ++++++++++++++++---------------
 testcases/files/testcase02.log    |  3 +++
 testcases/filtertestcase.py       | 32 +++++++++++++-------------
 6 files changed, 48 insertions(+), 40 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 640637a0..10a20fb8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -16,6 +16,7 @@ ver. 0.7.4 (2006/??/??) - beta
   option in "fail2ban.conf"
 - Added "backend" option in "jail.conf"
 - Added more filters/actions and jail samples
+- Improved testing framework
 
 ver. 0.7.3 (2006/09/28) - beta
 ----------
diff --git a/fail2ban-testcases b/fail2ban-testcases
index 309ada27..b4825473 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -39,6 +39,11 @@ from testcases import failmanagertestcase
 from testcases import filtertestcase
 from testcases import servertestcase
 from testcases import datedetectortestcase
+from server.mytime import MyTime
+
+# Set the time to a fixed, known value
+# Sun Aug 14 12:00:00 CEST 2005
+MyTime.setTime(1124013600)
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban")
@@ -54,7 +59,7 @@ tests = unittest.TestSuite()
 # Filter
 tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
 tests.addTest(unittest.makeSuite(filtertestcase.LogFile))
-#tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
+tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
 # Server
 #tests.addTest(unittest.makeSuite(servertestcase.StartStop))
 #tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 1c311c06..7c534ea0 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -48,13 +48,9 @@ class DateDetectorTest(unittest.TestCase):
 	
 	def testGetTime(self):
 		log = "Jan 23 21:59:59 [sshd] error: PAM: Authentication failure"
-		date = [2006, 1, 23, 21, 59, 59, 1, 23, -1]
-		dateUnix = 1138049999.0
+		date = [2005, 1, 23, 21, 59, 59, 1, 23, -1]
+		dateUnix = 1106513999.0
 	
 		self.assertEqual(self.__datedetector.getTime(log), date)
-		self.assertEqual(self.__datedetector.getTime(log), date)
-		self.assertEqual(self.__datedetector.getTime(log), date)
-		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
-		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
 		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
 		
\ No newline at end of file
diff --git a/testcases/files/testcase01.log b/testcases/files/testcase01.log
index 43143d0b..afca924b 100644
--- a/testcases/files/testcase01.log
+++ b/testcases/files/testcase01.log
@@ -1,18 +1,19 @@
-Déc 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Déc 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Déc 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
-Dez 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Dez 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Dez 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-De  31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-De  31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-De  31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
-Dec 31 23:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
+Déc 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Déc 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Déc 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
+Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
+Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from failed.dns.ch
+Dez 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dez 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dez 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+De  31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+De  31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+De  31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128
+Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
+Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
+Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
+Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10
diff --git a/testcases/files/testcase02.log b/testcases/files/testcase02.log
index 547f8a53..0200d6de 100644
--- a/testcases/files/testcase02.log
+++ b/testcases/files/testcase02.log
@@ -8,3 +8,6 @@ Mar 16 10:34:01 i60p295 sshd[12365]: Postponed keyboard-interactive/pam for roeh
 Mar 16 10:34:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
 Mär 16 10:33:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
 Mär 16 10:33:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Mar 16 10:35:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Mar 16 10:36:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Mar 16 10:37:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 18ebcec1..3ba478e6 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -26,13 +26,14 @@ __license__ = "GPL"
 
 import unittest, socket
 from server.filterpoll import FilterPoll
+from server.filter import Filter
 from server.failmanager import FailManager
 
 class IgnoreIP(unittest.TestCase):
 
 	def setUp(self):
 		"""Call before every test case."""
-		self.__filter = FilterPoll(None)
+		self.__filter = Filter(None)
 
 	def tearDown(self):
 		"""Call after every test case."""
@@ -77,29 +78,30 @@ class LogFile(unittest.TestCase):
 
 class GetFailures(unittest.TestCase):
 
+	FILENAME = "testcases/files/testcase01.log"
+
 	def setUp(self):
 		"""Call before every test case."""
-		self.__filter = FilterPoll(None)
-		self.__filter.addLogPath("testcases/files/testcase01.log")
-		self.__filter.setTimeRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
-		self.__filter.setTimePattern("%b %d %H:%M:%S")
+		self.__filter = Filter(None)
+		self.__filter.addLogPath(FILENAME)
+		#self.__filter.setTimeRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+		#self.__filter.setTimePattern("%b %d %H:%M:%S")
 		self.__filter.setFailRegex("(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)")
 
 	def tearDown(self):
 		"""Call after every test case."""
 		
 	def testGetFailures(self):
-		output = [('87.142.124.10', 3, 1167605999.0),
-				  ('193.168.0.128', 3, 1167605999.0)]
+		output = ('193.168.0.128', 3, 1124013599.0)
 
-		self.__filter.openLogFile()
-		self.__filter.getFailures()
+		self.__filter.getFailures(FILENAME)
+		
+		ticket = self.__filter.failManager.toBan()
+
+		attempts = ticket.getAttempt()
+		date = ticket.getTime()
+		ip = ticket.getIP()
+		found = (ip, attempts, date)
 		
-		found = []
-		for ip in self.__filter.failManager.failList:
-			fData = self.__filter.failManager.failList[ip]
-			retry = fData.getRetry()
-			lTime = fData.getLastTime()
-			found.append((ip, retry, lTime))
 		self.assertEqual(found, output)
 		
\ No newline at end of file

From dad43027d3d041f4205c29582cd7fe0b21597f56 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 19 Oct 2006 19:51:59 +0000
Subject: [PATCH 380/549] - Fixed multiple IP in "ignoreip". Thanks to Nick
 Munger

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@420 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/jailreader.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/client/jailreader.py b/client/jailreader.py
index 35510749..154c804d 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -109,7 +109,8 @@ class JailReader(ConfigReader):
 			elif opt == "maxretry":
 				stream.append(["set", self.__name, "maxretry", self.__opts[opt]])
 			elif opt == "ignoreip":
-				stream.append(["set", self.__name, "addignoreip", self.__opts[opt]])
+				for ip in self.__opts[opt].split():
+					stream.append(["set", self.__name, "addignoreip", ip])
 			elif opt == "maxtime":
 				stream.append(["set", self.__name, "maxtime", self.__opts[opt]])
 			elif opt == "bantime":

From 51fd8fac27725c4d44e89a8e74a4dd7b005d05dd Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 19 Oct 2006 20:15:24 +0000
Subject: [PATCH 381/549] - Added ipfw action script and example. Thanks to
 Nick Munger

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@421 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                 |  3 +-
 MANIFEST                  |  1 +
 config/action.d/ipfw.conf | 66 +++++++++++++++++++++++++++++++++++++++
 config/jail.conf          | 12 +++++++
 4 files changed, 81 insertions(+), 1 deletion(-)
 create mode 100644 config/action.d/ipfw.conf

diff --git a/CHANGELOG b/CHANGELOG
index 10a20fb8..58c282bc 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -15,7 +15,8 @@ ver. 0.7.4 (2006/??/??) - beta
 - Added "-s" option to specify the socket path and "socket"
   option in "fail2ban.conf"
 - Added "backend" option in "jail.conf"
-- Added more filters/actions and jail samples
+- Added more filters/actions and jail samples. Thanks to Nick
+  Munger
 - Improved testing framework
 
 ver. 0.7.3 (2006/09/28) - beta
diff --git a/MANIFEST b/MANIFEST
index 4fb36593..b5ee598d 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -60,6 +60,7 @@ config/filter.d/sshd.conf
 config/filter.d/proftpd.conf
 config/filter.d/sasl.conf
 config/action.d/iptables.conf
+config/action.d/ipfw.conf
 config/action.d/mail-whois.conf
 config/action.d/mail.conf
 config/action.d/hostsdeny.conf
diff --git a/config/action.d/ipfw.conf b/config/action.d/ipfw.conf
new file mode 100644
index 00000000..2f4de5a5
--- /dev/null
+++ b/config/action.d/ipfw.conf
@@ -0,0 +1,66 @@
+# Fail2Ban configuration file
+#
+# Author: Nick Munger
+# Modified by: Cyril Jaquier
+#
+# $Revision: 254 $
+#
+
+[Definition]
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = 
+
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = 
+
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD
+#
+actioncheck = 
+
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = ipfw add deny tcp from <ip> to <localhost> <port>
+
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+#
+actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
+
+[Init]
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]
+#
+port = ssh
+
+# Option:  localhost
+# Notes.:  the local IP address of the network interface
+# Values:  IP
+#
+localhost = 127.0.0.1
diff --git a/config/jail.conf b/config/jail.conf
index 3716d783..d915de8c 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -121,3 +121,15 @@ filter   = apache-noscript
 action   = shorewall
            mail[name=Postfix, dest=yourmail@mail.com]
 logpath  = /var/log/apache2/error_log
+
+# This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip"
+# option is overridden in this jail.
+
+[ssh-ipfw]
+
+enabled  = false
+filter   = sshd
+action   = ipfw[localhost=192.168.0.1]
+           mail-whois[name=SSH, dest=yourmail@mail.com]
+logpath  = /var/log/auth.log
+ignoreip = 168.192.0.1

From 3cd43b13ce6ba5a19170dd8b9446ee2d763fa006 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 19 Oct 2006 20:26:24 +0000
Subject: [PATCH 382/549] - Added simple date format

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@422 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/datedetector.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/server/datedetector.py b/server/datedetector.py
index 666bdc8c..cbf90da7 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -55,6 +55,12 @@ class DateDetector:
 		template.setRegex("\S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}")
 		template.setPattern("%a %b %d %H:%M:%S %Y")
 		self.__templates.append(template)
+		# simple date
+		template = DateStrptime()
+		template.setName("Year/Month/Day Hour:Minute:Second")
+		template.setRegex("\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
+		template.setPattern("%Y/%m/%d %H:%M:%S")
+		self.__templates.append(template)
 		# TAI64N
 		template = DateTai64n()
 		template.setName("TAI64N")

From 2f3728486373e4dd0045776af359d663e4f84b70 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 19 Oct 2006 21:49:16 +0000
Subject: [PATCH 383/549] - Removed useless code

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@423 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index 1b29510d..44813721 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -30,7 +30,7 @@ from jailthread import JailThread
 from datedetector import DateDetector
 from mytime import MyTime
 
-import time, logging, re
+import logging, re
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.filter")
@@ -356,13 +356,10 @@ class Filter(JailThread):
 		lastLine = None
 		for line in self.__crtHandler:
 			try:
-				# Try to convert UTF-8 string to Latin-1
-				#line = line.decode('utf-8').encode('latin-1')
+				# Decode line to UTF-8
 				line = line.decode('utf-8')
 			except UnicodeDecodeError:
 				pass
-			#except UnicodeEncodeError:
-			#	logSys.warn("Mmhh... Are you sure you watch the correct file?")
 			if not self.dateDetector.matchTime(line):
 				# There is no valid time in this line
 				continue

From 23127d951c660bf941c22d92438f17b265adf95f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 19 Oct 2006 21:49:54 +0000
Subject: [PATCH 384/549] - Added 'u' in front of the UTF-8 strings

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@424 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/datestrptime.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/server/datestrptime.py b/server/datestrptime.py
index 31ee892c..a4b8ad25 100644
--- a/server/datestrptime.py
+++ b/server/datestrptime.py
@@ -39,8 +39,8 @@ class DateStrptime(DateTemplate):
 	
 	TABLE = dict()
 	TABLE["Jan"] = []
-	TABLE["Feb"] = ["Fév"]
-	TABLE["Mar"] = ["Mär"]
+	TABLE["Feb"] = [u"Fév"]
+	TABLE["Mar"] = [u"Mär"]
 	TABLE["Apr"] = ["Avr"]
 	TABLE["May"] = ["Mai"]
 	TABLE["Jun"] = []
@@ -49,7 +49,7 @@ class DateStrptime(DateTemplate):
 	TABLE["Sep"] = []
 	TABLE["Oct"] = ["Okt"]
 	TABLE["Nov"] = []
-	TABLE["Dec"] = ["Déc", "Dez"]
+	TABLE["Dec"] = [u"Déc", "Dez"]
 	
 	def __init__(self):
 		DateTemplate.__init__(self)

From e581913c1fb23f3bc9ccc2da415a305115686dcd Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 19 Oct 2006 21:50:30 +0000
Subject: [PATCH 385/549] - Added more filter test cases

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@425 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 testcases/files/testcase02.log | 26 ++++++-------
 testcases/files/testcase03.log |  9 +++++
 testcases/files/testcase04.log | 15 ++++++++
 testcases/filtertestcase.py    | 69 +++++++++++++++++++++++++++++++---
 4 files changed, 101 insertions(+), 18 deletions(-)
 create mode 100644 testcases/files/testcase03.log
 create mode 100644 testcases/files/testcase04.log

diff --git a/testcases/files/testcase02.log b/testcases/files/testcase02.log
index 0200d6de..7ca87c19 100644
--- a/testcases/files/testcase02.log
+++ b/testcases/files/testcase02.log
@@ -1,13 +1,13 @@
-Mar 16 04:57:00 i60p295 sshd[11437]: input_userauth_request: illegal user test123
-Mar 16 04:57:00 i60p295 sshd[11437]: Failed password for illegal user test123 from ::ffff:66.38.192.238 port 51381 ssh2
-Mar 16 04:57:00 i60p295 sshd[11437]: Connection closed by ::ffff:66.38.192.238
-Mar 16 10:33:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mar 16 10:33:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mar 16 10:33:59 i60p295 sshd[12365]: Postponed keyboard-interactive for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mar 16 10:34:01 i60p295 sshd[12365]: Postponed keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mar 16 10:34:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mär 16 10:33:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mär 16 10:33:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mar 16 10:35:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mar 16 10:36:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
-Mar 16 10:37:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:51:00 i60p295 sshd[11437]: input_userauth_request: illegal user test123
+Aug 14 11:52:00 i60p295 sshd[11437]: Failed password for illegal user test123 from ::ffff:66.38.192.238 port 51381 ssh2
+Aug 14 11:53:00 i60p295 sshd[11437]: Connection closed by ::ffff:66.38.192.238
+Aug 14 11:53:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:54:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:55:59 i60p295 sshd[12365]: Postponed keyboard-interactive for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:56:01 i60p295 sshd[12365]: Postponed keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:57:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:57:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:59:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:59:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
+Aug 14 11:59:01 i60p295 sshd[12365]: Accepted keyboard-interactive/pam for roehl from ::ffff:141.3.81.106 port 51332 ssh2
diff --git a/testcases/files/testcase03.log b/testcases/files/testcase03.log
new file mode 100644
index 00000000..4d9d11cd
--- /dev/null
+++ b/testcases/files/testcase03.log
@@ -0,0 +1,9 @@
+Aug 14 11:53:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aug 14 11:54:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aug 14 11:55:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aou 14 11:56:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aou 14 11:57:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aoü 14 11:58:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aug 14 11:59:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aug 14 12:50:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
+Aug 14 12:51:04 HOSTNAME courieresmtpd: error,relay=::ffff:203.162.223.135,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.
diff --git a/testcases/files/testcase04.log b/testcases/files/testcase04.log
new file mode 100644
index 00000000..c0304d06
--- /dev/null
+++ b/testcases/files/testcase04.log
@@ -0,0 +1,15 @@
+Sep 21 22:03:07 [sshd] Invalid user toto from 212.41.96.185
+1124012400 [sshd] Invalid user fuck from 212.41.96.185
+Sep 21 21:03:38 [sshd] Invalid user toto from 212.41.96.185
+1124012500 [sshd] Invalid user fuck from 212.41.96.185
+Sep 21 21:03:46 [sshd] Invalid user toto from 212.41.96.185
+Aug 14 11:58:48 [sshd] Invalid user fuck from 212.41.96.185
+Aug 14 11:59:58 [sshd] Invalid user toto from 212.41.96.185
+Sep 21 21:04:03 [sshd] Invalid user fuck from 212.41.96.185
+                - Last output repeated twice -
+2005/08/14 11:57:00 [sshd] Invalid user toto from 212.41.96.186
+2005/08/14 11:58:00 [sshd] Invalid user fuck from 212.41.96.186
+2005/08/14 11:59:00 [sshd] Invalid user toto from 212.41.96.186
+2005/08/14 12:00:00 [sshd] Invalid user fuck from 212.41.96.186
+                - Last output repeated twice -
+Sep 21 21:09:01 [sshd] Invalid user toto from 212.41.96.185
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 3ba478e6..d51892a5 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -28,6 +28,7 @@ import unittest, socket
 from server.filterpoll import FilterPoll
 from server.filter import Filter
 from server.failmanager import FailManager
+from server.failmanager import FailManagerEmpty
 
 class IgnoreIP(unittest.TestCase):
 
@@ -78,23 +79,27 @@ class LogFile(unittest.TestCase):
 
 class GetFailures(unittest.TestCase):
 
-	FILENAME = "testcases/files/testcase01.log"
+	FILENAME_01 = "testcases/files/testcase01.log"
+	FILENAME_02 = "testcases/files/testcase02.log"
+	FILENAME_03 = "testcases/files/testcase03.log"
+	FILENAME_04 = "testcases/files/testcase04.log"
 
 	def setUp(self):
 		"""Call before every test case."""
 		self.__filter = Filter(None)
-		self.__filter.addLogPath(FILENAME)
 		#self.__filter.setTimeRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 		#self.__filter.setTimePattern("%b %d %H:%M:%S")
-		self.__filter.setFailRegex("(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)")
 
 	def tearDown(self):
 		"""Call after every test case."""
 		
-	def testGetFailures(self):
+	def testGetFailures01(self):
 		output = ('193.168.0.128', 3, 1124013599.0)
+		
+		self.__filter.addLogPath(GetFailures.FILENAME_01)
+		self.__filter.setFailRegex("(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)")
 
-		self.__filter.getFailures(FILENAME)
+		self.__filter.getFailures(GetFailures.FILENAME_01)
 		
 		ticket = self.__filter.failManager.toBan()
 
@@ -104,4 +109,58 @@ class GetFailures(unittest.TestCase):
 		found = (ip, attempts, date)
 		
 		self.assertEqual(found, output)
+	
+	def testGetFailures02(self):
+		output = ('141.3.81.106', 4, 1124013539.0)
+
+		self.__filter.addLogPath(GetFailures.FILENAME_02)
+		self.__filter.setFailRegex("Failed .* (?:::f{4,6}:)(?P<host>\S*)")
+		
+		self.__filter.getFailures(GetFailures.FILENAME_02)
+		
+		ticket = self.__filter.failManager.toBan()
+
+		attempts = ticket.getAttempt()
+		date = ticket.getTime()
+		ip = ticket.getIP()
+		found = (ip, attempts, date)
+		
+		self.assertEqual(found, output)	
+
+	def testGetFailures03(self):
+		output = ('203.162.223.135', 6, 1124013544.0)
+
+		self.__filter.addLogPath(GetFailures.FILENAME_03)
+		self.__filter.setFailRegex("error,relay=(?:::f{4,6}:)?(?P<host>\S*),.*550 User unknown")
+		
+		self.__filter.getFailures(GetFailures.FILENAME_03)
+		
+		ticket = self.__filter.failManager.toBan()
+		
+		attempts = ticket.getAttempt()
+		date = ticket.getTime()
+		ip = ticket.getIP()
+		found = (ip, attempts, date)
+		
+		self.assertEqual(found, output)	
+
+	def testGetFailures04(self):
+		output = [('212.41.96.186', 4, 1124013600.0),
+				  ('212.41.96.185', 4, 1124013598.0)]
+
+		self.__filter.addLogPath(GetFailures.FILENAME_04)
+		self.__filter.setFailRegex("Invalid user .* (?P<host>\S*)")
+		
+		self.__filter.getFailures(GetFailures.FILENAME_04)
+
+		try:
+			for i in range(2):
+				ticket = self.__filter.failManager.toBan()		
+				attempts = ticket.getAttempt()
+				date = ticket.getTime()
+				ip = ticket.getIP()
+				found = (ip, attempts, date)
+				self.assertEqual(found, output[i])
+		except FailManagerEmpty:
+			pass
 		
\ No newline at end of file

From eaea181f6888fb65025f46737ecea4b7a7eb1d9e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 19 Oct 2006 21:52:28 +0000
Subject: [PATCH 386/549] - Added log files for the test cases

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@426 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/MANIFEST b/MANIFEST
index b5ee598d..ccba12b5 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -46,6 +46,10 @@ testcases/filtertestcase.py
 testcases/__init__.py
 testcases/datedetectortestcase.py
 testcases/servertestcase.py
+testcases/files/testcase01.log
+testcases/files/testcase02.log
+testcases/files/testcase03.log
+testcases/files/testcase04.log
 setup.py
 setup.cfg
 version.py

From f74657f4b6daa012f1dc2177749d4154cb36701a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 22 Oct 2006 23:49:10 +0000
Subject: [PATCH 387/549] - Added "courierlogin" filter. Thanks to Christoph
 Haas

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@427 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                         |  2 +-
 MANIFEST                          |  1 +
 README                            |  3 ++-
 config/filter.d/courierlogin.conf | 15 +++++++++++++++
 4 files changed, 19 insertions(+), 2 deletions(-)
 create mode 100644 config/filter.d/courierlogin.conf

diff --git a/CHANGELOG b/CHANGELOG
index 58c282bc..4b0b8c82 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -16,7 +16,7 @@ ver. 0.7.4 (2006/??/??) - beta
   option in "fail2ban.conf"
 - Added "backend" option in "jail.conf"
 - Added more filters/actions and jail samples. Thanks to Nick
-  Munger
+  Munger, Christoph Haas
 - Improved testing framework
 
 ver. 0.7.3 (2006/09/28) - beta
diff --git a/MANIFEST b/MANIFEST
index ccba12b5..b3d825c4 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -60,6 +60,7 @@ config/filter.d/apache-auth.conf
 config/filter.d/apache-noscript.conf
 config/filter.d/qmail.conf
 config/filter.d/couriersmtp.conf
+config/filter.d/courierlogin.conf
 config/filter.d/sshd.conf
 config/filter.d/proftpd.conf
 config/filter.d/sasl.conf
diff --git a/README b/README
index 4e4a3c8f..e0a718e8 100644
--- a/README
+++ b/README
@@ -96,7 +96,8 @@ Thanks:
 Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
 Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
 Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
-Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler
+Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
+Nick Munger, Christoph Haas
 
 License:
 --------
diff --git a/config/filter.d/courierlogin.conf b/config/filter.d/courierlogin.conf
new file mode 100644
index 00000000..5b8dac6f
--- /dev/null
+++ b/config/filter.d/courierlogin.conf
@@ -0,0 +1,15 @@
+# Fail2Ban configuration file
+#
+# Author: Christoph Haas
+# Modified by: Cyril Jaquier
+#
+# $Revision: 267 $
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile.
+# Values:  TEXT
+#
+failregex = LOGIN FAILED, ip=\[::ffff:(?P<host>\S*)\]$

From a522d9b6d79fe7a2730380aa95248ed8ad64e913 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 23 Oct 2006 20:12:15 +0000
Subject: [PATCH 388/549] - Re-activated subprocess module - A return code
 different than 0 is considered as an error

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@428 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/action.py | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/server/action.py b/server/action.py
index b69b0946..9135f371 100644
--- a/server/action.py
+++ b/server/action.py
@@ -25,7 +25,7 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 import logging, os
-#from subprocess import call
+from subprocess import call
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.actions.action")
@@ -214,13 +214,13 @@ class Action:
 		logSys.debug(realCmd)
 		try:
 			# The following line gives deadlock with multiple jails
-			#retcode = call(realCmd, shell=True)
-			retcode = os.system(realCmd)
-			if retcode < 0:
-				logSys.error("%s returned %x" % (realCmd, -retcode))
-			else:
-				logSys.debug("%s returned %x" % (realCmd, retcode))
+			retcode = call(realCmd, shell=True)
+			#retcode = os.system(realCmd)
+			if retcode == 0:
+				logSys.debug("%s returned successfully" % realCmd)
 				return True
+			else:
+				logSys.error("%s returned %x" % (realCmd, retcode))
 		except OSError, e:
 			logSys.error("%s failed with %s" % (realCmd, e))
 		return False

From 5c668c8fedfd12438bdc9c50fc7aac2556433b51 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 23 Oct 2006 20:13:21 +0000
Subject: [PATCH 389/549] - Added action test case

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@429 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST                    |  1 +
 fail2ban-testcases          |  2 ++
 testcases/actiontestcase.py | 47 +++++++++++++++++++++++++++++++++++++
 3 files changed, 50 insertions(+)
 create mode 100644 testcases/actiontestcase.py

diff --git a/MANIFEST b/MANIFEST
index b3d825c4..0f09a20c 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -45,6 +45,7 @@ testcases/clientreadertestcase.py
 testcases/filtertestcase.py
 testcases/__init__.py
 testcases/datedetectortestcase.py
+testcases/actiontestcase.py
 testcases/servertestcase.py
 testcases/files/testcase01.log
 testcases/files/testcase02.log
diff --git a/fail2ban-testcases b/fail2ban-testcases
index b4825473..b2eaa47c 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -39,6 +39,7 @@ from testcases import failmanagertestcase
 from testcases import filtertestcase
 from testcases import servertestcase
 from testcases import datedetectortestcase
+from testcases import actiontestcase
 from server.mytime import MyTime
 
 # Set the time to a fixed, known value
@@ -63,6 +64,7 @@ tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
 # Server
 #tests.addTest(unittest.makeSuite(servertestcase.StartStop))
 #tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
+tests.addTest(unittest.makeSuite(actiontestcase.ExecuteAction))
 # FailManager
 tests.addTest(unittest.makeSuite(failmanagertestcase.AddFailure))
 # BanManager
diff --git a/testcases/actiontestcase.py b/testcases/actiontestcase.py
new file mode 100644
index 00000000..8a66320e
--- /dev/null
+++ b/testcases/actiontestcase.py
@@ -0,0 +1,47 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 382 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 382 $"
+__date__ = "$Date: 2006-09-25 19:03:48 +0200 (Mon, 25 Sep 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import unittest, time
+from server.action import Action
+
+class ExecuteAction(unittest.TestCase):
+
+	def setUp(self):
+		"""Call before every test case."""
+		self.__action = Action("Test")
+
+	def tearDown(self):
+		"""Call after every test case."""
+		self.__action.execActionStop()
+	
+	def testExecuteActionBan(self):
+		self.__action.setActionStart("touch /tmp/fail2ban.test")
+		self.__action.setActionStop("rm -f /tmp/fail2ban.test")
+		self.__action.setActionBan("echo -n")
+		self.__action.setActionCheck("[ -e /tmp/fail2ban.test ]")
+		
+		self.assertTrue(self.__action.execActionBan(None))
+		
\ No newline at end of file

From 7ac8ada25349841670e92ff690011bfdc342c0dd Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 23 Oct 2006 20:23:14 +0000
Subject: [PATCH 390/549] - Added the whole Eclipse settings folder

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@430 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 .settings/org.eclipse.core.resources.prefs | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 .settings/org.eclipse.core.resources.prefs

diff --git a/.settings/org.eclipse.core.resources.prefs b/.settings/org.eclipse.core.resources.prefs
new file mode 100644
index 00000000..8c39373f
--- /dev/null
+++ b/.settings/org.eclipse.core.resources.prefs
@@ -0,0 +1,3 @@
+#Wed Sep 20 22:14:25 GMT 2006
+eclipse.preferences.version=1
+encoding//server/datestrptime.py=UTF-8

From 70fe13ac920b3a3087632fa8d479adee329edf25 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 23 Oct 2006 20:34:29 +0000
Subject: [PATCH 391/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@431 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index 4b0b8c82..c9dcc1a9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -18,6 +18,8 @@ ver. 0.7.4 (2006/??/??) - beta
 - Added more filters/actions and jail samples. Thanks to Nick
   Munger, Christoph Haas
 - Improved testing framework
+- Fixed a bug in the return code handling of the executed
+  commands. Thanks to Yaroslav Halchenko
 
 ver. 0.7.3 (2006/09/28) - beta
 ----------

From 4fd934aa83045e3e5be03600a8d2236d1c362968 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 23 Oct 2006 20:37:11 +0000
Subject: [PATCH 392/549] - subprocess still hangs :'(

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@432 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/action.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/server/action.py b/server/action.py
index 9135f371..39939954 100644
--- a/server/action.py
+++ b/server/action.py
@@ -25,7 +25,7 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 import logging, os
-from subprocess import call
+#from subprocess import call
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.actions.action")
@@ -214,8 +214,8 @@ class Action:
 		logSys.debug(realCmd)
 		try:
 			# The following line gives deadlock with multiple jails
-			retcode = call(realCmd, shell=True)
-			#retcode = os.system(realCmd)
+			#retcode = call(realCmd, shell=True)
+			retcode = os.system(realCmd)
 			if retcode == 0:
 				logSys.debug("%s returned successfully" % realCmd)
 				return True

From 71b9fe8fe8ac79ab70729b762867c09098ae2f17 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 24 Oct 2006 19:40:51 +0000
Subject: [PATCH 393/549] - Fixed some Pylint warnings/errors

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@433 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/__init__.py     |  2 +-
 client/actionreader.py |  4 ++--
 client/configreader.py | 18 ++++++++----------
 client/configurator.py | 12 +++++++-----
 client/csocket.py      |  5 +++--
 client/filterreader.py |  8 ++++----
 client/jailreader.py   |  2 +-
 client/jailsreader.py  |  5 -----
 server/__init__.py     |  2 +-
 server/action.py       |  6 +++---
 server/actions.py      |  2 +-
 server/banmanager.py   |  2 +-
 server/datedetector.py |  2 +-
 server/filter.py       | 13 ++++++-------
 server/filterpoll.py   |  6 +++---
 server/jail.py         |  1 +
 server/jailthread.py   |  2 +-
 server/server.py       | 12 ++++++------
 server/ssocket.py      | 31 +++++++++++++++++--------------
 19 files changed, 67 insertions(+), 68 deletions(-)

diff --git a/client/__init__.py b/client/__init__.py
index 76dba873..dc25edd6 100644
--- a/client/__init__.py
+++ b/client/__init__.py
@@ -22,4 +22,4 @@ __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
 __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
\ No newline at end of file
+__license__ = "GPL"
diff --git a/client/actionreader.py b/client/actionreader.py
index 13ef3d85..51acaf07 100644
--- a/client/actionreader.py
+++ b/client/actionreader.py
@@ -38,8 +38,8 @@ class ActionReader(ConfigReader):
 		self.__cInfo = action[1]
 		self.__name = name
 	
-	def setFile(self, file):
-		self.__file = file
+	def setFile(self, fileName):
+		self.__file = fileName
 	
 	def getFile(self):
 		return self.__file
diff --git a/client/configreader.py b/client/configreader.py
index f804b0bb..7f129ced 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -25,33 +25,31 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 import logging, os
-from ConfigParser import *
+from ConfigParser import SafeConfigParser
+from ConfigParser import NoOptionError, NoSectionError
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.client.config")
 
 class ConfigReader(SafeConfigParser):
 	
-	basedir = "/etc/fail2ban/"
+	BASE_DIRECTORY = "/etc/fail2ban/"
 	
 	def __init__(self):
 		SafeConfigParser.__init__(self)
 		self.__opts = None
 	
 	@staticmethod
-	def setBaseDir(dir):
-		global basedir
-		path = dir.rstrip('/')
-		basedir = path + '/'
+	def setBaseDir(folderName):
+		path = folderName.rstrip('/')
+		ConfigReader.BASE_DIRECTORY = path + '/'
 		
 	@staticmethod
 	def getBaseDir():
-		global basedir
-		return basedir
+		return ConfigReader.BASE_DIRECTORY
 	
 	def read(self, filename):
-		global basedir
-		basename = basedir + filename
+		basename = ConfigReader.BASE_DIRECTORY + filename
 		logSys.debug("Reading " + basename)
 		bConf = basename + ".conf"
 		bLocal = basename + ".local"
diff --git a/client/configurator.py b/client/configurator.py
index b59f5192..f4882f4b 100644
--- a/client/configurator.py
+++ b/client/configurator.py
@@ -40,10 +40,12 @@ class Configurator:
 		self.__fail2ban = Fail2banReader()
 		self.__jails = JailsReader()
 	
-	def setBaseDir(self, dir):
-		ConfigReader.setBaseDir(dir)
+	@staticmethod
+	def setBaseDir(folderName):
+		ConfigReader.setBaseDir(folderName)
 	
-	def getBaseDir(self):
+	@staticmethod
+	def getBaseDir():
 		return ConfigReader.getBaseDir()
 	
 	def readEarly(self):
@@ -57,8 +59,8 @@ class Configurator:
 		return self.__fail2ban.getEarlyOptions()
 	
 	def getAllOptions(self):
-		self.__settings["general"] = self.__fail2ban.getOptions()
-		self.__settings["jails"] = self.__jails.getOptions()
+		self.__fail2ban.getOptions()
+		self.__jails.getOptions()
 		
 	def convertToProtocol(self):
 		self.__streams["general"] = self.__fail2ban.convert()
diff --git a/client/csocket.py b/client/csocket.py
index 33477ecf..29484622 100644
--- a/client/csocket.py
+++ b/client/csocket.py
@@ -46,10 +46,11 @@ class CSocket:
 		self.__csock.close()
 		return ret
 	
-	def receive(self, socket):
+	@staticmethod
+	def receive(sock):
 		msg = ''
 		while msg.rfind(CSocket.END_STRING) == -1:
-			chunk = socket.recv(6)
+			chunk = sock.recv(6)
 			if chunk == '':
 				raise RuntimeError, "socket connection broken"
 			msg = msg + chunk
diff --git a/client/filterreader.py b/client/filterreader.py
index d666128f..7e14dc5c 100644
--- a/client/filterreader.py
+++ b/client/filterreader.py
@@ -32,13 +32,13 @@ logSys = logging.getLogger("fail2ban.client.config")
 
 class FilterReader(ConfigReader):
 	
-	def __init__(self, file, name):
+	def __init__(self, fileName, name):
 		ConfigReader.__init__(self)
-		self.__file = file
+		self.__file = fileName
 		self.__name = name
 	
-	def setFile(self, file):
-		self.__file = file
+	def setFile(self, fileName):
+		self.__file = fileName
 	
 	def getFile(self):
 		return self.__file
diff --git a/client/jailreader.py b/client/jailreader.py
index 154c804d..c23beaf2 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -125,7 +125,7 @@ class JailReader(ConfigReader):
 	def splitAction(action):
 		m = JailReader.actionCRE.match(action)
 		d = dict()
-		if m.group(2) <> None:
+		if not m.group(2) == None:
 			for param in m.group(2).split(','):
 				p = param.split('=')
 				d[p[0].strip()] = p[1].strip()
diff --git a/client/jailsreader.py b/client/jailsreader.py
index d48da92e..6208572d 100644
--- a/client/jailsreader.py
+++ b/client/jailsreader.py
@@ -55,11 +55,6 @@ class JailsReader(ConfigReader):
 			else:
 				logSys.error("Errors in jail '" + sec + "'. Skipping...")
 	
-	def getFilterOptions(self, file):
-		filter = FilterReader(file)
-		filter.read()
-		return filter.getOptions()
-	
 	def convert(self):
 		stream = list()
 		for opt in self.__opts:
diff --git a/server/__init__.py b/server/__init__.py
index 76dba873..dc25edd6 100644
--- a/server/__init__.py
+++ b/server/__init__.py
@@ -22,4 +22,4 @@ __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
 __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
\ No newline at end of file
+__license__ = "GPL"
diff --git a/server/action.py b/server/action.py
index 39939954..c74f45de 100644
--- a/server/action.py
+++ b/server/action.py
@@ -108,7 +108,7 @@ class Action:
 		return self.__actionBan
 	
 	def execActionBan(self, aInfo):
-		return self.__processCmd(self.__actionBan, aInfo);
+		return self.__processCmd(self.__actionBan, aInfo)
 	
 	##
 	# Set the "unban" command.
@@ -128,7 +128,7 @@ class Action:
 		return self.__actionUnban
 	
 	def execActionUnban(self, aInfo):
-		return self.__processCmd(self.__actionUnban, aInfo);
+		return self.__processCmd(self.__actionUnban, aInfo)
 	
 	##
 	# Set the "check" command.
@@ -207,7 +207,7 @@ class Action:
 		# Replace static fields
 		realCmd = Action.replaceTag(realCmd, self.__cInfo)
 		
-  		return Action.executeCmd(realCmd)
+		return Action.executeCmd(realCmd)
 
   	@staticmethod
 	def executeCmd(realCmd):
diff --git a/server/actions.py b/server/actions.py
index a76edbda..50230de3 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -49,7 +49,7 @@ class Actions(JailThread):
 	# @param jail the jail object
 	
 	def __init__(self, jail):
-		JailThread.__init__(self, jail)
+		JailThread.__init__(self)
 		## The jail which contains this action.
 		self.jail = jail
 		self.__actions = list()
diff --git a/server/banmanager.py b/server/banmanager.py
index c88fa9da..88be86a2 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -27,7 +27,7 @@ __license__ = "GPL"
 from banticket import BanTicket
 from threading import Lock
 from mytime import MyTime
-import time, logging
+import logging
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.action")
diff --git a/server/datedetector.py b/server/datedetector.py
index cbf90da7..ad914b21 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -92,7 +92,7 @@ class DateDetector:
 			self.__lock.acquire()
 			for template in self.__templates:
 				match = template.matchDate(line)
-				if match <> None:
+				if not match == None:
 					self.__lock.release()
 					return match
 			self.__lock.release()
diff --git a/server/filter.py b/server/filter.py
index 44813721..45963d0e 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -51,7 +51,7 @@ class Filter(JailThread):
 	# @param jail the jail object
 	
 	def __init__(self, jail):
-		JailThread.__init__(self, jail)
+		JailThread.__init__(self)
 		## The jail which contains this filter.
 		self.jail = jail
 		## The failures manager.
@@ -347,7 +347,6 @@ class Filter(JailThread):
 	# is created and is added to the FailManager.
 	
 	def getFailures(self, filename):
-		ipList = dict()
 		ret = self.__openLogFile(filename)
 		if not ret:
 			logSys.error("Unable to get failures in " + filename)
@@ -392,7 +391,7 @@ class Filter(JailThread):
 		match = self.__failRegexObj.search(line)
 		if match:
 			date = self.dateDetector.getUnixTime(match.string)
-			if date <> None:
+			if not date == None:
 				try:
 					ipMatch = DNSUtils.textToIp(match.group("host"))
 					if ipMatch:
@@ -463,10 +462,10 @@ class DNSUtils:
 			return None
 	
 	@staticmethod
-	def isValidIP(str):
+	def isValidIP(string):
 		""" Return true if str is a valid IP
 		"""
-		s = str.split('/', 1)
+		s = string.split('/', 1)
 		try:
 			socket.inet_aton(s[0])
 			return True
@@ -503,10 +502,10 @@ class DNSUtils:
 		return ~(MASK >> n) & MASK & DNSUtils.addr2bin(i)
 	
 	@staticmethod
-	def addr2bin(str):
+	def addr2bin(string):
 		""" Convert a string IPv4 address into an unsigned integer.
 		"""
-		return struct.unpack("!L", socket.inet_aton(str))[0]
+		return struct.unpack("!L", socket.inet_aton(string))[0]
 	
 	@staticmethod
 	def bin2addr(addr):
diff --git a/server/filterpoll.py b/server/filterpoll.py
index 47fb1bf1..4aa07423 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -95,9 +95,9 @@ class FilterPoll(Filter):
 		while self.isActive():
 			if not self.getIdle():
 				# Get file modification
-				for file in self.getLogPath():
-					if self.isModified(file):
-						self.getFailures(file)
+				for f in self.getLogPath():
+					if self.isModified(f):
+						self.getFailures(f)
 						self.modified = True
 
 				if self.modified:
diff --git a/server/jail.py b/server/jail.py
index bdbc0f41..31d2a419 100644
--- a/server/jail.py
+++ b/server/jail.py
@@ -54,6 +54,7 @@ class Jail:
 		self.__filter = FilterPoll(self)
 	
 	def __initGamin(self):
+		# Try to import gamin
 		import gamin
 		logSys.info("Using Gamin")
 		from filtergamin import FilterGamin
diff --git a/server/jailthread.py b/server/jailthread.py
index 02ebe449..8a3c6d30 100644
--- a/server/jailthread.py
+++ b/server/jailthread.py
@@ -38,7 +38,7 @@ class JailThread(Thread):
 	# Initialize the filter object with default values.
 	# @param jail the jail object
 	
-	def __init__(self, jail):
+	def __init__(self):
 		Thread.__init__(self)
 		## Control the state of the thread.
 		self.__isRunning = False
diff --git a/server/server.py b/server/server.py
index ce495989..94f29ee6 100644
--- a/server/server.py
+++ b/server/server.py
@@ -34,7 +34,7 @@ import logging, logging.handlers, sys, os, signal
 logSys = logging.getLogger("fail2ban.server")
 
 class Server:
-	
+
 	def __init__(self, daemon = False):
 		self.__jails = Jails()
 		self.__daemon = daemon
@@ -111,11 +111,11 @@ class Server:
 	def getIgnoreIP(self, name):
 		return self.__jails.getFilter(name).getIgnoreIP()
 	
-	def addLogPath(self, name, file):
-		self.__jails.getFilter(name).addLogPath(file)
+	def addLogPath(self, name, fileName):
+		self.__jails.getFilter(name).addLogPath(fileName)
 	
-	def delLogPath(self, name, file):
-		self.__jails.getFilter(name).delLogPath(file)
+	def delLogPath(self, name, fileName):
+		self.__jails.getFilter(name).delLogPath(fileName)
 	
 	def getLogPath(self, name):
 		return self.__jails.getFilter(name).getLogPath()
@@ -356,7 +356,7 @@ class Server:
 				pass
 	
 		# Redirect the standard file descriptors to /dev/null.
-	   	os.open("/dev/null", os.O_RDONLY)	# standard input (0)
+		os.open("/dev/null", os.O_RDONLY)	# standard input (0)
 		os.open("/dev/null", os.O_RDWR)		# standard output (1)
 		os.open("/dev/null", os.O_RDWR)		# standard error (2)
 		return True
diff --git a/server/ssocket.py b/server/ssocket.py
index 26511d29..35873879 100644
--- a/server/ssocket.py
+++ b/server/ssocket.py
@@ -40,6 +40,7 @@ class SSocket(Thread):
 		self.__transmit = transmitter
 		self.__isRunning = False
 		self.__socket = "/tmp/fail2ban.sock"
+		self.__ssock = None
 		logSys.debug("Created SSocket")
 	
 	def initialize(self, sock = "/tmp/fail2ban.sock", force = False):
@@ -53,31 +54,31 @@ class SSocket(Thread):
 			else:
 				raise SSocketErrorException("Server already running")
 		# Create an INET, STREAMing socket
-		#self.ssock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-		self.ssock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-		#self.ssock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-		#self.ssock.setblocking(False)
+		#self.__ssock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+		self.__ssock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+		#self.__ssock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+		#self.__ssock.setblocking(False)
 		# Do not use a blocking socket as there is problem at shutdown.
 		# Use a timeout instead. Daemon exits at most 'timeout' seconds
 		# after the command.
-		self.ssock.settimeout(1)
+		self.__ssock.settimeout(1)
 		# Bind the socket to a public host and a well-known port
-		#self.ssock.bind(("localhost", 2222))
-		self.ssock.bind(sock)
+		#self.__ssock.bind(("localhost", 2222))
+		self.__ssock.bind(sock)
 		# Become a server socket
-		self.ssock.listen(5)
+		self.__ssock.listen(5)
 	
 	def run(self):
 		self.__isRunning = True
 		while self.__isRunning:
 			try:
-				(csock, address) = self.ssock.accept()
+				(csock, address) = self.__ssock.accept()
 				thread = SocketWorker(csock, self.__transmit)
 				thread.start()
 			except socket.timeout:
 				# Do nothing here
 				pass
-		self.ssock.close()
+		self.__ssock.close()
 		# Remove socket
 		if os.path.exists(self.__socket):
 			logSys.debug("Removed socket file " + self.__socket)
@@ -110,14 +111,16 @@ class SocketWorker(Thread):
 		self.__csock.close()
 		logSys.debug("Connection closed")
 	
-	def __send(self, socket, msg):
+	@staticmethod
+	def __send(sock, msg):
 		obj = dumps(msg)
-		socket.send(obj + SSocket.END_STRING)
+		sock.send(obj + SSocket.END_STRING)
 	
-	def __receive(self, socket):
+	@staticmethod
+	def __receive(sock):
 		msg = ''
 		while msg.rfind(SSocket.END_STRING) == -1:
-			chunk = socket.recv(6)
+			chunk = sock.recv(6)
 			if chunk == '':
 				raise RuntimeError, "socket connection broken"
 			msg = msg + chunk

From 4536ddbcc10020790a6c203e8da8f91c6b774c2c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 24 Oct 2006 19:49:31 +0000
Subject: [PATCH 394/549] - Fixed indentation with space instead of tabs

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@434 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/action.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/action.py b/server/action.py
index c74f45de..f7b5458e 100644
--- a/server/action.py
+++ b/server/action.py
@@ -209,7 +209,7 @@ class Action:
 		
 		return Action.executeCmd(realCmd)
 
-  	@staticmethod
+	@staticmethod
 	def executeCmd(realCmd):
 		logSys.debug(realCmd)
 		try:

From 9f44b18a2f99522ba01afc2e51f1d83f249a2bed Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 25 Oct 2006 20:06:35 +0000
Subject: [PATCH 395/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@435 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/TODO b/TODO
index 203ac0a8..2158fec5 100644
--- a/TODO
+++ b/TODO
@@ -28,17 +28,8 @@ Legend:
 
 # improve documentation and website for user
 
-- use PyLint to check the code
-
 # better return values in function
 
-? add gettext support. Is this really needed for a server
-  utility?
-
-# add a test framework. We could use unittest which is in
-  Python since 2.1. It should be possible to run all tests
-  automatically.
-
 ? restart automatically the daemon if an exception occurs.
 
 - do not close socket after a send

From ae0ed204eecfeb28d58f16a513d2efa40c9aa411 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 30 Oct 2006 22:47:30 +0000
Subject: [PATCH 396/549] - Added signal handling. There is a bug with join()
 and signal handling in Python.

https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1167930&group_id=5470

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@436 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG        |  2 ++
 server/server.py | 14 +++++++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index c9dcc1a9..074cb45a 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -20,6 +20,8 @@ ver. 0.7.4 (2006/??/??) - beta
 - Improved testing framework
 - Fixed a bug in the return code handling of the executed
   commands. Thanks to Yaroslav Halchenko
+- Signal handling. There is a bug with join() and signal in
+  Python
 
 ver. 0.7.3 (2006/09/28) - beta
 ----------
diff --git a/server/server.py b/server/server.py
index 94f29ee6..af995f54 100644
--- a/server/server.py
+++ b/server/server.py
@@ -46,8 +46,17 @@ class Server:
 		self.setLogLevel(self.__logLevel)
 		self.setLogTarget(self.__logTarget)
 	
+	def __sigTERMhandler(self, signum, frame):
+		logSys.debug("Caught signal %d. Exiting" % signum)
+		self.quit()
+	
 	def start(self, sock, force = False):
 		logSys.info("Starting Fail2ban")
+		
+		# Install signal handlers
+		signal.signal(signal.SIGTERM, self.__sigTERMhandler)
+		signal.signal(signal.SIGINT, self.__sigTERMhandler)
+		
 		# First set the mask to only allow access to owner
 		os.umask(0077)
 		if self.__daemon:
@@ -62,7 +71,10 @@ class Server:
 		try:
 			self.__socket.initialize(sock, force)
 			self.__socket.start()
-			self.__socket.join()
+			# Workaround (???) for join() bug.
+			# https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1167930&group_id=5470
+			while self.__socket.isAlive():
+				self.__socket.join(1)
 		except SSocketErrorException:
 			logSys.error("Could not start server")
 		logSys.info("Exiting Fail2ban")

From 150a6abd0d622b7fd67cba88cde4c9c6e5a7ee61 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 30 Oct 2006 22:48:52 +0000
Subject: [PATCH 397/549] - Stop reading log file when jail is no more active

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@437 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py            | 3 +++
 testcases/filtertestcase.py | 4 +++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/server/filter.py b/server/filter.py
index 45963d0e..8d2b38f6 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -354,6 +354,9 @@ class Filter(JailThread):
 		self.__setFilePos()
 		lastLine = None
 		for line in self.__crtHandler:
+			if not self.isActive():
+				# The jail has been stopped
+				break
 			try:
 				# Decode line to UTF-8
 				line = line.decode('utf-8')
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index d51892a5..91c5a592 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -24,7 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import unittest, socket
+import unittest
 from server.filterpoll import FilterPoll
 from server.filter import Filter
 from server.failmanager import FailManager
@@ -87,6 +87,8 @@ class GetFailures(unittest.TestCase):
 	def setUp(self):
 		"""Call before every test case."""
 		self.__filter = Filter(None)
+		self.__filter.setActive(True)
+		# TODO Test this
 		#self.__filter.setTimeRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 		#self.__filter.setTimePattern("%b %d %H:%M:%S")
 

From 1f5556981a0105dc035d79f87aa7036e5be59e72 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 30 Oct 2006 23:02:05 +0000
Subject: [PATCH 398/549] - Fixed exception if wrong use of ','. Thanks to
 Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@438 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/jailreader.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/client/jailreader.py b/client/jailreader.py
index c23beaf2..23b39c77 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -128,5 +128,8 @@ class JailReader(ConfigReader):
 		if not m.group(2) == None:
 			for param in m.group(2).split(','):
 				p = param.split('=')
-				d[p[0].strip()] = p[1].strip()
+				try:
+					d[p[0].strip()] = p[1].strip()
+				except IndexError:
+					logSys.error("Invalid argument %s in '%s'" % (p, m.group(2)))
 		return [m.group(1), d]

From a49cc6bb08d11d4f964ba1fb4f7a068b14b4825b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 31 Oct 2006 22:22:40 +0000
Subject: [PATCH 399/549] - Added new date format (Apache). Thanks to Yaroslav
 Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@439 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/datedetector.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/server/datedetector.py b/server/datedetector.py
index ad914b21..0b94d20f 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -61,6 +61,12 @@ class DateDetector:
 		template.setRegex("\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
 		template.setPattern("%Y/%m/%d %H:%M:%S")
 		self.__templates.append(template)
+		# Apache format [31/Oct/2006:09:22:55 -0000]
+		template = DateStrptime()
+		template.setName("Day/Month/Year:Hour:Minute:Second")
+		template.setRegex("\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}")
+		template.setPattern("%d/%b/%Y:%H:%M:%S")
+		self.__templates.append(template)
 		# TAI64N
 		template = DateTai64n()
 		template.setName("TAI64N")

From 5baa08c86f20ff9c473bde3ab222866defacec01 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 31 Oct 2006 22:24:34 +0000
Subject: [PATCH 400/549] - Improved checking and logging output in findFailure

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@440 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py | 43 +++++++++++++++++++++++++++----------------
 1 file changed, 27 insertions(+), 16 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index 8d2b38f6..afd573c7 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -30,7 +30,7 @@ from jailthread import JailThread
 from datedetector import DateDetector
 from mytime import MyTime
 
-import logging, re
+import logging, re, sre_constants
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.filter")
@@ -163,9 +163,12 @@ class Filter(JailThread):
 	# @param value the regular expression
 	
 	def setFailRegex(self, value):
-		self.__failRegex = value
-		self.__failRegexObj = re.compile(value)
-		logSys.info("Set failregex = %s" % value)
+		try:
+			self.__failRegexObj = re.compile(value)
+			self.__failRegex = value
+			logSys.info("Set failregex = %s" % value)
+		except sre_constants.error:
+			logSys.error("Unable to compile regular expression " + value)
 	
 	##
 	# Get the regular expression which matches the failure.
@@ -391,18 +394,26 @@ class Filter(JailThread):
 
 	def findFailure(self, line):
 		failList = list()
-		match = self.__failRegexObj.search(line)
-		if match:
-			date = self.dateDetector.getUnixTime(match.string)
-			if not date == None:
-				try:
-					ipMatch = DNSUtils.textToIp(match.group("host"))
-					if ipMatch:
-						for ip in ipMatch:
-							failList.append([ip, date])
-				except IndexError:
-					logSys.error("There is no 'host' group in the rule. " +
-								 "Please correct your configuration.")
+		if self.__failRegexObj == None:
+			logSys.error("No failregex is set")
+		else:
+			match = self.__failRegexObj.search(line)
+			if match:
+				date = self.dateDetector.getUnixTime(match.string)
+				if date == None:
+					logSys.debug("Found a match but no valid date/time found "
+								 + "for " + match.string + ". Please contact "
+								 + "the author in order to get support for "
+								 + "this format")
+				else:
+					try:
+						ipMatch = DNSUtils.textToIp(match.group("host"))
+						if ipMatch:
+							for ip in ipMatch:
+								failList.append([ip, date])
+					except IndexError:
+						logSys.error("There is no 'host' group in the rule. " +
+									 "Please correct your configuration.")
 		return failList
 	
 

From 519eddef21341ed43e14f5d5f33c90f8e5785e71 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 31 Oct 2006 22:25:26 +0000
Subject: [PATCH 401/549] - Added better debugging output

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@441 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-regex | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/fail2ban-regex b/fail2ban-regex
index c8b42f8f..8d82641a 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -34,10 +34,22 @@ sys.path.insert(1, "/usr/lib/fail2ban")
 from version import version
 from server.filter import Filter
 
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban.regex")
+
 class Fail2banRegex:
 	
 	def __init__(self):
 		self.__filter = Filter(None)
+		# Setup logging
+		logging.getLogger("fail2ban").handlers = []
+		self.__hdlr = logging.StreamHandler(sys.stdout)
+		# set a format which is simpler for console use
+		formatter = logging.Formatter("%(message)s")
+		# tell the handler to use this format
+		self.__hdlr.setFormatter(formatter)
+		logging.getLogger("fail2ban").addHandler(self.__hdlr)
+		logging.getLogger("fail2ban").setLevel(logging.ERROR)
 	
 	def dispVersion(self):
 		print "Fail2Ban v" + version
@@ -72,12 +84,16 @@ class Fail2banRegex:
 	 			sys.exit(0)
 	
 	def setRegex(self, value):
+		print
 		self.__filter.setFailRegex(value)
 	
 	def testRegex(self, line):
 		print
 		try:
+			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
 			ret = self.__filter.findFailure(line)
+			print
+			logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
 		except IndexError:
 			print "Sorry, but no <host> found in regex"
 			return False

From 98347341787bdc92fff574dcf23b7f336cc23cec Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 31 Oct 2006 22:25:48 +0000
Subject: [PATCH 402/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@442 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 2 ++
 TODO      | 6 ++----
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 074cb45a..fe968098 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -22,6 +22,8 @@ ver. 0.7.4 (2006/??/??) - beta
   commands. Thanks to Yaroslav Halchenko
 - Signal handling. There is a bug with join() and signal in
   Python
+- Better debugging output for "fail2ban-regex"
+- Added support for more date format
 
 ver. 0.7.3 (2006/09/28) - beta
 ----------
diff --git a/TODO b/TODO
index 2158fec5..6b13c144 100644
--- a/TODO
+++ b/TODO
@@ -13,15 +13,13 @@ Legend:
 # partially done
 * done
 
+- Multiline log reading
+
 - Improve communication. (asyncore, asynchat??)
 
 - Improve execution of action. Why does subprocess.call
   deadlock with multi-jails?
 
-- Verify TAI64N
-
-- signal handling (ctrl-c, etc)
-
 # see Feature Request Tracking System at SourceForge.net
 
 - improve installation process (better prefix support)

From d065d97888af6a9c0420cf54cce1f1b0bb0d728d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 31 Oct 2006 23:36:59 +0000
Subject: [PATCH 403/549] - Use pickle instead of cPickle. Python 2.5 gives an
 exception with cPickle - Use a binary format instead of ASCII

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@443 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG         | 2 ++
 TODO              | 2 ++
 client/csocket.py | 5 +++--
 server/ssocket.py | 6 ++++--
 4 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index fe968098..a90baae0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -24,6 +24,8 @@ ver. 0.7.4 (2006/??/??) - beta
   Python
 - Better debugging output for "fail2ban-regex"
 - Added support for more date format
+- cPickle does not work with Python 2.5. Use pickle instead
+  (performance is not a problem in our case)
 
 ver. 0.7.3 (2006/09/28) - beta
 ----------
diff --git a/TODO b/TODO
index 6b13c144..72101fd0 100644
--- a/TODO
+++ b/TODO
@@ -13,6 +13,8 @@ Legend:
 # partially done
 * done
 
+- Fix the cPickle issue with Python 2.5
+
 - Multiline log reading
 
 - Improve communication. (asyncore, asynchat??)
diff --git a/client/csocket.py b/client/csocket.py
index 29484622..444792f9 100644
--- a/client/csocket.py
+++ b/client/csocket.py
@@ -24,7 +24,8 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from cPickle import dumps, loads
+#from cPickle import dumps, loads, HIGHEST_PROTOCOL
+from pickle import dumps, loads, HIGHEST_PROTOCOL
 import socket
 
 class CSocket:
@@ -40,7 +41,7 @@ class CSocket:
 	
 	def send(self, msg):
 		# Convert every list member to string
-		obj = dumps(map(str, msg))
+		obj = dumps(map(str, msg), HIGHEST_PROTOCOL)
 		self.__csock.send(obj + CSocket.END_STRING)
 		ret = self.receive(self.__csock)
 		self.__csock.close()
diff --git a/server/ssocket.py b/server/ssocket.py
index 35873879..dfc69fca 100644
--- a/server/ssocket.py
+++ b/server/ssocket.py
@@ -25,7 +25,9 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 from threading import Thread
-from cPickle import dumps, loads
+# cPickle generates an exception with Python 2.5
+#from cPickle import dumps, loads, HIGHEST_PROTOCOL
+from pickle import dumps, loads, HIGHEST_PROTOCOL
 import socket, logging, os, os.path
 
 # Gets the instance of the logger.
@@ -113,7 +115,7 @@ class SocketWorker(Thread):
 	
 	@staticmethod
 	def __send(sock, msg):
-		obj = dumps(msg)
+		obj = dumps(msg, HIGHEST_PROTOCOL)
 		sock.send(obj + SSocket.END_STRING)
 	
 	@staticmethod

From 5569e9b816002a6601182573051b088b48a77e4e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 1 Nov 2006 22:03:48 +0000
Subject: [PATCH 404/549] - Changed default log level from INFO to WARNING

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@444 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 3cb7830c..4735a234 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -57,7 +57,7 @@ class Fail2banClient:
 		self.__conf["conf"] = "/etc/fail2ban"
 		self.__conf["dump"] = False
 		self.__conf["force"] = False
-		self.__conf["verbose"] = 2
+		self.__conf["verbose"] = 1
 		self.__conf["interactive"] = False
 		self.__conf["socket"] = None
 		
@@ -177,7 +177,7 @@ class Fail2banClient:
 	def __processCommand(self, cmd):
 		if len(cmd) == 1 and cmd[0] == "start":
 			if self.__ping():
-				logSys.info("Server already running")
+				logSys.error("Server already running")
 				return False
 			else:
 				self.__startServerAsync(self.__conf["force"])
@@ -282,7 +282,7 @@ class Fail2banClient:
 		socket = self.__configurator.getEarlyOptions()
 		if self.__conf["socket"] == None:
 			self.__conf["socket"] = socket["socket"]
-		logSys.warn("Using socket file " + self.__conf["socket"])
+		logSys.info("Using socket file " + self.__conf["socket"])
 
 		if self.__conf["dump"]:
 			self.__readConfig()

From e8c656b5ff1ee9f1d4c4421d08f104913da1b686 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 1 Nov 2006 22:08:03 +0000
Subject: [PATCH 405/549] - Added svn:executable

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@445 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 files/redhat-initd | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100644 => 100755 files/redhat-initd

diff --git a/files/redhat-initd b/files/redhat-initd
old mode 100644
new mode 100755

From 528c9a18556fc9d8ed5fad7069a9180513021cfe Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 1 Nov 2006 22:13:44 +0000
Subject: [PATCH 406/549] - Updated for 0.7.4

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@446 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG             | 4 ++--
 README                | 9 +++++----
 TODO                  | 2 ++
 man/fail2ban-client.1 | 4 ++--
 man/fail2ban-regex.1  | 4 ++--
 man/fail2ban-server.1 | 4 ++--
 man/generate-man      | 2 +-
 version.py            | 2 +-
 8 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index a90baae0..10fa5ac8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.4)                           2006/??/??
+Fail2Ban (version 0.7.4)                           2006/11/01
 =============================================================
 
-ver. 0.7.4 (2006/??/??) - beta
+ver. 0.7.4 (2006/11/01) - beta
 ----------
 - Improved configuration files. Thanks to Yaroslav Halchenko
 - Added man page for "fail2ban-regex"
diff --git a/README b/README
index e0a718e8..61797f72 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.3)                           2006/09/28
+Fail2Ban (version 0.7.4)                           2006/11/01
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -27,8 +27,8 @@ Optional:
 
 To install, just do:
 
-> tar xvfj fail2ban-0.7.3.tar.bz2
-> cd fail2ban-0.7.3
+> tar xvfj fail2ban-0.7.4.tar.bz2
+> cd fail2ban-0.7.4
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The
@@ -53,6 +53,7 @@ options (not complete yet):
 
 Options:
     -c <DIR>                configuration directory
+    -s <FILE>               socket path
     -d                      dump configuration. For debugging
     -i                      interactive mode
     -v                      increase verbosity
@@ -73,7 +74,7 @@ Command:
     set logtarget <TARGET>  set log target to <TARGET>
     get logtarget           get log target
 
-    add <JAIL>              create <JAIL>
+    add <JAIL> [BACKEND]    create <JAIL> using [BACKEND]
     set <JAIL> <CMD>        set the <CMD> value for <JAIL>
     get <JAIL> <CMD>        get the <CMD> value for <JAIL>
     start <JAIL>            start <JAIL>
diff --git a/TODO b/TODO
index 72101fd0..6fa50bc9 100644
--- a/TODO
+++ b/TODO
@@ -13,6 +13,8 @@ Legend:
 # partially done
 * done
 
+- Add gettext support (I8N)
+
 - Fix the cPickle issue with Python 2.5
 
 - Multiline log reading
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 8785f867..16e4c4b9 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "October 2006" "fail2ban-client v0.7.3-SVN" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "November 2006" "fail2ban-client v0.7.4" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH SYNOPSIS
 .B fail2ban-client
 [\fIOPTIONS\fR]... \fI<COMMAND>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.3\-SVN reads log file that contains password failure report
+Fail2Ban v0.7.4 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index 5a80049a..afe8f9b4 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-REGEX "1" "October 2006" "fail2ban-regex v0.7.3-SVN" "User Commands"
+.TH FAIL2BAN-REGEX "1" "November 2006" "fail2ban-regex v0.7.4" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
 .B fail2ban-regex
 \fI<logline> <failregex>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.3\-SVN reads log file that contains password failure report
+Fail2Ban v0.7.4 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 This tools can test and benchmark your regular expressions for the "failregex"
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index bcdcc0dd..ded43f8e 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "October 2006" "fail2ban-server v0.7.3-SVN" "User Commands"
+.TH FAIL2BAN-SERVER "1" "November 2006" "fail2ban-server v0.7.4" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.7.3\-SVN reads log file that contains password failure report
+Fail2Ban v0.7.4 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with
diff --git a/man/generate-man b/man/generate-man
index 481999b3..61c95d54 100755
--- a/man/generate-man
+++ b/man/generate-man
@@ -14,7 +14,7 @@ help2man --section=1 --no-info --include=fail2ban-server.h2m --output fail2ban-s
 echo "[done]"
 
 # fail2ban-regex
-echo -n "Generating fail2ban-regex "
+echo -n "Generating fail2ban-regex  "
 help2man --section=1 --no-info --include=fail2ban-regex.h2m --output fail2ban-regex.1 ../fail2ban-regex
 echo "[done]"
 
diff --git a/version.py b/version.py
index 1124e7e4..5bae999c 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.3-SVN"
+version = "0.7.4"

From dc0ae5ee0f9e6f56e54d4bf7dabae85e3343a85a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 6 Nov 2006 22:46:53 +0000
Subject: [PATCH 407/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@450 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/TODO b/TODO
index 6fa50bc9..d842cefa 100644
--- a/TODO
+++ b/TODO
@@ -13,7 +13,7 @@ Legend:
 # partially done
 * done
 
-- Add gettext support (I8N)
+- Add gettext support (I18N)
 
 - Fix the cPickle issue with Python 2.5
 

From 7659452ade29c719f88269ea401387afdce378dc Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 6 Nov 2006 22:47:24 +0000
Subject: [PATCH 408/549] - Refactoring

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@451 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py      | 1 -
 server/filtergamin.py | 7 ++++---
 server/filterpoll.py  | 7 ++++---
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index afd573c7..8c565f9b 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -56,7 +56,6 @@ class Filter(JailThread):
 		self.jail = jail
 		## The failures manager.
 		self.failManager = FailManager()
-		self.modified = False
 		## The log file handler.
 		self.__crtHandler = None
 		self.__crtFilename = None
diff --git a/server/filtergamin.py b/server/filtergamin.py
index 54c66d74..d0f8adcb 100644
--- a/server/filtergamin.py
+++ b/server/filtergamin.py
@@ -50,6 +50,7 @@ class FilterGamin(Filter):
 	
 	def __init__(self, jail):
 		Filter.__init__(self, jail)
+		self.__modified = False
 		# Gamin monitor
 		self.monitor = gamin.WatchMonitor()
 		logSys.info("Created FilterGamin")
@@ -60,7 +61,7 @@ class FilterGamin(Filter):
 		if event in (gamin.GAMCreated, gamin.GAMChanged, gamin.GAMExists):
 			logSys.debug("File changed: " + path)
 			self.getFailures(path)
-			self.modified = True
+			self.__modified = True
 
 
 	##
@@ -105,14 +106,14 @@ class FilterGamin(Filter):
 				if self.monitor.event_pending():
 					self.monitor.handle_events()
 
-				if self.modified:
+				if self.__modified:
 					try:
 						ticket = self.failManager.toBan()
 						self.jail.putFailTicket(ticket)
 					except FailManagerEmpty:
 						self.failManager.cleanup(MyTime.time())
 					self.dateDetector.sortTemplate()
-					self.modified = False
+					self.__modified = False
 				time.sleep(self.getSleepTime())
 			else:
 				time.sleep(self.getSleepTime())
diff --git a/server/filterpoll.py b/server/filterpoll.py
index 4aa07423..374d957d 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -50,6 +50,7 @@ class FilterPoll(Filter):
 	
 	def __init__(self, jail):
 		Filter.__init__(self, jail)
+		self.__modified = False
 		## The time of the last modification of the file.
 		self.__lastModTime = dict()
 		self.__file404Cnt = dict()
@@ -98,16 +99,16 @@ class FilterPoll(Filter):
 				for f in self.getLogPath():
 					if self.isModified(f):
 						self.getFailures(f)
-						self.modified = True
+						self.__modified = True
 
-				if self.modified:
+				if self.__modified:
 					try:
 						ticket = self.failManager.toBan()
 						self.jail.putFailTicket(ticket)
 					except FailManagerEmpty:
 						self.failManager.cleanup(MyTime.time())
 					self.dateDetector.sortTemplate()
-					self.modified = False
+					self.__modified = False
 				time.sleep(self.getSleepTime())
 			else:
 				time.sleep(self.getSleepTime())

From cdf5ae19db9d4aec742993581e6ad3ec06847e71 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 6 Nov 2006 22:48:46 +0000
Subject: [PATCH 409/549] - Improved synchronization

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@452 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/jail.py        |  70 +++----------
 server/jails.py       |  82 ++++++++++++---
 server/server.py      | 139 +++++++++++++++----------
 server/transmitter.py | 235 +++++++++++++++++++++---------------------
 4 files changed, 292 insertions(+), 234 deletions(-)

diff --git a/server/jail.py b/server/jail.py
index 31d2a419..00d0b96c 100644
--- a/server/jail.py
+++ b/server/jail.py
@@ -27,7 +27,6 @@ __license__ = "GPL"
 import Queue, logging
 
 from actions import Actions
-from threading import Lock
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.jail")
@@ -35,7 +34,6 @@ logSys = logging.getLogger("fail2ban.jail")
 class Jail:
 	
 	def __init__(self, name, backend = "auto"):
-		self.__lock = Lock()
 		self.__name = name
 		self.__queue = Queue.Queue()
 		self.__filter = None
@@ -61,89 +59,51 @@ class Jail:
 		self.__filter = FilterGamin(self)
 	
 	def setName(self, name):
-		self.__lock.acquire()
 		self.__name = name
-		self.__lock.release()
 	
 	def getName(self):
-		try:
-			self.__lock.acquire()
-			return self.__name
-		finally:
-			self.__lock.release()
+		return self.__name
 	
 	def getFilter(self):
-		try:
-			self.__lock.acquire()
-			return self.__filter
-		finally:
-			self.__lock.release()
+		return self.__filter
 	
 	def getAction(self):
-		try:
-			self.__lock.acquire()
-			return self.__action
-		finally:
-			self.__lock.release()
+		return self.__action
 	
 	def putFailTicket(self, ticket):
-		self.__lock.acquire()
 		self.__queue.put(ticket)
-		self.__lock.release()
 	
 	def getFailTicket(self):
 		try:
-			self.__lock.acquire()
-			try:
-				return self.__queue.get(False)
-			except Queue.Empty:
-				return False
-		finally:
-			self.__lock.release()
+			return self.__queue.get(False)
+		except Queue.Empty:
+			return False
 	
 	def start(self):
-		self.__lock.acquire()
 		self.__filter.start()
 		self.__action.start()
-		self.__lock.release()
 	
 	def stop(self):
-		self.__lock.acquire()
 		self.__filter.stop()
 		self.__action.stop()
-		self.__lock.release()
 		self.__filter.join()
 		self.__action.join()
 	
 	def isActive(self):
-		try:
-			self.__lock.acquire()
-			isActive0 = self.__filter.isActive()
-			isActive1 = self.__action.isActive()
-			return isActive0 or isActive1
-		finally:
-			self.__lock.release()
+		isActive0 = self.__filter.isActive()
+		isActive1 = self.__action.isActive()
+		return isActive0 or isActive1
 	
 	def setIdle(self, value):
-		self.__lock.acquire()
 		self.__filter.setIdle(value)
 		self.__action.setIdle(value)
-		self.__lock.release()
 	
 	def getIdle(self):
-		try:
-			self.__lock.acquire()
-			return self.__filter.getIdle() or self.__action.getIdle()
-		finally:
-			self.__lock.release()
+		return self.__filter.getIdle() or self.__action.getIdle()
 	
 	def getStatus(self):
-		try:
-			self.__lock.acquire()
-			fStatus = self.__filter.status()
-			aStatus = self.__action.status()
-			ret = [("filter", fStatus), 
-				   ("action", aStatus)]
-			return ret
-		finally:
-			self.__lock.release()
+		fStatus = self.__filter.status()
+		aStatus = self.__action.status()
+		ret = [("filter", fStatus), 
+			   ("action", aStatus)]
+		return ret
diff --git a/server/jails.py b/server/jails.py
index 8ae2ab67..6a327e1c 100644
--- a/server/jails.py
+++ b/server/jails.py
@@ -28,29 +28,63 @@ __license__ = "GPL"
 from jail import Jail
 from threading import Lock
 
+##
+# Handles the jails.
+#
+# This class handles the jails. Creation, deletion or access to a jail must be
+# done through this class. This class is thread-safe which is not the case of
+# the jail itself, including filter and actions.
+
 class Jails:
 	
+	##
+	# Constructor.
+	
 	def __init__(self):
 		self.__lock = Lock()
 		self.__jails = dict()
 	
+	##
+	# Adds a jail.
+	#
+	# Adds a new jail which should use the given backend. Raises a
+	# <code>DuplicateJailException</code> if the jail is already defined.
+	# @param name The name of the jail
+	# @param backend The backend to use
+	
 	def add(self, name, backend):
-		self.__lock.acquire()
-		if self.__jails.has_key(name):
-			self.__lock.release()
-			raise DuplicateJailException(name)
-		else:
-			self.__jails[name] = Jail(name, backend)
+		try:
+			self.__lock.acquire()
+			if self.__jails.has_key(name):
+				raise DuplicateJailException(name)
+			else:
+				self.__jails[name] = Jail(name, backend)
+		finally:
 			self.__lock.release()
 	
+	##
+	# Removes a jail.
+	#
+	# Removes the jail <code>name</code>. Raise an <code>UnknownJailException</code>
+	# if the jail does not exist.
+	# @param name The name of the jail
+	
 	def remove(self, name):
-		self.__lock.acquire()
-		if self.__jails.has_key(name):
-			del self.__jails[name]
+		try:
+			self.__lock.acquire()
+			if self.__jails.has_key(name):
+				del self.__jails[name]
+			else:
+				raise UnknownJailException(name)
+		finally:
 			self.__lock.release()
-		else:
-			self.__lock.release()
-			raise UnknownJailException(name)
+	
+	##
+	# Returns a jail.
+	#
+	# Returns the jail <code>name</code>. Raise an <code>UnknownJailException</code>
+	# if the jail does not exist.
+	# @param name The name of the jail
 	
 	def get(self, name):
 		try:
@@ -63,6 +97,13 @@ class Jails:
 		finally:
 			self.__lock.release()
 	
+	##
+	# Returns an action class instance.
+	#
+	# Returns the action object of the jail <code>name</code>. Raise an
+	# <code>UnknownJailException</code> if the jail does not exist.
+	# @param name The name of the jail
+	
 	def getAction(self, name):
 		try:
 			self.__lock.acquire()
@@ -74,6 +115,13 @@ class Jails:
 		finally:
 			self.__lock.release()
 	
+	##
+	# Returns a filter class instance.
+	#
+	# Returns the filter object of the jail <code>name</code>. Raise an
+	# <code>UnknownJailException</code> if the jail does not exist.
+	# @param name The name of the jail
+	
 	def getFilter(self, name):
 		try:
 			self.__lock.acquire()
@@ -85,6 +133,11 @@ class Jails:
 		finally:
 			self.__lock.release()
 	
+	##
+	# Returns the jails.
+	#
+	# Returns a copy of the jails list.
+	
 	def getAll(self):
 		try:
 			self.__lock.acquire()
@@ -92,6 +145,11 @@ class Jails:
 		finally:
 			self.__lock.release()
 	
+	##
+	# Returns the size of the jails.
+	#
+	# Returns the number of jails.
+	
 	def size(self):
 		try:
 			self.__lock.acquire()
diff --git a/server/server.py b/server/server.py
index af995f54..88099335 100644
--- a/server/server.py
+++ b/server/server.py
@@ -24,6 +24,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
+from threading import Lock, RLock
 from jails import Jails
 from transmitter import Transmitter
 from ssocket import SSocket
@@ -36,6 +37,8 @@ logSys = logging.getLogger("fail2ban.server")
 class Server:
 
 	def __init__(self, daemon = False):
+		self.__loggingLock = Lock()
+		self.__lock = RLock()
 		self.__jails = Jails()
 		self.__daemon = daemon
 		self.__transm = Transmitter(self)
@@ -91,17 +94,29 @@ class Server:
 		self.__jails.remove(name)
 	
 	def startJail(self, name):
-		if not self.isActive(name):
-			self.__jails.get(name).start()
+		try:
+			self.__lock.acquire()
+			if not self.isActive(name):
+				self.__jails.get(name).start()
+		finally:
+			self.__lock.release()
 	
 	def stopJail(self, name):
-		if self.isActive(name):
-			self.__jails.get(name).stop()
-			self.delJail(name)
+		try:
+			self.__lock.acquire()
+			if self.isActive(name):
+				self.__jails.get(name).stop()
+				self.delJail(name)
+		finally:
+			self.__lock.release()
 	
 	def stopAllJail(self):
-		for jail in self.__jails.getAll():
-			self.stopJail(jail)
+		try:
+			self.__lock.acquire()
+			for jail in self.__jails.getAll():
+				self.stopJail(jail)
+		finally:
+			self.__lock.release()
 	
 	def isActive(self, name):
 		return self.__jails.get(name).isActive()
@@ -225,15 +240,19 @@ class Server:
 		
 	# Status
 	def status(self):
-		jailList = ''
-		for jail in self.__jails.getAll():
-			jailList += jail + ', '
-		length = len(jailList)
-		if not length == 0:
-			jailList = jailList[:length-2]
-		ret = [("Number of jail", self.__jails.size()), 
-			   ("Jail list", jailList)]
-		return ret
+		try:
+			self.__lock.acquire()
+			jailList = ''
+			for jail in self.__jails.getAll():
+				jailList += jail + ', '
+			length = len(jailList)
+			if not length == 0:
+				jailList = jailList[:length-2]
+			ret = [("Number of jail", self.__jails.size()), 
+				   ("Jail list", jailList)]
+			return ret
+		finally:
+			self.__lock.release()
 	
 	def statusJail(self, name):
 		return self.__jails.get(name).getStatus()
@@ -252,17 +271,21 @@ class Server:
 	# @param value the level
 	
 	def setLogLevel(self, value):
-		self.__logLevel = value
-		logLevel = logging.DEBUG
-		if value == 0:
-			logLevel = logging.FATAL
-		elif value == 1:
-			logLevel = logging.ERROR
-		elif value == 2:
-			logLevel = logging.WARNING
-		elif value == 3:
-			logLevel = logging.INFO
-		logging.getLogger("fail2ban").setLevel(logLevel)
+		try:
+			self.__loggingLock.acquire()
+			self.__logLevel = value
+			logLevel = logging.DEBUG
+			if value == 0:
+				logLevel = logging.FATAL
+			elif value == 1:
+				logLevel = logging.ERROR
+			elif value == 2:
+				logLevel = logging.WARNING
+			elif value == 3:
+				logLevel = logging.INFO
+			logging.getLogger("fail2ban").setLevel(logLevel)
+		finally:
+			self.__loggingLock.release()
 	
 	##
 	# Get the logging level.
@@ -271,35 +294,47 @@ class Server:
 	# @return the log level
 	
 	def getLogLevel(self):
-		return self.__logLevel
+		try:
+			self.__loggingLock.acquire()
+			return self.__logLevel
+		finally:
+			self.__loggingLock.release()
 	
 	def setLogTarget(self, target):
-		# Remove previous handler
-		logging.getLogger("fail2ban").handlers = []
-		self.__logTarget = target
-		if target == "SYSLOG":
-			hdlr = logging.handlers.SysLogHandler()
-		elif target == "STDOUT":
-			hdlr = logging.StreamHandler(sys.stdout)
-		elif target == "STDERR":
-			hdlr = logging.StreamHandler(sys.stderr)
-		else:
-			# Target should be a file
-			try:
-				open(target, "a")
-				hdlr = logging.FileHandler(target)
-			except IOError:
-				logSys.error("Unable to log to " + target)
-				return False
-		# set a format which is simpler for console use
-		formatter = logging.Formatter("%(asctime)s %(name)-16s: %(levelname)-6s %(message)s")
-		# tell the handler to use this format
-		hdlr.setFormatter(formatter)
-		logging.getLogger("fail2ban").addHandler(hdlr)
-		return True
+		try:
+			self.__loggingLock.acquire()
+			# Remove previous handler
+			logging.getLogger("fail2ban").handlers = []
+			if target == "SYSLOG":
+				hdlr = logging.handlers.SysLogHandler()
+			elif target == "STDOUT":
+				hdlr = logging.StreamHandler(sys.stdout)
+			elif target == "STDERR":
+				hdlr = logging.StreamHandler(sys.stderr)
+			else:
+				# Target should be a file
+				try:
+					open(target, "a")
+					hdlr = logging.FileHandler(target)
+				except IOError:
+					logSys.error("Unable to log to " + target)
+					return False
+			self.__logTarget = target
+			# set a format which is simpler for console use
+			formatter = logging.Formatter("%(asctime)s %(name)-16s: %(levelname)-6s %(message)s")
+			# tell the handler to use this format
+			hdlr.setFormatter(formatter)
+			logging.getLogger("fail2ban").addHandler(hdlr)
+			return True
+		finally:
+			self.__loggingLock.release()
 	
 	def getLogTarget(self):
-		return self.__logTarget
+		try:
+			self.__loggingLock.acquire()
+			return self.__logTarget
+		finally:
+			self.__loggingLock.release()
 	
 	def __createDaemon(self):
 		""" Detach a process from the controlling terminal and run it in the
diff --git a/server/transmitter.py b/server/transmitter.py
index 64ad3919..f6051597 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -24,7 +24,6 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-from threading import Lock
 import logging, time
 
 # Gets the instance of the logger.
@@ -32,229 +31,235 @@ logSys = logging.getLogger("fail2ban.comm")
 
 class Transmitter:
 	
+	##
+	# Constructor.
+	#
+	# @param The server reference
+	
 	def __init__(self, server):
-		self.__lock = Lock()
 		self.__server = server
 		
-	def proceed(self, action):
+	##
+	# Proceeds a command.
+	#
+	# Proceeds an incoming command.
+	# @param command The incoming command
+	
+	def proceed(self, command):
 		# Deserialize object
+		logSys.debug("Command: " + `command`)
 		try:
-			self.__lock.acquire()
-			logSys.debug("Action: " + `action`)
-			try:
-				ret = self.__actionHandler(action)
-				ack = 0, ret
-			except Exception, e:
-				logSys.warn("Invalid command: " + `action`)
-				ack = 1, e
-			return ack
-		finally:
-			self.__lock.release()
+			ret = self.__commandHandler(command)
+			ack = 0, ret
+		except Exception, e:
+			logSys.warn("Invalid command: " + `command`)
+			ack = 1, e
+		return ack
 	
 	##
-	# Handle an action.
+	# Handle an command.
 	#
 	# 
 	
-	def __actionHandler(self, action):
-		if action[0] == "ping":
+	def __commandHandler(self, command):
+		if command[0] == "ping":
 			return "pong"
-		elif action[0] == "add":
-			name = action[1]
+		elif command[0] == "add":
+			name = command[1]
 			if name == "all":
 				raise Exception("Reserved name")
 			try:
-				backend = action[2]
+				backend = command[2]
 			except IndexError:
 				backend = "auto"
 			self.__server.addJail(name, backend)
 			return name
-		elif action[0] == "start":
-			name = action[1]
+		elif command[0] == "start":
+			name = command[1]
 			self.__server.startJail(name)
 			return None
-		elif action[0] == "stop":
-			if len(action) == 1:
+		elif command[0] == "stop":
+			if len(command) == 1:
 				self.__server.quit()
-			elif action[1] == "all":
+			elif command[1] == "all":
 				self.__server.stopAllJail()
 			else:
-				name = action[1]
+				name = command[1]
 				self.__server.stopJail(name)
 			return None
-		elif action[0] == "sleep":
-			value = action[1]
+		elif command[0] == "sleep":
+			value = command[1]
 			time.sleep(int(value))
 			return None
-		elif action[0] == "set":
-			return self.__actionSet(action[1:])
-		elif action[0] == "get":
-			return self.__actionGet(action[1:])
-		elif action[0] == "status":
-			return self.status(action[1:])			
+		elif command[0] == "set":
+			return self.__commandSet(command[1:])
+		elif command[0] == "get":
+			return self.__commandGet(command[1:])
+		elif command[0] == "status":
+			return self.status(command[1:])			
 		raise Exception("Invalid command")
 	
-	def __actionSet(self, action):
-		name = action[0]
+	def __commandSet(self, command):
+		name = command[0]
 		# Logging
 		if name == "loglevel":
-			value = int(action[1])
+			value = int(command[1])
 			self.__server.setLogLevel(value)
 			return self.__server.getLogLevel()
 		elif name == "logtarget":
-			value = action[1]
+			value = command[1]
 			self.__server.setLogTarget(value)
 			return self.__server.getLogTarget()
 		# Jail
-		elif action[1] == "idle":
-			if action[2] == "on":
+		elif command[1] == "idle":
+			if command[2] == "on":
 				self.__server.setIdleJail(name, True)
-			elif action[2] == "off":
+			elif command[2] == "off":
 				self.__server.setIdleJail(name, False)
 			return self.__server.getIdleJail(name)
 		# Filter
-		elif action[1] == "addignoreip":
-			value = action[2]
+		elif command[1] == "addignoreip":
+			value = command[2]
 			self.__server.addIgnoreIP(name, value)
 			return self.__server.getIgnoreIP(name)
-		elif action[1] == "delignoreip":
-			value = action[2]
+		elif command[1] == "delignoreip":
+			value = command[2]
 			self.__server.delIgnoreIP(name, value)
 			return self.__server.getIgnoreIP(name)
-		elif action[1] == "addlogpath":
-			value = action[2:]
+		elif command[1] == "addlogpath":
+			value = command[2:]
 			for path in value:
 				self.__server.addLogPath(name, path)
 			return self.__server.getLogPath(name)
-		elif action[1] == "dellogpath":
-			value = action[2]
+		elif command[1] == "dellogpath":
+			value = command[2]
 			self.__server.delLogPath(name, value)
 			return self.__server.getLogPath(name)
-		elif action[1] == "timeregex":
-			value = action[2]
+		elif command[1] == "timeregex":
+			value = command[2]
 			self.__server.setTimeRegex(name, value)
 			return self.__server.getTimeRegex(name)
-		elif action[1] == "timepattern":
-			value = action[2]
+		elif command[1] == "timepattern":
+			value = command[2]
 			self.__server.setTimePattern(name, value)
 			return self.__server.getTimePattern(name)
-		elif action[1] == "failregex":
-			value = action[2]
+		elif command[1] == "failregex":
+			value = command[2]
 			self.__server.setFailRegex(name, value)
 			return self.__server.getFailRegex(name)
-		elif action[1] == "maxtime":
-			value = action[2]
+		elif command[1] == "maxtime":
+			value = command[2]
 			self.__server.setMaxTime(name, int(value))
 			return self.__server.getMaxTime(name)
-		elif action[1] == "findtime":
-			value = action[2]
+		elif command[1] == "findtime":
+			value = command[2]
 			self.__server.setFindTime(name, int(value))
 			return self.__server.getFindTime(name)
-		elif action[1] == "maxretry":
-			value = action[2]
+		elif command[1] == "maxretry":
+			value = command[2]
 			self.__server.setMaxRetry(name, int(value))
 			return self.__server.getMaxRetry(name)
-		# Action
-		elif action[1] == "bantime":
-			value = action[2]
+		# command
+		elif command[1] == "bantime":
+			value = command[2]
 			self.__server.setBanTime(name, int(value))
 			return self.__server.getBanTime(name)
-		elif action[1] == "addaction":
-			value = action[2]
+		elif command[1] == "addaction":
+			value = command[2]
 			self.__server.addAction(name, value)
-			return self.__server.getLastAction(name).getName()
-		elif action[1] == "delaction":
+			return self.__server.getLastcommand(name).getName()
+		elif command[1] == "delaction":
 			self.__server.delAction(name, value)
 			return None
-		elif action[1] == "setcinfo":
-			act = action[2]
-			key = action[3]
-			value = action[4]
+		elif command[1] == "setcinfo":
+			act = command[2]
+			key = command[3]
+			value = command[4]
 			self.__server.setCInfo(name, act, key, value)
 			return self.__server.getCInfo(name, act, key)
-		elif action[1] == "delcinfo":
-			act = action[2]
-			key = action[3]
+		elif command[1] == "delcinfo":
+			act = command[2]
+			key = command[3]
 			self.__server.delCInfo(name, act, key)
 			return None
-		elif action[1] == "actionstart":
-			act = action[2]
-			value = action[3]
+		elif command[1] == "actionstart":
+			act = command[2]
+			value = command[3]
 			self.__server.setActionStart(name, act, value)
 			return self.__server.getActionStart(name, act)
-		elif action[1] == "actionstop":
-			act = action[2]
-			value = action[3]
+		elif command[1] == "actionstop":
+			act = command[2]
+			value = command[3]
 			self.__server.setActionStop(name, act, value)
 			return self.__server.getActionStop(name, act)
-		elif action[1] == "actioncheck":
-			act = action[2]
-			value = action[3]
+		elif command[1] == "actioncheck":
+			act = command[2]
+			value = command[3]
 			self.__server.setActionCheck(name, act, value)
 			return self.__server.getActionCheck(name, act)
-		elif action[1] == "actionban":
-			act = action[2]
-			value = action[3]
+		elif command[1] == "actionban":
+			act = command[2]
+			value = command[3]
 			self.__server.setActionBan(name, act, value)
 			return self.__server.getActionBan(name, act)
-		elif action[1] == "actionunban":
-			act = action[2]
-			value = action[3]
+		elif command[1] == "actionunban":
+			act = command[2]
+			value = command[3]
 			self.__server.setActionUnban(name, act, value)
 			return self.__server.getActionUnban(name, act)
 		raise Exception("Invalid command (no set action or not yet implemented)")
 	
-	def __actionGet(self, action):
-		name = action[0]
+	def __commandGet(self, command):
+		name = command[0]
 		# Logging
 		if name == "loglevel":
 			return self.__server.getLogLevel()
 		elif name == "logtarget":
 			return self.__server.getLogTarget()
 		# Filter
-		elif action[1] == "logpath":
+		elif command[1] == "logpath":
 			return self.__server.getLogPath(name)
-		elif action[1] == "ignoreip":
+		elif command[1] == "ignoreip":
 			return self.__server.getIgnoreIP(name)
-		elif action[1] == "timeregex":
+		elif command[1] == "timeregex":
 			return self.__server.getTimeRegex(name)
-		elif action[1] == "timepattern":
+		elif command[1] == "timepattern":
 			return self.__server.getTimePattern(name)
-		elif action[1] == "failregex":
+		elif command[1] == "failregex":
 			return self.__server.getFailRegex(name)
-		elif action[1] == "maxtime":
+		elif command[1] == "maxtime":
 			return self.__server.getMaxTime(name)
-		elif action[1] == "findtime":
+		elif command[1] == "findtime":
 			return self.__server.getFindTime(name)
-		elif action[1] == "maxretry":
+		elif command[1] == "maxretry":
 			return self.__server.getMaxRetry(name)
 		# Action
-		elif action[1] == "bantime":
+		elif command[1] == "bantime":
 			return self.__server.getBanTime(name)
-		elif action[1] == "addaction":
+		elif command[1] == "addaction":
 			return self.__server.getLastAction(name).getName()
-		elif action[1] == "actionstart":
-			act = action[2]
+		elif command[1] == "actionstart":
+			act = command[2]
 			return self.__server.getActionStart(name, act)
-		elif action[1] == "actionstop":
-			act = action[2]
+		elif command[1] == "actionstop":
+			act = command[2]
 			return self.__server.getActionStop(name, act)
-		elif action[1] == "actioncheck":
-			act = action[2]
+		elif command[1] == "actioncheck":
+			act = command[2]
 			return self.__server.getActionCheck(name, act)
-		elif action[1] == "actionban":
-			act = action[2]
+		elif command[1] == "actionban":
+			act = command[2]
 			return self.__server.getActionBan(name, act)
-		elif action[1] == "actionunban":
-			act = action[2]
+		elif command[1] == "actionunban":
+			act = command[2]
 			return self.__server.getActionUnban(name, act)
 		raise Exception("Invalid command (no get action or not yet implemented)")
 	
-	def status(self, action):
-		if len(action) == 0:
+	def status(self, command):
+		if len(command) == 0:
 			return self.__server.status()
 		else:
-			name = action[0]
+			name = command[0]
 			return self.__server.statusJail(name)
 		raise Exception("Invalid command (no status)")
 	
\ No newline at end of file

From 32b33c8ae4f66ec0963ab9f853170903f676e473 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 12 Nov 2006 10:52:42 +0000
Subject: [PATCH 410/549] - Fixed refactoring bug

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@453 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/transmitter.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/transmitter.py b/server/transmitter.py
index f6051597..34888863 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -167,7 +167,7 @@ class Transmitter:
 		elif command[1] == "addaction":
 			value = command[2]
 			self.__server.addAction(name, value)
-			return self.__server.getLastcommand(name).getName()
+			return self.__server.getLastAction(name).getName()
 		elif command[1] == "delaction":
 			self.__server.delAction(name, value)
 			return None

From f8989581b457eb2d1c28c1c532da430d5e3419af Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 12 Nov 2006 10:54:19 +0000
Subject: [PATCH 411/549] - Replaced loop with list comprehension

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@454 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/banmanager.py | 27 +++++++++++----------------
 1 file changed, 11 insertions(+), 16 deletions(-)

diff --git a/server/banmanager.py b/server/banmanager.py
index 88be86a2..dd7791d7 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -136,14 +136,6 @@ class BanManager:
 		finally:
 			self.__lock.release()
 	
-	##
-	# Delete a ban ticket.
-	#
-	# Remove a BanTicket from the ban list.
-	# @param ticket the ticket
-	
-	def __delBanTicket(self, ticket):
-		self.__banList.remove(ticket)
 	
 	##
 	# Get the size of the ban list.
@@ -177,20 +169,23 @@ class BanManager:
 	# Return a list of BanTicket which need to be unbanned.
 	# @param time the time
 	# @return the list of ticket to unban
-	# @todo Check the delete operation
 	
 	def unBanList(self, time):
 		try:
 			self.__lock.acquire()
-			uBList = list()
 			# Permanent banning
 			if self.__banTime < 0:
-				return uBList
-			for ticket in self.__banList:
-				if ticket.getTime() < time - self.__banTime:
-					uBList.append(ticket)
-					self.__delBanTicket(ticket)
-			return uBList
+				return list()
+
+			# Gets the list of ticket to remove.
+			unBanList = [ticket for ticket in self.__banList
+						 if ticket.getTime() < time - self.__banTime]
+			
+			# Removes tickets.
+			self.__banList = [ticket for ticket in self.__banList
+							  if ticket not in unBanList]
+						
+			return unBanList
 		finally:
 			self.__lock.release()
 	

From d6e49f8480bb8021661d976c82a21c44e10c39da Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 12 Nov 2006 10:56:21 +0000
Subject: [PATCH 412/549] - Fixed rebanned bug - Clarified available tags

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@455 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/dummy.conf      |  9 +++----
 config/action.d/hostsdeny.conf  |  7 +++---
 config/action.d/ipfw.conf       |  7 +++---
 config/action.d/iptables.conf   |  7 +++---
 config/action.d/mail-whois.conf |  7 +++---
 config/action.d/mail.conf       |  7 +++---
 config/action.d/shorewall.conf  |  7 +++---
 server/actions.py               | 44 +++++++++++++++++++++------------
 8 files changed, 50 insertions(+), 45 deletions(-)

diff --git a/config/action.d/dummy.conf b/config/action.d/dummy.conf
index 21b7fa9d..5737c372 100644
--- a/config/action.d/dummy.conf
+++ b/config/action.d/dummy.conf
@@ -18,7 +18,7 @@ actionstart = touch /tmp/fail2ban.dummy
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = rm /tmp/fail2ban.dummy
+actionstop = rm -f /tmp/fail2ban.dummy
 
 # Option:  fwcheck
 # Notes.:  command executed once before each fwban command
@@ -31,8 +31,7 @@ actioncheck =
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
 #          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
 actionban = echo "+<ip>" >> /tmp/fail2ban.dummy
@@ -41,8 +40,8 @@ actionban = echo "+<ip>" >> /tmp/fail2ban.dummy
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
 actionunban = echo "-<ip>" >> /tmp/fail2ban.dummy
diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf
index f87ecb5a..7f63ff9b 100644
--- a/config/action.d/hostsdeny.conf
+++ b/config/action.d/hostsdeny.conf
@@ -30,8 +30,7 @@ actioncheck =
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
 #          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
 actionban = IP=<ip> &&
@@ -41,8 +40,8 @@ actionban = IP=<ip> &&
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
 actionunban = IP=<ip> &&
diff --git a/config/action.d/ipfw.conf b/config/action.d/ipfw.conf
index 2f4de5a5..1828eef9 100644
--- a/config/action.d/ipfw.conf
+++ b/config/action.d/ipfw.conf
@@ -34,8 +34,7 @@ actioncheck =
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
 #          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
 actionban = ipfw add deny tcp from <ip> to <localhost> <port>
@@ -45,8 +44,8 @@ actionban = ipfw add deny tcp from <ip> to <localhost> <port>
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
 actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf
index fe55731f..27809e13 100644
--- a/config/action.d/iptables.conf
+++ b/config/action.d/iptables.conf
@@ -34,8 +34,7 @@ actioncheck = iptables -L INPUT | grep -q fail2ban-<name>
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
 #          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
 actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
@@ -44,8 +43,8 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
 actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf
index fc21065f..abc4f790 100644
--- a/config/action.d/mail-whois.conf
+++ b/config/action.d/mail-whois.conf
@@ -36,8 +36,7 @@ actioncheck =
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
 #          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
 actionban = echo -en "Hi,\n
@@ -52,8 +51,8 @@ actionban = echo -en "Hi,\n
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
 actionunban = 
diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf
index 90295906..871800f5 100644
--- a/config/action.d/mail.conf
+++ b/config/action.d/mail.conf
@@ -36,8 +36,7 @@ actioncheck =
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
 #          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
 actionban = echo -en "Hi,\n
@@ -50,8 +49,8 @@ actionban = echo -en "Hi,\n
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
 actionunban = 
diff --git a/config/action.d/shorewall.conf b/config/action.d/shorewall.conf
index 984f91b2..f0da70ee 100644
--- a/config/action.d/shorewall.conf
+++ b/config/action.d/shorewall.conf
@@ -30,8 +30,7 @@ actioncheck =
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
 #          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
 actionban = shorewall reject <ip>
@@ -40,8 +39,8 @@ actionban = shorewall reject <ip>
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
 actionunban = shorewall allow <ip>
diff --git a/server/actions.py b/server/actions.py
index 50230de3..c5f9d25b 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -134,11 +134,15 @@ class Actions(JailThread):
 			bTicket = BanManager.createBanTicket(ticket)
 			aInfo["ip"] = bTicket.getIP()
 			aInfo["failures"] = bTicket.getAttempt()
-			logSys.warn("[%s] Ban %s" % (self.jail.getName(), aInfo["ip"]))
-			for action in self.__actions:
-				action.execActionBan(aInfo)
-			self.__banManager.addBanTicket(bTicket)
-			return True
+			aInfo["time"] = bTicket.getTime()
+			if self.__banManager.addBanTicket(bTicket):
+				logSys.warn("[%s] Ban %s" % (self.jail.getName(), aInfo["ip"]))
+				for action in self.__actions:
+					action.execActionBan(aInfo)
+				return True
+			else:
+				logSys.warn("[%s] %s already banned" % (self.jail.getName(), 
+														aInfo["ip"]))
 		return False
 	
 	##
@@ -148,11 +152,7 @@ class Actions(JailThread):
 	
 	def __checkUnBan(self):
 		for ticket in self.__banManager.unBanList(MyTime.time()):
-			aInfo = dict()
-			aInfo["ip"] = ticket.getIP()
-			logSys.warn("[%s] Unban %s" % (self.jail.getName(), aInfo["ip"]))
-			for action in self.__actions:
-				action.execActionUnban(aInfo)
+			self.__unBan(ticket)
 	
 	##
 	# Flush the ban list.
@@ -162,11 +162,23 @@ class Actions(JailThread):
 	def __flushBan(self):
 		logSys.debug("Flush ban list")
 		for ticket in self.__banManager.flushBanList():
-			aInfo = dict()
-			aInfo["ip"] = ticket.getIP()
-			logSys.warn("[%s] Unban %s" % (self.jail.getName(), aInfo["ip"]))
-			for action in self.__actions:
-				action.execActionUnban(aInfo)
+			self.__unBan(ticket)
+	
+	##
+	# Unbans host corresponding to the ticket.
+	#
+	# Executes the actions in order to unban the host given in the
+	# ticket.
+	
+	def __unBan(self, ticket):
+		aInfo = dict()
+		aInfo["ip"] = ticket.getIP()
+		aInfo["failures"] = ticket.getAttempt()
+		aInfo["time"] = ticket.getTime()
+		logSys.warn("[%s] Unban %s" % (self.jail.getName(), aInfo["ip"]))
+		for action in self.__actions:
+			action.execActionUnban(aInfo)
+			
 	
 	##
 	# Get the status of the filter.
@@ -176,7 +188,7 @@ class Actions(JailThread):
 	# @return a list with tuple
 	
 	def status(self):
-		ret = [("Currently banned", self.__banManager.size()),
+		ret = [("Currently banned", self.__banManager.size()), 
 			   ("Total banned", self.__banManager.getBanTotal())]
 		return ret
 		
\ No newline at end of file

From 658d03af529e21da1ed40fcd55bf490d83987803 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 12 Nov 2006 10:56:40 +0000
Subject: [PATCH 413/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@456 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG  | 10 +++++++++-
 version.py |  2 +-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 10fa5ac8..3ab96aea 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,17 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.4)                           2006/11/01
+Fail2Ban (version 0.7.5)                           2006/??/??
 =============================================================
 
+ver. 0.7.5 (2006/??/??) - ???
+----------
+- Do not ban a host that is currently banned. Thanks to
+  Yaroslav Halchenko
+- The supported tags in "action(un)ban" are <ip>, <failures>
+  and <time>
+- Fixed refactoring bug (getLastcommand -> getLastAction)
+
 ver. 0.7.4 (2006/11/01) - beta
 ----------
 - Improved configuration files. Thanks to Yaroslav Halchenko
diff --git a/version.py b/version.py
index 5bae999c..c3e0b276 100644
--- a/version.py
+++ b/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.4"
+version = "0.7.4-SVN"

From 1f64fadb7ddd3956f44e42aa5b86b93b75eb77e3 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 12 Nov 2006 11:09:04 +0000
Subject: [PATCH 414/549] - Added pydev configuration file

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@457 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 .pydevproject | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 .pydevproject

diff --git a/.pydevproject b/.pydevproject
new file mode 100644
index 00000000..c4ae6c59
--- /dev/null
+++ b/.pydevproject
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<?eclipse-pydev version="1.0"?>
+
+<pydev_project>
+<pydev_property name="org.python.pydev.PYTHON_PROJECT_VERSION">python 2.4</pydev_property>
+<pydev_pathproperty name="org.python.pydev.PROJECT_SOURCE_PATH">
+<path>/fail2ban-unstable/client</path>
+<path>/fail2ban-unstable/server</path>
+<path>/fail2ban-unstable/testcases</path>
+</pydev_pathproperty>
+</pydev_project>

From 90359ba5231ceda46f1c25ba9b781c5cd33c7a92 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 12 Nov 2006 14:52:36 +0000
Subject: [PATCH 415/549] - Added option "ignoreregex" in filter scripts and
 jail.conf. Feature Request #1283304

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@458 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                            |  2 +
 client/configreader.py               |  4 +-
 client/filterreader.py               |  5 +-
 client/jailreader.py                 |  6 +++
 config/filter.d/apache-auth.conf     |  6 +++
 config/filter.d/apache-noscript.conf |  6 +++
 config/filter.d/courierlogin.conf    |  6 +++
 config/filter.d/couriersmtp.conf     |  6 +++
 config/filter.d/postfix.conf         |  6 +++
 config/filter.d/proftpd.conf         |  6 +++
 config/filter.d/qmail.conf           |  6 +++
 config/filter.d/sasl.conf            |  6 +++
 config/filter.d/sshd.conf            |  5 ++
 config/filter.d/vsftpd.conf          |  6 +++
 config/jail.conf                     | 14 ++---
 server/filter.py                     | 79 +++++++++++++++++++++-------
 server/server.py                     |  6 +++
 server/transmitter.py                |  6 +++
 18 files changed, 154 insertions(+), 27 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 3ab96aea..46a3f1f8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -14,6 +14,8 @@ ver. 0.7.5 (2006/??/??) - ???
 - The supported tags in "action(un)ban" are <ip>, <failures>
   and <time>
 - Fixed refactoring bug (getLastcommand -> getLastAction)
+- Added option "ignoreregex" in filter scripts and jail.conf.
+  Feature Request #1283304
 
 ver. 0.7.4 (2006/11/01) - beta
 ----------
diff --git a/client/configreader.py b/client/configreader.py
index 7f129ced..1185bb65 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -69,6 +69,7 @@ class ConfigReader(SafeConfigParser):
 	# 0 -> the type of the option
 	# 1 -> the name of the option
 	# 2 -> the default value for the option
+	
 	def getOptions(self, sec, options, pOptions = None):
 		values = dict()
 		for option in options:
@@ -88,7 +89,8 @@ class ConfigReader(SafeConfigParser):
 				values[option[1]] = option[2]
 			except NoOptionError:
 				if not option[2] == None:
-					logSys.warn("No '" + option[1] + "' defined in '" + sec + "'")
+					logSys.warn("'%s' not defined in '%s'. Using default value"
+								% (option[1], sec))
 					values[option[1]] = option[2]
 			except ValueError:
 				logSys.warn("Wrong value for '" + option[1] + "' in '" + sec +
diff --git a/client/filterreader.py b/client/filterreader.py
index 7e14dc5c..14ffbb91 100644
--- a/client/filterreader.py
+++ b/client/filterreader.py
@@ -55,6 +55,7 @@ class FilterReader(ConfigReader):
 	def getOptions(self, pOpts):
 		opts = [["string", "timeregex", None],
 				["string", "timepattern", None],
+				["string", "ignoreregex", ""],
 				["string", "failregex", ""]]
 		self.__opts = ConfigReader.getOptions(self, "Definition", opts, pOpts)
 	
@@ -66,6 +67,8 @@ class FilterReader(ConfigReader):
 			elif opt == "timepattern":
 				stream.append(["set", self.__name, "timepattern", self.__opts[opt]])
 			elif opt == "failregex":
-				stream.append(["set", self.__name, "failregex", self.__opts[opt]])		
+				stream.append(["set", self.__name, "failregex", self.__opts[opt]])
+			elif opt == "ignoreregex":
+				stream.append(["set", self.__name, "ignoreregex", self.__opts[opt]])		
 		return stream
 		
\ No newline at end of file
diff --git a/client/jailreader.py b/client/jailreader.py
index 23b39c77..34bb1e8d 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -62,6 +62,8 @@ class JailReader(ConfigReader):
 				["int", "maxretry", 3],
 				["int", "maxtime", 600],
 				["int", "bantime", 600],
+				["string", "failregex", None],
+				["string", "ignoreregex", None],
 				["string", "ignoreip", None],
 				["string", "filter", ""],
 				["string", "action", ""]]
@@ -115,6 +117,10 @@ class JailReader(ConfigReader):
 				stream.append(["set", self.__name, "maxtime", self.__opts[opt]])
 			elif opt == "bantime":
 				stream.append(["set", self.__name, "bantime", self.__opts[opt]])
+			elif opt == "failregex":
+				stream.append(["set", self.__name, "failregex", self.__opts[opt]])
+			elif opt == "ignoreregex":
+				stream.append(["set", self.__name, "ignoreregex", self.__opts[opt]])
 		stream.extend(self.__filter.convert())
 		for action in self.__actions:
 			stream.extend(action.convert())
diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index ac3a0256..73097938 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -12,3 +12,9 @@
 # Values:  TEXT
 #
 failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+#ignoreregex = user: myusername
diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
index 1d366045..cd71df8f 100644
--- a/config/filter.d/apache-noscript.conf
+++ b/config/filter.d/apache-noscript.conf
@@ -12,3 +12,9 @@
 # Values:  TEXT
 #
 failregex = [[]client (?P<host>\S*)[]] File does not exist: .*(\.php|\.asp)
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+#ignoreregex = user: myusername
diff --git a/config/filter.d/courierlogin.conf b/config/filter.d/courierlogin.conf
index 5b8dac6f..5656368d 100644
--- a/config/filter.d/courierlogin.conf
+++ b/config/filter.d/courierlogin.conf
@@ -13,3 +13,9 @@
 # Values:  TEXT
 #
 failregex = LOGIN FAILED, ip=\[::ffff:(?P<host>\S*)\]$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+#ignoreregex = user: myusername
diff --git a/config/filter.d/couriersmtp.conf b/config/filter.d/couriersmtp.conf
index 29242a34..d0d2e63d 100644
--- a/config/filter.d/couriersmtp.conf
+++ b/config/filter.d/couriersmtp.conf
@@ -12,3 +12,9 @@
 # Values:  TEXT
 #
 failregex = error,relay=(?:::f{4,6}:)?(?P<host>\S*),.*550 User unknown
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+#ignoreregex = user: myusername
diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf
index 1fded787..c0850eb9 100644
--- a/config/filter.d/postfix.conf
+++ b/config/filter.d/postfix.conf
@@ -12,3 +12,9 @@
 # Values:  TEXT
 #
 failregex = reject: RCPT from (.*)\[(?P<host>\S*)\]: 554
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+#ignoreregex = user: myusername
diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index 3254e198..f0b82167 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -12,3 +12,9 @@
 # Values: TEXT
 #
 failregex = USER \S+: no such user found from \S* ?\[(?P<host>\S+)\] to \S+\s*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+#ignoreregex = user: myusername
diff --git a/config/filter.d/qmail.conf b/config/filter.d/qmail.conf
index 58c6bd05..c958c22d 100644
--- a/config/filter.d/qmail.conf
+++ b/config/filter.d/qmail.conf
@@ -12,3 +12,9 @@
 # Values:  TEXT
 #
 failregex = (?:[\d,.]+[\d,.] rblsmtpd: |421 badiprbl: ip )(?P<host>\S*)
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+#ignoreregex = user: myusername
diff --git a/config/filter.d/sasl.conf b/config/filter.d/sasl.conf
index 3a675fbd..005dcb28 100644
--- a/config/filter.d/sasl.conf
+++ b/config/filter.d/sasl.conf
@@ -12,3 +12,9 @@
 # Values: TEXT
 #
 failregex = : warning: [-._\w]+\[(?P<host>[.\d]+)\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+#ignoreregex = user: myusername
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 92552674..3003c856 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -13,3 +13,8 @@
 #
 failregex = (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
 
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+#ignoreregex = user: myusername
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index 0b7cd843..fd8f0ab4 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -12,3 +12,9 @@
 # Values: TEXT
 #
 failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S*)
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+#ignoreregex = user: myusername
diff --git a/config/jail.conf b/config/jail.conf
index d915de8c..53d446dd 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -66,15 +66,17 @@ action   = iptables[name=SSH, port=ssh, protocol=tcp]
 logpath  = /var/log/sshd.log
 maxretry = 5
 
-# Here we use TCP-Wrappers instead of Netfilter/Iptables.
+# Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
+# used to avoid banning the user "myuser".
 
 [ssh-tcpwrapper]
 
-enabled  = false
-filter   = sshd
-action   = hostsdeny
-           mail-whois[name=SSH, dest=yourmail@mail.com]
-logpath  = /var/log/sshd.log
+enabled     = false
+filter      = sshd
+action      = hostsdeny
+              mail-whois[name=SSH, dest=yourmail@mail.com]
+ignoreregex = for myuser from
+logpath     = /var/log/sshd.log
 
 # This jail demonstrates the use of wildcards in "logpath".
 # Moreover, it is possible to give other files on a new line.
diff --git a/server/filter.py b/server/filter.py
index 8c565f9b..3c468f52 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -64,6 +64,9 @@ class Filter(JailThread):
 		## The regular expression matching the failure.
 		self.__failRegex = ''
 		self.__failRegexObj = None
+		## The regular expression with expression to ignore.
+		self.__ignoreRegex = ''
+		self.__ignoreRegexObj = None
 		## The amount of time to look back.
 		self.__findTime = 6000
 		## The ignore IP list.
@@ -163,7 +166,10 @@ class Filter(JailThread):
 	
 	def setFailRegex(self, value):
 		try:
-			self.__failRegexObj = re.compile(value)
+			if value.lstrip() == '':
+				self.__failRegexObj = None
+			else:
+				self.__failRegexObj = re.compile(value)
 			self.__failRegex = value
 			logSys.info("Set failregex = %s" % value)
 		except sre_constants.error:
@@ -177,6 +183,32 @@ class Filter(JailThread):
 	def getFailRegex(self):
 		return self.__failRegex
 	
+	##
+	# Set the regular expression which matches the failure.
+	#
+	# The regular expression can also match any other pattern than failures
+	# and thus can be used for many purporse.
+	# @param value the regular expression
+	
+	def setIgnoreRegex(self, value):
+		try:
+			if value.lstrip() == '':
+				self.__ignoreRegexObj = None
+			else:
+				self.__ignoreRegexObj = re.compile(value)
+			self.__ignoreRegex = value
+			logSys.info("Set ignoreregex = %s" % value)
+		except sre_constants.error:
+			logSys.error("Unable to compile regular expression " + value)
+	
+	##
+	# Get the regular expression which matches the failure.
+	#
+	# @return the regular expression
+	
+	def getIgnoreRegex(self):
+		return self.__ignoreRegex
+	
 	##
 	# Set the time needed to find a failure.
 	#
@@ -393,26 +425,35 @@ class Filter(JailThread):
 
 	def findFailure(self, line):
 		failList = list()
+		# Checks if failregex is defined.
 		if self.__failRegexObj == None:
 			logSys.error("No failregex is set")
-		else:
-			match = self.__failRegexObj.search(line)
+			return failList
+		# Checks if ignoreregex is defined.
+		if not self.__ignoreRegexObj == None:
+			match = self.__ignoreRegexObj.search(line)
 			if match:
-				date = self.dateDetector.getUnixTime(match.string)
-				if date == None:
-					logSys.debug("Found a match but no valid date/time found "
-								 + "for " + match.string + ". Please contact "
-								 + "the author in order to get support for "
-								 + "this format")
-				else:
-					try:
-						ipMatch = DNSUtils.textToIp(match.group("host"))
-						if ipMatch:
-							for ip in ipMatch:
-								failList.append([ip, date])
-					except IndexError:
-						logSys.error("There is no 'host' group in the rule. " +
-									 "Please correct your configuration.")
+				# The ignoreregex matched. Return.
+				logSys.debug("Ignoring this line")
+				return failList
+		match = self.__failRegexObj.search(line)
+		if match:
+			# The failregex matched.
+			date = self.dateDetector.getUnixTime(match.string)
+			if date == None:
+				logSys.debug("Found a match but no valid date/time found "
+							 + "for " + match.string + ". Please contact "
+							 + "the author in order to get support for "
+							 + "this format")
+			else:
+				try:
+					ipMatch = DNSUtils.textToIp(match.group("host"))
+					if ipMatch:
+						for ip in ipMatch:
+							failList.append([ip, date])
+				except IndexError:
+					logSys.error("There is no 'host' group in the rule. " +
+								 "Please correct your configuration.")
 		return failList
 	
 
@@ -424,7 +465,7 @@ class Filter(JailThread):
 	# @return a list with tuple
 	
 	def status(self):
-		ret = [("Currently failed", self.failManager.size()),
+		ret = [("Currently failed", self.failManager.size()), 
 			   ("Total failed", self.failManager.getFailTotal())]
 		return ret
 
diff --git a/server/server.py b/server/server.py
index 88099335..ba830526 100644
--- a/server/server.py
+++ b/server/server.py
@@ -171,6 +171,12 @@ class Server:
 	def getFailRegex(self, name):
 		return self.__jails.getFilter(name).getFailRegex()
 	
+	def setIgnoreRegex(self, name, value):
+		self.__jails.getFilter(name).setIgnoreRegex(value)
+	
+	def getIgnoreRegex(self, name):
+		return self.__jails.getFilter(name).getIgnoreRegex()
+	
 	def setMaxRetry(self, name, value):
 		self.__jails.getFilter(name).setMaxRetry(value)
 	
diff --git a/server/transmitter.py b/server/transmitter.py
index 34888863..5d0b5caf 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -147,6 +147,10 @@ class Transmitter:
 			value = command[2]
 			self.__server.setFailRegex(name, value)
 			return self.__server.getFailRegex(name)
+		elif command[1] == "ignoreregex":
+			value = command[2]
+			self.__server.setIgnoreRegex(name, value)
+			return self.__server.getIgnoreRegex(name)
 		elif command[1] == "maxtime":
 			value = command[2]
 			self.__server.setMaxTime(name, int(value))
@@ -227,6 +231,8 @@ class Transmitter:
 			return self.__server.getTimePattern(name)
 		elif command[1] == "failregex":
 			return self.__server.getFailRegex(name)
+		elif command[1] == "ignoreregex":
+			return self.__server.getIgnoreRegex(name)
 		elif command[1] == "maxtime":
 			return self.__server.getMaxTime(name)
 		elif command[1] == "findtime":

From 2995a995963005cac37dac3752c4b4621127bd1b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 12 Nov 2006 21:55:57 +0000
Subject: [PATCH 416/549] - Replaced "map" with list comprehension

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@459 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/csocket.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/csocket.py b/client/csocket.py
index 444792f9..34d0844d 100644
--- a/client/csocket.py
+++ b/client/csocket.py
@@ -41,7 +41,7 @@ class CSocket:
 	
 	def send(self, msg):
 		# Convert every list member to string
-		obj = dumps(map(str, msg), HIGHEST_PROTOCOL)
+		obj = dumps([str(m) for m in msg], HIGHEST_PROTOCOL)
 		self.__csock.send(obj + CSocket.END_STRING)
 		ret = self.receive(self.__csock)
 		self.__csock.close()

From b3143c723d3002c63993f29f0fb1071102add54b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 12 Nov 2006 21:57:26 +0000
Subject: [PATCH 417/549] - Fixed a bug in user defined regex/pattern date
 template

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@460 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/datedetector.py            |  3 +--
 server/datetemplate.py            |  4 ++--
 testcases/datedetectortestcase.py | 15 +++++++++++++--
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/server/datedetector.py b/server/datedetector.py
index 0b94d20f..1c886427 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -26,7 +26,6 @@ __license__ = "GPL"
 
 import time, logging
 
-from datetemplate import DateTemplate
 from datestrptime import DateStrptime
 from datetai64n	import DateTai64n
 from dateepoch import DateEpoch
@@ -40,7 +39,7 @@ class DateDetector:
 	def __init__(self):
 		self.__lock = Lock()
 		self.__templates = list()
-		self.__defTemplate = DateTemplate()
+		self.__defTemplate = DateStrptime()
 	
 	def addDefaultTemplate(self):
 		# standard
diff --git a/server/datetemplate.py b/server/datetemplate.py
index c4bb1d12..dccd58f6 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -42,14 +42,14 @@ class DateTemplate:
 		return self.__name
 	
 	def setRegex(self, regex):
-		self.__regex = regex
+		self.__regex = regex.strip()
 		self.__cRegex = re.compile(regex)
 		
 	def getRegex(self):
 		return self.__regex
 	
 	def setPattern(self, pattern):
-		self.__pattern = pattern
+		self.__pattern = pattern.strip()
 		
 	def getPattern(self):
 		return self.__pattern
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 7c534ea0..5f2f0b26 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -24,7 +24,7 @@ __date__ = "$Date: 2006-07-17 00:21:58 +0200 (Mon, 17 Jul 2006) $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import unittest, time
+import unittest
 from server.datedetector import DateDetector
 from server.datetemplate import DateTemplate
 
@@ -53,4 +53,15 @@ class DateDetectorTest(unittest.TestCase):
 	
 		self.assertEqual(self.__datedetector.getTime(log), date)
 		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
-		
\ No newline at end of file
+
+	def testDefaultTempate(self):
+		self.__datedetector.setDefaultRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+		self.__datedetector.setDefaultPattern("%b %d %H:%M:%S")
+		
+		log = "Jan 23 21:59:59 [sshd] error: PAM: Authentication failure"
+		date = [2005, 1, 23, 21, 59, 59, 1, 23, -1]
+		dateUnix = 1106513999.0
+		
+		self.assertEqual(self.__datedetector.getTime(log), date)
+		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
+	
\ No newline at end of file

From a8299b42479433bb29b07825c30f0f8979633f49 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 12 Nov 2006 21:58:47 +0000
Subject: [PATCH 418/549] - Added "protocol.py" which describes the protocol
 used to communicate with the server

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@461 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST        |  1 +
 fail2ban-client | 21 ++++------------
 protocol.py     | 66 +++++++++++++++++++++++++++++++++++++++++++++++++
 setup.py        |  5 +++-
 4 files changed, 76 insertions(+), 17 deletions(-)
 create mode 100644 protocol.py

diff --git a/MANIFEST b/MANIFEST
index 0f09a20c..c055a5f0 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -54,6 +54,7 @@ testcases/files/testcase04.log
 setup.py
 setup.cfg
 version.py
+protocol.py
 config/jail.conf
 config/filter.d/postfix.conf
 config/filter.d/vsftpd.conf
diff --git a/fail2ban-client b/fail2ban-client
index 4735a234..dff6aedd 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -37,6 +37,7 @@ from version import version
 from client.csocket import CSocket
 from client.configurator import Configurator
 from client.beautifier import Beautifier
+from protocol import printFormatted
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.client")
@@ -91,22 +92,10 @@ class Fail2banClient:
 		print "    -V, --version           print the version"
 		print
 		print "Command:"
-		print "    start                   start the server and the jails"
-		print "    reload                  reload the configuration"
-		print "    stop                    stop all jails and terminate the server"
-		print "    status                  get the current status"
-		print
-		print "    set loglevel <LEVEL>    set loglevel to <LEVEL>"
-		print "    get loglevel            get loglevel"
-		print "    set logtarget <TARGET>  set log target to <TARGET>"
-		print "    get logtarget           get log target"
-		print
-		print "    add <JAIL> [BACKEND]    create <JAIL> using [BACKEND]"
-		print "    set <JAIL> <CMD>        set the <CMD> value for <JAIL>"
-		print "    get <JAIL> <CMD>        get the <CMD> value for <JAIL>"
-		print "    start <JAIL>            start <JAIL>"
-		print "    stop <JAIL>             stop <JAIL>. The jail is removed"
-		print "    status <JAIL>           get the current status of <JAIL>"
+		
+		# Prints the protocol
+		printFormatted()
+		
 		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	
diff --git a/protocol.py b/protocol.py
new file mode 100644
index 00000000..daf36e6d
--- /dev/null
+++ b/protocol.py
@@ -0,0 +1,66 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 456 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 456 $"
+__date__ = "$Date: 2006-11-12 11:56:40 +0100 (Sun, 12 Nov 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import textwrap
+
+##
+# Describes the protocol used to communicate with the server.
+
+protocol = [
+["start", "starts the server and the jails"],
+["reload", "reloads the configuration"],
+["stop", "stops all jails and terminate the server"],
+["status", "gets the current status of the server"],
+["ping", "tests if the server is alive"],
+['', ''],
+["set loglevel <LEVEL>", "sets logging level to <LEVEL>"],
+["get loglevel", "gets the logging level"],
+["set logtarget <TARGET>", "sets logging target to <TARGET>"],
+["get logtarget", "gets logging target"],
+['', ''],
+["add <JAIL> <BACKEND>", "creates <JAIL> using <BACKEND>"],
+["set <JAIL> <CMD>", "sets the <CMD> value for <JAIL>"],
+["get <JAIL> <CMD>", "gets the <CMD> value for <JAIL>"],
+['', ''],
+["start <JAIL>", "starts <JAIL>"],
+["stop <JAIL>", "stops <JAIL>. The jail is removed"],
+["status <JAIL>", "gets the current status of <JAIL>"]
+]
+
+##
+# Prints the protocol in a "man" format. This is used for the
+# "-h" output of fail2ban-client.
+
+def printFormatted():
+	INDENT=4
+	FIRST=30
+	WIDTH=75
+	for command in [' ' * INDENT + m[0] +
+					"\n".join(textwrap.wrap(m[1], WIDTH - INDENT,
+					initial_indent=' ' * (FIRST - len(m[0])),
+					subsequent_indent=' ' * (FIRST + INDENT)))
+					for m in protocol]:
+		print command
diff --git a/setup.py b/setup.py
index b9896166..04009636 100755
--- a/setup.py
+++ b/setup.py
@@ -54,7 +54,10 @@ setup(
 					'fail2ban-server',
 					'fail2ban-regex'
 				],
-	py_modules =	['version'],
+	py_modules =	[
+						'version',
+						'protocol'
+					],
 	packages =	[
 					'client',
 					'server'

From 994fefcd4a53ebcc03e43d8991757ccaf15446f2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 12 Nov 2006 21:59:14 +0000
Subject: [PATCH 419/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@462 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 .pydevproject | 1 +
 CHANGELOG     | 1 +
 TODO          | 6 ------
 3 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/.pydevproject b/.pydevproject
index c4ae6c59..07eba934 100644
--- a/.pydevproject
+++ b/.pydevproject
@@ -7,5 +7,6 @@
 <path>/fail2ban-unstable/client</path>
 <path>/fail2ban-unstable/server</path>
 <path>/fail2ban-unstable/testcases</path>
+<path>/fail2ban-unstable</path>
 </pydev_pathproperty>
 </pydev_project>
diff --git a/CHANGELOG b/CHANGELOG
index 46a3f1f8..5ccbf134 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -16,6 +16,7 @@ ver. 0.7.5 (2006/??/??) - ???
 - Fixed refactoring bug (getLastcommand -> getLastAction)
 - Added option "ignoreregex" in filter scripts and jail.conf.
   Feature Request #1283304
+- Fixed a bug in user defined time regex/pattern
 
 ver. 0.7.4 (2006/11/01) - beta
 ----------
diff --git a/TODO b/TODO
index d842cefa..e6c9234a 100644
--- a/TODO
+++ b/TODO
@@ -26,14 +26,8 @@ Legend:
 
 # see Feature Request Tracking System at SourceForge.net
 
-- improve installation process (better prefix support)
-
 # improve documentation and website for user
 
 # better return values in function
 
-? restart automatically the daemon if an exception occurs.
-
-- do not close socket after a send
-
 # refactoring in server.py, actions.py, filter.py

From f8c0c60c2c7692c8189e0fb6a693dd97e6b31494 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 13 Nov 2006 22:17:20 +0000
Subject: [PATCH 420/549] - Fixed printFormatted - Added more commands

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@463 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 protocol.py | 65 ++++++++++++++++++++++++++++++++---------------------
 1 file changed, 40 insertions(+), 25 deletions(-)

diff --git a/protocol.py b/protocol.py
index daf36e6d..8985edc0 100644
--- a/protocol.py
+++ b/protocol.py
@@ -30,23 +30,33 @@ import textwrap
 # Describes the protocol used to communicate with the server.
 
 protocol = [
-["start", "starts the server and the jails"],
-["reload", "reloads the configuration"],
-["stop", "stops all jails and terminate the server"],
-["status", "gets the current status of the server"],
-["ping", "tests if the server is alive"],
-['', ''],
-["set loglevel <LEVEL>", "sets logging level to <LEVEL>"],
-["get loglevel", "gets the logging level"],
-["set logtarget <TARGET>", "sets logging target to <TARGET>"],
-["get logtarget", "gets logging target"],
-['', ''],
-["add <JAIL> <BACKEND>", "creates <JAIL> using <BACKEND>"],
-["set <JAIL> <CMD>", "sets the <CMD> value for <JAIL>"],
-["get <JAIL> <CMD>", "gets the <CMD> value for <JAIL>"],
-['', ''],
-["start <JAIL>", "starts <JAIL>"],
-["stop <JAIL>", "stops <JAIL>. The jail is removed"],
+["start", "starts the server and the jails"], 
+["reload", "reloads the configuration"], 
+["stop", "stops all jails and terminate the server"], 
+["status", "gets the current status of the server"], 
+["ping", "tests if the server is alive"], 
+['', ''], 
+["set loglevel <LEVEL>", "sets logging level to <LEVEL>"], 
+["get loglevel", "gets the logging level"], 
+["set logtarget <TARGET>", "sets logging target to <TARGET>"], 
+["get logtarget", "gets logging target"], 
+['', ''], 
+["add <JAIL> <BACKEND>", "creates <JAIL> using <BACKEND>"], 
+['', ''], 
+["set <JAIL> idle on|off", "sets the idle state of <JAIL>"], 
+["set <JAIL> addignoreip <IP>", "adds <IP> to the ignore list of <JAIL>"], 
+["set <JAIL> delignoreip <IP>", "removes <IP> from the ignore list of <JAIL>"], 
+["set <JAIL> addlogpath <FILE>", "adds <FILE> to the monitoring list of <JAIL>"], 
+["set <JAIL> dellogpath <FILE>", "removes <FILE> to the monitoring list of <JAIL>"], 
+["set <JAIL> timeregex <REGEX>", "sets the regular expression <REGEX> to match the date format for <JAIL>"], 
+["set <JAIL> timepattern <PATTERN>", "sets the pattern <PATTERN> to match the date format for <JAIL>"], 
+["set <JAIL> failregex <REGEX>", "sets the regular expression <REGEX> which must match failures for <JAIL>"], 
+["set <JAIL> ignoreregex <REGEX>", "sets the regular expression <REGEX> which should match pattern to exclude for <JAIL>"], 
+['', ''], 
+["get <JAIL> <CMD>", "gets the <CMD> value for <JAIL>"], 
+['', ''], 
+["start <JAIL>", "starts <JAIL>"], 
+["stop <JAIL>", "stops <JAIL>. The jail is removed"], 
 ["status <JAIL>", "gets the current status of <JAIL>"]
 ]
 
@@ -56,11 +66,16 @@ protocol = [
 
 def printFormatted():
 	INDENT=4
-	FIRST=30
-	WIDTH=75
-	for command in [' ' * INDENT + m[0] +
-					"\n".join(textwrap.wrap(m[1], WIDTH - INDENT,
-					initial_indent=' ' * (FIRST - len(m[0])),
-					subsequent_indent=' ' * (FIRST + INDENT)))
-					for m in protocol]:
-		print command
+	MARGIN=35
+	WIDTH=40
+	for m in protocol:
+		if m[0] == '':
+			print
+		first = True
+		for n in textwrap.wrap(m[1], WIDTH):
+			if first:
+				n = ' ' * INDENT + m[0] + ' ' * (MARGIN - len(m[0])) + n
+				first = False
+			else:
+				n = ' ' * (INDENT + MARGIN) + n
+			print n

From 0fd986517213913f71687acb635035c8b51e57c8 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 15 Nov 2006 18:44:28 +0000
Subject: [PATCH 421/549] - Defined default values in .conf. Should fix Debian
 bug #398758

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@464 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/apache-auth.conf     | 2 +-
 config/filter.d/apache-noscript.conf | 2 +-
 config/filter.d/courierlogin.conf    | 2 +-
 config/filter.d/couriersmtp.conf     | 2 +-
 config/filter.d/postfix.conf         | 2 +-
 config/filter.d/proftpd.conf         | 2 +-
 config/filter.d/qmail.conf           | 2 +-
 config/filter.d/sasl.conf            | 2 +-
 config/filter.d/sshd.conf            | 2 +-
 config/filter.d/vsftpd.conf          | 2 +-
 config/jail.conf                     | 7 ++++++-
 11 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 73097938..756c3767 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -17,4 +17,4 @@ failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not fo
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
 #
-#ignoreregex = user: myusername
+ignoreregex = 
diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
index cd71df8f..dc11a304 100644
--- a/config/filter.d/apache-noscript.conf
+++ b/config/filter.d/apache-noscript.conf
@@ -17,4 +17,4 @@ failregex = [[]client (?P<host>\S*)[]] File does not exist: .*(\.php|\.asp)
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
 #
-#ignoreregex = user: myusername
+ignoreregex = 
diff --git a/config/filter.d/courierlogin.conf b/config/filter.d/courierlogin.conf
index 5656368d..7088a625 100644
--- a/config/filter.d/courierlogin.conf
+++ b/config/filter.d/courierlogin.conf
@@ -18,4 +18,4 @@ failregex = LOGIN FAILED, ip=\[::ffff:(?P<host>\S*)\]$
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
 #
-#ignoreregex = user: myusername
+ignoreregex = 
diff --git a/config/filter.d/couriersmtp.conf b/config/filter.d/couriersmtp.conf
index d0d2e63d..7860fedb 100644
--- a/config/filter.d/couriersmtp.conf
+++ b/config/filter.d/couriersmtp.conf
@@ -17,4 +17,4 @@ failregex = error,relay=(?:::f{4,6}:)?(?P<host>\S*),.*550 User unknown
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
 #
-#ignoreregex = user: myusername
+ignoreregex = 
diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf
index c0850eb9..8ca98149 100644
--- a/config/filter.d/postfix.conf
+++ b/config/filter.d/postfix.conf
@@ -17,4 +17,4 @@ failregex = reject: RCPT from (.*)\[(?P<host>\S*)\]: 554
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
 #
-#ignoreregex = user: myusername
+ignoreregex = 
diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index f0b82167..1b31cda1 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -17,4 +17,4 @@ failregex = USER \S+: no such user found from \S* ?\[(?P<host>\S+)\] to \S+\s*$
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
 #
-#ignoreregex = user: myusername
+ignoreregex = 
diff --git a/config/filter.d/qmail.conf b/config/filter.d/qmail.conf
index c958c22d..9aaac649 100644
--- a/config/filter.d/qmail.conf
+++ b/config/filter.d/qmail.conf
@@ -17,4 +17,4 @@ failregex = (?:[\d,.]+[\d,.] rblsmtpd: |421 badiprbl: ip )(?P<host>\S*)
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
 #
-#ignoreregex = user: myusername
+ignoreregex = 
diff --git a/config/filter.d/sasl.conf b/config/filter.d/sasl.conf
index 005dcb28..8fd2027b 100644
--- a/config/filter.d/sasl.conf
+++ b/config/filter.d/sasl.conf
@@ -17,4 +17,4 @@ failregex = : warning: [-._\w]+\[(?P<host>[.\d]+)\]: SASL (?:LOGIN|PLAIN|(?:CRAM
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
 #
-#ignoreregex = user: myusername
+ignoreregex = 
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 3003c856..cd9a3628 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -17,4 +17,4 @@ failregex = (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|n
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
 #
-#ignoreregex = user: myusername
+ignoreregex = 
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index fd8f0ab4..aaa3fbbb 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -17,4 +17,4 @@ failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S*)
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
 #
-#ignoreregex = user: myusername
+ignoreregex = 
diff --git a/config/jail.conf b/config/jail.conf
index 53d446dd..81368c86 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -10,9 +10,14 @@
 
 [DEFAULT]
 
-# "ignoreip" can be an IP address, a CIDR mask or a DNS host
+# "ignoreip" can be an IP address, a CIDR mask or a DNS host.
 ignoreip = 127.0.0.1
+# "bantime" is the number of seconds that a host is banned.
 bantime  = 600
+# A host is banned if it has generated "maxretry" during the
+# last "maxtime" seconds.
+maxtime  = 3600
+# "maxretry" is the number of failures before a host get banned.
 maxretry = 3
 
 # "backend" specifies the backend used to get files modification. Available

From 377ebbea5d82d64eafed51637cacd0a3e1bbaeed Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 15 Nov 2006 23:05:51 +0000
Subject: [PATCH 422/549] - Added all commands. To be completed.

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@465 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 protocol.py | 35 ++++++++++++++++++++++++++++++++---
 1 file changed, 32 insertions(+), 3 deletions(-)

diff --git a/protocol.py b/protocol.py
index 8985edc0..ae1055ba 100644
--- a/protocol.py
+++ b/protocol.py
@@ -52,8 +52,37 @@ protocol = [
 ["set <JAIL> timepattern <PATTERN>", "sets the pattern <PATTERN> to match the date format for <JAIL>"], 
 ["set <JAIL> failregex <REGEX>", "sets the regular expression <REGEX> which must match failures for <JAIL>"], 
 ["set <JAIL> ignoreregex <REGEX>", "sets the regular expression <REGEX> which should match pattern to exclude for <JAIL>"], 
+["set <JAIL> maxtime <TIME>", "TODO"], 
+["set <JAIL> findtime <TIME>", "TODO"], 
+["set <JAIL> bantime <TIME>", "TODO"], 
+["set <JAIL> maxretry <RETRY>", "TODO"], 
+["set <JAIL> addaction <NAME>", "TODO"], 
+["set <JAIL> delaction <NAME>", "TODO"], 
+["set <JAIL> setcinfo <NAME> <VALUE>", "TODO"], 
+["set <JAIL> delcinfo <NAME> <VALUE>", "TODO"], 
+["set <JAIL> actionstart <NAME> <CMD>", "TODO"], 
+["set <JAIL> actionstop <NAME> <CMD>", "TODO"], 
+["set <JAIL> actioncheck <NAME> <CMD>", "TODO"], 
+["set <JAIL> actionban <NAME> <CMD>", "TODO"],
+["set <JAIL> actionunban <NAME> <CMD>", "TODO"], 
 ['', ''], 
-["get <JAIL> <CMD>", "gets the <CMD> value for <JAIL>"], 
+["get <JAIL> <CMD>", "gets the <CMD> value for <JAIL>"],
+["get <JAIL> logpath", "TODO"],
+["get <JAIL> ignoreip", "TODO"],
+["get <JAIL> timeregex", "TODO"],
+["get <JAIL> timepattern", "TODO"],
+["get <JAIL> failregex", "TODO"],
+["get <JAIL> ignoreregex", "TODO"],
+["get <JAIL> maxtime", "TODO"],
+["get <JAIL> findtime", "TODO"],
+["get <JAIL> bantime", "TODO"],
+["get <JAIL> maxretry", "TODO"],
+["get <JAIL> addaction", "TODO"],
+["get <JAIL> actionstart <NAME>", "TODO"],
+["get <JAIL> actionstop <NAME>", "TODO"],
+["get <JAIL> actioncheck <NAME>", "TODO"],
+["get <JAIL> actionban <NAME>", "TODO"],
+["get <JAIL> actionunban <NAME>", "TODO"],
 ['', ''], 
 ["start <JAIL>", "starts <JAIL>"], 
 ["stop <JAIL>", "stops <JAIL>. The jail is removed"], 
@@ -66,8 +95,8 @@ protocol = [
 
 def printFormatted():
 	INDENT=4
-	MARGIN=35
-	WIDTH=40
+	MARGIN=37
+	WIDTH=38
 	for m in protocol:
 		if m[0] == '':
 			print

From 160900f88efd9c46e635669d6172aec5e6494bf0 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 15 Nov 2006 23:09:49 +0000
Subject: [PATCH 423/549] - Fixed pylint warnings.

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@466 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 setup.py | 60 ++++++++++++++++++++++++++++----------------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/setup.py b/setup.py
index 04009636..4aed98dc 100755
--- a/setup.py
+++ b/setup.py
@@ -29,7 +29,7 @@ __license__ = "GPL"
 from distutils.core import setup
 from version import version
 from os.path import isfile, join
-from sys import exit, argv
+from sys import argv
 from glob import glob
 
 longdesc = '''
@@ -40,38 +40,38 @@ to reject the IP address or executes user defined
 commands.'''
 
 setup(
-	name = "fail2ban",
-	version = version,
-	description = "Ban IPs that make too many password failure",
-	long_description = longdesc,
-	author = "Cyril Jaquier",
-	author_email = "lostcontrol@users.sourceforge.net",
-	url = "http://fail2ban.sourceforge.net",
-	license = "GPL",
-	platforms = "Posix",
+	name = "fail2ban", 
+	version = version, 
+	description = "Ban IPs that make too many password failure", 
+	long_description = longdesc, 
+	author = "Cyril Jaquier", 
+	author_email = "lostcontrol@users.sourceforge.net", 
+	url = "http://fail2ban.sourceforge.net", 
+	license = "GPL", 
+	platforms = "Posix", 
 	scripts =	[
-					'fail2ban-client',
-					'fail2ban-server',
+					'fail2ban-client', 
+					'fail2ban-server', 
 					'fail2ban-regex'
-				],
+				], 
 	py_modules =	[
-						'version',
+						'version', 
 						'protocol'
-					],
+					], 
 	packages =	[
-					'client',
+					'client', 
 					'server'
-				],
+				], 
 	data_files =	[
-						('/etc/fail2ban',
+						('/etc/fail2ban', 
 							glob("config/*.conf")
-						),
-						('/etc/fail2ban/filter.d',
+																								), 
+						('/etc/fail2ban/filter.d', 
 							glob("config/filter.d/*.conf")
-						),
-						('/etc/fail2ban/action.d',
+																								), 
+						('/etc/fail2ban/action.d', 
 							glob("config/action.d/*.conf")
-						)
+																								)
 					]
 )
 
@@ -82,22 +82,22 @@ elements =	{
 				"/etc/":
 					[
 						"fail2ban.conf"
-					],
+					], 
 				"/usr/bin/":
 					[
 						"fail2ban.py"
-					],
+					], 
 				"/usr/lib/fail2ban/firewall/":
 					[
-						"iptables.py",
-						"ipfwadm.py",
+						"iptables.py", 
+						"ipfwadm.py", 
 						"ipfw.py"
 					]
 			}
 
-for dir in elements:
-	for f in elements[dir]:
-		path = join(dir, f)
+for directory in elements:
+	for f in elements[directory]:
+		path = join(directory, f)
 		if isfile(path):
 			obsoleteFiles.append(path)
 if obsoleteFiles:

From 58acd9fb9ff89f1bada081e2bbc629dde83a11ea Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 16 Nov 2006 21:07:42 +0000
Subject: [PATCH 424/549] - Moved version.py and protocol.py to common/

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@467 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                         |  2 ++
 MANIFEST                          |  5 +++--
 common/__init__.py                | 25 +++++++++++++++++++++++++
 protocol.py => common/protocol.py |  0
 version.py => common/version.py   |  0
 fail2ban-client                   |  4 ++--
 fail2ban-regex                    |  2 +-
 fail2ban-server                   |  2 +-
 fail2ban-testcases                |  2 +-
 setup.py                          | 14 ++++++--------
 10 files changed, 41 insertions(+), 15 deletions(-)
 create mode 100644 common/__init__.py
 rename protocol.py => common/protocol.py (100%)
 rename version.py => common/version.py (100%)

diff --git a/CHANGELOG b/CHANGELOG
index 5ccbf134..4b82a3e9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -17,6 +17,8 @@ ver. 0.7.5 (2006/??/??) - ???
 - Added option "ignoreregex" in filter scripts and jail.conf.
   Feature Request #1283304
 - Fixed a bug in user defined time regex/pattern
+- Improved documentation
+- Moved version.py and protocol.py to common/
 
 ver. 0.7.4 (2006/11/01) - beta
 ----------
diff --git a/MANIFEST b/MANIFEST
index c055a5f0..db392e40 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -53,8 +53,9 @@ testcases/files/testcase03.log
 testcases/files/testcase04.log
 setup.py
 setup.cfg
-version.py
-protocol.py
+common/__init__.py
+common/version.py
+common/protocol.py
 config/jail.conf
 config/filter.d/postfix.conf
 config/filter.d/vsftpd.conf
diff --git a/common/__init__.py b/common/__init__.py
new file mode 100644
index 00000000..cf63d1b6
--- /dev/null
+++ b/common/__init__.py
@@ -0,0 +1,25 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 433 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 433 $"
+__date__ = "$Date: 2006-10-24 21:40:51 +0200 (Tue, 24 Oct 2006) $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
diff --git a/protocol.py b/common/protocol.py
similarity index 100%
rename from protocol.py
rename to common/protocol.py
diff --git a/version.py b/common/version.py
similarity index 100%
rename from version.py
rename to common/version.py
diff --git a/fail2ban-client b/fail2ban-client
index dff6aedd..c3f2fdec 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -33,11 +33,11 @@ import getopt, time, readline, shlex, socket
 sys.path.insert(1, "/usr/lib/fail2ban")
 
 # Now we can import our modules
-from version import version
+from common.version import version
+from common.protocol import printFormatted
 from client.csocket import CSocket
 from client.configurator import Configurator
 from client.beautifier import Beautifier
-from protocol import printFormatted
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.client")
diff --git a/fail2ban-regex b/fail2ban-regex
index 8d82641a..6f4849ad 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -31,7 +31,7 @@ import locale, getopt, sys, time, logging, gc
 # fix for bug #343821
 sys.path.insert(1, "/usr/lib/fail2ban")
 
-from version import version
+from common.version import version
 from server.filter import Filter
 
 # Gets the instance of the logger.
diff --git a/fail2ban-server b/fail2ban-server
index c7877971..1f022d13 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -31,7 +31,7 @@ import getopt, sys
 # fix for bug #343821
 sys.path.insert(1, "/usr/lib/fail2ban")
 
-from version import version
+from common.version import version
 from server.server import Server
 
 ##
diff --git a/fail2ban-testcases b/fail2ban-testcases
index b2eaa47c..91c34317 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -32,7 +32,7 @@ import unittest, logging, sys
 # fix for bug #343821
 sys.path.insert(1, "/usr/lib/fail2ban")
 
-from version import version
+from common.version import version
 from testcases import banmanagertestcase
 from testcases import clientreadertestcase
 from testcases import failmanagertestcase
diff --git a/setup.py b/setup.py
index 4aed98dc..f5eb71ca 100755
--- a/setup.py
+++ b/setup.py
@@ -27,7 +27,7 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 from distutils.core import setup
-from version import version
+from common.version import version
 from os.path import isfile, join
 from sys import argv
 from glob import glob
@@ -54,24 +54,21 @@ setup(
 					'fail2ban-server', 
 					'fail2ban-regex'
 				], 
-	py_modules =	[
-						'version', 
-						'protocol'
-					], 
 	packages =	[
+					'common', 
 					'client', 
 					'server'
 				], 
 	data_files =	[
 						('/etc/fail2ban', 
 							glob("config/*.conf")
-																								), 
+						), 
 						('/etc/fail2ban/filter.d', 
 							glob("config/filter.d/*.conf")
-																								), 
+						), 
 						('/etc/fail2ban/action.d', 
 							glob("config/action.d/*.conf")
-																								)
+						)
 					]
 )
 
@@ -100,6 +97,7 @@ for directory in elements:
 		path = join(directory, f)
 		if isfile(path):
 			obsoleteFiles.append(path)
+
 if obsoleteFiles:
 	print
 	print "Obsolete files from previous Fail2Ban versions were found on " \

From 2df211966855af794885731ea9ff94e7b9c86c08 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 16 Nov 2006 22:30:48 +0000
Subject: [PATCH 425/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@468 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO                  |   2 +
 common/protocol.py    |  74 +++++++--------
 man/fail2ban-client.1 | 204 ++++++++++++++++++++++++++++++++++++++----
 man/fail2ban-regex.1  |   4 +-
 man/fail2ban-server.1 |   4 +-
 5 files changed, 229 insertions(+), 59 deletions(-)

diff --git a/TODO b/TODO
index e6c9234a..23a34875 100644
--- a/TODO
+++ b/TODO
@@ -13,6 +13,8 @@ Legend:
 # partially done
 * done
 
+- Better handling of the protocol in transmitter.py
+
 - Add gettext support (I18N)
 
 - Fix the cPickle issue with Python 2.5
diff --git a/common/protocol.py b/common/protocol.py
index ae1055ba..0a5910be 100644
--- a/common/protocol.py
+++ b/common/protocol.py
@@ -36,9 +36,9 @@ protocol = [
 ["status", "gets the current status of the server"], 
 ["ping", "tests if the server is alive"], 
 ['', ''], 
-["set loglevel <LEVEL>", "sets logging level to <LEVEL>"], 
+["set loglevel <LEVEL>", "sets logging level to <LEVEL>. 0 is minimal, 4 is debug"], 
 ["get loglevel", "gets the logging level"], 
-["set logtarget <TARGET>", "sets logging target to <TARGET>"], 
+["set logtarget <TARGET>", "sets logging target to <TARGET>. Can be STDOUT, STDERR, SYSLOG or a file"], 
 ["get logtarget", "gets logging target"], 
 ['', ''], 
 ["add <JAIL> <BACKEND>", "creates <JAIL> using <BACKEND>"], 
@@ -48,44 +48,44 @@ protocol = [
 ["set <JAIL> delignoreip <IP>", "removes <IP> from the ignore list of <JAIL>"], 
 ["set <JAIL> addlogpath <FILE>", "adds <FILE> to the monitoring list of <JAIL>"], 
 ["set <JAIL> dellogpath <FILE>", "removes <FILE> to the monitoring list of <JAIL>"], 
-["set <JAIL> timeregex <REGEX>", "sets the regular expression <REGEX> to match the date format for <JAIL>"], 
-["set <JAIL> timepattern <PATTERN>", "sets the pattern <PATTERN> to match the date format for <JAIL>"], 
+["set <JAIL> timeregex <REGEX>", "sets the regular expression <REGEX> to match the date format for <JAIL>. This will disable the autodetection feature."], 
+["set <JAIL> timepattern <PATTERN>", "sets the pattern <PATTERN> to match the date format for <JAIL>. This will disable the autodetection feature."], 
 ["set <JAIL> failregex <REGEX>", "sets the regular expression <REGEX> which must match failures for <JAIL>"], 
 ["set <JAIL> ignoreregex <REGEX>", "sets the regular expression <REGEX> which should match pattern to exclude for <JAIL>"], 
-["set <JAIL> maxtime <TIME>", "TODO"], 
-["set <JAIL> findtime <TIME>", "TODO"], 
-["set <JAIL> bantime <TIME>", "TODO"], 
-["set <JAIL> maxretry <RETRY>", "TODO"], 
-["set <JAIL> addaction <NAME>", "TODO"], 
-["set <JAIL> delaction <NAME>", "TODO"], 
-["set <JAIL> setcinfo <NAME> <VALUE>", "TODO"], 
-["set <JAIL> delcinfo <NAME> <VALUE>", "TODO"], 
-["set <JAIL> actionstart <NAME> <CMD>", "TODO"], 
-["set <JAIL> actionstop <NAME> <CMD>", "TODO"], 
-["set <JAIL> actioncheck <NAME> <CMD>", "TODO"], 
-["set <JAIL> actionban <NAME> <CMD>", "TODO"],
-["set <JAIL> actionunban <NAME> <CMD>", "TODO"], 
+["set <JAIL> maxtime <TIME>", "sets the number of seconds <TIME> a failure stay in the list for <JAIL>"], 
+["set <JAIL> findtime <TIME>", "sets the number of seconds <TIME> for which the filter will look back for <JAIL>"], 
+["set <JAIL> bantime <TIME>", "sets the number of seconds <TIME> a host will be banned for <JAIL>"], 
+["set <JAIL> maxretry <RETRY>", "sets the number of failures <RETRY> before banning the host for <JAIL>"], 
+["set <JAIL> addaction <ACT>", "adds a new action named <NAME> for <JAIL>"], 
+["set <JAIL> delaction <ACT>", "removes the action <NAME> from <JAIL>"], 
+["set <JAIL> setcinfo <ACT> <KEY> <VALUE>", "sets <VALUE> for <KEY> of the action <NAME> for <JAIL>"], 
+["set <JAIL> delcinfo <ACT> <KEY>", "removes <KEY> for the action <NAME> for <JAIL>"], 
+["set <JAIL> actionstart <ACT> <CMD>", "sets the start command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actionstop <ACT> <CMD>", "sets the stop command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actioncheck <ACT> <CMD>", "sets the check command <CMD> of the action <ACT> for <JAIL>"], 
+["set <JAIL> actionban <ACT> <CMD>", "sets the ban command <CMD> of the action <ACT> for <JAIL>"],
+["set <JAIL> actionunban <ACT> <CMD>", "sets the unban command <CMD> of the action <ACT> for <JAIL>"], 
 ['', ''], 
 ["get <JAIL> <CMD>", "gets the <CMD> value for <JAIL>"],
-["get <JAIL> logpath", "TODO"],
-["get <JAIL> ignoreip", "TODO"],
-["get <JAIL> timeregex", "TODO"],
-["get <JAIL> timepattern", "TODO"],
-["get <JAIL> failregex", "TODO"],
-["get <JAIL> ignoreregex", "TODO"],
-["get <JAIL> maxtime", "TODO"],
-["get <JAIL> findtime", "TODO"],
-["get <JAIL> bantime", "TODO"],
-["get <JAIL> maxretry", "TODO"],
-["get <JAIL> addaction", "TODO"],
-["get <JAIL> actionstart <NAME>", "TODO"],
-["get <JAIL> actionstop <NAME>", "TODO"],
-["get <JAIL> actioncheck <NAME>", "TODO"],
-["get <JAIL> actionban <NAME>", "TODO"],
-["get <JAIL> actionunban <NAME>", "TODO"],
+["get <JAIL> logpath", "gets the list of the monitored files for <JAIL>"],
+["get <JAIL> ignoreip", "gets the list of ignored IP addresses for <JAIL>"],
+["get <JAIL> timeregex", "gets the regular expression used for the time detection for <JAIL>"],
+["get <JAIL> timepattern", "gets the pattern used for the time detection for <JAIL>"],
+["get <JAIL> failregex", "gets the regular expression which matches the failures for <JAIL>"],
+["get <JAIL> ignoreregex", "gets the regular expression which matches patterns to ignore for <JAIL>"],
+["get <JAIL> maxtime", "gets the time a failure stays in the list for <JAIL>"],
+["get <JAIL> findtime", "gets the time for which the filter will look back for failures for <JAIL>"],
+["get <JAIL> bantime", "gets the time a host is banned for <JAIL>"],
+["get <JAIL> maxretry", "gets the number of failures allowed for <JAIL>"],
+["get <JAIL> addaction", "gets the last action which has been added for <JAIL>"],
+["get <JAIL> actionstart <ACT>", "gets the start command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionstop <ACT>", "gets the stop command for the action <ACT> for <JAIL>"],
+["get <JAIL> actioncheck <ACT>", "gets the check command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionban <ACT>", "gets the ban command for the action <ACT> for <JAIL>"],
+["get <JAIL> actionunban <ACT>", "gets the unban command for the action <ACT> for <JAIL>"],
 ['', ''], 
-["start <JAIL>", "starts <JAIL>"], 
-["stop <JAIL>", "stops <JAIL>. The jail is removed"], 
+["start <JAIL>", "starts the jail <JAIL>"], 
+["stop <JAIL>", "stops the jail <JAIL>. The jail is removed"], 
 ["status <JAIL>", "gets the current status of <JAIL>"]
 ]
 
@@ -95,8 +95,8 @@ protocol = [
 
 def printFormatted():
 	INDENT=4
-	MARGIN=37
-	WIDTH=38
+	MARGIN=41
+	WIDTH=34
 	for m in protocol:
 		if m[0] == '':
 			print
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 16e4c4b9..0292abd5 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "November 2006" "fail2ban-client v0.7.4" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "November 2006" "fail2ban-client v0.7.4-SVN" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH SYNOPSIS
 .B fail2ban-client
 [\fIOPTIONS\fR]... \fI<COMMAND>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.4 reads log file that contains password failure report
+Fail2Ban v0.7.4\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
@@ -39,46 +39,214 @@ print the version
 .SH COMMAND
 .TP
 start
-start the server and the jails
+starts the server and the jails
 .TP
 reload
-reload the configuration
+reloads the configuration
 .TP
 stop
-stop all jails and terminate the server
+stops all jails and terminate the
+server
 .TP
 status
-get the current status
+gets the current status of the
+server
+.TP
+ping
+tests if the server is alive
 .TP
 set loglevel <LEVEL>
-set loglevel to <LEVEL>
+sets logging level to <LEVEL>. 0
+is minimal, 4 is debug
 .TP
 get loglevel
-get loglevel
+gets the logging level
 .TP
 set logtarget <TARGET>
-set log target to <TARGET>
+sets logging target to <TARGET>.
+Can be STDOUT, STDERR, SYSLOG or a
+file
 .TP
 get logtarget
-get log target
+gets logging target
 .TP
-add <JAIL> [BACKEND]
-create <JAIL> using [BACKEND]
+add <JAIL> <BACKEND>
+creates <JAIL> using <BACKEND>
 .TP
-set <JAIL> <CMD>
-set the <CMD> value for <JAIL>
+set <JAIL> idle on|off
+sets the idle state of <JAIL>
+.TP
+set <JAIL> addignoreip <IP>
+adds <IP> to the ignore list of
+<JAIL>
+.TP
+set <JAIL> delignoreip <IP>
+removes <IP> from the ignore list
+of <JAIL>
+.TP
+set <JAIL> addlogpath <FILE>
+adds <FILE> to the monitoring list
+of <JAIL>
+.TP
+set <JAIL> dellogpath <FILE>
+removes <FILE> to the monitoring
+list of <JAIL>
+.TP
+set <JAIL> timeregex <REGEX>
+sets the regular expression
+<REGEX> to match the date format
+for <JAIL>. This will disable the
+autodetection feature.
+.TP
+set <JAIL> timepattern <PATTERN>
+sets the pattern <PATTERN> to
+match the date format for <JAIL>.
+This will disable the
+autodetection feature.
+.TP
+set <JAIL> failregex <REGEX>
+sets the regular expression
+<REGEX> which must match failures
+for <JAIL>
+.TP
+set <JAIL> ignoreregex <REGEX>
+sets the regular expression
+<REGEX> which should match pattern
+to exclude for <JAIL>
+.TP
+set <JAIL> maxtime <TIME>
+sets the number of seconds <TIME>
+a failure stay in the list for
+<JAIL>
+.TP
+set <JAIL> findtime <TIME>
+sets the number of seconds <TIME>
+for which the filter will look
+back for <JAIL>
+.TP
+set <JAIL> bantime <TIME>
+sets the number of seconds <TIME>
+a host will be banned for <JAIL>
+.TP
+set <JAIL> maxretry <RETRY>
+sets the number of failures
+<RETRY> before banning the host
+for <JAIL>
+.TP
+set <JAIL> addaction <ACT>
+adds a new action named <NAME> for
+<JAIL>
+.TP
+set <JAIL> delaction <ACT>
+removes the action <NAME> from
+<JAIL>
+.TP
+set <JAIL> setcinfo <ACT> <KEY> <VALUE>
+sets <VALUE> for <KEY> of the
+action <NAME> for <JAIL>
+.TP
+set <JAIL> delcinfo <ACT> <KEY>
+removes <KEY> for the action
+<NAME> for <JAIL>
+.TP
+set <JAIL> actionstart <ACT> <CMD>
+sets the start command <CMD> of
+the action <ACT> for <JAIL>
+.TP
+set <JAIL> actionstop <ACT> <CMD>
+sets the stop command <CMD> of the
+action <ACT> for <JAIL>
+.TP
+set <JAIL> actioncheck <ACT> <CMD>
+sets the check command <CMD> of
+the action <ACT> for <JAIL>
+.TP
+set <JAIL> actionban <ACT> <CMD>
+sets the ban command <CMD> of the
+action <ACT> for <JAIL>
+.TP
+set <JAIL> actionunban <ACT> <CMD>
+sets the unban command <CMD> of
+the action <ACT> for <JAIL>
 .TP
 get <JAIL> <CMD>
-get the <CMD> value for <JAIL>
+gets the <CMD> value for <JAIL>
+.TP
+get <JAIL> logpath
+gets the list of the monitored
+files for <JAIL>
+.TP
+get <JAIL> ignoreip
+gets the list of ignored IP
+addresses for <JAIL>
+.TP
+get <JAIL> timeregex
+gets the regular expression used
+for the time detection for <JAIL>
+.TP
+get <JAIL> timepattern
+gets the pattern used for the time
+detection for <JAIL>
+.TP
+get <JAIL> failregex
+gets the regular expression which
+matches the failures for <JAIL>
+.TP
+get <JAIL> ignoreregex
+gets the regular expression which
+matches patterns to ignore for
+<JAIL>
+.TP
+get <JAIL> maxtime
+gets the time a failure stays in
+the list for <JAIL>
+.TP
+get <JAIL> findtime
+gets the time for which the filter
+will look back for failures for
+<JAIL>
+.TP
+get <JAIL> bantime
+gets the time a host is banned for
+<JAIL>
+.TP
+get <JAIL> maxretry
+gets the number of failures
+allowed for <JAIL>
+.TP
+get <JAIL> addaction
+gets the last action which has
+been added for <JAIL>
+.TP
+get <JAIL> actionstart <ACT>
+gets the start command for the
+action <ACT> for <JAIL>
+.TP
+get <JAIL> actionstop <ACT>
+gets the stop command for the
+action <ACT> for <JAIL>
+.TP
+get <JAIL> actioncheck <ACT>
+gets the check command for the
+action <ACT> for <JAIL>
+.TP
+get <JAIL> actionban <ACT>
+gets the ban command for the
+action <ACT> for <JAIL>
+.TP
+get <JAIL> actionunban <ACT>
+gets the unban command for the
+action <ACT> for <JAIL>
 .TP
 start <JAIL>
-start <JAIL>
+starts the jail <JAIL>
 .TP
 stop <JAIL>
-stop <JAIL>. The jail is removed
+stops the jail <JAIL>. The jail is
+removed
 .TP
 status <JAIL>
-get the current status of <JAIL>
+gets the current status of <JAIL>
 .SH FILES
 \fI/etc/fail2ban/*\fR
 .SH AUTHOR
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index afe8f9b4..e83777f8 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-REGEX "1" "November 2006" "fail2ban-regex v0.7.4" "User Commands"
+.TH FAIL2BAN-REGEX "1" "November 2006" "fail2ban-regex v0.7.4-SVN" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
 .B fail2ban-regex
 \fI<logline> <failregex>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.4 reads log file that contains password failure report
+Fail2Ban v0.7.4\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 This tools can test and benchmark your regular expressions for the "failregex"
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index ded43f8e..e93c3966 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "November 2006" "fail2ban-server v0.7.4" "User Commands"
+.TH FAIL2BAN-SERVER "1" "November 2006" "fail2ban-server v0.7.4-SVN" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.7.4 reads log file that contains password failure report
+Fail2Ban v0.7.4\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with

From 3a63321bc8b4a6dbebbeba5aec0f0664c1434256 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 18 Nov 2006 15:12:22 +0000
Subject: [PATCH 426/549] - Use bold font for commands

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@469 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 man/generate-man | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/man/generate-man b/man/generate-man
index 61c95d54..bf4f651e 100755
--- a/man/generate-man
+++ b/man/generate-man
@@ -5,7 +5,30 @@ echo -n "Generating fail2ban-client "
 help2man --section=1 --no-info --include=fail2ban-client.h2m --output fail2ban-client.1 ../fail2ban-client
 echo "[done]"
 echo -n "Patching fail2ban-client   "
+# Changes the title.
 sed -i -e 's/.SS "Command:"/.SH COMMAND/' fail2ban-client.1
+# Sets bold font for commands.
+IFS="
+"
+NEXT=0
+FOUND=0
+LINES=$( cat fail2ban-client.1 )
+echo -n "" > fail2ban-client.1
+for LINE in $LINES; do
+	if [ "$LINE" = ".SH COMMAND" ]; then
+		FOUND=1
+	fi
+	if [ $NEXT -eq 1 ] && [ $FOUND -eq 1 ]; then
+		echo "\fB$LINE\fR" >> fail2ban-client.1
+	else
+		echo "$LINE" >> fail2ban-client.1
+	fi
+	if [ "$LINE" = ".TP" ]; then
+		NEXT=1
+	else
+		NEXT=0
+	fi
+done
 echo "[done]"
 
 # fail2ban-server

From 911b2b15fcf905d4a26aa92daa06f1174c0c3289 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 18 Nov 2006 15:15:58 +0000
Subject: [PATCH 427/549] - Merged "maxtime" with "findtime"

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@470 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG             |   1 +
 client/jailreader.py  |   6 +--
 common/protocol.py    |   3 --
 config/jail.conf      |   4 +-
 man/fail2ban-client.1 | 110 +++++++++++++++++++-----------------------
 server/filter.py      |  18 +------
 server/server.py      |   6 ---
 server/transmitter.py |   6 ---
 8 files changed, 56 insertions(+), 98 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 4b82a3e9..6db6427e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -19,6 +19,7 @@ ver. 0.7.5 (2006/??/??) - ???
 - Fixed a bug in user defined time regex/pattern
 - Improved documentation
 - Moved version.py and protocol.py to common/
+- Merged "maxtime" option with "findtime"
 
 ver. 0.7.4 (2006/11/01) - beta
 ----------
diff --git a/client/jailreader.py b/client/jailreader.py
index 34bb1e8d..bb408876 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -60,7 +60,7 @@ class JailReader(ConfigReader):
 				["string", "logpath", "/var/log/messages"],
 				["string", "backend", "auto"],
 				["int", "maxretry", 3],
-				["int", "maxtime", 600],
+				["int", "findtime", 600],
 				["int", "bantime", 600],
 				["string", "failregex", None],
 				["string", "ignoreregex", None],
@@ -113,8 +113,8 @@ class JailReader(ConfigReader):
 			elif opt == "ignoreip":
 				for ip in self.__opts[opt].split():
 					stream.append(["set", self.__name, "addignoreip", ip])
-			elif opt == "maxtime":
-				stream.append(["set", self.__name, "maxtime", self.__opts[opt]])
+			elif opt == "findtime":
+				stream.append(["set", self.__name, "findtime", self.__opts[opt]])
 			elif opt == "bantime":
 				stream.append(["set", self.__name, "bantime", self.__opts[opt]])
 			elif opt == "failregex":
diff --git a/common/protocol.py b/common/protocol.py
index 0a5910be..01c0c984 100644
--- a/common/protocol.py
+++ b/common/protocol.py
@@ -52,7 +52,6 @@ protocol = [
 ["set <JAIL> timepattern <PATTERN>", "sets the pattern <PATTERN> to match the date format for <JAIL>. This will disable the autodetection feature."], 
 ["set <JAIL> failregex <REGEX>", "sets the regular expression <REGEX> which must match failures for <JAIL>"], 
 ["set <JAIL> ignoreregex <REGEX>", "sets the regular expression <REGEX> which should match pattern to exclude for <JAIL>"], 
-["set <JAIL> maxtime <TIME>", "sets the number of seconds <TIME> a failure stay in the list for <JAIL>"], 
 ["set <JAIL> findtime <TIME>", "sets the number of seconds <TIME> for which the filter will look back for <JAIL>"], 
 ["set <JAIL> bantime <TIME>", "sets the number of seconds <TIME> a host will be banned for <JAIL>"], 
 ["set <JAIL> maxretry <RETRY>", "sets the number of failures <RETRY> before banning the host for <JAIL>"], 
@@ -66,14 +65,12 @@ protocol = [
 ["set <JAIL> actionban <ACT> <CMD>", "sets the ban command <CMD> of the action <ACT> for <JAIL>"],
 ["set <JAIL> actionunban <ACT> <CMD>", "sets the unban command <CMD> of the action <ACT> for <JAIL>"], 
 ['', ''], 
-["get <JAIL> <CMD>", "gets the <CMD> value for <JAIL>"],
 ["get <JAIL> logpath", "gets the list of the monitored files for <JAIL>"],
 ["get <JAIL> ignoreip", "gets the list of ignored IP addresses for <JAIL>"],
 ["get <JAIL> timeregex", "gets the regular expression used for the time detection for <JAIL>"],
 ["get <JAIL> timepattern", "gets the pattern used for the time detection for <JAIL>"],
 ["get <JAIL> failregex", "gets the regular expression which matches the failures for <JAIL>"],
 ["get <JAIL> ignoreregex", "gets the regular expression which matches patterns to ignore for <JAIL>"],
-["get <JAIL> maxtime", "gets the time a failure stays in the list for <JAIL>"],
 ["get <JAIL> findtime", "gets the time for which the filter will look back for failures for <JAIL>"],
 ["get <JAIL> bantime", "gets the time a host is banned for <JAIL>"],
 ["get <JAIL> maxretry", "gets the number of failures allowed for <JAIL>"],
diff --git a/config/jail.conf b/config/jail.conf
index 81368c86..15befe5b 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -15,8 +15,8 @@ ignoreip = 127.0.0.1
 # "bantime" is the number of seconds that a host is banned.
 bantime  = 600
 # A host is banned if it has generated "maxretry" during the
-# last "maxtime" seconds.
-maxtime  = 3600
+# last "findtime" seconds.
+findtime  = 600
 # "maxretry" is the number of failures before a host get banned.
 maxretry = 3
 
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 0292abd5..1a2e6ce5 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -38,214 +38,202 @@ display this help message
 print the version
 .SH COMMAND
 .TP
-start
+\fBstart\fR
 starts the server and the jails
 .TP
-reload
+\fBreload\fR
 reloads the configuration
 .TP
-stop
+\fBstop\fR
 stops all jails and terminate the
 server
 .TP
-status
+\fBstatus\fR
 gets the current status of the
 server
 .TP
-ping
+\fBping\fR
 tests if the server is alive
 .TP
-set loglevel <LEVEL>
+\fBset loglevel <LEVEL>\fR
 sets logging level to <LEVEL>. 0
 is minimal, 4 is debug
 .TP
-get loglevel
+\fBget loglevel\fR
 gets the logging level
 .TP
-set logtarget <TARGET>
+\fBset logtarget <TARGET>\fR
 sets logging target to <TARGET>.
 Can be STDOUT, STDERR, SYSLOG or a
 file
 .TP
-get logtarget
+\fBget logtarget\fR
 gets logging target
 .TP
-add <JAIL> <BACKEND>
+\fBadd <JAIL> <BACKEND>\fR
 creates <JAIL> using <BACKEND>
 .TP
-set <JAIL> idle on|off
+\fBset <JAIL> idle on|off\fR
 sets the idle state of <JAIL>
 .TP
-set <JAIL> addignoreip <IP>
+\fBset <JAIL> addignoreip <IP>\fR
 adds <IP> to the ignore list of
 <JAIL>
 .TP
-set <JAIL> delignoreip <IP>
+\fBset <JAIL> delignoreip <IP>\fR
 removes <IP> from the ignore list
 of <JAIL>
 .TP
-set <JAIL> addlogpath <FILE>
+\fBset <JAIL> addlogpath <FILE>\fR
 adds <FILE> to the monitoring list
 of <JAIL>
 .TP
-set <JAIL> dellogpath <FILE>
+\fBset <JAIL> dellogpath <FILE>\fR
 removes <FILE> to the monitoring
 list of <JAIL>
 .TP
-set <JAIL> timeregex <REGEX>
+\fBset <JAIL> timeregex <REGEX>\fR
 sets the regular expression
 <REGEX> to match the date format
 for <JAIL>. This will disable the
 autodetection feature.
 .TP
-set <JAIL> timepattern <PATTERN>
+\fBset <JAIL> timepattern <PATTERN>\fR
 sets the pattern <PATTERN> to
 match the date format for <JAIL>.
 This will disable the
 autodetection feature.
 .TP
-set <JAIL> failregex <REGEX>
+\fBset <JAIL> failregex <REGEX>\fR
 sets the regular expression
 <REGEX> which must match failures
 for <JAIL>
 .TP
-set <JAIL> ignoreregex <REGEX>
+\fBset <JAIL> ignoreregex <REGEX>\fR
 sets the regular expression
 <REGEX> which should match pattern
 to exclude for <JAIL>
 .TP
-set <JAIL> maxtime <TIME>
-sets the number of seconds <TIME>
-a failure stay in the list for
-<JAIL>
-.TP
-set <JAIL> findtime <TIME>
+\fBset <JAIL> findtime <TIME>\fR
 sets the number of seconds <TIME>
 for which the filter will look
 back for <JAIL>
 .TP
-set <JAIL> bantime <TIME>
+\fBset <JAIL> bantime <TIME>\fR
 sets the number of seconds <TIME>
 a host will be banned for <JAIL>
 .TP
-set <JAIL> maxretry <RETRY>
+\fBset <JAIL> maxretry <RETRY>\fR
 sets the number of failures
 <RETRY> before banning the host
 for <JAIL>
 .TP
-set <JAIL> addaction <ACT>
+\fBset <JAIL> addaction <ACT>\fR
 adds a new action named <NAME> for
 <JAIL>
 .TP
-set <JAIL> delaction <ACT>
+\fBset <JAIL> delaction <ACT>\fR
 removes the action <NAME> from
 <JAIL>
 .TP
-set <JAIL> setcinfo <ACT> <KEY> <VALUE>
+\fBset <JAIL> setcinfo <ACT> <KEY> <VALUE>\fR
 sets <VALUE> for <KEY> of the
 action <NAME> for <JAIL>
 .TP
-set <JAIL> delcinfo <ACT> <KEY>
+\fBset <JAIL> delcinfo <ACT> <KEY>\fR
 removes <KEY> for the action
 <NAME> for <JAIL>
 .TP
-set <JAIL> actionstart <ACT> <CMD>
+\fBset <JAIL> actionstart <ACT> <CMD>\fR
 sets the start command <CMD> of
 the action <ACT> for <JAIL>
 .TP
-set <JAIL> actionstop <ACT> <CMD>
+\fBset <JAIL> actionstop <ACT> <CMD>\fR
 sets the stop command <CMD> of the
 action <ACT> for <JAIL>
 .TP
-set <JAIL> actioncheck <ACT> <CMD>
+\fBset <JAIL> actioncheck <ACT> <CMD>\fR
 sets the check command <CMD> of
 the action <ACT> for <JAIL>
 .TP
-set <JAIL> actionban <ACT> <CMD>
+\fBset <JAIL> actionban <ACT> <CMD>\fR
 sets the ban command <CMD> of the
 action <ACT> for <JAIL>
 .TP
-set <JAIL> actionunban <ACT> <CMD>
+\fBset <JAIL> actionunban <ACT> <CMD>\fR
 sets the unban command <CMD> of
 the action <ACT> for <JAIL>
 .TP
-get <JAIL> <CMD>
-gets the <CMD> value for <JAIL>
-.TP
-get <JAIL> logpath
+\fBget <JAIL> logpath\fR
 gets the list of the monitored
 files for <JAIL>
 .TP
-get <JAIL> ignoreip
+\fBget <JAIL> ignoreip\fR
 gets the list of ignored IP
 addresses for <JAIL>
 .TP
-get <JAIL> timeregex
+\fBget <JAIL> timeregex\fR
 gets the regular expression used
 for the time detection for <JAIL>
 .TP
-get <JAIL> timepattern
+\fBget <JAIL> timepattern\fR
 gets the pattern used for the time
 detection for <JAIL>
 .TP
-get <JAIL> failregex
+\fBget <JAIL> failregex\fR
 gets the regular expression which
 matches the failures for <JAIL>
 .TP
-get <JAIL> ignoreregex
+\fBget <JAIL> ignoreregex\fR
 gets the regular expression which
 matches patterns to ignore for
 <JAIL>
 .TP
-get <JAIL> maxtime
-gets the time a failure stays in
-the list for <JAIL>
-.TP
-get <JAIL> findtime
+\fBget <JAIL> findtime\fR
 gets the time for which the filter
 will look back for failures for
 <JAIL>
 .TP
-get <JAIL> bantime
+\fBget <JAIL> bantime\fR
 gets the time a host is banned for
 <JAIL>
 .TP
-get <JAIL> maxretry
+\fBget <JAIL> maxretry\fR
 gets the number of failures
 allowed for <JAIL>
 .TP
-get <JAIL> addaction
+\fBget <JAIL> addaction\fR
 gets the last action which has
 been added for <JAIL>
 .TP
-get <JAIL> actionstart <ACT>
+\fBget <JAIL> actionstart <ACT>\fR
 gets the start command for the
 action <ACT> for <JAIL>
 .TP
-get <JAIL> actionstop <ACT>
+\fBget <JAIL> actionstop <ACT>\fR
 gets the stop command for the
 action <ACT> for <JAIL>
 .TP
-get <JAIL> actioncheck <ACT>
+\fBget <JAIL> actioncheck <ACT>\fR
 gets the check command for the
 action <ACT> for <JAIL>
 .TP
-get <JAIL> actionban <ACT>
+\fBget <JAIL> actionban <ACT>\fR
 gets the ban command for the
 action <ACT> for <JAIL>
 .TP
-get <JAIL> actionunban <ACT>
+\fBget <JAIL> actionunban <ACT>\fR
 gets the unban command for the
 action <ACT> for <JAIL>
 .TP
-start <JAIL>
+\fBstart <JAIL>\fR
 starts the jail <JAIL>
 .TP
-stop <JAIL>
+\fBstop <JAIL>\fR
 stops the jail <JAIL>. The jail is
 removed
 .TP
-status <JAIL>
+\fBstatus <JAIL>\fR
 gets the current status of <JAIL>
 .SH FILES
 \fI/etc/fail2ban/*\fR
diff --git a/server/filter.py b/server/filter.py
index 3c468f52..cade9eab 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -218,6 +218,7 @@ class Filter(JailThread):
 	
 	def setFindTime(self, value):
 		self.__findTime = value
+		self.failManager.setMaxTime(value)
 		logSys.info("Set findtime = %s" % value)
 	
 	##
@@ -245,23 +246,6 @@ class Filter(JailThread):
 	def getMaxRetry(self):
 		return self.failManager.getMaxRetry()
 	
-	##
-	# Set the maximum time a failure stays in the list.
-	#
-	# @param value the maximum time
-	
-	def setMaxTime(self, value):
-		self.failManager.setMaxTime(value)
-		logSys.info("Set maxTime = %s" % value)
-	
-	##
-	# Get the maximum time a failure stays in the list.
-	#
-	# @return the time value
-	
-	def getMaxTime(self):
-		return self.failManager.getMaxTime()
-
 	##
 	# Main loop.
 	#
diff --git a/server/server.py b/server/server.py
index ba830526..b93032b0 100644
--- a/server/server.py
+++ b/server/server.py
@@ -183,12 +183,6 @@ class Server:
 	def getMaxRetry(self, name):
 		return self.__jails.getFilter(name).getMaxRetry()
 	
-	def setMaxTime(self, name, value):
-		self.__jails.getFilter(name).setMaxTime(value)
-	
-	def getMaxTime(self, name):
-		return self.__jails.getFilter(name).getMaxTime()
-	
 	# Action
 	def addAction(self, name, value):
 		self.__jails.getAction(name).addAction(value)
diff --git a/server/transmitter.py b/server/transmitter.py
index 5d0b5caf..e08e40e0 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -151,10 +151,6 @@ class Transmitter:
 			value = command[2]
 			self.__server.setIgnoreRegex(name, value)
 			return self.__server.getIgnoreRegex(name)
-		elif command[1] == "maxtime":
-			value = command[2]
-			self.__server.setMaxTime(name, int(value))
-			return self.__server.getMaxTime(name)
 		elif command[1] == "findtime":
 			value = command[2]
 			self.__server.setFindTime(name, int(value))
@@ -233,8 +229,6 @@ class Transmitter:
 			return self.__server.getFailRegex(name)
 		elif command[1] == "ignoreregex":
 			return self.__server.getIgnoreRegex(name)
-		elif command[1] == "maxtime":
-			return self.__server.getMaxTime(name)
 		elif command[1] == "findtime":
 			return self.__server.getFindTime(name)
 		elif command[1] == "maxretry":

From f5d4cb6be2b00571e0f20ee12d83804ee1faeb59 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 19 Nov 2006 21:25:51 +0000
Subject: [PATCH 428/549] - Added alias "<HOST>" for failregex

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@471 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/apache-auth.conf     |  6 ++++--
 config/filter.d/apache-noscript.conf |  6 ++++--
 config/filter.d/courierlogin.conf    |  6 ++++--
 config/filter.d/couriersmtp.conf     |  6 ++++--
 config/filter.d/postfix.conf         |  6 ++++--
 config/filter.d/proftpd.conf         |  6 ++++--
 config/filter.d/qmail.conf           |  6 ++++--
 config/filter.d/sasl.conf            |  6 ++++--
 config/filter.d/sshd.conf            |  6 ++++--
 config/filter.d/vsftpd.conf          |  6 ++++--
 server/filter.py                     | 14 ++++++++++----
 11 files changed, 50 insertions(+), 24 deletions(-)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 756c3767..501e3d68 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -8,10 +8,12 @@
 [Definition]
 
 # Option:  failregex
-# Notes.:  regex to match the password failure messages in the logfile.
+# Notes.:  regex to match the password failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching.
 # Values:  TEXT
 #
-failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
+failregex = [[]client <HOST>[]] user .*(?:: authentication failure|not found)
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
index dc11a304..45366867 100644
--- a/config/filter.d/apache-noscript.conf
+++ b/config/filter.d/apache-noscript.conf
@@ -8,10 +8,12 @@
 [Definition]
 
 # Option:  failregex
-# Notes.:  regex to match the password failure messages in the logfile.
+# Notes.:  regex to match the password failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching.
 # Values:  TEXT
 #
-failregex = [[]client (?P<host>\S*)[]] File does not exist: .*(\.php|\.asp)
+failregex = [[]client <HOST>[]] File does not exist: .*(\.php|\.asp)
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/courierlogin.conf b/config/filter.d/courierlogin.conf
index 7088a625..0e6b7a11 100644
--- a/config/filter.d/courierlogin.conf
+++ b/config/filter.d/courierlogin.conf
@@ -9,10 +9,12 @@
 [Definition]
 
 # Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile.
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching.
 # Values:  TEXT
 #
-failregex = LOGIN FAILED, ip=\[::ffff:(?P<host>\S*)\]$
+failregex = LOGIN FAILED, ip=\[<HOST>\]$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/couriersmtp.conf b/config/filter.d/couriersmtp.conf
index 7860fedb..d67a61ea 100644
--- a/config/filter.d/couriersmtp.conf
+++ b/config/filter.d/couriersmtp.conf
@@ -8,10 +8,12 @@
 [Definition]
 
 # Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile.
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching.
 # Values:  TEXT
 #
-failregex = error,relay=(?:::f{4,6}:)?(?P<host>\S*),.*550 User unknown
+failregex = error,relay=<HOST>,.*550 User unknown
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf
index 8ca98149..a0e0a974 100644
--- a/config/filter.d/postfix.conf
+++ b/config/filter.d/postfix.conf
@@ -8,10 +8,12 @@
 [Definition]
 
 # Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile.
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching.
 # Values:  TEXT
 #
-failregex = reject: RCPT from (.*)\[(?P<host>\S*)\]: 554
+failregex = reject: RCPT from (.*)\[<HOST>\]: 554
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index 1b31cda1..28921a01 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -8,10 +8,12 @@
 [Definition]
 
 # Option: failregex
-# Notes.: regex to match the password failures messages in the logfile.
+# Notes.: regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching.
 # Values: TEXT
 #
-failregex = USER \S+: no such user found from \S* ?\[(?P<host>\S+)\] to \S+\s*$
+failregex = USER \S+: no such user found from \S* ?\[<HOST>\] to \S+\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/qmail.conf b/config/filter.d/qmail.conf
index 9aaac649..3e4ae215 100644
--- a/config/filter.d/qmail.conf
+++ b/config/filter.d/qmail.conf
@@ -8,10 +8,12 @@
 [Definition]
 
 # Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile.
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching.
 # Values:  TEXT
 #
-failregex = (?:[\d,.]+[\d,.] rblsmtpd: |421 badiprbl: ip )(?P<host>\S*)
+failregex = (?:[\d,.]+[\d,.] rblsmtpd: |421 badiprbl: ip )<HOST>
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/sasl.conf b/config/filter.d/sasl.conf
index 8fd2027b..3602b594 100644
--- a/config/filter.d/sasl.conf
+++ b/config/filter.d/sasl.conf
@@ -8,10 +8,12 @@
 [Definition]
 
 # Option: failregex
-# Notes.: regex to match the password failures messages in the logfile.
+# Notes.: regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching.
 # Values: TEXT
 #
-failregex = : warning: [-._\w]+\[(?P<host>[.\d]+)\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
+failregex = : warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index cd9a3628..3c2c5db6 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -8,10 +8,12 @@
 [Definition]
 
 # Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile.
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching.
 # Values:  TEXT
 #
-failregex = (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
+failregex = (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) <HOST>
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index aaa3fbbb..384fa36b 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -8,10 +8,12 @@
 [Definition]
 
 # Option: failregex
-# Notes.: regex to match the password failures messages in the logfile.
+# Notes.: regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching.
 # Values: TEXT
 #
-failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S*)
+failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=<HOST>
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/server/filter.py b/server/filter.py
index cade9eab..f19cf732 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -167,13 +167,17 @@ class Filter(JailThread):
 	def setFailRegex(self, value):
 		try:
 			if value.lstrip() == '':
+				self.__failRegex = value
 				self.__failRegexObj = None
 			else:
-				self.__failRegexObj = re.compile(value)
-			self.__failRegex = value
-			logSys.info("Set failregex = %s" % value)
+				# Replace "<HOST>" with default regular expression for host.
+				regex = value.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>\S+)")
+				self.__failRegex = regex
+				self.__failRegexObj = re.compile(regex)
+			logSys.info("Set failregex = %s" % self.__failRegex)
 		except sre_constants.error:
-			logSys.error("Unable to compile regular expression " + value)
+			logSys.error("Unable to compile regular expression " +
+						self.__failRegex)
 	
 	##
 	# Get the regular expression which matches the failure.
@@ -475,6 +479,8 @@ class DNSUtils:
 		try:
 			return socket.gethostbyname_ex(dns)[2]
 		except socket.gaierror:
+			logSys.warn("Unable to find a corresponding IP address for %s"
+						% dns)
 			return list()
 	
 	@staticmethod

From c10e1bb7ff530c138bfb344faa5478df6cd7755b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 19 Nov 2006 21:26:47 +0000
Subject: [PATCH 429/549] - Fixed exception when passing unknown command line
 option

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@472 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-server | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/fail2ban-server b/fail2ban-server
index 1f022d13..7602bd85 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -71,15 +71,16 @@ class Fail2banServer:
 		print "and bans the corresponding IP addresses using firewall rules."
 		print
 		print "Only use this command for debugging purpose. Start the server with"
-		print "fail2ban-client instead."
+		print "fail2ban-client instead. The default behaviour is to start the server"
+		print "in background."
 		print
 		print "Options:"
-		print "  -b             start in background"
-		print "  -f             start in foreground"
-		print "  -s <FILE>      socket path"
-		print "  -x             force execution of the server"
-		print "  -h, --help     display this help message"
-		print "  -V, --version  print the version"
+		print "    -b                   start in background"
+		print "    -f                   start in foreground"
+		print "    -s <FILE>            socket path"
+		print "    -x                   force execution of the server"
+		print "    -h, --help           display this help message"
+		print "    -V, --version        print the version"
 		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	
@@ -113,6 +114,7 @@ class Fail2banServer:
 			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
 			self.dispUsage()
+			sys.exit(-1)
 			
 		self.__getCmdLineOptions(optList)
 		

From d342d847f2129049dd0ce4e87b5bdc7b2746b70e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 19 Nov 2006 21:35:54 +0000
Subject: [PATCH 430/549] - Check for deprecated version.py and protocol.py

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@473 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 setup.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/setup.py b/setup.py
index f5eb71ca..9ad1ece5 100755
--- a/setup.py
+++ b/setup.py
@@ -89,6 +89,11 @@ elements =	{
 						"iptables.py", 
 						"ipfwadm.py", 
 						"ipfw.py"
+					],
+				"/usr/lib/fail2ban/":
+					[
+						"version.py", 
+						"protocol.py"
 					]
 			}
 

From 136b32c2e165d9c88b5ec1a86d79d92e98535f5c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 19 Nov 2006 21:36:32 +0000
Subject: [PATCH 431/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@474 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG             |  5 +++++
 README                | 47 +++++++++----------------------------------
 man/fail2ban-server.1 |  3 ++-
 3 files changed, 17 insertions(+), 38 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 6db6427e..e0bbf79e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -20,6 +20,11 @@ ver. 0.7.5 (2006/??/??) - ???
 - Improved documentation
 - Moved version.py and protocol.py to common/
 - Merged "maxtime" option with "findtime"
+- Added "<HOST>" tag support in failregex which matches
+  default IP address/hostname. "(?P<host>\S)" is still valid
+  and supported
+- Fixed exception when calling fail2ban-server with unknown
+  option
 
 ver. 0.7.4 (2006/11/01) - beta
 ----------
diff --git a/README b/README
index 61797f72..4b5cd6de 100644
--- a/README
+++ b/README
@@ -13,7 +13,8 @@ rules to reject the IP address. These rules can be defined by
 the user. Fail2Ban can read multiple log files such as sshd
 or Apache web server ones.
 
-Documentation, FAQ, HOWTOs are available on the project
+This README is a quick introduction to Fail2ban. More
+documentation, FAQ, HOWTOs are available on the project
 website: http://fail2ban.sourceforge.net
 
 Installation:
@@ -38,54 +39,26 @@ Gentoo: ebuilds are available on the website.
 Debian: Fail2Ban is in Debian unstable.
 RedHat: packages are available on the website.
 
-Fail2Ban should now be correctly installed. Just type:
+Fail2Ban should be correctly installed now. Just type:
 
 > fail2ban-client -h
 
-to see if everything is alright.
+to see if everything is alright. You should always use
+fail2ban-client and never call fail2ban-server directly.
 
 Configuration:
 --------------
 
-You can configure fail2ban using the files in /etc/fail2ban
-or using command line. Here are the available command line
-options (not complete yet):
-
-Options:
-    -c <DIR>                configuration directory
-    -s <FILE>               socket path
-    -d                      dump configuration. For debugging
-    -i                      interactive mode
-    -v                      increase verbosity
-    -q                      decrease verbosity
-    -x                      force execution of the server
-    -h, --help              display this help message
-    -V, --version           print the version
-
-Command:
-    start                   start the server and the jails
-    reload                  reload the configuration
-    stop                    stop all jails and terminate the
-                            server
-    status                  get the current status
-
-    set loglevel <LEVEL>    set loglevel to <LEVEL>
-    get loglevel            get loglevel
-    set logtarget <TARGET>  set log target to <TARGET>
-    get logtarget           get log target
-
-    add <JAIL> [BACKEND]    create <JAIL> using [BACKEND]
-    set <JAIL> <CMD>        set the <CMD> value for <JAIL>
-    get <JAIL> <CMD>        get the <CMD> value for <JAIL>
-    start <JAIL>            start <JAIL>
-    stop <JAIL>             stop <JAIL>. The jail is removed
-    status <JAIL>           get the current status of <JAIL>
+You can configure Fail2ban using the files in /etc/fail2ban.
+It is possible to configure the server using commands sent to
+it by fail2ban-client. The available commands are described
+in the man page of fail2ban-client. Please refer to it.
 
 Contact:
 --------
 
 You need some new features, you found bugs or you just
-appreciate this program, you can contact me at :
+appreciate this program, you can contact me at:
 
 Website: http://fail2ban.sourceforge.net
 
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index e93c3966..daee00cf 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -10,7 +10,8 @@ Fail2Ban v0.7.4\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with
-fail2ban\-client instead.
+fail2ban\-client instead. The default behaviour is to start the server
+in background.
 .SH OPTIONS
 .TP
 \fB\-b\fR

From c27ef35b904fa060fd26b5bc85a9d33337e8b21f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 26 Nov 2006 22:22:54 +0000
Subject: [PATCH 432/549] - Fixed bug with the "socket" option

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@475 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG       |  2 ++
 fail2ban-client | 12 +++++++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index e0bbf79e..11888001 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -25,6 +25,8 @@ ver. 0.7.5 (2006/??/??) - ???
   and supported
 - Fixed exception when calling fail2ban-server with unknown
   option
+- Fixed Debian bug 400162. The "socket" option is now handled
+  correctly by fail2ban-client
 
 ver. 0.7.4 (2006/11/01) - beta
 ----------
diff --git a/fail2ban-client b/fail2ban-client
index c3f2fdec..0cc9112e 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -169,7 +169,8 @@ class Fail2banClient:
 				logSys.error("Server already running")
 				return False
 			else:
-				self.__startServerAsync(self.__conf["force"])
+				self.__startServerAsync(self.__conf["socket"],
+										self.__conf["force"])
 				# Read the config while the server is starting
 				self.__readConfig()
 				try:
@@ -199,14 +200,19 @@ class Fail2banClient:
 	#
 	# Start the Fail2ban server in daemon mode.
 	
-	def __startServerAsync(self, force = False):
+	def __startServerAsync(self, socket, force = False):
 		args = list()
 		
 		args.append("fail2ban-server")
+		# Start in background mode.
 		args.append("-b")
+		# Set the socket path.
+		args.append("-s")
+		args.append(socket)
+		# Force the execution if needed.
 		if force:
 			args.append("-x")
-		
+		print args
 		pid = os.fork()
 		if pid == 0:
 			try:

From 159ecbc5671766e8bd2c887e9161ff7fabd52085 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 3 Dec 2006 21:58:48 +0000
Subject: [PATCH 433/549] - Fixed RedHat init script. Thanks to Justin Shore

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@476 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 files/redhat-initd | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/files/redhat-initd b/files/redhat-initd
index 0dfd0d2c..5909efeb 100755
--- a/files/redhat-initd
+++ b/files/redhat-initd
@@ -27,7 +27,7 @@ getpid() {
 start() {
     echo -n $"Starting fail2ban: "
     getpid
-    if [ -z "$pid"]; then
+    if [ -z "$pid" ]; then
         $FAIL2BAN start > /dev/null
         RETVAL=$?
     fi
@@ -77,8 +77,8 @@ case "$1" in
         fi
         ;;
   restart)
+  		stop
         start
-        stop
         ;;
   *)
         echo $"Usage: $0 {start|stop|status|restart}"

From a77711deb65ed5817644b830dc7794d85de22387 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 3 Dec 2006 22:01:18 +0000
Subject: [PATCH 434/549] - Changed timeout to 30 secondes before assuming the
 server cannot be started

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@477 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 0cc9112e..dbb84616 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -201,20 +201,19 @@ class Fail2banClient:
 	# Start the Fail2ban server in daemon mode.
 	
 	def __startServerAsync(self, socket, force = False):
-		args = list()
-		
-		args.append("fail2ban-server")
-		# Start in background mode.
-		args.append("-b")
-		# Set the socket path.
-		args.append("-s")
-		args.append(socket)
-		# Force the execution if needed.
-		if force:
-			args.append("-x")
-		print args
+		# Forks the current process.
 		pid = os.fork()
 		if pid == 0:
+			args = list()
+			args.append("fail2ban-server")
+			# Start in background mode.
+			args.append("-b")
+			# Set the socket path.
+			args.append("-s")
+			args.append(socket)
+			# Force the execution if needed.
+			if force:
+				args.append("-x")
 			try:
 				# Use the PATH env
 				os.execvp("fail2ban-server", args)
@@ -231,10 +230,11 @@ class Fail2banClient:
 		# Wait for the server to start
 		cnt = 0
 		while not self.__ping():
-			if cnt > 10:
+			# The server has 30 secondes to start.
+			if cnt >= 300:
 				raise ServerExecutionException("Failed to start server")
 			time.sleep(0.1)
-			cnt = cnt + 1
+			cnt += 1
 			
 	
 	def start(self, argv):

From 0045958bd795deaf8e2c98d17b0fa5cfe6f95208 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 3 Dec 2006 22:01:33 +0000
Subject: [PATCH 435/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@478 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index 11888001..6876dcd1 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -27,6 +27,9 @@ ver. 0.7.5 (2006/??/??) - ???
   option
 - Fixed Debian bug 400162. The "socket" option is now handled
   correctly by fail2ban-client
+- Fixed RedHat init script. Thanks to Justin Shore
+- Changed timeout to 30 secondes before assuming the server
+  cannot be started
 
 ver. 0.7.4 (2006/11/01) - beta
 ----------

From 90fb1d442ec08a769faa5ad2bdc499051e89cd02 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 7 Dec 2006 03:12:28 +0000
Subject: [PATCH 436/549] slight english adjustment with no good english:
 Destinataire->Destination/Addressee

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@479 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/mail-whois.conf | 2 +-
 config/action.d/mail.conf       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf
index abc4f790..fdff74af 100644
--- a/config/action.d/mail-whois.conf
+++ b/config/action.d/mail-whois.conf
@@ -63,7 +63,7 @@ actionunban =
 #
 name = default
 
-# Destinataire of the mail
+# Destination/Addressee of the mail
 #
 dest = root
 
diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf
index 871800f5..c33487b8 100644
--- a/config/action.d/mail.conf
+++ b/config/action.d/mail.conf
@@ -61,7 +61,7 @@ actionunban =
 #
 name = default
 
-# Destinataire of the mail
+# Destination/Addressee of the mail
 #
 dest = root
 

From f366a0b2825cd971859af506c665a682e4f21522 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Dec 2006 21:47:53 +0000
Subject: [PATCH 437/549] - Trivial changes for 0.7.5

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@480 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG             |  6 +++---
 README                | 11 ++++++-----
 common/version.py     |  2 +-
 man/fail2ban-client.1 |  2 +-
 man/fail2ban-regex.1  |  2 +-
 man/fail2ban-server.1 |  2 +-
 6 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 6876dcd1..90b4d506 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.5)                           2006/??/??
+Fail2Ban (version 0.7.5)                           2006/12/07
 =============================================================
 
-ver. 0.7.5 (2006/??/??) - ???
+ver. 0.7.5 (2006/12/07) - beta
 ----------
 - Do not ban a host that is currently banned. Thanks to
   Yaroslav Halchenko
@@ -29,7 +29,7 @@ ver. 0.7.5 (2006/??/??) - ???
   correctly by fail2ban-client
 - Fixed RedHat init script. Thanks to Justin Shore
 - Changed timeout to 30 secondes before assuming the server
-  cannot be started
+  cannot be started. Thanks to Joël Bertrand
 
 ver. 0.7.4 (2006/11/01) - beta
 ----------
diff --git a/README b/README
index 4b5cd6de..f0f26801 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.4)                           2006/11/01
+Fail2Ban (version 0.7.5)                           2006/12/07
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -28,8 +28,8 @@ Optional:
 
 To install, just do:
 
-> tar xvfj fail2ban-0.7.4.tar.bz2
-> cd fail2ban-0.7.4
+> tar xvfj fail2ban-0.7.5.tar.bz2
+> cd fail2ban-0.7.5
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The
@@ -52,7 +52,8 @@ Configuration:
 You can configure Fail2ban using the files in /etc/fail2ban.
 It is possible to configure the server using commands sent to
 it by fail2ban-client. The available commands are described
-in the man page of fail2ban-client. Please refer to it.
+in the man page of fail2ban-client. Please refer to it or to
+the website: http://fail2ban.sourceforge.net
 
 Contact:
 --------
@@ -71,7 +72,7 @@ Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
 Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
 Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
 Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
-Nick Munger, Christoph Haas
+Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand
 
 License:
 --------
diff --git a/common/version.py b/common/version.py
index c3e0b276..ee3b9df7 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.4-SVN"
+version = "0.7.5"
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 1a2e6ce5..d52e990a 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,5 +1,5 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "November 2006" "fail2ban-client v0.7.4-SVN" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "December 2006" "fail2ban-client v0.7.4-SVN" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH SYNOPSIS
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index e83777f8..e122b7a8 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,5 +1,5 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-REGEX "1" "November 2006" "fail2ban-regex v0.7.4-SVN" "User Commands"
+.TH FAIL2BAN-REGEX "1" "December 2006" "fail2ban-regex v0.7.4-SVN" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index daee00cf..415d6155 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,5 +1,5 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "November 2006" "fail2ban-server v0.7.4-SVN" "User Commands"
+.TH FAIL2BAN-SERVER "1" "December 2006" "fail2ban-server v0.7.4-SVN" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS

From 9539012e1365bd216c8428fbe09047792947bce0 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Dec 2006 16:37:22 +0000
Subject: [PATCH 438/549] - Added a "sleep 1". Thanks to Jim Wight

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@482 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 files/redhat-initd | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/redhat-initd b/files/redhat-initd
index 5909efeb..12867615 100755
--- a/files/redhat-initd
+++ b/files/redhat-initd
@@ -48,6 +48,7 @@ stop() {
     if [ -n "$pid" ]; then
         $FAIL2BAN stop > /dev/null
     fi
+    sleep 1
     getpid
     if [ -z "$pid" ]; then
         rm -f /var/lock/subsys/fail2ban

From a9b3f190efd8736d65bfac9498c7a47531fc164b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 10 Dec 2006 16:46:54 +0000
Subject: [PATCH 439/549] - Prepared for next release

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@483 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG         | 6 +++++-
 README            | 2 +-
 common/version.py | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 90b4d506..3530ac3a 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,13 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.5)                           2006/12/07
+Fail2Ban (version 0.7.6)                           200?/??/??
 =============================================================
 
+ver. 0.7.6 (200?/??/??) - ???
+----------
+- Added a "sleep 1" in redhat-initd. Thanks to Jim Wight
+
 ver. 0.7.5 (2006/12/07) - beta
 ----------
 - Do not ban a host that is currently banned. Thanks to
diff --git a/README b/README
index f0f26801..0dedd93a 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.5)                           2006/12/07
+Fail2Ban (version 0.7.6)                           200?/??/??
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
diff --git a/common/version.py b/common/version.py
index ee3b9df7..9e74d0e5 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.5"
+version = "0.7.5-SVN"

From 8ca367d609c3e6cf7804d15fb3d76d9c1a3ef021 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 13 Dec 2006 23:02:46 +0000
Subject: [PATCH 440/549] - Use /dev/log for SYSLOG output. Thanks to Joerg
 Sommrey

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@488 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG            | 1 +
 config/fail2ban.conf | 5 +++--
 server/server.py     | 4 +++-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 3530ac3a..fc591814 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -10,6 +10,7 @@ Fail2Ban (version 0.7.6)                           200?/??/??
 ver. 0.7.6 (200?/??/??) - ???
 ----------
 - Added a "sleep 1" in redhat-initd. Thanks to Jim Wight
+- Use /dev/log for SYSLOG output. Thanks to Joerg Sommrey
 
 ver. 0.7.5 (2006/12/07) - beta
 ----------
diff --git a/config/fail2ban.conf b/config/fail2ban.conf
index 90439d0c..518c2ff4 100644
--- a/config/fail2ban.conf
+++ b/config/fail2ban.conf
@@ -18,8 +18,9 @@
 loglevel = 3
 
 # Option:  logtarget
-# Notes.:  Set the log target. This could be a file, SYSLOG, STDERR.
-# Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
+# Notes.:  Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
+#          Only one log target can be specified.
+# Values:  STDOUT STDERR SYSLOG file  Default:  /var/log/fail2ban.log
 #
 logtarget = /var/log/fail2ban.log
 
diff --git a/server/server.py b/server/server.py
index b93032b0..13d57669 100644
--- a/server/server.py
+++ b/server/server.py
@@ -306,7 +306,9 @@ class Server:
 			# Remove previous handler
 			logging.getLogger("fail2ban").handlers = []
 			if target == "SYSLOG":
-				hdlr = logging.handlers.SysLogHandler()
+				facility = logging.handlers.SysLogHandler.LOG_DAEMON
+				hdlr = logging.handlers.SysLogHandler("/dev/log",
+													  facility = facility)
 			elif target == "STDOUT":
 				hdlr = logging.StreamHandler(sys.stdout)
 			elif target == "STDERR":

From 6f7df2cc3c3f9a70c48189369268dd28ab285ec9 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 14 Dec 2006 21:20:03 +0000
Subject: [PATCH 441/549] - Use numeric output for iptables in "actioncheck"

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@489 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                     | 1 +
 config/action.d/iptables.conf | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index fc591814..fad0e412 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -11,6 +11,7 @@ ver. 0.7.6 (200?/??/??) - ???
 ----------
 - Added a "sleep 1" in redhat-initd. Thanks to Jim Wight
 - Use /dev/log for SYSLOG output. Thanks to Joerg Sommrey
+- Use numeric output for iptables in "actioncheck"
 
 ver. 0.7.5 (2006/12/07) - beta
 ----------
diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf
index 27809e13..d9be0202 100644
--- a/config/action.d/iptables.conf
+++ b/config/action.d/iptables.conf
@@ -27,7 +27,7 @@ actionstop = iptables -D INPUT -p <protocol> --dport <port> -j fail2ban-<name>
 # Notes.:  command executed once before each fwban command
 # Values:  CMD
 #
-actioncheck = iptables -L INPUT | grep -q fail2ban-<name>
+actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
 
 # Option:  fwban
 # Notes.:  command executed when banning an IP. Take care that the

From b8a522cf3f2fe4a2b73043703116101b53ab54d2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Fri, 15 Dec 2006 23:02:12 +0000
Subject: [PATCH 442/549] - Added protocol output for Mediawiki

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@490 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 common/protocol.py | 51 +++++++++++++++++++++++++++++++++++-----------
 1 file changed, 39 insertions(+), 12 deletions(-)

diff --git a/common/protocol.py b/common/protocol.py
index 01c0c984..e53d121b 100644
--- a/common/protocol.py
+++ b/common/protocol.py
@@ -30,19 +30,23 @@ import textwrap
 # Describes the protocol used to communicate with the server.
 
 protocol = [
+['', "Basic", ""],
 ["start", "starts the server and the jails"], 
 ["reload", "reloads the configuration"], 
 ["stop", "stops all jails and terminate the server"], 
 ["status", "gets the current status of the server"], 
 ["ping", "tests if the server is alive"], 
-['', ''], 
+['', "Logging", ""],
 ["set loglevel <LEVEL>", "sets logging level to <LEVEL>. 0 is minimal, 4 is debug"], 
 ["get loglevel", "gets the logging level"], 
 ["set logtarget <TARGET>", "sets logging target to <TARGET>. Can be STDOUT, STDERR, SYSLOG or a file"], 
 ["get logtarget", "gets logging target"], 
-['', ''], 
+['', "Jail control", ""],
 ["add <JAIL> <BACKEND>", "creates <JAIL> using <BACKEND>"], 
-['', ''], 
+["start <JAIL>", "starts the jail <JAIL>"], 
+["stop <JAIL>", "stops the jail <JAIL>. The jail is removed"], 
+["status <JAIL>", "gets the current status of <JAIL>"],
+['', "Jail configuration", ""],
 ["set <JAIL> idle on|off", "sets the idle state of <JAIL>"], 
 ["set <JAIL> addignoreip <IP>", "adds <IP> to the ignore list of <JAIL>"], 
 ["set <JAIL> delignoreip <IP>", "removes <IP> from the ignore list of <JAIL>"], 
@@ -64,7 +68,7 @@ protocol = [
 ["set <JAIL> actioncheck <ACT> <CMD>", "sets the check command <CMD> of the action <ACT> for <JAIL>"], 
 ["set <JAIL> actionban <ACT> <CMD>", "sets the ban command <CMD> of the action <ACT> for <JAIL>"],
 ["set <JAIL> actionunban <ACT> <CMD>", "sets the unban command <CMD> of the action <ACT> for <JAIL>"], 
-['', ''], 
+['', "Jail information", ""],
 ["get <JAIL> logpath", "gets the list of the monitored files for <JAIL>"],
 ["get <JAIL> ignoreip", "gets the list of ignored IP addresses for <JAIL>"],
 ["get <JAIL> timeregex", "gets the regular expression used for the time detection for <JAIL>"],
@@ -80,10 +84,6 @@ protocol = [
 ["get <JAIL> actioncheck <ACT>", "gets the check command for the action <ACT> for <JAIL>"],
 ["get <JAIL> actionban <ACT>", "gets the ban command for the action <ACT> for <JAIL>"],
 ["get <JAIL> actionunban <ACT>", "gets the unban command for the action <ACT> for <JAIL>"],
-['', ''], 
-["start <JAIL>", "starts the jail <JAIL>"], 
-["stop <JAIL>", "stops the jail <JAIL>. The jail is removed"], 
-["status <JAIL>", "gets the current status of <JAIL>"]
 ]
 
 ##
@@ -94,14 +94,41 @@ def printFormatted():
 	INDENT=4
 	MARGIN=41
 	WIDTH=34
+	firstHeading = False
 	for m in protocol:
-		if m[0] == '':
+		if m[0] == '' and firstHeading:
 			print
+		firstHeading = True
 		first = True
 		for n in textwrap.wrap(m[1], WIDTH):
 			if first:
-				n = ' ' * INDENT + m[0] + ' ' * (MARGIN - len(m[0])) + n
+				line = ' ' * INDENT + m[0] + ' ' * (MARGIN - len(m[0])) + n
 				first = False
 			else:
-				n = ' ' * (INDENT + MARGIN) + n
-			print n
+				line = ' ' * (INDENT + MARGIN) + n
+			print line
+
+##
+# Prints the protocol in a "mediawiki" format.
+
+def printWiki():
+	firstHeading = False
+	for m in protocol:
+		if m[0] == '':
+			if firstHeading:
+				print "|}"
+			__printWikiHeader(m[1], m[2])
+			firstHeading = True
+		else:
+			print "|-"
+			print "| <span style=\"white-space:nowrap;\"><tt>" + m[0] + "</tt></span> || || " + m[1]
+	print "|}"
+
+def __printWikiHeader(section, desc):
+	print
+	print "=== " + section + " ==="
+	print
+	print desc
+	print
+	print "{|"
+	print "| '''Command''' || || '''Description'''"

From b02394fd23176f94d95ca9e7fdd175546fbbe004 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 17 Dec 2006 22:32:40 +0000
Subject: [PATCH 443/549] - Fixed restart. Wait for the server to shutdown

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@491 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 files/gentoo-initd | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/files/gentoo-initd b/files/gentoo-initd
index 60ce443d..64a2105c 100755
--- a/files/gentoo-initd
+++ b/files/gentoo-initd
@@ -17,7 +17,7 @@
 #
 # Author: Sireyessire, Cyril Jaquier
 # 
-# $Revision: 1.2 $
+# $Revision$
 
 opts="start stop restart reload showlog"
 
@@ -41,6 +41,32 @@ stop() {
 	eend $? "Failed to stop fail2ban"
 }
 
+restart() {
+    if ! service_stopped "${SVCNAME}" ; then
+            svc_stop || return "$?"
+            einfon "Waiting for server to shutdown ."
+			cnt=0
+			while [ 1 ]; do
+				# Ping fail2ban-server
+				${FAIL2BAN} ping &> /dev/null
+				if [ ! "$?" == "0" ]; then
+					break
+				fi
+				cnt=`expr $cnt + 1`
+				if [ $cnt -gt 60 ] ; then
+					# We have waited 1 minute. Failed
+					echo
+					eend 1 "Failed"
+					break
+				fi
+				sleep 1
+				echo -n "."
+			done
+			echo
+    fi
+    svc_start
+}
+
 reload() {
 	ebegin "Reloading fail2ban"
 	${FAIL2BAN} reload > /dev/null

From 5dd2c5162ef42bad3b1403b1c0a24d8b734a717e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 18 Dec 2006 22:30:30 +0000
Subject: [PATCH 444/549] - Reset logging handlers only if new handler succeeds

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@493 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/server.py | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/server/server.py b/server/server.py
index 13d57669..c71708d7 100644
--- a/server/server.py
+++ b/server/server.py
@@ -300,14 +300,18 @@ class Server:
 		finally:
 			self.__loggingLock.release()
 	
+	##
+	# Sets the logging target.
+	#
+	# target can be a file, SYSLOG, STDOUT or STDERR.
+	# @param target the logging target
+	
 	def setLogTarget(self, target):
 		try:
 			self.__loggingLock.acquire()
-			# Remove previous handler
-			logging.getLogger("fail2ban").handlers = []
 			if target == "SYSLOG":
 				facility = logging.handlers.SysLogHandler.LOG_DAEMON
-				hdlr = logging.handlers.SysLogHandler("/dev/log",
+				hdlr = logging.handlers.SysLogHandler("/dev/log", 
 													  facility = facility)
 			elif target == "STDOUT":
 				hdlr = logging.StreamHandler(sys.stdout)
@@ -320,8 +324,11 @@ class Server:
 					hdlr = logging.FileHandler(target)
 				except IOError:
 					logSys.error("Unable to log to " + target)
+					logSys.info("Logging to previous target " + self.__logTarget)
 					return False
 			self.__logTarget = target
+			# Remove previous handler
+			logging.getLogger("fail2ban").handlers = []
 			# set a format which is simpler for console use
 			formatter = logging.Formatter("%(asctime)s %(name)-16s: %(levelname)-6s %(message)s")
 			# tell the handler to use this format

From 0c40adda4bd6e980071258f3a468131d495fc3d1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 18 Dec 2006 22:33:01 +0000
Subject: [PATCH 445/549] - Fixed some comments

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@494 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/dummy.conf      | 12 ++++++------
 config/action.d/hostsdeny.conf  | 12 ++++++------
 config/action.d/ipfw.conf       | 16 ++++++++--------
 config/action.d/iptables.conf   | 12 ++++++------
 config/action.d/mail-whois.conf | 12 ++++++------
 config/action.d/mail.conf       | 12 ++++++------
 config/action.d/shorewall.conf  | 12 ++++++------
 config/fail2ban.conf            |  5 +++--
 config/jail.conf                | 19 +++++++++++++++----
 9 files changed, 62 insertions(+), 50 deletions(-)

diff --git a/config/action.d/dummy.conf b/config/action.d/dummy.conf
index 5737c372..cc729fdd 100644
--- a/config/action.d/dummy.conf
+++ b/config/action.d/dummy.conf
@@ -7,26 +7,26 @@
 
 [Definition]
 
-# Option:  fwstart
+# Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = touch /tmp/fail2ban.dummy
               echo "<init>" >> /tmp/fail2ban.dummy
 
-# Option:  fwend
+# Option:  actionend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = rm -f /tmp/fail2ban.dummy
 
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
 actioncheck = 
 
-# Option:  fwban
+# Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
@@ -36,7 +36,7 @@ actioncheck =
 #
 actionban = echo "+<ip>" >> /tmp/fail2ban.dummy
 
-# Option:  fwunban
+# Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf
index 7f63ff9b..784fddc5 100644
--- a/config/action.d/hostsdeny.conf
+++ b/config/action.d/hostsdeny.conf
@@ -7,25 +7,25 @@
 
 [Definition]
 
-# Option:  fwstart
+# Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = touch <tmpfile>
 
-# Option:  fwend
+# Option:  actionend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = rm -f <tmpfile>
 
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
 actioncheck = 
 
-# Option:  fwban
+# Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
@@ -36,7 +36,7 @@ actioncheck =
 actionban = IP=<ip> &&
             echo "ALL: $IP" >> <file>
 
-# Option:  fwunban
+# Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
diff --git a/config/action.d/ipfw.conf b/config/action.d/ipfw.conf
index 1828eef9..5ae00cae 100644
--- a/config/action.d/ipfw.conf
+++ b/config/action.d/ipfw.conf
@@ -8,28 +8,28 @@
 
 [Definition]
 
-# Option:  fwstart
+# Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 
 
 
-# Option:  fwend
+# Option:  actionend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = 
 
 
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
 actioncheck = 
 
 
-# Option:  fwban
+# Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
@@ -37,10 +37,10 @@ actioncheck =
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = ipfw add deny tcp from <ip> to <localhost> <port>
+actionban = ipaction add deny tcp from <ip> to <localhost> <port>
 
 
-# Option:  fwunban
+# Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
@@ -48,7 +48,7 @@ actionban = ipfw add deny tcp from <ip> to <localhost> <port>
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
+actionunban = ipaction delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
 
 [Init]
 
diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf
index d9be0202..de3646f6 100644
--- a/config/action.d/iptables.conf
+++ b/config/action.d/iptables.conf
@@ -7,7 +7,7 @@
 
 [Definition]
 
-# Option:  fwstart
+# Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
@@ -15,7 +15,7 @@ actionstart = iptables -N fail2ban-<name>
               iptables -A fail2ban-<name> -j RETURN
               iptables -I INPUT -p <protocol> --dport <port> -j fail2ban-<name>
 
-# Option:  fwend
+# Option:  actionend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
@@ -23,13 +23,13 @@ actionstop = iptables -D INPUT -p <protocol> --dport <port> -j fail2ban-<name>
              iptables -F fail2ban-<name>
              iptables -X fail2ban-<name>
 
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
 actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
 
-# Option:  fwban
+# Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
@@ -39,7 +39,7 @@ actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
 #
 actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 
-# Option:  fwunban
+# Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf
index fdff74af..6055d98b 100644
--- a/config/action.d/mail-whois.conf
+++ b/config/action.d/mail-whois.conf
@@ -7,7 +7,7 @@
 
 [Definition]
 
-# Option:  fwstart
+# Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
@@ -16,7 +16,7 @@ actionstart = echo -en "Hi,\n
               Regards,\n
               Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
 
-# Option:  fwend
+# Option:  actionend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
@@ -25,13 +25,13 @@ actionstop = echo -en "Hi,\n
              Regards,\n
              Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
 
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
 actioncheck = 
 
-# Option:  fwban
+# Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
@@ -47,7 +47,7 @@ actionban = echo -en "Hi,\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
 
-# Option:  fwunban
+# Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf
index c33487b8..61522b27 100644
--- a/config/action.d/mail.conf
+++ b/config/action.d/mail.conf
@@ -7,7 +7,7 @@
 
 [Definition]
 
-# Option:  fwstart
+# Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
@@ -16,7 +16,7 @@ actionstart = echo -en "Hi,\n
               Regards,\n
               Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
 
-# Option:  fwend
+# Option:  actionend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
@@ -25,13 +25,13 @@ actionstop = echo -en "Hi,\n
              Regards,\n
              Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
 
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
 actioncheck = 
 
-# Option:  fwban
+# Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
@@ -45,7 +45,7 @@ actionban = echo -en "Hi,\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
 
-# Option:  fwunban
+# Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
diff --git a/config/action.d/shorewall.conf b/config/action.d/shorewall.conf
index f0da70ee..446c8a4b 100644
--- a/config/action.d/shorewall.conf
+++ b/config/action.d/shorewall.conf
@@ -7,25 +7,25 @@
 
 [Definition]
 
-# Option:  fwstart
+# Option:  actionstart
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
 actionstart = 
 
-# Option:  fwend
+# Option:  actionend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
 actionstop = 
 
-# Option:  fwcheck
-# Notes.:  command executed once before each fwban command
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
 # Values:  CMD
 #
 actioncheck = 
 
-# Option:  fwban
+# Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
@@ -35,7 +35,7 @@ actioncheck =
 #
 actionban = shorewall reject <ip>
 
-# Option:  fwunban
+# Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
diff --git a/config/fail2ban.conf b/config/fail2ban.conf
index 518c2ff4..8001285d 100644
--- a/config/fail2ban.conf
+++ b/config/fail2ban.conf
@@ -25,8 +25,9 @@ loglevel = 3
 logtarget = /var/log/fail2ban.log
 
 # Option: socket
-# Notes.: Set the socket file. This is used to communication with the
-#         daemon.
+# Notes.: Set the socket file. This is used to communicate with the daemon. Do
+#         not remove this file when Fail2ban runs. It will not be possible to
+#         communicate with the server afterwards.
 # Values: FILE  Default:  /tmp/fail2ban.sock
 #
 socket = /tmp/fail2ban.sock
diff --git a/config/jail.conf b/config/jail.conf
index 15befe5b..b3985363 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -10,18 +10,29 @@
 
 [DEFAULT]
 
-# "ignoreip" can be an IP address, a CIDR mask or a DNS host.
+# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
+# ban a host which matches an address in this list. Several addresses can be
+# defined using space separator.
 ignoreip = 127.0.0.1
+
 # "bantime" is the number of seconds that a host is banned.
 bantime  = 600
-# A host is banned if it has generated "maxretry" during the
-# last "findtime" seconds.
+
+# A host is banned if it has generated "maxretry" during the last "findtime"
+# seconds.
 findtime  = 600
+
 # "maxretry" is the number of failures before a host get banned.
 maxretry = 3
 
 # "backend" specifies the backend used to get files modification. Available
-# options are "gamin", "polling" and "auto".
+# options are "gamin", "polling" and "auto". This option can be overridden in
+# each jail too (use "gamin" for a jail and "polling" for another).
+#
+# gamin:   requires Gamin (a file alteration monitor) to be installed. If Gamin
+#          is not installed, Fail2ban will use polling.
+# polling: uses a polling algorithm which does not require external libraries.
+# auto:    will choose Gamin if available and polling otherwise.
 backend = auto
 
 

From 840b9fff0f3707d2c529f1136fbc1eca1aba0c84 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 18 Dec 2006 22:35:34 +0000
Subject: [PATCH 446/549] - Fixed some comments

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@495 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/apache-auth.conf     | 3 ++-
 config/filter.d/apache-noscript.conf | 3 ++-
 config/filter.d/courierlogin.conf    | 3 ++-
 config/filter.d/couriersmtp.conf     | 3 ++-
 config/filter.d/postfix.conf         | 3 ++-
 config/filter.d/proftpd.conf         | 3 ++-
 config/filter.d/qmail.conf           | 3 ++-
 config/filter.d/sasl.conf            | 3 ++-
 config/filter.d/sshd.conf            | 3 ++-
 config/filter.d/vsftpd.conf          | 3 ++-
 10 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 501e3d68..87d6edef 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -10,7 +10,8 @@
 # Option:  failregex
 # Notes.:  regex to match the password failure messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching.
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
 failregex = [[]client <HOST>[]] user .*(?:: authentication failure|not found)
diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
index 45366867..280f72b9 100644
--- a/config/filter.d/apache-noscript.conf
+++ b/config/filter.d/apache-noscript.conf
@@ -10,7 +10,8 @@
 # Option:  failregex
 # Notes.:  regex to match the password failure messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching.
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
 failregex = [[]client <HOST>[]] File does not exist: .*(\.php|\.asp)
diff --git a/config/filter.d/courierlogin.conf b/config/filter.d/courierlogin.conf
index 0e6b7a11..90e55ce2 100644
--- a/config/filter.d/courierlogin.conf
+++ b/config/filter.d/courierlogin.conf
@@ -11,7 +11,8 @@
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching.
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
 failregex = LOGIN FAILED, ip=\[<HOST>\]$
diff --git a/config/filter.d/couriersmtp.conf b/config/filter.d/couriersmtp.conf
index d67a61ea..b695a707 100644
--- a/config/filter.d/couriersmtp.conf
+++ b/config/filter.d/couriersmtp.conf
@@ -10,7 +10,8 @@
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching.
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
 failregex = error,relay=<HOST>,.*550 User unknown
diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf
index a0e0a974..90b19d55 100644
--- a/config/filter.d/postfix.conf
+++ b/config/filter.d/postfix.conf
@@ -10,7 +10,8 @@
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching.
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
 failregex = reject: RCPT from (.*)\[<HOST>\]: 554
diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index 28921a01..65ff59b7 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -10,7 +10,8 @@
 # Option: failregex
 # Notes.: regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching.
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
 # Values: TEXT
 #
 failregex = USER \S+: no such user found from \S* ?\[<HOST>\] to \S+\s*$
diff --git a/config/filter.d/qmail.conf b/config/filter.d/qmail.conf
index 3e4ae215..854d4ee2 100644
--- a/config/filter.d/qmail.conf
+++ b/config/filter.d/qmail.conf
@@ -10,7 +10,8 @@
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching.
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
 failregex = (?:[\d,.]+[\d,.] rblsmtpd: |421 badiprbl: ip )<HOST>
diff --git a/config/filter.d/sasl.conf b/config/filter.d/sasl.conf
index 3602b594..ad4fe463 100644
--- a/config/filter.d/sasl.conf
+++ b/config/filter.d/sasl.conf
@@ -10,7 +10,8 @@
 # Option: failregex
 # Notes.: regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching.
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
 # Values: TEXT
 #
 failregex = : warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 3c2c5db6..9659fa16 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -10,7 +10,8 @@
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching.
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
 failregex = (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) <HOST>
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index 384fa36b..4955fcfc 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -10,7 +10,8 @@
 # Option: failregex
 # Notes.: regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching.
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
 # Values: TEXT
 #
 failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=<HOST>

From 2e197487a2195176f6d9ded8e5b2a33986d44ce1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 19 Dec 2006 21:51:14 +0000
Subject: [PATCH 447/549] =?UTF-8?q?-=20Fixed=20removal=20of=20host=20in=20?=
 =?UTF-8?q?hosts.deny.=20Thanks=20to=20Ren=C3=A9=20Berber?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@496 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                      |  1 +
 README                         |  3 ++-
 config/action.d/hostsdeny.conf | 11 +----------
 3 files changed, 4 insertions(+), 11 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index fad0e412..c29412b3 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -12,6 +12,7 @@ ver. 0.7.6 (200?/??/??) - ???
 - Added a "sleep 1" in redhat-initd. Thanks to Jim Wight
 - Use /dev/log for SYSLOG output. Thanks to Joerg Sommrey
 - Use numeric output for iptables in "actioncheck"
+- Fixed removal of host in hosts.deny. Thanks to René Berber
 
 ver. 0.7.5 (2006/12/07) - beta
 ----------
diff --git a/README b/README
index 0dedd93a..911ba62e 100644
--- a/README
+++ b/README
@@ -72,7 +72,8 @@ Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
 Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
 Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
 Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
-Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand
+Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
+René Berber
 
 License:
 --------
diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf
index 784fddc5..3282a4cb 100644
--- a/config/action.d/hostsdeny.conf
+++ b/config/action.d/hostsdeny.conf
@@ -44,9 +44,7 @@ actionban = IP=<ip> &&
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionunban = IP=<ip> &&
-              grep -v "ALL: $IP" <file> > <tmpfile> &&
-              mv <tmpfile> <file>
+actionunban = IP=<ip> && sed -i.old /ALL:\ $IP/d <file>
 
 [Init]
 
@@ -55,10 +53,3 @@ actionunban = IP=<ip> &&
 # Values:  STR  Default:  /etc/hosts.deny
 #
 file = /etc/hosts.deny
-
-# Option:  file
-# Notes.:  hosts.deny temporary file path.
-# Values:  STR  Default:  /etc/hostsdeny.failban
-#
-tmpfile = /tmp/hosts.deny.tmp
-

From 1ac00d062a3736d1d32b9b081604681dedecab07 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 23 Dec 2006 09:48:49 +0000
Subject: [PATCH 448/549] - Regular expression should be more correct now

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@498 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/courierlogin.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/courierlogin.conf b/config/filter.d/courierlogin.conf
index 90e55ce2..e92301d7 100644
--- a/config/filter.d/courierlogin.conf
+++ b/config/filter.d/courierlogin.conf
@@ -15,7 +15,7 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = LOGIN FAILED, ip=\[<HOST>\]$
+failregex = LOGIN FAILED, .*, ip=\[<HOST>\]$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 3a344557ecbfdeb82e3f7ae7852b01bd72d37f02 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 23 Dec 2006 09:49:19 +0000
Subject: [PATCH 449/549] - Exim4 filter. Thanks to mEDI

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@499 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/exim.conf | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 config/filter.d/exim.conf

diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
new file mode 100644
index 00000000..564bb9a8
--- /dev/null
+++ b/config/filter.d/exim.conf
@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 267 $
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = \[<HOST>\] .*(?:rejected by local_scan|Unrouteable address)
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

From 812a47cc4a5693576fc92d70ac40a3c71940bc0b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 23 Dec 2006 09:50:03 +0000
Subject: [PATCH 450/549] - Added new date pattern (Exim4). Thanks to mEDI

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@500 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/datedetector.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/server/datedetector.py b/server/datedetector.py
index 1c886427..8c5f618a 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -66,6 +66,12 @@ class DateDetector:
 		template.setRegex("\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}")
 		template.setPattern("%d/%b/%Y:%H:%M:%S")
 		self.__templates.append(template)
+		# Exim 2006-12-21 06:43:20
+		template = DateStrptime()
+		template.setName("Year-Month-Day Hour:Minute:Second")
+		template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
+		template.setPattern("%Y-%m-%d %H:%M:%S")
+		self.__templates.append(template)
 		# TAI64N
 		template = DateTai64n()
 		template.setName("TAI64N")

From 071474089bdb9ccb28f7b4a02402a09957ef8670 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 23 Dec 2006 09:50:51 +0000
Subject: [PATCH 451/549] - Improved regular expression checking

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@501 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index f19cf732..7b17397b 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -435,10 +435,18 @@ class Filter(JailThread):
 							 + "this format")
 			else:
 				try:
-					ipMatch = DNSUtils.textToIp(match.group("host"))
-					if ipMatch:
-						for ip in ipMatch:
-							failList.append([ip, date])
+					matchGroup = match.group("host")
+					# For strange reasons, match.group can return None with some
+					# regular expressions. However, these expressions can be
+					# compiled successfully.
+					if matchGroup == None:
+						logSys.error("Unexpected error. Please correct your "
+									 + "configuration.")
+					else:
+						ipMatch = DNSUtils.textToIp(match.group("host"))
+						if ipMatch:
+							for ip in ipMatch:
+								failList.append([ip, date])
 				except IndexError:
 					logSys.error("There is no 'host' group in the rule. " +
 								 "Please correct your configuration.")

From 34a48157dccde2509de922675fa2d190e18e6370 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 23 Dec 2006 09:51:41 +0000
Subject: [PATCH 452/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@502 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 3 +++
 README    | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index c29412b3..75540cfe 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -13,6 +13,9 @@ ver. 0.7.6 (200?/??/??) - ???
 - Use /dev/log for SYSLOG output. Thanks to Joerg Sommrey
 - Use numeric output for iptables in "actioncheck"
 - Fixed removal of host in hosts.deny. Thanks to René Berber
+- Added new date format (2006-12-21 06:43:20) and Exim4
+  filter. Thanks to mEDI
+- Improved regular expression checking a bit
 
 ver. 0.7.5 (2006/12/07) - beta
 ----------
diff --git a/README b/README
index 911ba62e..db025b72 100644
--- a/README
+++ b/README
@@ -73,7 +73,7 @@ Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
 Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
 Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
 Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
-René Berber
+René Berber, mEDI
 
 License:
 --------

From 0f31cc0feb1a393452664aff83c596f139185b52 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 23 Dec 2006 16:31:00 +0000
Subject: [PATCH 453/549] - Added support for several "failregex" and
 "ignoreregex". This should simplify the configuration files. - Configuration
 files are backward-compatible but need to be updated in order to take
 advantage of this feature.

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@503 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                   |   3 +-
 MANIFEST                    |   2 +
 client/beautifier.py        |  13 +++-
 client/filterreader.py      |   6 +-
 common/protocol.py          |  10 +--
 fail2ban-regex              |  14 ++--
 man/fail2ban-client.1       |  61 +++++++++++------
 man/fail2ban-regex.1        |   4 +-
 man/fail2ban-server.1       |   4 +-
 server/failregex.py         |  62 +++++++++++++++++
 server/filter.py            | 129 ++++++++++++++++++------------------
 server/regex.py             |  88 ++++++++++++++++++++++++
 server/server.py            |  14 ++--
 server/transmitter.py       |  16 +++--
 testcases/filtertestcase.py |  41 ++++++++++--
 15 files changed, 349 insertions(+), 118 deletions(-)
 create mode 100644 server/failregex.py
 create mode 100644 server/regex.py

diff --git a/CHANGELOG b/CHANGELOG
index 75540cfe..c9460d61 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -15,7 +15,8 @@ ver. 0.7.6 (200?/??/??) - ???
 - Fixed removal of host in hosts.deny. Thanks to René Berber
 - Added new date format (2006-12-21 06:43:20) and Exim4
   filter. Thanks to mEDI
-- Improved regular expression checking a bit
+- Several "failregex" and "ignoreregex" are now accepted.
+  Creation of rules should be easier now.
 
 ver. 0.7.5 (2006/12/07) - beta
 ----------
diff --git a/MANIFEST b/MANIFEST
index db392e40..9908c9f1 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -39,6 +39,8 @@ server/dateepoch.py
 server/banmanager.py
 server/datetemplate.py
 server/mytime.py
+server/regex.py
+server/failregex.py
 testcases/banmanagertestcase.py
 testcases/failmanagertestcase.py
 testcases/clientreadertestcase.py
diff --git a/client/beautifier.py b/client/beautifier.py
index 2ef8d515..abe562a6 100644
--- a/client/beautifier.py
+++ b/client/beautifier.py
@@ -109,7 +109,18 @@ class Beautifier:
 					msg = "These IP addresses/networks are ignored:\n"
 					for ip in response[:-1]:
 						msg = msg + "|- " + ip + "\n"
-					msg = msg + "`- " + response[len(response)-1]				
+					msg = msg + "`- " + response[len(response)-1]
+			elif inC[2] in ("failregex", "addfailregex", "delfailregex",
+							"ignoreregex", "addignoreregex", "delignoreregex"):
+				if len(response) == 0:
+					msg = "No regular expression is defined"
+				else:
+					msg = "The following regular expression are defined:\n"
+					c = 0
+					for ip in response[:-1]:
+						msg = msg + "|- [" + str(c) + "]: " + ip + "\n"
+						c += 1
+					msg = msg + "`- [" + str(c) + "]: " + response[len(response)-1]
 		except Exception:
 			logSys.warn("Beautifier error. Please report the error")
 			logSys.error("Beautify " + `response` + " with " + `self.__inputCmd` +
diff --git a/client/filterreader.py b/client/filterreader.py
index 14ffbb91..30cca818 100644
--- a/client/filterreader.py
+++ b/client/filterreader.py
@@ -67,8 +67,10 @@ class FilterReader(ConfigReader):
 			elif opt == "timepattern":
 				stream.append(["set", self.__name, "timepattern", self.__opts[opt]])
 			elif opt == "failregex":
-				stream.append(["set", self.__name, "failregex", self.__opts[opt]])
+				for regex in self.__opts[opt].split('\n'):
+					stream.append(["set", self.__name, "addfailregex", regex])
 			elif opt == "ignoreregex":
-				stream.append(["set", self.__name, "ignoreregex", self.__opts[opt]])		
+				for regex in self.__opts[opt].split('\n'):
+					stream.append(["set", self.__name, "addignoreregex", regex])		
 		return stream
 		
\ No newline at end of file
diff --git a/common/protocol.py b/common/protocol.py
index e53d121b..d9312f9b 100644
--- a/common/protocol.py
+++ b/common/protocol.py
@@ -54,8 +54,10 @@ protocol = [
 ["set <JAIL> dellogpath <FILE>", "removes <FILE> to the monitoring list of <JAIL>"], 
 ["set <JAIL> timeregex <REGEX>", "sets the regular expression <REGEX> to match the date format for <JAIL>. This will disable the autodetection feature."], 
 ["set <JAIL> timepattern <PATTERN>", "sets the pattern <PATTERN> to match the date format for <JAIL>. This will disable the autodetection feature."], 
-["set <JAIL> failregex <REGEX>", "sets the regular expression <REGEX> which must match failures for <JAIL>"], 
-["set <JAIL> ignoreregex <REGEX>", "sets the regular expression <REGEX> which should match pattern to exclude for <JAIL>"], 
+["set <JAIL> addfailregex <REGEX>", "adds the regular expression <REGEX> which must match failures for <JAIL>"], 
+["set <JAIL> delfailregex <INDEX>", "removes the regular expression at <INDEX> for failregex"], 
+["set <JAIL> addignoreregex <REGEX>", "adds the regular expression <REGEX> which should match pattern to exclude for <JAIL>"],
+["set <JAIL> delignoreregex <INDEX>", "removes the regular expression at <INDEX> for ignoreregex"], 
 ["set <JAIL> findtime <TIME>", "sets the number of seconds <TIME> for which the filter will look back for <JAIL>"], 
 ["set <JAIL> bantime <TIME>", "sets the number of seconds <TIME> a host will be banned for <JAIL>"], 
 ["set <JAIL> maxretry <RETRY>", "sets the number of failures <RETRY> before banning the host for <JAIL>"], 
@@ -73,8 +75,8 @@ protocol = [
 ["get <JAIL> ignoreip", "gets the list of ignored IP addresses for <JAIL>"],
 ["get <JAIL> timeregex", "gets the regular expression used for the time detection for <JAIL>"],
 ["get <JAIL> timepattern", "gets the pattern used for the time detection for <JAIL>"],
-["get <JAIL> failregex", "gets the regular expression which matches the failures for <JAIL>"],
-["get <JAIL> ignoreregex", "gets the regular expression which matches patterns to ignore for <JAIL>"],
+["get <JAIL> failregex", "gets the list of regular expressions which matches the failures for <JAIL>"],
+["get <JAIL> ignoreregex", "gets the list of regular expressions which matches patterns to ignore for <JAIL>"],
 ["get <JAIL> findtime", "gets the time for which the filter will look back for failures for <JAIL>"],
 ["get <JAIL> bantime", "gets the time a host is banned for <JAIL>"],
 ["get <JAIL> maxretry", "gets the number of failures allowed for <JAIL>"],
diff --git a/fail2ban-regex b/fail2ban-regex
index 6f4849ad..dc497e0a 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -33,6 +33,7 @@ sys.path.insert(1, "/usr/lib/fail2ban")
 
 from common.version import version
 from server.filter import Filter
+from server.regex import RegexException
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.regex")
@@ -83,17 +84,17 @@ class Fail2banRegex:
 	 			self.dispVersion()
 	 			sys.exit(0)
 	
-	def setRegex(self, value):
-		print
-		self.__filter.setFailRegex(value)
-	
-	def testRegex(self, line):
+	def testRegex(self, line, regex):
 		print
 		try:
 			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
+			self.__filter.addFailRegex(regex)
 			ret = self.__filter.findFailure(line)
 			print
 			logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
+		except RegexException, e:
+			print e
+			return False
 		except IndexError:
 			print "Sorry, but no <host> found in regex"
 			return False
@@ -156,8 +157,7 @@ if __name__ == "__main__":
 		regex.dispUsage()
 		sys.exit(-1)
 	else:
-		regex.setRegex(sys.argv[2])
-		ret = regex.testRegex(sys.argv[1])
+		ret = regex.testRegex(sys.argv[1], sys.argv[2])
 		if ret:
 			sys.exit(0)
 		else:
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index d52e990a..b905634d 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "December 2006" "fail2ban-client v0.7.4-SVN" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "December 2006" "fail2ban-client v0.7.5-SVN" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH SYNOPSIS
 .B fail2ban-client
 [\fIOPTIONS\fR]... \fI<COMMAND>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.4\-SVN reads log file that contains password failure report
+Fail2Ban v0.7.5\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
@@ -37,6 +37,8 @@ display this help message
 \fB\-V\fR, \fB\-\-version\fR
 print the version
 .SH COMMAND
+.IP
+Basic
 .TP
 \fBstart\fR
 starts the server and the jails
@@ -54,6 +56,8 @@ server
 .TP
 \fBping\fR
 tests if the server is alive
+.IP
+Logging
 .TP
 \fBset loglevel <LEVEL>\fR
 sets logging level to <LEVEL>. 0
@@ -69,10 +73,24 @@ file
 .TP
 \fBget logtarget\fR
 gets logging target
+.IP
+Jail control
 .TP
 \fBadd <JAIL> <BACKEND>\fR
 creates <JAIL> using <BACKEND>
 .TP
+\fBstart <JAIL>\fR
+starts the jail <JAIL>
+.TP
+\fBstop <JAIL>\fR
+stops the jail <JAIL>. The jail is
+removed
+.TP
+\fBstatus <JAIL>\fR
+gets the current status of <JAIL>
+.IP
+Jail configuration
+.TP
 \fBset <JAIL> idle on|off\fR
 sets the idle state of <JAIL>
 .TP
@@ -104,16 +122,24 @@ match the date format for <JAIL>.
 This will disable the
 autodetection feature.
 .TP
-\fBset <JAIL> failregex <REGEX>\fR
-sets the regular expression
+\fBset <JAIL> addfailregex <REGEX>\fR
+adds the regular expression
 <REGEX> which must match failures
 for <JAIL>
 .TP
-\fBset <JAIL> ignoreregex <REGEX>\fR
-sets the regular expression
+\fBset <JAIL> delfailregex <INDEX>\fR
+removes the regular expression at
+<INDEX> for failregex
+.TP
+\fBset <JAIL> addignoreregex <REGEX>\fR
+adds the regular expression
 <REGEX> which should match pattern
 to exclude for <JAIL>
 .TP
+\fBset <JAIL> delignoreregex <INDEX>\fR
+removes the regular expression at
+<INDEX> for ignoreregex
+.TP
 \fBset <JAIL> findtime <TIME>\fR
 sets the number of seconds <TIME>
 for which the filter will look
@@ -163,6 +189,8 @@ action <ACT> for <JAIL>
 \fBset <JAIL> actionunban <ACT> <CMD>\fR
 sets the unban command <CMD> of
 the action <ACT> for <JAIL>
+.IP
+Jail information
 .TP
 \fBget <JAIL> logpath\fR
 gets the list of the monitored
@@ -181,13 +209,14 @@ gets the pattern used for the time
 detection for <JAIL>
 .TP
 \fBget <JAIL> failregex\fR
-gets the regular expression which
-matches the failures for <JAIL>
+gets the list of regular
+expressions which matches the
+failures for <JAIL>
 .TP
 \fBget <JAIL> ignoreregex\fR
-gets the regular expression which
-matches patterns to ignore for
-<JAIL>
+gets the list of regular
+expressions which matches patterns
+to ignore for <JAIL>
 .TP
 \fBget <JAIL> findtime\fR
 gets the time for which the filter
@@ -225,16 +254,6 @@ action <ACT> for <JAIL>
 \fBget <JAIL> actionunban <ACT>\fR
 gets the unban command for the
 action <ACT> for <JAIL>
-.TP
-\fBstart <JAIL>\fR
-starts the jail <JAIL>
-.TP
-\fBstop <JAIL>\fR
-stops the jail <JAIL>. The jail is
-removed
-.TP
-\fBstatus <JAIL>\fR
-gets the current status of <JAIL>
 .SH FILES
 \fI/etc/fail2ban/*\fR
 .SH AUTHOR
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index e122b7a8..a1352142 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-REGEX "1" "December 2006" "fail2ban-regex v0.7.4-SVN" "User Commands"
+.TH FAIL2BAN-REGEX "1" "December 2006" "fail2ban-regex v0.7.5-SVN" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
 .B fail2ban-regex
 \fI<logline> <failregex>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.4\-SVN reads log file that contains password failure report
+Fail2Ban v0.7.5\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 This tools can test and benchmark your regular expressions for the "failregex"
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index 415d6155..d58ba373 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "December 2006" "fail2ban-server v0.7.4-SVN" "User Commands"
+.TH FAIL2BAN-SERVER "1" "December 2006" "fail2ban-server v0.7.5-SVN" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.7.4\-SVN reads log file that contains password failure report
+Fail2Ban v0.7.5\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with
diff --git a/server/failregex.py b/server/failregex.py
new file mode 100644
index 00000000..275380b9
--- /dev/null
+++ b/server/failregex.py
@@ -0,0 +1,62 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from regex import Regex, RegexException
+
+##
+# Regular expression class.
+#
+# This class represents a regular expression with its compiled version.
+
+class FailRegex(Regex):
+
+	##
+	# Constructor.
+	#
+	# Creates a new object. This method can throw RegexException in order to
+	# avoid construction of invalid object.
+	# @param value the regular expression
+	
+	def __init__(self, value):
+		# Replace "<HOST>" with default regular expression for host.
+		regex = value.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>\S+)")
+		# Initializes the parent.
+		Regex.__init__(self, regex)
+		# Check for group "host"
+		if "host" not in self._regexObj.groupindex:
+			raise RegexException("No 'host' group in '%s'" % self._regex)
+	
+	##
+	# Returns the matched host.
+	#
+	# This corresponds to the pattern matched by the named group "host".
+	# @return the matched host
+	
+	def getHost(self):
+		host = self._matchCache.group("host")
+		if host == None:
+			raise RegexException("Unexpected error. Please check your regex")
+		return host
diff --git a/server/filter.py b/server/filter.py
index 7b17397b..4736ff92 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -29,8 +29,10 @@ from failticket import FailTicket
 from jailthread import JailThread
 from datedetector import DateDetector
 from mytime import MyTime
+from regex import Regex, RegexException
+from failregex import FailRegex
 
-import logging, re, sre_constants
+import logging, re
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.filter")
@@ -61,12 +63,10 @@ class Filter(JailThread):
 		self.__crtFilename = None
 		## The log file path.
 		self.__logPath = []
-		## The regular expression matching the failure.
-		self.__failRegex = ''
-		self.__failRegexObj = None
-		## The regular expression with expression to ignore.
-		self.__ignoreRegex = ''
-		self.__ignoreRegexObj = None
+		## The regular expression list matching the failures.
+		self.__failRegex = list()
+		## The regular expression list with expressions to ignore.
+		self.__ignoreRegex = list()
 		## The amount of time to look back.
 		self.__findTime = 6000
 		## The ignore IP list.
@@ -158,26 +158,26 @@ class Filter(JailThread):
 		return self.dateDetector.getDefaultPattern()
 	
 	##
-	# Set the regular expression which matches the failure.
+	# Add a regular expression which matches the failure.
 	#
 	# The regular expression can also match any other pattern than failures
 	# and thus can be used for many purporse.
 	# @param value the regular expression
 	
-	def setFailRegex(self, value):
+	def addFailRegex(self, value):
 		try:
-			if value.lstrip() == '':
-				self.__failRegex = value
-				self.__failRegexObj = None
-			else:
-				# Replace "<HOST>" with default regular expression for host.
-				regex = value.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>\S+)")
-				self.__failRegex = regex
-				self.__failRegexObj = re.compile(regex)
-			logSys.info("Set failregex = %s" % self.__failRegex)
-		except sre_constants.error:
-			logSys.error("Unable to compile regular expression " +
-						self.__failRegex)
+			regex = FailRegex(value)
+			self.__failRegex.append(regex)
+		except RegexException, e:
+			logSys.error(e)
+	
+
+	def delFailRegex(self, index):
+		try:
+			del self.__failRegex[index]
+		except IndexError:
+			logSys.error("Cannot remove regular expression. Index %d is not "
+						 "valid" % index)
 	
 	##
 	# Get the regular expression which matches the failure.
@@ -185,25 +185,31 @@ class Filter(JailThread):
 	# @return the regular expression
 	
 	def getFailRegex(self):
-		return self.__failRegex
+		failRegex = list()
+		for regex in self.__failRegex:
+			failRegex.append(regex.getRegex())
+		return failRegex
 	
 	##
-	# Set the regular expression which matches the failure.
+	# Add the regular expression which matches the failure.
 	#
 	# The regular expression can also match any other pattern than failures
 	# and thus can be used for many purporse.
 	# @param value the regular expression
 	
-	def setIgnoreRegex(self, value):
+	def addIgnoreRegex(self, value):
 		try:
-			if value.lstrip() == '':
-				self.__ignoreRegexObj = None
-			else:
-				self.__ignoreRegexObj = re.compile(value)
-			self.__ignoreRegex = value
-			logSys.info("Set ignoreregex = %s" % value)
-		except sre_constants.error:
-			logSys.error("Unable to compile regular expression " + value)
+			regex = Regex(value)
+			self.__ignoreRegex.append(regex)
+		except RegexException, e:
+			logSys.error(e)
+	
+	def delIgnoreRegex(self, index):
+		try:
+			del self.__ignoreRegex[index]
+		except IndexError:
+			logSys.error("Cannot remove regular expression. Index %d is not "
+						 "valid" % index)
 	
 	##
 	# Get the regular expression which matches the failure.
@@ -211,7 +217,10 @@ class Filter(JailThread):
 	# @return the regular expression
 	
 	def getIgnoreRegex(self):
-		return self.__ignoreRegex
+		ignoreRegex = list()
+		for regex in self.__ignoreRegex:
+			ignoreRegex.append(regex.getRegex())
+		return ignoreRegex
 	
 	##
 	# Set the time needed to find a failure.
@@ -413,43 +422,35 @@ class Filter(JailThread):
 
 	def findFailure(self, line):
 		failList = list()
-		# Checks if failregex is defined.
-		if self.__failRegexObj == None:
-			logSys.error("No failregex is set")
-			return failList
-		# Checks if ignoreregex is defined.
-		if not self.__ignoreRegexObj == None:
-			match = self.__ignoreRegexObj.search(line)
-			if match:
+		# Checks if we must ignore this line.
+		for ignoreRegex in self.__ignoreRegex:
+			ignoreRegex.search(line)
+			if ignoreRegex.hasMatched():
 				# The ignoreregex matched. Return.
 				logSys.debug("Ignoring this line")
 				return failList
-		match = self.__failRegexObj.search(line)
-		if match:
-			# The failregex matched.
-			date = self.dateDetector.getUnixTime(match.string)
-			if date == None:
-				logSys.debug("Found a match but no valid date/time found "
-							 + "for " + match.string + ". Please contact "
-							 + "the author in order to get support for "
-							 + "this format")
-			else:
-				try:
-					matchGroup = match.group("host")
-					# For strange reasons, match.group can return None with some
-					# regular expressions. However, these expressions can be
-					# compiled successfully.
-					if matchGroup == None:
-						logSys.error("Unexpected error. Please correct your "
-									 + "configuration.")
-					else:
-						ipMatch = DNSUtils.textToIp(match.group("host"))
+		# Iterates over all the regular expressions.
+		for failRegex in self.__failRegex:
+			failRegex.search(line)
+			if failRegex.hasMatched():
+				# The failregex matched.
+				date = self.dateDetector.getUnixTime(line)
+				if date == None:
+					logSys.debug("Found a match but no valid date/time found "
+								 + "for " + line + ". Please contact the "
+								 + "author in order to get support for this "
+								 + "format")
+				else:
+					try:
+						host = failRegex.getHost()
+						ipMatch = DNSUtils.textToIp(host)
 						if ipMatch:
 							for ip in ipMatch:
 								failList.append([ip, date])
-				except IndexError:
-					logSys.error("There is no 'host' group in the rule. " +
-								 "Please correct your configuration.")
+							# We matched a regex, it is enough to stop.
+							break
+					except RegexException, e:
+						logSys.error(e)
 		return failList
 	
 
diff --git a/server/regex.py b/server/regex.py
new file mode 100644
index 00000000..c4e9c8ec
--- /dev/null
+++ b/server/regex.py
@@ -0,0 +1,88 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import re, sre_constants
+
+##
+# Regular expression class.
+#
+# This class represents a regular expression with its compiled version.
+
+class Regex:
+
+	##
+	# Constructor.
+	#
+	# Creates a new object. This method can throw RegexException in order to
+	# avoid construction of invalid object.
+	# @param value the regular expression
+	
+	def __init__(self, regex):
+		self._matchCache = None
+		try:
+			self._regexObj = re.compile(regex)
+			self._regex = regex
+		except sre_constants.error:
+			raise RegexException("Unable to compile regular expression '%s'" %
+								 regex)
+	
+	##
+	# Gets the regular expression.
+	#
+	# The effective regular expression used is returned.
+	# @return the regular expression
+	
+	def getRegex(self):
+		return self._regex
+	
+	##
+	# Searches the regular expression.
+	#
+	# Sets an internal cache (match object) in order to avoid searching for
+	# the pattern again. This method must be called before calling any other
+	# method of this object.
+	# @param value the line
+	
+	def search(self, value):
+		self._matchCache = self._regexObj.search(value)
+	
+	##
+	# Checks if the previous call to search() matched.
+	#
+	# @return True if a match was found, False otherwise
+	
+	def hasMatched(self):
+		if self._matchCache:
+			return True
+		else:
+			return False
+
+
+##
+# Exception dedicated to the class Regex.
+
+class RegexException(Exception):
+	pass
diff --git a/server/server.py b/server/server.py
index c71708d7..aa481045 100644
--- a/server/server.py
+++ b/server/server.py
@@ -165,14 +165,20 @@ class Server:
 	def getFindTime(self, name):
 		return self.__jails.getFilter(name).getFindTime()
 
-	def setFailRegex(self, name, value):
-		self.__jails.getFilter(name).setFailRegex(value)
+	def addFailRegex(self, name, value):
+		self.__jails.getFilter(name).addFailRegex(value)
+	
+	def delFailRegex(self, name, index):
+		self.__jails.getFilter(name).delFailRegex(index)
 	
 	def getFailRegex(self, name):
 		return self.__jails.getFilter(name).getFailRegex()
 	
-	def setIgnoreRegex(self, name, value):
-		self.__jails.getFilter(name).setIgnoreRegex(value)
+	def addIgnoreRegex(self, name, value):
+		self.__jails.getFilter(name).addIgnoreRegex(value)
+	
+	def delIgnoreRegex(self, name, index):
+		self.__jails.getFilter(name).delIgnoreRegex(index)
 	
 	def getIgnoreRegex(self, name):
 		return self.__jails.getFilter(name).getIgnoreRegex()
diff --git a/server/transmitter.py b/server/transmitter.py
index e08e40e0..98c55756 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -143,13 +143,21 @@ class Transmitter:
 			value = command[2]
 			self.__server.setTimePattern(name, value)
 			return self.__server.getTimePattern(name)
-		elif command[1] == "failregex":
+		elif command[1] == "addfailregex":
 			value = command[2]
-			self.__server.setFailRegex(name, value)
+			self.__server.addFailRegex(name, value)
 			return self.__server.getFailRegex(name)
-		elif command[1] == "ignoreregex":
+		elif command[1] == "delfailregex":
+			value = int(command[2])
+			self.__server.delFailRegex(name, value)
+			return self.__server.getFailRegex(name)
+		elif command[1] == "addignoreregex":
 			value = command[2]
-			self.__server.setIgnoreRegex(name, value)
+			self.__server.addIgnoreRegex(name, value)
+			return self.__server.getIgnoreRegex(name)
+		elif command[1] == "delignoreregex":
+			value = int(command[2])
+			self.__server.delIgnoreRegex(name, value)
 			return self.__server.getIgnoreRegex(name)
 		elif command[1] == "findtime":
 			value = command[2]
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 91c5a592..520b1ef3 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -99,7 +99,7 @@ class GetFailures(unittest.TestCase):
 		output = ('193.168.0.128', 3, 1124013599.0)
 		
 		self.__filter.addLogPath(GetFailures.FILENAME_01)
-		self.__filter.setFailRegex("(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)")
+		self.__filter.addFailRegex("(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)")
 
 		self.__filter.getFailures(GetFailures.FILENAME_01)
 		
@@ -116,7 +116,7 @@ class GetFailures(unittest.TestCase):
 		output = ('141.3.81.106', 4, 1124013539.0)
 
 		self.__filter.addLogPath(GetFailures.FILENAME_02)
-		self.__filter.setFailRegex("Failed .* (?:::f{4,6}:)(?P<host>\S*)")
+		self.__filter.addFailRegex("Failed .* (?:::f{4,6}:)(?P<host>\S*)")
 		
 		self.__filter.getFailures(GetFailures.FILENAME_02)
 		
@@ -127,13 +127,13 @@ class GetFailures(unittest.TestCase):
 		ip = ticket.getIP()
 		found = (ip, attempts, date)
 		
-		self.assertEqual(found, output)	
+		self.assertEqual(found, output)
 
 	def testGetFailures03(self):
 		output = ('203.162.223.135', 6, 1124013544.0)
 
 		self.__filter.addLogPath(GetFailures.FILENAME_03)
-		self.__filter.setFailRegex("error,relay=(?:::f{4,6}:)?(?P<host>\S*),.*550 User unknown")
+		self.__filter.addFailRegex("error,relay=(?:::f{4,6}:)?(?P<host>\S*),.*550 User unknown")
 		
 		self.__filter.getFailures(GetFailures.FILENAME_03)
 		
@@ -151,7 +151,7 @@ class GetFailures(unittest.TestCase):
 				  ('212.41.96.185', 4, 1124013598.0)]
 
 		self.__filter.addLogPath(GetFailures.FILENAME_04)
-		self.__filter.setFailRegex("Invalid user .* (?P<host>\S*)")
+		self.__filter.addFailRegex("Invalid user .* (?P<host>\S*)")
 		
 		self.__filter.getFailures(GetFailures.FILENAME_04)
 
@@ -165,4 +165,33 @@ class GetFailures(unittest.TestCase):
 				self.assertEqual(found, output[i])
 		except FailManagerEmpty:
 			pass
-		
\ No newline at end of file
+		
+	def testGetFailuresMultiRegex(self):
+		output = ('141.3.81.106', 8, 1124013541.0)
+
+		self.__filter.addLogPath(GetFailures.FILENAME_02)
+		self.__filter.addFailRegex("Failed .* from <HOST>")
+		self.__filter.addFailRegex("Accepted .* from <HOST>")
+		
+		self.__filter.getFailures(GetFailures.FILENAME_02)
+		
+		ticket = self.__filter.failManager.toBan()
+
+		attempts = ticket.getAttempt()
+		date = ticket.getTime()
+		ip = ticket.getIP()
+		found = (ip, attempts, date)
+		
+		self.assertEqual(found, output)
+	
+	def testGetFailuresIgnoreRegex(self):
+		output = ('141.3.81.106', 8, 1124013541.0)
+
+		self.__filter.addLogPath(GetFailures.FILENAME_02)
+		self.__filter.addFailRegex("Failed .* from <HOST>")
+		self.__filter.addFailRegex("Accepted .* from <HOST>")
+		self.__filter.addIgnoreRegex("for roehl")
+		
+		self.__filter.getFailures(GetFailures.FILENAME_02)
+		
+		self.assertRaises(FailManagerEmpty, self.__filter.failManager.toBan)

From cd012dda85b3fda9b6debe0e90c97cb2a261b758 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 23 Dec 2006 16:37:17 +0000
Subject: [PATCH 454/549] - Added svn:keywords

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@504 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/beautifier.py              | 6 +++---
 common/__init__.py                | 6 +++---
 common/protocol.py                | 6 +++---
 fail2ban-regex                    | 6 +++---
 server/datedetector.py            | 6 +++---
 server/dateepoch.py               | 6 +++---
 server/datestrptime.py            | 6 +++---
 server/datetai64n.py              | 6 +++---
 server/datetemplate.py            | 6 +++---
 server/filterpoll.py              | 6 +++---
 server/jails.py                   | 6 +++---
 server/mytime.py                  | 6 +++---
 testcases/actiontestcase.py       | 6 +++---
 testcases/clientreadertestcase.py | 6 +++---
 testcases/datedetectortestcase.py | 6 +++---
 15 files changed, 45 insertions(+), 45 deletions(-)

diff --git a/client/beautifier.py b/client/beautifier.py
index abe562a6..c017c5a2 100644
--- a/client/beautifier.py
+++ b/client/beautifier.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 288 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 288 $"
-__date__ = "$Date: 2006-08-22 23:59:51 +0200 (Tue, 22 Aug 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/common/__init__.py b/common/__init__.py
index cf63d1b6..dc25edd6 100644
--- a/common/__init__.py
+++ b/common/__init__.py
@@ -16,10 +16,10 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 433 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 433 $"
-__date__ = "$Date: 2006-10-24 21:40:51 +0200 (Tue, 24 Oct 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
diff --git a/common/protocol.py b/common/protocol.py
index d9312f9b..543e08e4 100644
--- a/common/protocol.py
+++ b/common/protocol.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 456 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 456 $"
-__date__ = "$Date: 2006-11-12 11:56:40 +0100 (Sun, 12 Nov 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/fail2ban-regex b/fail2ban-regex
index dc497e0a..a5f28780 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -17,11 +17,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 300 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 300 $"
-__date__ = "$Date: 2006-08-23 21:53:09 +0200 (Wed, 23 Aug 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/datedetector.py b/server/datedetector.py
index 8c5f618a..951aba6f 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 321 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 321 $"
-__date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/dateepoch.py b/server/dateepoch.py
index bc0ca667..b6ee14d0 100644
--- a/server/dateepoch.py
+++ b/server/dateepoch.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 321 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 321 $"
-__date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/datestrptime.py b/server/datestrptime.py
index a4b8ad25..bd2d351a 100644
--- a/server/datestrptime.py
+++ b/server/datestrptime.py
@@ -17,11 +17,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 321 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 321 $"
-__date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/datetai64n.py b/server/datetai64n.py
index d40a7f08..dd0ffa77 100644
--- a/server/datetai64n.py
+++ b/server/datetai64n.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 321 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 321 $"
-__date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/datetemplate.py b/server/datetemplate.py
index dccd58f6..9aca63e5 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 321 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 321 $"
-__date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/filterpoll.py b/server/filterpoll.py
index 374d957d..3afd587f 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 354 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 354 $"
-__date__ = "$Date: 2006-09-13 23:31:22 +0200 (Wed, 13 Sep 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/jails.py b/server/jails.py
index 6a327e1c..8dbde9c8 100644
--- a/server/jails.py
+++ b/server/jails.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 354 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 354 $"
-__date__ = "$Date: 2006-09-13 23:31:22 +0200 (Wed, 13 Sep 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/mytime.py b/server/mytime.py
index a7930813..57fee41e 100644
--- a/server/mytime.py
+++ b/server/mytime.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 321 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 321 $"
-__date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/testcases/actiontestcase.py b/testcases/actiontestcase.py
index 8a66320e..bc6f39ad 100644
--- a/testcases/actiontestcase.py
+++ b/testcases/actiontestcase.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 382 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 382 $"
-__date__ = "$Date: 2006-09-25 19:03:48 +0200 (Mon, 25 Sep 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index c1b1eddf..39ab80bf 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 253 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 253 $"
-__date__ = "$Date: 2006-07-17 00:21:58 +0200 (Mon, 17 Jul 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 5f2f0b26..14af9b27 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 253 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 253 $"
-__date__ = "$Date: 2006-07-17 00:21:58 +0200 (Mon, 17 Jul 2006) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 

From b8f0ce7155c4a9748c6e49e9678a8d9e65735400 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sat, 23 Dec 2006 23:20:16 +0000
Subject: [PATCH 455/549] - Do not accept empty regular expression - Do not
 send an empty string if the option is not defined

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@505 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/filterreader.py | 8 ++++++--
 client/jailreader.py   | 4 +++-
 server/regex.py        | 2 ++
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/client/filterreader.py b/client/filterreader.py
index 30cca818..4bb36fda 100644
--- a/client/filterreader.py
+++ b/client/filterreader.py
@@ -68,9 +68,13 @@ class FilterReader(ConfigReader):
 				stream.append(["set", self.__name, "timepattern", self.__opts[opt]])
 			elif opt == "failregex":
 				for regex in self.__opts[opt].split('\n'):
-					stream.append(["set", self.__name, "addfailregex", regex])
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addfailregex", regex])
 			elif opt == "ignoreregex":
 				for regex in self.__opts[opt].split('\n'):
-					stream.append(["set", self.__name, "addignoreregex", regex])		
+					# Do not send a command if the rule is empty.
+					if regex != '':
+						stream.append(["set", self.__name, "addignoreregex", regex])		
 		return stream
 		
\ No newline at end of file
diff --git a/client/jailreader.py b/client/jailreader.py
index bb408876..aa26d789 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -112,7 +112,9 @@ class JailReader(ConfigReader):
 				stream.append(["set", self.__name, "maxretry", self.__opts[opt]])
 			elif opt == "ignoreip":
 				for ip in self.__opts[opt].split():
-					stream.append(["set", self.__name, "addignoreip", ip])
+					# Do not send a command if the rule is empty.
+					if ip != '':
+						stream.append(["set", self.__name, "addignoreip", ip])
 			elif opt == "findtime":
 				stream.append(["set", self.__name, "findtime", self.__opts[opt]])
 			elif opt == "bantime":
diff --git a/server/regex.py b/server/regex.py
index c4e9c8ec..d3d6eee4 100644
--- a/server/regex.py
+++ b/server/regex.py
@@ -42,6 +42,8 @@ class Regex:
 	
 	def __init__(self, regex):
 		self._matchCache = None
+		if regex.lstrip() == '':
+			raise RegexException("Cannot add empty regex")
 		try:
 			self._regexObj = re.compile(regex)
 			self._regex = regex

From ba833a57adb2be7f087e36dd4599287bec927876 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 3 Jan 2007 18:15:55 +0000
Subject: [PATCH 456/549] - Added license file. Thanks to Axel Thimm

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@506 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG |   1 +
 COPYING   | 339 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 MANIFEST  |   1 +
 3 files changed, 341 insertions(+)
 create mode 100644 COPYING

diff --git a/CHANGELOG b/CHANGELOG
index c9460d61..70962aba 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -17,6 +17,7 @@ ver. 0.7.6 (200?/??/??) - ???
   filter. Thanks to mEDI
 - Several "failregex" and "ignoreregex" are now accepted.
   Creation of rules should be easier now.
+- Added license in COPYING. Thanks to Axel Thimm
 
 ver. 0.7.5 (2006/12/07) - beta
 ----------
diff --git a/COPYING b/COPYING
new file mode 100644
index 00000000..d511905c
--- /dev/null
+++ b/COPYING
@@ -0,0 +1,339 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
diff --git a/MANIFEST b/MANIFEST
index 9908c9f1..57911033 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -1,6 +1,7 @@
 README
 CHANGELOG
 TODO
+COPYING
 fail2ban-client
 fail2ban-server
 fail2ban-testcases

From 7719c00d3711663814fb7e298fad088a512efd11 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 4 Jan 2007 11:58:58 +0000
Subject: [PATCH 457/549] - Allow comma in action options. The value of the
 option must be escaped with " or '. Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@509 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG            |  2 ++
 TODO                 |  2 ++
 client/jailreader.py | 26 +++++++++++++++++++++++++-
 config/jail.conf     |  6 ++++--
 4 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 70962aba..c822d3d8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -18,6 +18,8 @@ ver. 0.7.6 (200?/??/??) - ???
 - Several "failregex" and "ignoreregex" are now accepted.
   Creation of rules should be easier now.
 - Added license in COPYING. Thanks to Axel Thimm
+- Allow comma in action options. The value of the option must
+  be escaped with " or '. Thanks to Yaroslav Halchenko
 
 ver. 0.7.5 (2006/12/07) - beta
 ----------
diff --git a/TODO b/TODO
index 23a34875..0348a3e1 100644
--- a/TODO
+++ b/TODO
@@ -13,6 +13,8 @@ Legend:
 # partially done
 * done
 
+- Improve parsing of the action parameters in jailreader.py
+
 - Better handling of the protocol in transmitter.py
 
 - Add gettext support (I18N)
diff --git a/client/jailreader.py b/client/jailreader.py
index aa26d789..3588daab 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -134,7 +134,31 @@ class JailReader(ConfigReader):
 		m = JailReader.actionCRE.match(action)
 		d = dict()
 		if not m.group(2) == None:
-			for param in m.group(2).split(','):
+			# Huge bad hack :( This method really sucks. TODO Reimplement it.
+			actions = ""
+			escapeChar = None
+			allowComma = False
+			for c in m.group(2):
+				if c in ('"', "'") and not allowComma:
+					# Start
+					escapeChar = c
+					allowComma = True
+				elif c == escapeChar:
+					# End
+					escapeChar = None
+					allowComma = False
+				else:
+					if c == ',' and allowComma:
+						actions += "<COMMA>"
+					else:
+						actions += c
+			
+			# Split using ,
+			actionsSplit = actions.split(',')
+			# Replace the tag <COMMA> with ,
+			actionsSplit = [n.replace("<COMMA>", ',') for n in actionsSplit]
+			
+			for param in actionsSplit:
 				p = param.split('=')
 				try:
 					d[p[0].strip()] = p[1].strip()
diff --git a/config/jail.conf b/config/jail.conf
index b3985363..5c4628f0 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -141,13 +141,15 @@ action   = shorewall
 logpath  = /var/log/apache2/error_log
 
 # This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip"
-# option is overridden in this jail.
+# option is overridden in this jail. Moreover, the action "mail-whois" defines
+# the variable "name" which contains a comma using "". The characters '' are
+# valid too.
 
 [ssh-ipfw]
 
 enabled  = false
 filter   = sshd
 action   = ipfw[localhost=192.168.0.1]
-           mail-whois[name=SSH, dest=yourmail@mail.com]
+           mail-whois[name="SSH,IPFW", dest=yourmail@mail.com]
 logpath  = /var/log/auth.log
 ignoreip = 168.192.0.1

From 44d75eb54f3cd9f76a13f387691a880a37fec1bd Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 4 Jan 2007 12:21:44 +0000
Subject: [PATCH 458/549] - Added missing svn:keywords - Split failregex in
 sshd.conf - Added sshd-ddos.conf. Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@510 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/ipfw.conf            |  2 +-
 config/action.d/mail-whois.conf      |  2 +-
 config/action.d/mail.conf            |  2 +-
 config/action.d/shorewall.conf       |  2 +-
 config/filter.d/apache-noscript.conf |  2 +-
 config/filter.d/courierlogin.conf    |  2 +-
 config/filter.d/couriersmtp.conf     |  2 +-
 config/filter.d/exim.conf            |  2 +-
 config/filter.d/postfix.conf         |  2 +-
 config/filter.d/proftpd.conf         |  2 +-
 config/filter.d/qmail.conf           |  2 +-
 config/filter.d/sasl.conf            |  2 +-
 config/filter.d/sshd-ddos.conf       | 23 +++++++++++++++++++++++
 config/filter.d/sshd.conf            |  3 ++-
 14 files changed, 37 insertions(+), 13 deletions(-)
 create mode 100644 config/filter.d/sshd-ddos.conf

diff --git a/config/action.d/ipfw.conf b/config/action.d/ipfw.conf
index 5ae00cae..0d5f1bbb 100644
--- a/config/action.d/ipfw.conf
+++ b/config/action.d/ipfw.conf
@@ -3,7 +3,7 @@
 # Author: Nick Munger
 # Modified by: Cyril Jaquier
 #
-# $Revision: 254 $
+# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf
index 6055d98b..044aa05b 100644
--- a/config/action.d/mail-whois.conf
+++ b/config/action.d/mail-whois.conf
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision: 254 $
+# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf
index 61522b27..2757aa74 100644
--- a/config/action.d/mail.conf
+++ b/config/action.d/mail.conf
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision: 254 $
+# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/shorewall.conf b/config/action.d/shorewall.conf
index 446c8a4b..83e66975 100644
--- a/config/action.d/shorewall.conf
+++ b/config/action.d/shorewall.conf
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision: 394 $
+# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
index 280f72b9..6f57cc8c 100644
--- a/config/filter.d/apache-noscript.conf
+++ b/config/filter.d/apache-noscript.conf
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision: 394 $
+# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/courierlogin.conf b/config/filter.d/courierlogin.conf
index e92301d7..a5b6d161 100644
--- a/config/filter.d/courierlogin.conf
+++ b/config/filter.d/courierlogin.conf
@@ -3,7 +3,7 @@
 # Author: Christoph Haas
 # Modified by: Cyril Jaquier
 #
-# $Revision: 267 $
+# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/couriersmtp.conf b/config/filter.d/couriersmtp.conf
index b695a707..a035e285 100644
--- a/config/filter.d/couriersmtp.conf
+++ b/config/filter.d/couriersmtp.conf
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision: 267 $
+# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index 564bb9a8..98b589be 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision: 267 $
+# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf
index 90b19d55..c808b109 100644
--- a/config/filter.d/postfix.conf
+++ b/config/filter.d/postfix.conf
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision: 267 $
+# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index 65ff59b7..1fc31ef5 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -2,7 +2,7 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision: 331 $
+# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/qmail.conf b/config/filter.d/qmail.conf
index 854d4ee2..0ae518fc 100644
--- a/config/filter.d/qmail.conf
+++ b/config/filter.d/qmail.conf
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision: 267 $
+# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/sasl.conf b/config/filter.d/sasl.conf
index ad4fe463..c25aca6b 100644
--- a/config/filter.d/sasl.conf
+++ b/config/filter.d/sasl.conf
@@ -2,7 +2,7 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision: 331 $
+# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/sshd-ddos.conf b/config/filter.d/sshd-ddos.conf
new file mode 100644
index 00000000..2a907e88
--- /dev/null
+++ b/config/filter.d/sshd-ddos.conf
@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = sshd\[\S*\]: Did not receive identification string from <HOST>
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 9659fa16..fe46dd86 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -14,7 +14,8 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) <HOST>
+failregex = (?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid))? user .*(?: from|FROM) <HOST>
+            ROOT LOGIN REFUSED .*(?: from|FROM) <HOST>
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From ab3d2d1b9adf8909c26f28f7b672cd5e6fec3c9a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 4 Jan 2007 12:58:21 +0000
Subject: [PATCH 459/549] - Now Fail2ban goes in /usr/share/fail2ban instead of
 /usr/lib/fail2ban. This is more compliant with FHS. Thanks to Axel Thimm and
 Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@511 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG          | 7 +++++--
 fail2ban-client    | 2 +-
 fail2ban-regex     | 2 +-
 fail2ban-server    | 2 +-
 fail2ban-testcases | 2 +-
 setup.cfg          | 2 +-
 setup.py           | 9 ++++++++-
 7 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index c822d3d8..71983906 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.6)                           200?/??/??
+Fail2Ban (version 0.7.6)                           2007/01/04
 =============================================================
 
-ver. 0.7.6 (200?/??/??) - ???
+ver. 0.7.6 (2007/01/04) - beta
 ----------
 - Added a "sleep 1" in redhat-initd. Thanks to Jim Wight
 - Use /dev/log for SYSLOG output. Thanks to Joerg Sommrey
@@ -20,6 +20,9 @@ ver. 0.7.6 (200?/??/??) - ???
 - Added license in COPYING. Thanks to Axel Thimm
 - Allow comma in action options. The value of the option must
   be escaped with " or '. Thanks to Yaroslav Halchenko
+- Now Fail2ban goes in /usr/share/fail2ban instead of
+  /usr/lib/fail2ban. This is more compliant with FHS. Thanks
+  to Axel Thimm and Yaroslav Halchenko
 
 ver. 0.7.5 (2006/12/07) - beta
 ----------
diff --git a/fail2ban-client b/fail2ban-client
index dbb84616..14aeabd0 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -30,7 +30,7 @@ import getopt, time, readline, shlex, socket
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-sys.path.insert(1, "/usr/lib/fail2ban")
+sys.path.insert(1, "/usr/share/fail2ban")
 
 # Now we can import our modules
 from common.version import version
diff --git a/fail2ban-regex b/fail2ban-regex
index a5f28780..8074a853 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -29,7 +29,7 @@ import locale, getopt, sys, time, logging, gc
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-sys.path.insert(1, "/usr/lib/fail2ban")
+sys.path.insert(1, "/usr/share/fail2ban")
 
 from common.version import version
 from server.filter import Filter
diff --git a/fail2ban-server b/fail2ban-server
index 7602bd85..bdb7455f 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -29,7 +29,7 @@ import getopt, sys
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-sys.path.insert(1, "/usr/lib/fail2ban")
+sys.path.insert(1, "/usr/share/fail2ban")
 
 from common.version import version
 from server.server import Server
diff --git a/fail2ban-testcases b/fail2ban-testcases
index 91c34317..38ab89d7 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -30,7 +30,7 @@ import unittest, logging, sys
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-sys.path.insert(1, "/usr/lib/fail2ban")
+sys.path.insert(1, "/usr/share/fail2ban")
 
 from common.version import version
 from testcases import banmanagertestcase
diff --git a/setup.cfg b/setup.cfg
index fba97f88..cdc25b29 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,5 +1,5 @@
 [install]
-install-purelib=/usr/lib/fail2ban
+install-purelib=/usr/share/fail2ban
 
 [sdist]
 formats=bztar
diff --git a/setup.py b/setup.py
index 9ad1ece5..12da08f3 100755
--- a/setup.py
+++ b/setup.py
@@ -28,7 +28,7 @@ __license__ = "GPL"
 
 from distutils.core import setup
 from common.version import version
-from os.path import isfile, join
+from os.path import isfile, join, isdir
 from sys import argv
 from glob import glob
 
@@ -113,6 +113,13 @@ if obsoleteFiles:
 		print "\t" + f
 	print
 
+if isdir("/usr/lib/fail2ban"):
+	print
+	print "Fail2ban is not installed under /usr/lib anymore. The new " \
+		  "location is under /usr/share. Please remove the directory " \
+		  "/usr/lib/fail2ban and everything under this directory."
+	print
+
 # Update config file
 if argv[1] == "install":
 	print

From c377739f994f9ecd6597d5f29f9d894e4e027f5b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 4 Jan 2007 12:59:09 +0000
Subject: [PATCH 460/549] - Prepared for releasing (0.7.6)

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@512 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 README            | 10 +++++-----
 common/version.py |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/README b/README
index db025b72..6ff995c2 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.6)                           200?/??/??
+Fail2Ban (version 0.7.6)                           2007/01/04
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -28,11 +28,11 @@ Optional:
 
 To install, just do:
 
-> tar xvfj fail2ban-0.7.5.tar.bz2
-> cd fail2ban-0.7.5
+> tar xvfj fail2ban-0.7.6.tar.bz2
+> cd fail2ban-0.7.6
 > python setup.py install
 
-This will install Fail2Ban into /usr/lib/fail2ban. The
+This will install Fail2Ban into /usr/share/fail2ban. The
 executable scripts are placed into /usr/bin.
 
 Gentoo: ebuilds are available on the website.
@@ -73,7 +73,7 @@ Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
 Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
 Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
 Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
-René Berber, mEDI
+René Berber, mEDI, Axel Thimm
 
 License:
 --------
diff --git a/common/version.py b/common/version.py
index 9e74d0e5..e913d1c0 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.5-SVN"
+version = "0.7.6"

From 6cf814245e9e04f3053ee72d41989d0e65d5492b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 4 Jan 2007 13:07:04 +0000
Subject: [PATCH 461/549] - Fixed missing regular expression

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@513 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/sshd.conf | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index fe46dd86..f3dd29f8 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -15,7 +15,8 @@
 # Values:  TEXT
 #
 failregex = (?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid))? user .*(?: from|FROM) <HOST>
-            ROOT LOGIN REFUSED .*(?: from|FROM) <HOST>
+            ROOT LOGIN REFUSED .* FROM <HOST>
+            [iI](?:llegal|nvalid) user .* from <HOST>
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 26a762ac942519bdacaac7a7ddd15d20b07fed17 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 4 Jan 2007 23:34:35 +0000
Subject: [PATCH 462/549] - Added signal handling in fail2ban-client - Added a
 wonderful visual effect when waiting on the server - Improved error message.
 Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@515 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG       |  7 ++++++-
 fail2ban-client | 40 ++++++++++++++++++++++++++++++++++++----
 fail2ban-server |  2 +-
 3 files changed, 43 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 71983906..65285a81 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,14 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.6)                           2007/01/04
+Fail2Ban (version 0.7.7)                           2007/??/??
 =============================================================
 
+ver. 0.7.7 (2007/??/??)
+----------
+- Added signal handling in fail2ban-client
+- Added a wonderful visual effect when waiting on the server
+
 ver. 0.7.6 (2007/01/04) - beta
 ----------
 - Added a "sleep 1" in redhat-initd. Thanks to Jim Wight
diff --git a/fail2ban-client b/fail2ban-client
index 14aeabd0..52103d19 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -25,7 +25,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import sys, string, os, pickle, re, logging
+import sys, string, os, pickle, re, logging, signal
 import getopt, time, readline, shlex, socket
 
 # Inserts our own modules path first in the list
@@ -87,7 +87,7 @@ class Fail2banClient:
 		print "    -i                      interactive mode"
 		print "    -v                      increase verbosity"
 		print "    -q                      decrease verbosity"
-		print "    -x                      force execution of the server"
+		print "    -x                      force execution of the server (remove socket file)"
 		print "    -h, --help              display this help message"
 		print "    -V, --version           print the version"
 		print
@@ -103,7 +103,13 @@ class Fail2banClient:
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
 		print 
-	
+
+	def __sigTERMhandler(self, signum, frame):
+		# Print a new line because we probably come from wait
+		print
+		logSys.warn("Caught signal %d. Exiting" % signum)
+		sys.exit(-1)
+
 	def __getCmdLineOptions(self, optList):
 		""" Gets the command line options
 		"""
@@ -180,7 +186,11 @@ class Fail2banClient:
 					self.__processCmd(self.__stream, False)
 					return True
 				except ServerExecutionException:
-					logSys.error("Could not start server. Try -x option")
+					logSys.error("Could not start server. Maybe an old " +
+								 "socket file is still present. Try to " +
+								 "remove " + self.__conf["socket"] + ". If " +
+								 "you used fail2ban-client to start the " +
+								 "server, adding the -x option will do it")
 					return False
 		elif len(cmd) == 1 and cmd[0] == "reload":
 			if self.__ping():
@@ -229,18 +239,40 @@ class Fail2banClient:
 	def __waitOnServer(self):
 		# Wait for the server to start
 		cnt = 0
+		if self.__conf["verbose"] > 1:
+			pos = 0
+			delta = 1
+			mask = "[          ]"
 		while not self.__ping():
+			# Wonderful visual :)
+			if self.__conf["verbose"] > 1:
+				pos += delta
+				sys.stdout.write("\rINFO   " + mask[:pos] + '#' + mask[pos+1:] +
+								 " Waiting on the server...")
+				sys.stdout.flush()
+				if pos > len(mask)-3:
+					delta = -1
+				elif pos < 2:
+					delta = 1
 			# The server has 30 secondes to start.
 			if cnt >= 300:
+				if self.__conf["verbose"] > 1:
+					sys.stdout.write('\n')
 				raise ServerExecutionException("Failed to start server")
 			time.sleep(0.1)
 			cnt += 1
+		if self.__conf["verbose"] > 1:
+			sys.stdout.write('\n')
 			
 	
 	def start(self, argv):
 		# Command line options
 		self.__argv = argv
 		
+		# Install signal handlers
+		signal.signal(signal.SIGTERM, self.__sigTERMhandler)
+		signal.signal(signal.SIGINT, self.__sigTERMhandler)
+		
 		# Reads the command line options.
 		try:
 			cmdOpts = 'hc:s:xdviqV'
diff --git a/fail2ban-server b/fail2ban-server
index bdb7455f..e706d04e 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -78,7 +78,7 @@ class Fail2banServer:
 		print "    -b                   start in background"
 		print "    -f                   start in foreground"
 		print "    -s <FILE>            socket path"
-		print "    -x                   force execution of the server"
+		print "    -x                   force execution of the server (remove socket file)"
 		print "    -h, --help           display this help message"
 		print "    -V, --version        print the version"
 		print

From daabd590add392843850c13b8d562b428e842d9f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 4 Jan 2007 23:35:57 +0000
Subject: [PATCH 463/549] - Updated man pages

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@516 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 man/fail2ban-client.1 | 6 +++---
 man/fail2ban-regex.1  | 4 ++--
 man/fail2ban-server.1 | 6 +++---
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index b905634d..1ee203c7 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "December 2006" "fail2ban-client v0.7.5-SVN" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "January 2007" "fail2ban-client v0.7.6" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH SYNOPSIS
 .B fail2ban-client
 [\fIOPTIONS\fR]... \fI<COMMAND>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.5\-SVN reads log file that contains password failure report
+Fail2Ban v0.7.6 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
@@ -29,7 +29,7 @@ increase verbosity
 decrease verbosity
 .TP
 \fB\-x\fR
-force execution of the server
+force execution of the server (remove socket file)
 .TP
 \fB\-h\fR, \fB\-\-help\fR
 display this help message
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index a1352142..16e3fa5a 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-REGEX "1" "December 2006" "fail2ban-regex v0.7.5-SVN" "User Commands"
+.TH FAIL2BAN-REGEX "1" "January 2007" "fail2ban-regex v0.7.6" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
 .B fail2ban-regex
 \fI<logline> <failregex>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.5\-SVN reads log file that contains password failure report
+Fail2Ban v0.7.6 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 This tools can test and benchmark your regular expressions for the "failregex"
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index d58ba373..85780a23 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "December 2006" "fail2ban-server v0.7.5-SVN" "User Commands"
+.TH FAIL2BAN-SERVER "1" "January 2007" "fail2ban-server v0.7.6" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.7.5\-SVN reads log file that contains password failure report
+Fail2Ban v0.7.6 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with
@@ -24,7 +24,7 @@ start in foreground
 socket path
 .TP
 \fB\-x\fR
-force execution of the server
+force execution of the server (remove socket file)
 .TP
 \fB\-h\fR, \fB\-\-help\fR
 display this help message

From ffc9c5d8f96271b3ac72e0ad269ac673cb00790b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 8 Jan 2007 21:09:50 +0000
Subject: [PATCH 464/549] - Removed sys.path.insert as fail2ban-testcases is
 not installed

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@517 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-testcases | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 38ab89d7..11f4a3ce 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -28,10 +28,6 @@ __license__ = "GPL"
 
 import unittest, logging, sys
 
-# Inserts our own modules path first in the list
-# fix for bug #343821
-sys.path.insert(1, "/usr/share/fail2ban")
-
 from common.version import version
 from testcases import banmanagertestcase
 from testcases import clientreadertestcase

From 2725dd6f22bfe8e9c54c8a910f283b77a7226a82 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 8 Jan 2007 21:15:47 +0000
Subject: [PATCH 465/549] - fail2ban-client returns an error code if
 configuration is not valid

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@518 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG              |  2 ++
 client/configurator.py |  2 +-
 client/jailsreader.py  |  2 ++
 fail2ban-client        | 20 ++++++++++++++------
 4 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 65285a81..bd9e6631 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -11,6 +11,8 @@ ver. 0.7.7 (2007/??/??)
 ----------
 - Added signal handling in fail2ban-client
 - Added a wonderful visual effect when waiting on the server
+- fail2ban-client returns an error code if configuration is
+  not valid
 
 ver. 0.7.6 (2007/01/04) - beta
 ----------
diff --git a/client/configurator.py b/client/configurator.py
index f4882f4b..8181a889 100644
--- a/client/configurator.py
+++ b/client/configurator.py
@@ -60,7 +60,7 @@ class Configurator:
 	
 	def getAllOptions(self):
 		self.__fail2ban.getOptions()
-		self.__jails.getOptions()
+		return self.__jails.getOptions()
 		
 	def convertToProtocol(self):
 		self.__streams["general"] = self.__fail2ban.convert()
diff --git a/client/jailsreader.py b/client/jailsreader.py
index 6208572d..ada5fe09 100644
--- a/client/jailsreader.py
+++ b/client/jailsreader.py
@@ -54,6 +54,8 @@ class JailsReader(ConfigReader):
 					self.__jails.append(jail)
 			else:
 				logSys.error("Errors in jail '" + sec + "'. Skipping...")
+				return False
+		return True
 	
 	def convert(self):
 		stream = list()
diff --git a/fail2ban-client b/fail2ban-client
index 52103d19..dbb0f185 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -175,10 +175,14 @@ class Fail2banClient:
 				logSys.error("Server already running")
 				return False
 			else:
+				# Read the config
+				ret = self.__readConfig()
+				# Do not continue if configuration is not 100% valid
+				if not ret:
+					return False
+				# Start the server
 				self.__startServerAsync(self.__conf["socket"],
 										self.__conf["force"])
-				# Read the config while the server is starting
-				self.__readConfig()
 				try:
 					# Wait for the server to start
 					self.__waitOnServer()
@@ -194,7 +198,10 @@ class Fail2banClient:
 					return False
 		elif len(cmd) == 1 and cmd[0] == "reload":
 			if self.__ping():
-				self.__readConfig()
+				ret = self.__readConfig()
+				# Do not continue if configuration is not 100% valid
+				if not ret:
+					return False
 				self.__processCmd([['stop', 'all']], False)
 				# Configure the server
 				return self.__processCmd(self.__stream, False)
@@ -312,9 +319,9 @@ class Fail2banClient:
 		logSys.info("Using socket file " + self.__conf["socket"])
 
 		if self.__conf["dump"]:
-			self.__readConfig()
+			ret = self.__readConfig()
 			self.dumpConfig(self.__stream)
-			return True
+			return ret
 		
 		# Interactive mode
 		if self.__conf["interactive"]:
@@ -345,9 +352,10 @@ class Fail2banClient:
 	def __readConfig(self):
 		# Read the configuration
 		self.__configurator.readAll()
-		self.__configurator.getAllOptions()
+		ret = self.__configurator.getAllOptions()
 		self.__configurator.convertToProtocol()
 		self.__stream = self.__configurator.getConfigStream()
+		return ret
 	
 	@staticmethod
 	def dumpConfig(cmd):

From 079985c14b4b3e76cbc26ccdfd615108efe538b7 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 8 Jan 2007 21:16:57 +0000
Subject: [PATCH 466/549] - Updated to SVN version

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@519 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 common/version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/common/version.py b/common/version.py
index e913d1c0..2e3c2d89 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.6"
+version = "0.7.6-SVN"

From 04cd3f5bd5424d537b2a61fd340db4227b4fec2d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 8 Jan 2007 21:40:37 +0000
Subject: [PATCH 467/549] - Added new filters/actions. Thanks to Yaroslav
 Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@520 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                               |  1 +
 MANIFEST                                |  4 ++
 config/action.d/iptables-multiport.conf | 69 +++++++++++++++++++++++
 config/action.d/iptables-new.conf       | 71 +++++++++++++++++++++++
 config/action.d/mail-whois-lines.conf   | 75 +++++++++++++++++++++++++
 config/filter.d/vsftpd.conf             |  1 +
 config/filter.d/wuftpd.conf             | 14 +++++
 7 files changed, 235 insertions(+)
 create mode 100644 config/action.d/iptables-multiport.conf
 create mode 100644 config/action.d/iptables-new.conf
 create mode 100644 config/action.d/mail-whois-lines.conf
 create mode 100644 config/filter.d/wuftpd.conf

diff --git a/CHANGELOG b/CHANGELOG
index bd9e6631..ac8ed752 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -13,6 +13,7 @@ ver. 0.7.7 (2007/??/??)
 - Added a wonderful visual effect when waiting on the server
 - fail2ban-client returns an error code if configuration is
   not valid
+- Added new filters/actions. Thanks to Yaroslav Halchenko
 
 ver. 0.7.6 (2007/01/04) - beta
 ----------
diff --git a/MANIFEST b/MANIFEST
index 57911033..2a71efd5 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -70,9 +70,13 @@ config/filter.d/courierlogin.conf
 config/filter.d/sshd.conf
 config/filter.d/proftpd.conf
 config/filter.d/sasl.conf
+config/filter.d/wuftpd.conf
 config/action.d/iptables.conf
+config/action.d/iptables-multiport.conf
+config/action.d/iptables-new.conf
 config/action.d/ipfw.conf
 config/action.d/mail-whois.conf
+config/action.d/mail-whois-lines.conf
 config/action.d/mail.conf
 config/action.d/hostsdeny.conf
 config/action.d/shorewall.conf
diff --git a/config/action.d/iptables-multiport.conf b/config/action.d/iptables-multiport.conf
new file mode 100644
index 00000000..f881a782
--- /dev/null
+++ b/config/action.d/iptables-multiport.conf
@@ -0,0 +1,69 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified by Yaroslav Halchenko for multiport banning
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
diff --git a/config/action.d/iptables-new.conf b/config/action.d/iptables-new.conf
new file mode 100644
index 00000000..ef9571c5
--- /dev/null
+++ b/config/action.d/iptables-new.conf
@@ -0,0 +1,71 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Copied from iptables.conf and modified by Yaroslav Halchenko 
+#  to fullfill the needs of bugreporter dbts#350746.
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I INPUT -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
diff --git a/config/action.d/mail-whois-lines.conf b/config/action.d/mail-whois-lines.conf
new file mode 100644
index 00000000..c4bb9784
--- /dev/null
+++ b/config/action.d/mail-whois-lines.conf
@@ -0,0 +1,75 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified-By: Yaroslav Halchenko to include grepping on IP over log files
+# $Revision$
+#
+
+[Definition]
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = echo -en "Hi,\n
+              The jail <name> has been started successfuly.\n
+              Regards,\n
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = echo -en "Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = echo -en "Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here are more information about <ip>:\n
+            `whois <ip>`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `grep '\<<ip>\>' <logpath>`\n\n
+            Regards,\n
+            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destinataire of the mail
+#
+dest = root
+
+# Path to the log files which contain relevant lines for the abuser IP
+#
+logpath = /dev/null
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index 4955fcfc..19c5d496 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -15,6 +15,7 @@
 # Values: TEXT
 #
 failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=<HOST>
+            \[.+\] FAIL LOGIN: Client "<HOST>"$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/wuftpd.conf b/config/filter.d/wuftpd.conf
new file mode 100644
index 00000000..e7981e1e
--- /dev/null
+++ b/config/filter.d/wuftpd.conf
@@ -0,0 +1,14 @@
+# Fail2Ban configuration file for wuftpd
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision:  $
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = wu-ftpd\[\d+\]:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>

From 5370b6740d18bdfbc4aa70fc6177afb9193f6d93 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 21 Jan 2007 22:17:56 +0000
Subject: [PATCH 468/549] - Removed unneeded local variable

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@521 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filter.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index 4736ff92..ed63299d 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -378,8 +378,8 @@ class Filter(JailThread):
 	# is created and is added to the FailManager.
 	
 	def getFailures(self, filename):
-		ret = self.__openLogFile(filename)
-		if not ret:
+		# Try to open log file.
+		if not self.__openLogFile(filename):
 			logSys.error("Unable to get failures in " + filename)
 			return False
 		self.__setFilePos()

From a257fdc87d73a0b84d96d2ef84f58faf79d28eff Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 21 Jan 2007 22:19:57 +0000
Subject: [PATCH 469/549] - Call Python interpreter directly (instead of using
 "env")

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@522 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client    | 2 +-
 fail2ban-server    | 2 +-
 fail2ban-testcases | 2 +-
 setup.py           | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index dbb0f185..b52cd6fe 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
diff --git a/fail2ban-server b/fail2ban-server
index e706d04e..ca449798 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
diff --git a/fail2ban-testcases b/fail2ban-testcases
index 11f4a3ce..9573d62b 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
diff --git a/setup.py b/setup.py
index 12da08f3..c9667d48 100755
--- a/setup.py
+++ b/setup.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 
 # This file is part of Fail2Ban.
 #

From 7bcfd2ace98ed74bfb8b1e601b5c38ad6572633e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 21 Jan 2007 22:21:13 +0000
Subject: [PATCH 470/549] - Added file support to fail2ban-regex. Benchmark
 feature has been removed

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@523 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-regex        | 232 ++++++++++++++++++++++++++++++------------
 man/fail2ban-client.1 |   9 +-
 man/fail2ban-regex.1  |  30 +++++-
 man/fail2ban-server.1 |   4 +-
 man/generate-man      |  28 ++++-
 5 files changed, 225 insertions(+), 78 deletions(-)

diff --git a/fail2ban-regex b/fail2ban-regex
index 8074a853..261f742b 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/python -O
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -25,12 +25,14 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import locale, getopt, sys, time, logging, gc
+import getopt, sys, time, logging, os
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
 sys.path.insert(1, "/usr/share/fail2ban")
 
+from ConfigParser import SafeConfigParser
+from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError
 from common.version import version
 from server.filter import Filter
 from server.regex import RegexException
@@ -38,13 +40,38 @@ from server.regex import RegexException
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.regex")
 
+class RegexStat:
+
+	def __init__(self, failregex):
+		self.__stats = 0
+		self.__failregex = failregex
+		self.__ipList = list()
+	
+	def inc(self):
+		self.__stats += 1
+	
+	def getStats(self):
+		return self.__stats
+
+	def getFailRegex(self):
+		return self.__failregex
+	
+	def appendIP(self, value):
+		self.__ipList.extend(value)
+	
+	def getIPList(self):
+		return self.__ipList
+
 class Fail2banRegex:
 	
+	test = None
+	
 	def __init__(self):
 		self.__filter = Filter(None)
+		self.__failregex = list()
 		# Setup logging
 		logging.getLogger("fail2ban").handlers = []
-		self.__hdlr = logging.StreamHandler(sys.stdout)
+		self.__hdlr = logging.StreamHandler(Fail2banRegex.test)
 		# set a format which is simpler for console use
 		formatter = logging.Formatter("%(message)s")
 		# tell the handler to use this format
@@ -52,7 +79,8 @@ class Fail2banRegex:
 		logging.getLogger("fail2ban").addHandler(self.__hdlr)
 		logging.getLogger("fail2ban").setLevel(logging.ERROR)
 	
-	def dispVersion(self):
+	@staticmethod
+	def dispVersion():
 		print "Fail2Ban v" + version
 		print
 		print "Copyright (c) 2004-2006 Cyril Jaquier"
@@ -62,14 +90,26 @@ class Fail2banRegex:
 		print "Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>."
 		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
 	
-	def dispUsage(self):
-		print "Usage: "+sys.argv[0]+" <logline> <failregex>"
+	@staticmethod
+	def dispUsage():
+		print "Usage: "+sys.argv[0]+" [OPTIONS] <LOG> <REGEX>"
 		print
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
 		print
-		print "This tools can test and benchmark your regular expressions for the \"failregex\""
-		print "option."
+		print "This tools can test regular expressions for \"fail2ban\"."
+		print
+		print "Options:"
+		print "    -h, --help              display this help message"
+		print "    -V, --version           print the version"
+		print
+		print "Log:"
+		print "    string                  a string representing a log line"
+		print "    filename                path to a log file (/var/log/auth.log)"
+		print
+		print "Regex:"
+		print "    string                  a string representing a 'failregex'"
+		print "    filename                path to a filter file (filter.d/sshd.conf)"
 		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	
@@ -78,87 +118,149 @@ class Fail2banRegex:
 		"""
 		for opt in optList:
 			if opt[0] in ["-h", "--help"]:
-	 			self.dispUsage()
-	 			sys.exit(0)
-	 		elif opt[0] in ["-V", "--version"]:
-	 			self.dispVersion()
-	 			sys.exit(0)
+				self.dispUsage()
+				sys.exit(0)
+			elif opt[0] in ["-V", "--version"]:
+				self.dispVersion()
+				sys.exit(0)
+
+	@staticmethod
+	def logIsFile(value):
+		return os.path.isfile(value)
+
+	def readRegex(self, value):
+		if os.path.isfile(value):
+			reader = SafeConfigParser()
+			try:
+				reader.read(value)
+				self.__failregex = [RegexStat(m)
+									for m in reader.get("Definition", "failregex").split('\n')]
+			except NoSectionError:
+				print "No [Definition] section in " + value
+				return False
+			except NoOptionError:
+				print "No failregex option in " + value
+				return False
+			except MissingSectionHeaderError:
+				print "No section headers in " + value
+				return False
+		else:
+			self.__failregex = [RegexStat(value)]
+		return True
 	
-	def testRegex(self, line, regex):
-		print
-		try:
+	def testRegex(self, line):
+		for regex in self.__failregex:
 			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
-			self.__filter.addFailRegex(regex)
-			ret = self.__filter.findFailure(line)
-			print
-			logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
-		except RegexException, e:
-			print e
-			return False
-		except IndexError:
-			print "Sorry, but no <host> found in regex"
-			return False
-		if len(ret) == 0:
+			try:
+				self.__filter.addFailRegex(regex.getFailRegex())
+				try:
+					ret = self.__filter.findFailure(line)
+					if not len(ret) == 0:
+						regex.inc()
+						regex.appendIP(ret)
+				except RegexException, e:
+					print e
+					return False
+				except IndexError:
+					print "Sorry, but no <host> found in regex"
+					return False
+			finally:
+				self.__filter.delFailRegex(0)
+				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
+	
+	def printStats(self):
+		print
+		print "Results"
+		print "======="
+		print
+		
+		# Print title
+		cnt = 1
+		print "Failregex:"
+		for failregex in self.__failregex:
+			print "[" + str(cnt) + "] " + failregex.getFailRegex()
+			cnt += 1
+		
+		print
+		
+		# Print stats
+		cnt = 1
+		total = 0
+		print "Number of matches:"
+		for failregex in self.__failregex:
+			match = failregex.getStats()
+			total += match
+			print "[" + str(cnt) + "] " + str(match) + " match(es)"
+			cnt += 1
+		
+		print
+		
+		if total == 0:
 			print "Sorry, no match"
+			print
+			print "Look at the above section 'Running tests' which could contain important"
+			print "information."
 			return False
 		else:
-			print "Success, the following data were found:"
-			timeTuple = time.localtime(ret[0][1])
-			print "Date: " + time.strftime("%a %b %d %H:%M:%S %Y", timeTuple)
-			ipList = ""
-			for i in ret:
-				ipList = ipList + " " + i[0]
-			print "IP  :" + ipList
+			# Print stats
+			cnt = 1
+			print "Addresses found:"
+			for failregex in self.__failregex:
+				print "[" + str(cnt) + "]"
+				for ip in failregex.getIPList():
+					timeTuple = time.localtime(ip[1])
+					timeString = time.strftime("%a %b %d %H:%M:%S %Y", timeTuple)
+					print "    " + ip[0] + " (" + timeString + ")"
+				cnt += 1
+			
 			print
+			
 			print "Date template hits:"
 			for template in self.__filter.dateDetector.getTemplates():
 				print `template.getHits()` + " hit: " + template.getName()
+			
 			print
-			print "Benchmark. Executing 1000..."
-			gc.disable()
-			total = 0
-			maxValue = 0
-			maxPos = 0
-			minValue = 99999999
-			minPos = 0
-			for i in range(1000):
-				start = time.time()
-				ret = self.__filter.findFailure(line)
-				end = time.time()
-				diff = (end - start) * 1000
-				total = total + diff
-				minValue = min(minValue, diff)
-				if minValue == diff:
-					minPos = i
-				maxValue = max(maxValue, diff)
-				if maxValue == diff:
-					maxPos = i
-			gc.enable()
-			print "Performance"
-			print "Avg: " + `total / 1000` + " ms"
-			print "Max: " + `maxValue` + " ms (Run " + `maxPos` + ")"
-			print "Min: " + `minValue` + " ms (Run " + `minPos` + ")"
+			
+			print "Success, the total number of match is " + str(total)
+			print
+			print "However, look at the above section 'Running tests' which could contain important"
+			print "information."
 			return True
+
 			
 if __name__ == "__main__":
-	regex = Fail2banRegex()
+	fail2banRegex = Fail2banRegex()
 	# Reads the command line options.
 	try:
 		cmdOpts = 'hV'
 		cmdLongOpts = ['help', 'version']
 		optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
 	except getopt.GetoptError:
-		regex.dispUsage()
+		fail2banRegex.dispUsage()
 		sys.exit(-1)
 	# Process command line
-	regex.getCmdLineOptions(optList)
+	fail2banRegex.getCmdLineOptions(optList)
 	# We need exactly 3 parameters
-	if len(sys.argv) <> 3:
-		regex.dispUsage()
+	if not len(sys.argv) == 3:
+		fail2banRegex.dispUsage()
 		sys.exit(-1)
 	else:
-		ret = regex.testRegex(sys.argv[1], sys.argv[2])
-		if ret:
+		if fail2banRegex.readRegex(sys.argv[2]) == False:
+			sys.exit(-1)
+
+		print
+		print "Running tests"
+		print "============="
+		print
+
+		if fail2banRegex.logIsFile(sys.argv[1]):
+			hdlr = open(sys.argv[1])
+			for line in hdlr:
+				fail2banRegex.testRegex(line)
+		else:
+			fail2banRegex.testRegex(sys.argv[1])
+		
+		if fail2banRegex.printStats():
 			sys.exit(0)
 		else:
 			sys.exit(-1)
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 1ee203c7..b99c5ada 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,12 +1,11 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "January 2007" "fail2ban-client v0.7.6" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "January 2007" "fail2ban-client v0.7.6-SVN" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
-.SH SYNOPSIS
-.B fail2ban-client
-[\fIOPTIONS\fR]... \fI<COMMAND>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.6 reads log file that contains password failure report
+[?1034hUsage: ../fail2ban\-client [OPTIONS]... <COMMAND>
+.PP
+Fail2Ban v0.7.6\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index 16e3fa5a..499c1c96 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,16 +1,36 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-REGEX "1" "January 2007" "fail2ban-regex v0.7.6" "User Commands"
+.TH FAIL2BAN-REGEX "1" "January 2007" "fail2ban-regex v0.7.6-SVN" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
 .B fail2ban-regex
-\fI<logline> <failregex>\fR
+[\fIOPTIONS\fR] \fI<LOG> <REGEX>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.6 reads log file that contains password failure report
+Fail2Ban v0.7.6\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
-This tools can test and benchmark your regular expressions for the "failregex"
-option.
+This tools can test regular expressions for "fail2ban".
+.SH OPTIONS
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+display this help message
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+print the version
+.SH LOG
+.TP
+\fBstring\fR
+a string representing a log line
+.TP
+\fBfilename\fR
+path to a log file (/var/log/auth.log)
+.SH REGEX
+.TP
+\fBstring\fR
+a string representing a 'failregex'
+.TP
+\fBfilename\fR
+path to a filter file (filter.d/sshd.conf)
 .SH AUTHOR
 Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
 Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index 85780a23..211cbabf 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "January 2007" "fail2ban-server v0.7.6" "User Commands"
+.TH FAIL2BAN-SERVER "1" "January 2007" "fail2ban-server v0.7.6-SVN" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.7.6 reads log file that contains password failure report
+Fail2Ban v0.7.6\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with
diff --git a/man/generate-man b/man/generate-man
index bf4f651e..86ad5c12 100755
--- a/man/generate-man
+++ b/man/generate-man
@@ -40,4 +40,30 @@ echo "[done]"
 echo -n "Generating fail2ban-regex  "
 help2man --section=1 --no-info --include=fail2ban-regex.h2m --output fail2ban-regex.1 ../fail2ban-regex
 echo "[done]"
-
+echo -n "Patching fail2ban-regex    "
+# Changes the title.
+sed -i -e 's/.SS "Log:"/.SH LOG/' fail2ban-regex.1
+sed -i -e 's/.SS "Regex:"/.SH REGEX/' fail2ban-regex.1
+# Sets bold font for commands.
+IFS="
+"
+NEXT=0
+FOUND=0
+LINES=$( cat fail2ban-regex.1 )
+echo -n "" > fail2ban-regex.1
+for LINE in $LINES; do
+	if [ "$LINE" = ".SH LOG" ]; then
+		FOUND=1
+	fi
+	if [ $NEXT -eq 1 ] && [ $FOUND -eq 1 ]; then
+		echo "\fB$LINE\fR" >> fail2ban-regex.1
+	else
+		echo "$LINE" >> fail2ban-regex.1
+	fi
+	if [ "$LINE" = ".TP" ]; then
+		NEXT=1
+	else
+		NEXT=0
+	fi
+done
+echo "[done]"

From 45277fff4ad7c1ba674593710eac31458fd4e952 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 21 Jan 2007 22:22:29 +0000
Subject: [PATCH 471/549] - Removed section with mail-report script which does
 not exist anymore

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@524 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/jail.conf | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/config/jail.conf b/config/jail.conf
index 5c4628f0..f57b37f5 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -69,19 +69,6 @@ action   = iptables[name=sasl, port=smtp, protocol=tcp]
            mail-whois[name=sasl, dest=yourmail@mail.com]
 logpath  = /var/log/mail.log
 
-# This one behaves like the previous and sends a report when the jail
-# is stopped.
-
-[ssh-iptables-report]
-
-enabled  = false
-filter   = sshd
-action   = iptables[name=SSH, port=ssh, protocol=tcp]
-           mail-whois[name=SSH, dest=yourmail@mail.com]
-           mail-report[dest=yourmail@mail.com]
-logpath  = /var/log/sshd.log
-maxretry = 5
-
 # Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
 # used to avoid banning the user "myuser".
 

From 865f243a9fc4a62d3cf2a2b068d09e5801c0c287 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 21 Jan 2007 22:23:46 +0000
Subject: [PATCH 472/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@525 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index ac8ed752..793cb8b9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -14,6 +14,9 @@ ver. 0.7.7 (2007/??/??)
 - fail2ban-client returns an error code if configuration is
   not valid
 - Added new filters/actions. Thanks to Yaroslav Halchenko
+- Call Python interpreter directly (instead of using "env")
+- Added file support to fail2ban-regex. Benchmark feature has
+  been removed
 
 ver. 0.7.6 (2007/01/04) - beta
 ----------

From 54ef4ef33b8555dd5ec26732b62f4b4542162222 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 29 Jan 2007 20:25:50 +0000
Subject: [PATCH 474/549] - Added initial cacti script. Still needs testing,
 template, etc

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@527 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                     |  1 +
 MANIFEST                      |  1 +
 files/cacti/fail2ban_stats.sh | 47 +++++++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+)
 create mode 100644 files/cacti/fail2ban_stats.sh

diff --git a/CHANGELOG b/CHANGELOG
index 793cb8b9..2eb5540c 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -17,6 +17,7 @@ ver. 0.7.7 (2007/??/??)
 - Call Python interpreter directly (instead of using "env")
 - Added file support to fail2ban-regex. Benchmark feature has
   been removed
+- Added cacti script and template.
 
 ver. 0.7.6 (2007/01/04) - beta
 ----------
diff --git a/MANIFEST b/MANIFEST
index 2a71efd5..209a64a0 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -90,3 +90,4 @@ man/fail2ban-regex.h2m
 man/generate-man
 files/gentoo-initd
 files/redhat-initd
+files/cacti/fail2ban_stats.sh
diff --git a/files/cacti/fail2ban_stats.sh b/files/cacti/fail2ban_stats.sh
new file mode 100644
index 00000000..afe52466
--- /dev/null
+++ b/files/cacti/fail2ban_stats.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# This script can be used to collect data for Cacti. One parameter is needed,
+# the jail name. It must be a currently running jail. The script returns two
+# value: the number of failures and the number of banned host.
+#
+# If Fail2ban is not available in the path, you can change the value of the
+# variable FAIL2BAN below.. You can add option to this variable too. Please
+# look at the man page of fail2ban-client for more information.
+#
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+FAIL2BAN="fail2ban-client"
+
+JAIL=$1
+
+if [ -z $JAIL ]; then
+	echo "Usage:" `basename $0` "<jail>"
+	exit
+fi
+
+IFS=""
+
+STATS=$($FAIL2BAN status $JAIL)
+
+TOTAL_FAILED=$(echo $STATS | grep "Total failed:" | awk '{ print $5 }')
+TOTAL_BANNED=$(echo $STATS | grep "Total banned:" | awk '{ print $4 }')
+
+echo "failed:"$TOTAL_FAILED "banned:"$TOTAL_BANNED
+

From ca299b5ce4a708fc1c081c4b4f2328cf1f9449bc Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 29 Jan 2007 20:27:01 +0000
Subject: [PATCH 475/549] - Removed ...

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@528 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-client | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban-client b/fail2ban-client
index b52cd6fe..32064682 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -75,7 +75,7 @@ class Fail2banClient:
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
-		print "Usage: "+self.__argv[0]+" [OPTIONS]... <COMMAND>"
+		print "Usage: "+self.__argv[0]+" [OPTIONS] <COMMAND>"
 		print
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."

From 9d6a591aa7db7124c6597b71add606a956efe27f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 29 Jan 2007 20:27:51 +0000
Subject: [PATCH 476/549] - Changed case of titles

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@529 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 common/protocol.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/common/protocol.py b/common/protocol.py
index 543e08e4..85d4947b 100644
--- a/common/protocol.py
+++ b/common/protocol.py
@@ -30,23 +30,23 @@ import textwrap
 # Describes the protocol used to communicate with the server.
 
 protocol = [
-['', "Basic", ""],
+['', "BASIC", ""],
 ["start", "starts the server and the jails"], 
 ["reload", "reloads the configuration"], 
 ["stop", "stops all jails and terminate the server"], 
 ["status", "gets the current status of the server"], 
 ["ping", "tests if the server is alive"], 
-['', "Logging", ""],
+['', "LOGGING", ""],
 ["set loglevel <LEVEL>", "sets logging level to <LEVEL>. 0 is minimal, 4 is debug"], 
 ["get loglevel", "gets the logging level"], 
 ["set logtarget <TARGET>", "sets logging target to <TARGET>. Can be STDOUT, STDERR, SYSLOG or a file"], 
 ["get logtarget", "gets logging target"], 
-['', "Jail control", ""],
+['', "JAIL CONTROL", ""],
 ["add <JAIL> <BACKEND>", "creates <JAIL> using <BACKEND>"], 
 ["start <JAIL>", "starts the jail <JAIL>"], 
 ["stop <JAIL>", "stops the jail <JAIL>. The jail is removed"], 
 ["status <JAIL>", "gets the current status of <JAIL>"],
-['', "Jail configuration", ""],
+['', "JAIL CONFIGURATION", ""],
 ["set <JAIL> idle on|off", "sets the idle state of <JAIL>"], 
 ["set <JAIL> addignoreip <IP>", "adds <IP> to the ignore list of <JAIL>"], 
 ["set <JAIL> delignoreip <IP>", "removes <IP> from the ignore list of <JAIL>"], 
@@ -70,7 +70,7 @@ protocol = [
 ["set <JAIL> actioncheck <ACT> <CMD>", "sets the check command <CMD> of the action <ACT> for <JAIL>"], 
 ["set <JAIL> actionban <ACT> <CMD>", "sets the ban command <CMD> of the action <ACT> for <JAIL>"],
 ["set <JAIL> actionunban <ACT> <CMD>", "sets the unban command <CMD> of the action <ACT> for <JAIL>"], 
-['', "Jail information", ""],
+['', "JAIL INFORMATION", ""],
 ["get <JAIL> logpath", "gets the list of the monitored files for <JAIL>"],
 ["get <JAIL> ignoreip", "gets the list of ignored IP addresses for <JAIL>"],
 ["get <JAIL> timeregex", "gets the regular expression used for the time detection for <JAIL>"],

From 55009342ef00c95db77e358b9093cfb6c5e2126d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 29 Jan 2007 20:31:04 +0000
Subject: [PATCH 477/549] - Added more details in output

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@530 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 fail2ban-regex | 48 ++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 40 insertions(+), 8 deletions(-)

diff --git a/fail2ban-regex b/fail2ban-regex
index 261f742b..28ea4b43 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -1,4 +1,4 @@
-#!/usr/bin/python -O
+#!/usr/bin/python
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -133,22 +133,32 @@ class Fail2banRegex:
 			reader = SafeConfigParser()
 			try:
 				reader.read(value)
+				print "Use regex file : " + value
 				self.__failregex = [RegexStat(m)
 									for m in reader.get("Definition", "failregex").split('\n')]
 			except NoSectionError:
 				print "No [Definition] section in " + value
+				print
 				return False
 			except NoOptionError:
 				print "No failregex option in " + value
+				print
 				return False
 			except MissingSectionHeaderError:
 				print "No section headers in " + value
+				print
 				return False
 		else:
+			if len(value) > 53:
+				stripReg = value[0:50] + "..."
+			else:
+				stripReg = value
+			print "Use regex line : " + stripReg
 			self.__failregex = [RegexStat(value)]
 		return True
 	
 	def testRegex(self, line):
+		found = False
 		for regex in self.__failregex:
 			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
 			try:
@@ -156,6 +166,11 @@ class Fail2banRegex:
 				try:
 					ret = self.__filter.findFailure(line)
 					if not len(ret) == 0:
+						if found == True:
+							ret[0].append(True)
+						else:
+							found = True
+							ret[0].append(False)
 						regex.inc()
 						regex.appendIP(ret)
 				except RegexException, e:
@@ -210,7 +225,11 @@ class Fail2banRegex:
 				for ip in failregex.getIPList():
 					timeTuple = time.localtime(ip[1])
 					timeString = time.strftime("%a %b %d %H:%M:%S %Y", timeTuple)
-					print "    " + ip[0] + " (" + timeString + ")"
+					if ip[2]:
+						dup = " (already matched)"
+					else:
+						dup = ""
+					print "    " + ip[0] + " (" + timeString + ")" + dup
 				cnt += 1
 			
 			print
@@ -245,19 +264,32 @@ if __name__ == "__main__":
 		fail2banRegex.dispUsage()
 		sys.exit(-1)
 	else:
-		if fail2banRegex.readRegex(sys.argv[2]) == False:
-			sys.exit(-1)
-
 		print
 		print "Running tests"
 		print "============="
 		print
 
+		if fail2banRegex.readRegex(sys.argv[2]) == False:
+			sys.exit(-1)
+
 		if fail2banRegex.logIsFile(sys.argv[1]):
-			hdlr = open(sys.argv[1])
-			for line in hdlr:
-				fail2banRegex.testRegex(line)
+			try:
+				hdlr = open(sys.argv[1])
+				print "Use log file   : " + sys.argv[1]
+				print
+				for line in hdlr:
+					fail2banRegex.testRegex(line)
+			except IOError, e:
+				print e
+				print
+				sys.exit(-1)
 		else:
+			if len(sys.argv[1]) > 53:
+				stripLog = sys.argv[1][0:50] + "..."
+			else:
+				stripLog = sys.argv[1]
+			print "Use single line: " + stripLog
+			print
 			fail2banRegex.testRegex(sys.argv[1])
 		
 		if fail2banRegex.printStats():

From 2bab4f5aac9d2c582d697adf75de88fe1e47c91b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 29 Jan 2007 20:31:36 +0000
Subject: [PATCH 478/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@531 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/TODO b/TODO
index 0348a3e1..2ab2142a 100644
--- a/TODO
+++ b/TODO
@@ -13,6 +13,19 @@ Legend:
 # partially done
 * done
 
+- Uniformize filters and actions name. Use the software name
+  (openssh, postfix, proftp)
+
+- Added <USER> tag for failregex. Add features using this
+  information
+
+- Look at the memory consumption
+
+- More detailed statistics
+
+- Auto-enable function (search for log files), check
+  modification date to see if service is still in use
+
 - Improve parsing of the action parameters in jailreader.py
 
 - Better handling of the protocol in transmitter.py

From 743ec88eef76e13749fd3712984714f06f0ce6e9 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 29 Jan 2007 20:32:13 +0000
Subject: [PATCH 479/549] - Updated failregex

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@532 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/sshd.conf | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index f3dd29f8..8e9c22e2 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -14,7 +14,8 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = (?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid))? user .*(?: from|FROM) <HOST>
+failregex = Authentication failure for .* from <HOST>
+            Failed [-/\w+]+ for .* from <HOST>
             ROOT LOGIN REFUSED .* FROM <HOST>
             [iI](?:llegal|nvalid) user .* from <HOST>
 

From 002fbac6e7af6eb5809b71362015353d688cc9af Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 29 Jan 2007 20:35:16 +0000
Subject: [PATCH 480/549] - Updated man page

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@533 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 man/fail2ban-client.1 | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index b99c5ada..88a853d9 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -3,7 +3,7 @@
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH DESCRIPTION
-[?1034hUsage: ../fail2ban\-client [OPTIONS]... <COMMAND>
+[?1034hUsage: ../fail2ban\-client [OPTIONS] <COMMAND>
 .PP
 Fail2Ban v0.7.6\-SVN reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
@@ -37,7 +37,7 @@ display this help message
 print the version
 .SH COMMAND
 .IP
-Basic
+BASIC
 .TP
 \fBstart\fR
 starts the server and the jails
@@ -56,7 +56,7 @@ server
 \fBping\fR
 tests if the server is alive
 .IP
-Logging
+LOGGING
 .TP
 \fBset loglevel <LEVEL>\fR
 sets logging level to <LEVEL>. 0
@@ -73,7 +73,7 @@ file
 \fBget logtarget\fR
 gets logging target
 .IP
-Jail control
+JAIL CONTROL
 .TP
 \fBadd <JAIL> <BACKEND>\fR
 creates <JAIL> using <BACKEND>
@@ -88,7 +88,7 @@ removed
 \fBstatus <JAIL>\fR
 gets the current status of <JAIL>
 .IP
-Jail configuration
+JAIL CONFIGURATION
 .TP
 \fBset <JAIL> idle on|off\fR
 sets the idle state of <JAIL>
@@ -189,7 +189,7 @@ action <ACT> for <JAIL>
 sets the unban command <CMD> of
 the action <ACT> for <JAIL>
 .IP
-Jail information
+JAIL INFORMATION
 .TP
 \fBget <JAIL> logpath\fR
 gets the list of the monitored

From d5ededc3407d1345f321daaf0ef56954ee1f4b13 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 29 Jan 2007 20:51:43 +0000
Subject: [PATCH 481/549] - Updated failregex

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@534 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/vsftpd.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index 19c5d496..34e3da92 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -14,7 +14,7 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values: TEXT
 #
-failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=<HOST>
+failregex = vsftpd: .* authentication failure; .* rhost=<HOST>$
             \[.+\] FAIL LOGIN: Client "<HOST>"$
 
 # Option:  ignoreregex

From 6d6acb075a7eba7c8f699829147d95648e147ebb Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 29 Jan 2007 21:46:59 +0000
Subject: [PATCH 482/549] - Added IP list in "status <JAIL>". Thanks to Eric
 Gerbier

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@535 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG             |  1 +
 README                |  2 +-
 client/beautifier.py  | 10 ++++++----
 server/actions.py     |  4 ++--
 server/banmanager.py  | 12 ++++++++++++
 server/failmanager.py | 12 ++++++++++++
 server/filter.py      |  3 ++-
 7 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 2eb5540c..5181fd21 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -18,6 +18,7 @@ ver. 0.7.7 (2007/??/??)
 - Added file support to fail2ban-regex. Benchmark feature has
   been removed
 - Added cacti script and template.
+- Added IP list in "status <JAIL>". Thanks to Eric Gerbier
 
 ver. 0.7.6 (2007/01/04) - beta
 ----------
diff --git a/README b/README
index 6ff995c2..11d42c37 100644
--- a/README
+++ b/README
@@ -73,7 +73,7 @@ Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
 Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
 Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
 Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
-René Berber, mEDI, Axel Thimm
+René Berber, mEDI, Axel Thimm, Eric Gerbier
 
 License:
 --------
diff --git a/client/beautifier.py b/client/beautifier.py
index c017c5a2..e6eb6c27 100644
--- a/client/beautifier.py
+++ b/client/beautifier.py
@@ -70,11 +70,13 @@ class Beautifier:
 				if len(inC) > 1:
 					msg = "Status for the jail: " + inC[1] + "\n"
 					msg = msg + "|- " + response[0][0] + "\n"
-					msg = msg + "|  |- " + response[0][1][0][0] + ":\t\t" + `response[0][1][0][1]` + "\n"
-					msg = msg + "|  `- " + response[0][1][1][0] + ":\t\t" + `response[0][1][1][1]` + "\n"
+					msg = msg + "|  |- " + response[0][1][0][0] + ":\t" + `response[0][1][0][1]` + "\n"
+					msg = msg + "|  |  `- " + response[0][1][2][0] + ":\t" + `response[0][1][2][1]` + "\n"
+					msg = msg + "|  `- " + response[0][1][1][0] + ":\t" + `response[0][1][1][1]` + "\n"
 					msg = msg + "`- " + response[1][0] + "\n"
-					msg = msg + "   |- " + response[1][1][0][0] + ":\t\t" + `response[1][1][0][1]` + "\n"
-					msg = msg + "   `- " + response[1][1][1][0] + ":\t\t" + `response[1][1][1][1]`
+					msg = msg + "   |- " + response[1][1][0][0] + ":\t" + `response[1][1][0][1]` + "\n"
+					msg = msg + "   |  `- " + response[1][1][2][0] + ":\t" + `response[1][1][2][1]` + "\n"
+					msg = msg + "   `- " + response[1][1][1][0] + ":\t" + `response[1][1][1][1]`
 				else:
 					msg = "Status\n"
 					msg = msg + "|- " + response[0][0] + ":\t" + `response[0][1]` + "\n"
diff --git a/server/actions.py b/server/actions.py
index c5f9d25b..a18d2f4f 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -189,6 +189,6 @@ class Actions(JailThread):
 	
 	def status(self):
 		ret = [("Currently banned", self.__banManager.size()), 
-			   ("Total banned", self.__banManager.getBanTotal())]
+			   ("Total banned", self.__banManager.getBanTotal()),
+			   ("IP list", self.__banManager.getBanList())]
 		return ret
-		
\ No newline at end of file
diff --git a/server/banmanager.py b/server/banmanager.py
index dd7791d7..140a50f0 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -100,7 +100,19 @@ class BanManager:
 			return self.__banTotal
 		finally:
 			self.__lock.release()
+
+	##
+	# Returns a copy of the IP list.
+	#
+	# @return IP list
 	
+	def getBanList(self):
+		try:
+			self.__lock.acquire()
+			return list(self.__banList)
+		finally:
+			self.__lock.release()
+
 	##
 	# Create a ban ticket.
 	#
diff --git a/server/failmanager.py b/server/failmanager.py
index 2a43c9f1..bbe64503 100644
--- a/server/failmanager.py
+++ b/server/failmanager.py
@@ -77,6 +77,18 @@ class FailManager:
 		finally:
 			self.__lock.release()
 
+	##
+	# Returns a copy of the IP list.
+	#
+	# @return IP list
+	
+	def getBanList(self):
+		try:
+			self.__lock.acquire()
+			return list(self.__failList)
+		finally:
+			self.__lock.release()
+
 	def addFailure(self, ticket):
 		self.__lock.acquire()
 		ip = ticket.getIP()
diff --git a/server/filter.py b/server/filter.py
index ed63299d..f4705562 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -463,7 +463,8 @@ class Filter(JailThread):
 	
 	def status(self):
 		ret = [("Currently failed", self.failManager.size()), 
-			   ("Total failed", self.failManager.getFailTotal())]
+			   ("Total failed", self.failManager.getFailTotal()),
+			   ("IP List", self.failManager.getBanList())]
 		return ret
 
 

From 126d57ef6ca48f56f2394e8cd75acfa698d6dcd8 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 31 Jan 2007 22:31:42 +0000
Subject: [PATCH 483/549] - Returns IP address instead of Ticket

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@536 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/banmanager.py  | 2 +-
 server/failmanager.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/banmanager.py b/server/banmanager.py
index 140a50f0..033f317c 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -109,7 +109,7 @@ class BanManager:
 	def getBanList(self):
 		try:
 			self.__lock.acquire()
-			return list(self.__banList)
+			return [m.getIP() for m in self.__banList]
 		finally:
 			self.__lock.release()
 
diff --git a/server/failmanager.py b/server/failmanager.py
index bbe64503..4d7fcbdf 100644
--- a/server/failmanager.py
+++ b/server/failmanager.py
@@ -85,7 +85,7 @@ class FailManager:
 	def getBanList(self):
 		try:
 			self.__lock.acquire()
-			return list(self.__failList)
+			return [m.getIP() for m in self.__failList]
 		finally:
 			self.__lock.release()
 

From 04e2b6730c5a71fc9be542dcf553aeaa68ad2a79 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 1 Feb 2007 20:50:12 +0000
Subject: [PATCH 484/549] - Removed IP list in status for failmanager

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@537 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/beautifier.py  |  1 -
 server/failmanager.py | 12 ------------
 server/filter.py      |  3 +--
 3 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/client/beautifier.py b/client/beautifier.py
index e6eb6c27..b31cc266 100644
--- a/client/beautifier.py
+++ b/client/beautifier.py
@@ -71,7 +71,6 @@ class Beautifier:
 					msg = "Status for the jail: " + inC[1] + "\n"
 					msg = msg + "|- " + response[0][0] + "\n"
 					msg = msg + "|  |- " + response[0][1][0][0] + ":\t" + `response[0][1][0][1]` + "\n"
-					msg = msg + "|  |  `- " + response[0][1][2][0] + ":\t" + `response[0][1][2][1]` + "\n"
 					msg = msg + "|  `- " + response[0][1][1][0] + ":\t" + `response[0][1][1][1]` + "\n"
 					msg = msg + "`- " + response[1][0] + "\n"
 					msg = msg + "   |- " + response[1][1][0][0] + ":\t" + `response[1][1][0][1]` + "\n"
diff --git a/server/failmanager.py b/server/failmanager.py
index 4d7fcbdf..2a43c9f1 100644
--- a/server/failmanager.py
+++ b/server/failmanager.py
@@ -77,18 +77,6 @@ class FailManager:
 		finally:
 			self.__lock.release()
 
-	##
-	# Returns a copy of the IP list.
-	#
-	# @return IP list
-	
-	def getBanList(self):
-		try:
-			self.__lock.acquire()
-			return [m.getIP() for m in self.__failList]
-		finally:
-			self.__lock.release()
-
 	def addFailure(self, ticket):
 		self.__lock.acquire()
 		ip = ticket.getIP()
diff --git a/server/filter.py b/server/filter.py
index f4705562..ed63299d 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -463,8 +463,7 @@ class Filter(JailThread):
 	
 	def status(self):
 		ret = [("Currently failed", self.failManager.size()), 
-			   ("Total failed", self.failManager.getFailTotal()),
-			   ("IP List", self.failManager.getBanList())]
+			   ("Total failed", self.failManager.getFailTotal())]
 		return ret
 
 

From 693e288e359ce00be8d631c6ddd8a9a32087b176 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 7 Feb 2007 23:09:54 +0000
Subject: [PATCH 485/549] - Updated website URL

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@538 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 README | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/README b/README
index 11d42c37..1a31b724 100644
--- a/README
+++ b/README
@@ -15,7 +15,7 @@ or Apache web server ones.
 
 This README is a quick introduction to Fail2ban. More
 documentation, FAQ, HOWTOs are available on the project
-website: http://fail2ban.sourceforge.net
+website: http://www.fail2ban.org
 
 Installation:
 -------------
@@ -53,7 +53,7 @@ You can configure Fail2ban using the files in /etc/fail2ban.
 It is possible to configure the server using commands sent to
 it by fail2ban-client. The available commands are described
 in the man page of fail2ban-client. Please refer to it or to
-the website: http://fail2ban.sourceforge.net
+the website: http://www.fail2ban.org
 
 Contact:
 --------
@@ -61,7 +61,7 @@ Contact:
 You need some new features, you found bugs or you just
 appreciate this program, you can contact me at:
 
-Website: http://fail2ban.sourceforge.net
+Website: http://www.fail2ban.org
 
 Cyril Jaquier: <lostcontrol@users.sourceforge.net>
 

From 51f57506d45fbc34e24076d6e16148fe061e8492 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 7 Feb 2007 23:10:47 +0000
Subject: [PATCH 486/549] - Added cacti template and partial README

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@539 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 files/cacti/README                           |  53 ++++
 files/cacti/cacti_host_template_fail2ban.xml | 277 +++++++++++++++++++
 2 files changed, 330 insertions(+)
 create mode 100644 files/cacti/README
 create mode 100644 files/cacti/cacti_host_template_fail2ban.xml

diff --git a/files/cacti/README b/files/cacti/README
new file mode 100644
index 00000000..6d6ddff3
--- /dev/null
+++ b/files/cacti/README
@@ -0,0 +1,53 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+Fail2Ban (version 0.7.7)                           2007/??/??
+=============================================================
+
+Cacti is a graphing solution using RRDTool. It is possible to
+use Cacti to display statistics about Fail2ban.
+
+Installation:
+-------------
+
+1/ Install Fail2ban version 0.7 or higher and ensure that it
+   works properly.
+2/ The user running poller.php must have read and write
+   access to the socket used by Fail2ban.
+3/ Copy fail2ban_stats.sh to scripts/. You can test it with
+   bash scripts/fail2ban_stats.sh
+4/ Import the template cacti_host_template_fail2ban.xml
+5/ TO BE CONTINUED...
+
+Contact:
+--------
+
+You need some new features, you found bugs or you just
+appreciate this program, you can contact me at:
+
+Website: http://www.fail2ban.org
+
+Cyril Jaquier: <lostcontrol@users.sourceforge.net>
+
+License:
+--------
+
+Fail2Ban is free software; you can redistribute it
+and/or modify it under the terms of the GNU General Public
+License as published by the Free Software Foundation; either
+version 2 of the License, or (at your option) any later
+version.
+
+Fail2Ban is distributed in the hope that it will be
+useful, but WITHOUT ANY WARRANTY; without even the implied
+warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public
+License along with Fail2Ban; if not, write to the Free
+Software Foundation, Inc., 59 Temple Place, Suite 330,
+Boston, MA  02111-1307  USA
diff --git a/files/cacti/cacti_host_template_fail2ban.xml b/files/cacti/cacti_host_template_fail2ban.xml
new file mode 100644
index 00000000..9b9c0410
--- /dev/null
+++ b/files/cacti/cacti_host_template_fail2ban.xml
@@ -0,0 +1,277 @@
+<cacti>	
+	<hash_02001346a4e9f7498a8129f0dfc2e1c8c7b35a>
+		<name>Fail2ban</name>
+		<graph_templates>hash_0000132fe631a3ac1f1705e332d0aee925d21b</graph_templates>
+		<data_queries></data_queries>
+	</hash_02001346a4e9f7498a8129f0dfc2e1c8c7b35a>
+	<hash_0000132fe631a3ac1f1705e332d0aee925d21b>
+		<name>Fail2ban - Statistics</name>
+		<graph>
+			<t_title>on</t_title>
+			<title>|host_description| - Statistics</title>
+			<t_image_format_id></t_image_format_id>
+			<image_format_id>1</image_format_id>
+			<t_height></t_height>
+			<height>120</height>
+			<t_width></t_width>
+			<width>500</width>
+			<t_auto_scale></t_auto_scale>
+			<auto_scale>on</auto_scale>
+			<t_auto_scale_opts></t_auto_scale_opts>
+			<auto_scale_opts>2</auto_scale_opts>
+			<t_auto_scale_log></t_auto_scale_log>
+			<auto_scale_log></auto_scale_log>
+			<t_auto_scale_rigid></t_auto_scale_rigid>
+			<auto_scale_rigid></auto_scale_rigid>
+			<t_auto_padding></t_auto_padding>
+			<auto_padding>on</auto_padding>
+			<t_export></t_export>
+			<export>on</export>
+			<t_upper_limit></t_upper_limit>
+			<upper_limit>100</upper_limit>
+			<t_lower_limit></t_lower_limit>
+			<lower_limit>0</lower_limit>
+			<t_base_value></t_base_value>
+			<base_value>1000</base_value>
+			<t_unit_value></t_unit_value>
+			<unit_value></unit_value>
+			<t_unit_exponent_value></t_unit_exponent_value>
+			<unit_exponent_value></unit_exponent_value>
+			<t_vertical_label></t_vertical_label>
+			<vertical_label></vertical_label>
+		</graph>
+		<items>
+			<hash_100013f76575fdcd7f2684843e8f2cbae4ef96>
+				<task_item_id>hash_0800132d7bfb27a7ecb33f23433863e6f90612</task_item_id>
+				<color_id>00CF00</color_id>
+				<graph_type_id>4</graph_type_id>
+				<consolidation_function_id>1</consolidation_function_id>
+				<cdef_id>0</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Failed</text_format>
+				<hard_return></hard_return>
+				<sequence>1</sequence>
+			</hash_100013f76575fdcd7f2684843e8f2cbae4ef96>
+			<hash_100013ca0d59c48dde83a1753e21eb1f44a396>
+				<task_item_id>hash_0800132d7bfb27a7ecb33f23433863e6f90612</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>4</consolidation_function_id>
+				<cdef_id>0</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Current:</text_format>
+				<hard_return></hard_return>
+				<sequence>2</sequence>
+			</hash_100013ca0d59c48dde83a1753e21eb1f44a396>
+			<hash_1000132f8d371932ebedbb665f80abf427ffb4>
+				<task_item_id>hash_0800132d7bfb27a7ecb33f23433863e6f90612</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>1</consolidation_function_id>
+				<cdef_id>0</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Average:</text_format>
+				<hard_return></hard_return>
+				<sequence>3</sequence>
+			</hash_1000132f8d371932ebedbb665f80abf427ffb4>
+			<hash_1000131b8e847f7be22014f1f0b3d098c9e702>
+				<task_item_id>hash_0800132d7bfb27a7ecb33f23433863e6f90612</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>3</consolidation_function_id>
+				<cdef_id>0</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Maximum:</text_format>
+				<hard_return>on</hard_return>
+				<sequence>4</sequence>
+			</hash_1000131b8e847f7be22014f1f0b3d098c9e702>
+			<hash_1000130e6084fd4ed86d8c86dea8f84b115eaa>
+				<task_item_id>hash_080013b224f2764ba5a827de959b1ff44cbc1d</task_item_id>
+				<color_id>FF0000</color_id>
+				<graph_type_id>5</graph_type_id>
+				<consolidation_function_id>1</consolidation_function_id>
+				<cdef_id>0</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Banned</text_format>
+				<hard_return></hard_return>
+				<sequence>5</sequence>
+			</hash_1000130e6084fd4ed86d8c86dea8f84b115eaa>
+			<hash_1000132812e5f3ee8261819268854c67093b94>
+				<task_item_id>hash_080013b224f2764ba5a827de959b1ff44cbc1d</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>4</consolidation_function_id>
+				<cdef_id>0</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Current:</text_format>
+				<hard_return></hard_return>
+				<sequence>6</sequence>
+			</hash_1000132812e5f3ee8261819268854c67093b94>
+			<hash_10001336fcfc1d017e975fa22a3ce0d0492daf>
+				<task_item_id>hash_080013b224f2764ba5a827de959b1ff44cbc1d</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>1</consolidation_function_id>
+				<cdef_id>0</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Average:</text_format>
+				<hard_return></hard_return>
+				<sequence>7</sequence>
+			</hash_10001336fcfc1d017e975fa22a3ce0d0492daf>
+			<hash_100013e5fddd5da42b9bf296d7f344b2a00446>
+				<task_item_id>hash_080013b224f2764ba5a827de959b1ff44cbc1d</task_item_id>
+				<color_id>0</color_id>
+				<graph_type_id>9</graph_type_id>
+				<consolidation_function_id>3</consolidation_function_id>
+				<cdef_id>0</cdef_id>
+				<value></value>
+				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
+				<text_format>Maximum:</text_format>
+				<hard_return>on</hard_return>
+				<sequence>8</sequence>
+			</hash_100013e5fddd5da42b9bf296d7f344b2a00446>
+		</items>
+		<inputs>
+			<hash_090013a5d69bc5ca8b53ef62b61221a69b8055>
+				<name>Data Source [banned]</name>
+				<description></description>
+				<column_name>task_item_id</column_name>
+				<items>hash_0000130e6084fd4ed86d8c86dea8f84b115eaa|hash_0000132812e5f3ee8261819268854c67093b94|hash_00001336fcfc1d017e975fa22a3ce0d0492daf|hash_000013e5fddd5da42b9bf296d7f344b2a00446</items>
+			</hash_090013a5d69bc5ca8b53ef62b61221a69b8055>
+			<hash_0900132cee6f79f051b0dd39cafcbfcfd87960>
+				<name>Data Source [failed]</name>
+				<description></description>
+				<column_name>task_item_id</column_name>
+				<items>hash_000013f76575fdcd7f2684843e8f2cbae4ef96|hash_000013ca0d59c48dde83a1753e21eb1f44a396|hash_0000131b8e847f7be22014f1f0b3d098c9e702|hash_0000132f8d371932ebedbb665f80abf427ffb4</items>
+			</hash_0900132cee6f79f051b0dd39cafcbfcfd87960>
+		</inputs>
+	</hash_0000132fe631a3ac1f1705e332d0aee925d21b>
+	<hash_0100130fce21647570158d210c7832cd50e98a>
+		<name>Fail2ban - Statistics</name>
+		<ds>
+			<t_name></t_name>
+			<name>|host_description| - Statistics</name>
+			<data_input_id>hash_030013a3adf3f2607747859b08262d972eabf0</data_input_id>
+			<t_rra_id></t_rra_id>
+			<t_rrd_step></t_rrd_step>
+			<rrd_step>300</rrd_step>
+			<t_active></t_active>
+			<active>on</active>
+			<rra_items>hash_150013c21df5178e5c955013591239eb0afd46|hash_1500130d9c0af8b8acdc7807943937b3208e29|hash_1500136fc2d038fb42950138b0ce3e9874cc60|hash_150013e36f3adb9f152adfa5dc50fd2b23337e</rra_items>
+		</ds>
+		<items>
+			<hash_0800132d7bfb27a7ecb33f23433863e6f90612>
+				<t_data_source_name></t_data_source_name>
+				<data_source_name>failed</data_source_name>
+				<t_rrd_minimum></t_rrd_minimum>
+				<rrd_minimum>0</rrd_minimum>
+				<t_rrd_maximum></t_rrd_maximum>
+				<rrd_maximum>0</rrd_maximum>
+				<t_data_source_type_id></t_data_source_type_id>
+				<data_source_type_id>2</data_source_type_id>
+				<t_rrd_heartbeat></t_rrd_heartbeat>
+				<rrd_heartbeat>600</rrd_heartbeat>
+				<t_data_input_field_id></t_data_input_field_id>
+				<data_input_field_id>hash_0700134027ae7d3baefb02f510c09de07d159f</data_input_field_id>
+			</hash_0800132d7bfb27a7ecb33f23433863e6f90612>
+			<hash_080013b224f2764ba5a827de959b1ff44cbc1d>
+				<t_data_source_name></t_data_source_name>
+				<data_source_name>banned</data_source_name>
+				<t_rrd_minimum></t_rrd_minimum>
+				<rrd_minimum>0</rrd_minimum>
+				<t_rrd_maximum></t_rrd_maximum>
+				<rrd_maximum>0</rrd_maximum>
+				<t_data_source_type_id></t_data_source_type_id>
+				<data_source_type_id>2</data_source_type_id>
+				<t_rrd_heartbeat></t_rrd_heartbeat>
+				<rrd_heartbeat>600</rrd_heartbeat>
+				<t_data_input_field_id></t_data_input_field_id>
+				<data_input_field_id>hash_07001319c32c9466152aa6cfc2bbc639a246d8</data_input_field_id>
+			</hash_080013b224f2764ba5a827de959b1ff44cbc1d>
+		</items>
+		<data>
+			<item_000>
+				<data_input_field_id>hash_0700131cda0f872b68c87e508a29e8976a6a7a</data_input_field_id>
+				<t_value>on</t_value>
+				<value>ssh-iptables</value>
+			</item_000>
+		</data>
+	</hash_0100130fce21647570158d210c7832cd50e98a>
+	<hash_030013a3adf3f2607747859b08262d972eabf0>
+		<name>Fail2ban - Get statistics</name>
+		<type_id>1</type_id>
+		<input_string>bash &lt;path_cacti&gt;/scripts/fail2ban_stats.sh &lt;jail&gt;</input_string>
+		<fields>
+			<hash_0700131cda0f872b68c87e508a29e8976a6a7a>
+				<name>Jail name</name>
+				<update_rra></update_rra>
+				<regexp_match></regexp_match>
+				<allow_nulls></allow_nulls>
+				<type_code></type_code>
+				<input_output>in</input_output>
+				<data_name>jail</data_name>
+			</hash_0700131cda0f872b68c87e508a29e8976a6a7a>
+			<hash_0700134027ae7d3baefb02f510c09de07d159f>
+				<name>Total of failed logins</name>
+				<update_rra>on</update_rra>
+				<regexp_match></regexp_match>
+				<allow_nulls></allow_nulls>
+				<type_code></type_code>
+				<input_output>out</input_output>
+				<data_name>failed</data_name>
+			</hash_0700134027ae7d3baefb02f510c09de07d159f>
+			<hash_07001319c32c9466152aa6cfc2bbc639a246d8>
+				<name>Total of banned hosts</name>
+				<update_rra>on</update_rra>
+				<regexp_match></regexp_match>
+				<allow_nulls></allow_nulls>
+				<type_code></type_code>
+				<input_output>out</input_output>
+				<data_name>banned</data_name>
+			</hash_07001319c32c9466152aa6cfc2bbc639a246d8>
+		</fields>
+	</hash_030013a3adf3f2607747859b08262d972eabf0>
+	<hash_150013c21df5178e5c955013591239eb0afd46>
+		<name>Daily (5 Minute Average)</name>
+		<x_files_factor>0.5</x_files_factor>
+		<steps>1</steps>
+		<rows>600</rows>
+		<timespan>86400</timespan>
+		<cf_items>1|2|3|4</cf_items>
+	</hash_150013c21df5178e5c955013591239eb0afd46>
+	<hash_1500130d9c0af8b8acdc7807943937b3208e29>
+		<name>Weekly (30 Minute Average)</name>
+		<x_files_factor>0.5</x_files_factor>
+		<steps>6</steps>
+		<rows>700</rows>
+		<timespan>604800</timespan>
+		<cf_items>1|2|3|4</cf_items>
+	</hash_1500130d9c0af8b8acdc7807943937b3208e29>
+	<hash_1500136fc2d038fb42950138b0ce3e9874cc60>
+		<name>Monthly (2 Hour Average)</name>
+		<x_files_factor>0.5</x_files_factor>
+		<steps>24</steps>
+		<rows>775</rows>
+		<timespan>2678400</timespan>
+		<cf_items>1|2|3|4</cf_items>
+	</hash_1500136fc2d038fb42950138b0ce3e9874cc60>
+	<hash_150013e36f3adb9f152adfa5dc50fd2b23337e>
+		<name>Yearly (1 Day Average)</name>
+		<x_files_factor>0.5</x_files_factor>
+		<steps>288</steps>
+		<rows>797</rows>
+		<timespan>33053184</timespan>
+		<cf_items>1|2|3|4</cf_items>
+	</hash_150013e36f3adb9f152adfa5dc50fd2b23337e>
+	<hash_060013e9c43831e54eca8069317a2ce8c6f751>
+		<name>Normal</name>
+		<gprint_text>%8.2lf %s</gprint_text>
+	</hash_060013e9c43831e54eca8069317a2ce8c6f751>
+</cacti>
\ No newline at end of file

From 088fd07b0546284424204b646e6eb53b156a4355 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 7 Feb 2007 23:20:10 +0000
Subject: [PATCH 487/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@540 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/TODO b/TODO
index 2ab2142a..aff717ac 100644
--- a/TODO
+++ b/TODO
@@ -13,13 +13,18 @@ Legend:
 # partially done
 * done
 
+- Add timeout to external commands (signal alarm, watchdog
+  thread, etc)
+
+- New backend: pynotify
+
 - Uniformize filters and actions name. Use the software name
   (openssh, postfix, proftp)
 
 - Added <USER> tag for failregex. Add features using this
   information
 
-- Look at the memory consumption
+- Look at the memory consumption. Decrease memory usage
 
 - More detailed statistics
 

From 13967efa0f67dbd2401c40fcc631f9d420044dae Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 8 Feb 2007 19:26:00 +0000
Subject: [PATCH 488/549] - Added y-label - Changed per second with per 5
 minutes

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@541 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 files/cacti/cacti_host_template_fail2ban.xml | 38 +++++++++++++++-----
 1 file changed, 29 insertions(+), 9 deletions(-)

diff --git a/files/cacti/cacti_host_template_fail2ban.xml b/files/cacti/cacti_host_template_fail2ban.xml
index 9b9c0410..b0dc2ded 100644
--- a/files/cacti/cacti_host_template_fail2ban.xml
+++ b/files/cacti/cacti_host_template_fail2ban.xml
@@ -38,7 +38,7 @@
 			<t_unit_exponent_value></t_unit_exponent_value>
 			<unit_exponent_value></unit_exponent_value>
 			<t_vertical_label></t_vertical_label>
-			<vertical_label></vertical_label>
+			<vertical_label>hits/5min</vertical_label>
 		</graph>
 		<items>
 			<hash_100013f76575fdcd7f2684843e8f2cbae4ef96>
@@ -46,7 +46,7 @@
 				<color_id>00CF00</color_id>
 				<graph_type_id>4</graph_type_id>
 				<consolidation_function_id>1</consolidation_function_id>
-				<cdef_id>0</cdef_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
 				<value></value>
 				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
 				<text_format>Failed</text_format>
@@ -58,7 +58,7 @@
 				<color_id>0</color_id>
 				<graph_type_id>9</graph_type_id>
 				<consolidation_function_id>4</consolidation_function_id>
-				<cdef_id>0</cdef_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
 				<value></value>
 				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
 				<text_format>Current:</text_format>
@@ -70,7 +70,7 @@
 				<color_id>0</color_id>
 				<graph_type_id>9</graph_type_id>
 				<consolidation_function_id>1</consolidation_function_id>
-				<cdef_id>0</cdef_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
 				<value></value>
 				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
 				<text_format>Average:</text_format>
@@ -82,7 +82,7 @@
 				<color_id>0</color_id>
 				<graph_type_id>9</graph_type_id>
 				<consolidation_function_id>3</consolidation_function_id>
-				<cdef_id>0</cdef_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
 				<value></value>
 				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
 				<text_format>Maximum:</text_format>
@@ -94,7 +94,7 @@
 				<color_id>FF0000</color_id>
 				<graph_type_id>5</graph_type_id>
 				<consolidation_function_id>1</consolidation_function_id>
-				<cdef_id>0</cdef_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
 				<value></value>
 				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
 				<text_format>Banned</text_format>
@@ -106,7 +106,7 @@
 				<color_id>0</color_id>
 				<graph_type_id>9</graph_type_id>
 				<consolidation_function_id>4</consolidation_function_id>
-				<cdef_id>0</cdef_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
 				<value></value>
 				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
 				<text_format>Current:</text_format>
@@ -118,7 +118,7 @@
 				<color_id>0</color_id>
 				<graph_type_id>9</graph_type_id>
 				<consolidation_function_id>1</consolidation_function_id>
-				<cdef_id>0</cdef_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
 				<value></value>
 				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
 				<text_format>Average:</text_format>
@@ -130,7 +130,7 @@
 				<color_id>0</color_id>
 				<graph_type_id>9</graph_type_id>
 				<consolidation_function_id>3</consolidation_function_id>
-				<cdef_id>0</cdef_id>
+				<cdef_id>hash_050013e961cc8ec04fda6ed4981cf5ad501aa5</cdef_id>
 				<value></value>
 				<gprint_id>hash_060013e9c43831e54eca8069317a2ce8c6f751</gprint_id>
 				<text_format>Maximum:</text_format>
@@ -270,6 +270,26 @@
 		<timespan>33053184</timespan>
 		<cf_items>1|2|3|4</cf_items>
 	</hash_150013e36f3adb9f152adfa5dc50fd2b23337e>
+	<hash_050013e961cc8ec04fda6ed4981cf5ad501aa5>
+		<name>Make Per 5 Minutes</name>
+		<items>
+			<hash_14001340bb7a1143b0f2e2efca14eb356236de>
+				<sequence>1</sequence>
+				<type>4</type>
+				<value>CURRENT_DATA_SOURCE</value>
+			</hash_14001340bb7a1143b0f2e2efca14eb356236de>
+			<hash_140013faf1b148b2c0e0527362ed5b8ca1d351>
+				<sequence>2</sequence>
+				<type>6</type>
+				<value>300</value>
+			</hash_140013faf1b148b2c0e0527362ed5b8ca1d351>
+			<hash_14001342686ea0925c0220924b7d333599cd67>
+				<sequence>3</sequence>
+				<type>2</type>
+				<value>3</value>
+			</hash_14001342686ea0925c0220924b7d333599cd67>
+		</items>
+	</hash_050013e961cc8ec04fda6ed4981cf5ad501aa5>
 	<hash_060013e9c43831e54eca8069317a2ce8c6f751>
 		<name>Normal</name>
 		<gprint_text>%8.2lf %s</gprint_text>

From 13f52e17a0dfebdc8329b5f9eee567b16c89f846 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 8 Feb 2007 19:32:18 +0000
Subject: [PATCH 489/549] - Updated with new cacti files

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@542 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MANIFEST b/MANIFEST
index 209a64a0..28edae13 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -91,3 +91,5 @@ man/generate-man
 files/gentoo-initd
 files/redhat-initd
 files/cacti/fail2ban_stats.sh
+files/cacti/cacti_host_template_fail2ban.xml
+files/cacti/README

From 88d65de126c01d10daa16c084b934a7284d953b1 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 8 Feb 2007 21:14:01 +0000
Subject: [PATCH 490/549] - Updated for 0.7.7

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@543 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG             | 4 ++--
 README                | 6 +++---
 common/version.py     | 2 +-
 man/fail2ban-client.1 | 4 ++--
 man/fail2ban-regex.1  | 4 ++--
 man/fail2ban-server.1 | 4 ++--
 6 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 5181fd21..1de258b9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.7)                           2007/??/??
+Fail2Ban (version 0.7.7)                           2007/02/08
 =============================================================
 
-ver. 0.7.7 (2007/??/??)
+ver. 0.7.7 (2007/02/08) - release candidate
 ----------
 - Added signal handling in fail2ban-client
 - Added a wonderful visual effect when waiting on the server
diff --git a/README b/README
index 1a31b724..369c87e4 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.6)                           2007/01/04
+Fail2Ban (version 0.7.7)                           2007/02/08
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -28,8 +28,8 @@ Optional:
 
 To install, just do:
 
-> tar xvfj fail2ban-0.7.6.tar.bz2
-> cd fail2ban-0.7.6
+> tar xvfj fail2ban-0.7.7.tar.bz2
+> cd fail2ban-0.7.7
 > python setup.py install
 
 This will install Fail2Ban into /usr/share/fail2ban. The
diff --git a/common/version.py b/common/version.py
index 2e3c2d89..f563230f 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.6-SVN"
+version = "0.7.7"
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 88a853d9..8b396854 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,11 +1,11 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "January 2007" "fail2ban-client v0.7.6-SVN" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "February 2007" "fail2ban-client v0.7.7" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH DESCRIPTION
 [?1034hUsage: ../fail2ban\-client [OPTIONS] <COMMAND>
 .PP
-Fail2Ban v0.7.6\-SVN reads log file that contains password failure report
+Fail2Ban v0.7.7 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index 499c1c96..d9e8ef0f 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-REGEX "1" "January 2007" "fail2ban-regex v0.7.6-SVN" "User Commands"
+.TH FAIL2BAN-REGEX "1" "February 2007" "fail2ban-regex v0.7.7" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
 .B fail2ban-regex
 [\fIOPTIONS\fR] \fI<LOG> <REGEX>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.6\-SVN reads log file that contains password failure report
+Fail2Ban v0.7.7 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 This tools can test regular expressions for "fail2ban".
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index 211cbabf..dc79c090 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "January 2007" "fail2ban-server v0.7.6-SVN" "User Commands"
+.TH FAIL2BAN-SERVER "1" "February 2007" "fail2ban-server v0.7.7" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.7.6\-SVN reads log file that contains password failure report
+Fail2Ban v0.7.7 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with

From 364e1ff397e9129db6a6ddaf8575de75cb12a0ab Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 11 Feb 2007 23:18:58 +0000
Subject: [PATCH 491/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@545 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 common/version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/common/version.py b/common/version.py
index f563230f..22f09605 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.7"
+version = "0.7.7-SVN"

From 35a26237ebb667217109f22fb153652c4f414d7c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 11 Feb 2007 23:19:32 +0000
Subject: [PATCH 492/549] - Fixed asctime pattern in datedetector.py

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@546 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/datedetector.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/datedetector.py b/server/datedetector.py
index 951aba6f..9e7fbb36 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -51,7 +51,7 @@ class DateDetector:
 		# asctime
 		template = DateStrptime()
 		template.setName("Weekday Month Day Hour:Minute:Second Year")
-		template.setRegex("\S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}")
+		template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}")
 		template.setPattern("%a %b %d %H:%M:%S %Y")
 		self.__templates.append(template)
 		# simple date

From 3d5b32c19975d188f3d1bed7234ac68731d04c22 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 11 Feb 2007 23:21:56 +0000
Subject: [PATCH 493/549] - Display the IP list correctly

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@547 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 client/beautifier.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/client/beautifier.py b/client/beautifier.py
index b31cc266..132d1626 100644
--- a/client/beautifier.py
+++ b/client/beautifier.py
@@ -68,13 +68,18 @@ class Beautifier:
 				msg = "Added jail " + response
 			elif inC[0:1] == ['status']:
 				if len(inC) > 1:
+					# Create IP list
+					ipList = ""
+					for ip in response[1][1][2][1]:
+						ipList += ip + " "
+					# Display information
 					msg = "Status for the jail: " + inC[1] + "\n"
 					msg = msg + "|- " + response[0][0] + "\n"
 					msg = msg + "|  |- " + response[0][1][0][0] + ":\t" + `response[0][1][0][1]` + "\n"
 					msg = msg + "|  `- " + response[0][1][1][0] + ":\t" + `response[0][1][1][1]` + "\n"
 					msg = msg + "`- " + response[1][0] + "\n"
 					msg = msg + "   |- " + response[1][1][0][0] + ":\t" + `response[1][1][0][1]` + "\n"
-					msg = msg + "   |  `- " + response[1][1][2][0] + ":\t" + `response[1][1][2][1]` + "\n"
+					msg = msg + "   |  `- " + response[1][1][2][0] + ":\t" + ipList + "\n"
 					msg = msg + "   `- " + response[1][1][1][0] + ":\t" + `response[1][1][1][1]`
 				else:
 					msg = "Status\n"

From eee07663198e1416298470acb76aa7174a115021 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 11 Feb 2007 23:22:32 +0000
Subject: [PATCH 494/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@548 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 4 ++++
 TODO      | 8 +++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 1de258b9..a113b396 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,10 @@
 Fail2Ban (version 0.7.7)                           2007/02/08
 =============================================================
 
+ver. 0.?.? (2007/??/??) - ???
+----------
+- Fixed asctime pattern in datedetector.py
+
 ver. 0.7.7 (2007/02/08) - release candidate
 ----------
 - Added signal handling in fail2ban-client
diff --git a/TODO b/TODO
index aff717ac..87f64929 100644
--- a/TODO
+++ b/TODO
@@ -13,6 +13,12 @@ Legend:
 # partially done
 * done
 
+- Discuss where Fail2ban should be installed (/usr/share,
+  /usr/lib/python/site-packages/, etc)
+
+- Cleanup fail2ban-client and fail2ban-server. Move code to
+  server/ and client/
+
 - Add timeout to external commands (signal alarm, watchdog
   thread, etc)
 
@@ -22,7 +28,7 @@ Legend:
   (openssh, postfix, proftp)
 
 - Added <USER> tag for failregex. Add features using this
-  information
+  information. Maybe add more tags
 
 - Look at the memory consumption. Decrease memory usage
 

From b4caed8c007961f869dca581f45c7f6151378739 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 12 Feb 2007 21:50:50 +0000
Subject: [PATCH 495/549] - Added new filter for spam bots - Added new action
 for buffered mails

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@549 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                           |  1 +
 MANIFEST                            |  1 +
 config/action.d/mail-buffered.conf  | 88 +++++++++++++++++++++++++++++
 config/filter.d/apache-badbots.conf | 25 ++++++++
 config/jail.conf                    | 13 +++++
 5 files changed, 128 insertions(+)
 create mode 100644 config/action.d/mail-buffered.conf
 create mode 100644 config/filter.d/apache-badbots.conf

diff --git a/CHANGELOG b/CHANGELOG
index a113b396..0590250f 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -10,6 +10,7 @@ Fail2Ban (version 0.7.7)                           2007/02/08
 ver. 0.?.? (2007/??/??) - ???
 ----------
 - Fixed asctime pattern in datedetector.py
+- Added new filters/actions. Thanks to Yaroslav Halchenko
 
 ver. 0.7.7 (2007/02/08) - release candidate
 ----------
diff --git a/MANIFEST b/MANIFEST
index 28edae13..d49b19bc 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -78,6 +78,7 @@ config/action.d/ipfw.conf
 config/action.d/mail-whois.conf
 config/action.d/mail-whois-lines.conf
 config/action.d/mail.conf
+config/action.d/mail-buffered.conf
 config/action.d/hostsdeny.conf
 config/action.d/shorewall.conf
 config/fail2ban.conf
diff --git a/config/action.d/mail-buffered.conf b/config/action.d/mail-buffered.conf
new file mode 100644
index 00000000..6be60a63
--- /dev/null
+++ b/config/action.d/mail-buffered.conf
@@ -0,0 +1,88 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision: 510 $
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = echo -en "Hi,\n
+              The jail <name> has been started successfuly.\n
+              Output will be buffered until <lines> lines are available.\n
+              Regards,\n
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = if [ -d <tmpfile> ]; then
+                 echo -en "Hi,\n
+                 These hosts have been banned by Fail2Ban.\n
+                 `cat <tmpfile>`
+                 Regards,\n
+                 Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary" <dest>
+                 rm <tmpfile>
+             fi
+             echo -en "Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = echo `date`": <ip> (<failures> failures)" >> <tmpfile>
+            LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
+            if [ $LINE -eq <lines> ]; then
+                echo -en "Hi,\n
+                These hosts have been banned by Fail2Ban.\n
+                `cat <tmpfile>`
+                Regards,\n
+                Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary" <dest>
+                rm <tmpfile>
+            fi
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Default name of the chain
+#
+name = default
+
+# Default number of lines that are buffered
+#
+lines = 5
+
+# Default temporary file
+#
+tmpfile = /tmp/fail2ban-mail.txt
+
+# Destination/Addressee of the mail
+#
+dest = root
diff --git a/config/filter.d/apache-badbots.conf b/config/filter.d/apache-badbots.conf
new file mode 100644
index 00000000..4feb70d7
--- /dev/null
+++ b/config/filter.d/apache-badbots.conf
@@ -0,0 +1,25 @@
+# Fail2Ban configuration file
+#
+# List of bad bots fetched from http://www.user-agents.org
+# Generated on Sun Feb 11 01:09:15 EST 2007 by ./badbots.sh
+#
+# Author: Yaroslav Halchenko
+#
+#
+
+[Definition]
+badbotscustom = EmailCollector|WebEMailExtrac
+badbots = atSpider/1\.0|autoemailspider|China Local Browse 2\.6|ContentSmartz|DataCha0s/2\.0|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|MVAClient|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|sogou spider|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|WebVulnCrawl\.blogspot\.com/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
+
+# Option:  failregex
+# Notes.:  Regexp to catch known spambots and software alike. Please verify that
+#          it is your intent to block IPs which were driven by abovementioned bots
+# Values:  TEXT
+#
+failregex = ^(?P<host>\S*) -.*"GET.*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex =
diff --git a/config/jail.conf b/config/jail.conf
index f57b37f5..c95e01bb 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -117,6 +117,19 @@ logpath  = /var/log/vsftpd.log
 maxretry = 5
 bantime  = 1800
 
+# Ban hosts which agent identifies spammer robots crawling the web
+# for email addresses. The mail outputs are buffered.
+
+[apache-badbots]
+
+enabled  = false
+filter   = apache-badbots
+action   = iptables-multiport[name=BadBots, port="http,https"]
+           mail-buffered[name=BadBots, lines=5, dest=yourmail@mail.com]
+logpath  = /var/www/*/logs/access_log
+bantime  = 172800
+maxretry = 1
+
 # Use shorewall instead of iptables.
 
 [apache-shorewall]

From 3803150e6eb9c0c4ad69f090f3504f613a6ccaca Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 20 Feb 2007 20:44:47 +0000
Subject: [PATCH 496/549] - Added Suse init script and modified gentoo-initd.
 Thanks to Christian Rauch

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@550 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG          |  2 ++
 README             |  2 +-
 files/gentoo-initd | 28 +++------------
 files/suse-initd   | 87 ++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 95 insertions(+), 24 deletions(-)
 create mode 100755 files/suse-initd

diff --git a/CHANGELOG b/CHANGELOG
index 0590250f..8605717c 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -11,6 +11,8 @@ ver. 0.?.? (2007/??/??) - ???
 ----------
 - Fixed asctime pattern in datedetector.py
 - Added new filters/actions. Thanks to Yaroslav Halchenko
+- Added Suse init script and modified gentoo-initd. Thanks to
+  Christian Rauch
 
 ver. 0.7.7 (2007/02/08) - release candidate
 ----------
diff --git a/README b/README
index 369c87e4..0c798e89 100644
--- a/README
+++ b/README
@@ -73,7 +73,7 @@ Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
 Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
 Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
 Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
-René Berber, mEDI, Axel Thimm, Eric Gerbier
+René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch
 
 License:
 --------
diff --git a/files/gentoo-initd b/files/gentoo-initd
index 64a2105c..6041f243 100755
--- a/files/gentoo-initd
+++ b/files/gentoo-initd
@@ -42,29 +42,11 @@ stop() {
 }
 
 restart() {
-    if ! service_stopped "${SVCNAME}" ; then
-            svc_stop || return "$?"
-            einfon "Waiting for server to shutdown ."
-			cnt=0
-			while [ 1 ]; do
-				# Ping fail2ban-server
-				${FAIL2BAN} ping &> /dev/null
-				if [ ! "$?" == "0" ]; then
-					break
-				fi
-				cnt=`expr $cnt + 1`
-				if [ $cnt -gt 60 ] ; then
-					# We have waited 1 minute. Failed
-					echo
-					eend 1 "Failed"
-					break
-				fi
-				sleep 1
-				echo -n "."
-			done
-			echo
-    fi
-    svc_start
+	if ! service_stopped "${SVCNAME}" ; then
+		svc_stop || return "$?"
+		sleep 1
+	fi
+	svc_start
 }
 
 reload() {
diff --git a/files/suse-initd b/files/suse-initd
new file mode 100755
index 00000000..06e481fe
--- /dev/null
+++ b/files/suse-initd
@@ -0,0 +1,87 @@
+#!/bin/sh
+#
+# /etc/init.d/fail2ban
+#   and its symbolic link
+# /usr/sbin/rcfail2ban
+#
+### BEGIN INIT INFO
+# Provides:          fail2ban
+# Required-Start:    $syslog $remote_fs postfix
+# Required-Stop:     $syslog $remote_fs
+# Should-Stop: $time ypbind sendmail
+# Default-Start:     3 5
+# Default-Stop:      0 1 2 6
+# Description:       startup Fail2Ban
+### END INIT INFO
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin
+FAIL2BAN_BIN=/usr/local/bin/fail2ban-client
+FAIL2BAN_SERVER=/usr/local/bin/fail2ban-server
+FAIL2BAN_SOCKET=/tmp/fail2ban.sock
+test -x $FAIL2BAN_BIN || { echo "$FAIL2BAN_BIN not installed"; 
+	if [ "$1" = "stop" ]; then exit 0;
+	else exit 5; fi; }
+
+# Check for existence of needed config file and read it
+FAIL2BAN_CONFIG=/etc/fail2ban/fail2ban.conf
+test -r $FAIL2BAN_CONFIG || { echo "$FAIL2BAN_CONFIG not existing";
+	if [ "$1" = "stop" ]; then exit 0;
+	else exit 6; fi; }
+
+. /etc/rc.status
+
+# Reset status of this service
+rc_reset
+
+case "$1" in
+    start)
+	echo -n "Starting Fail2Ban "
+	/sbin/startproc $FAIL2BAN_BIN -q start 2>1 > /dev/null
+	rc_status -v
+	;;
+    stop)
+	echo -n "Shutting down Fail2ban "
+	/sbin/startproc $FAIL2BAN_BIN -q stop
+	rc_status -v
+	;;
+    try-restart|condrestart)
+	if test "$1" = "condrestart"; then
+		echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}"
+	fi
+	$0 status
+	if test $? = 0; then
+		$0 restart
+	else
+		rc_reset	# Not running is not a failure.
+	fi
+	rc_status
+	;;
+    restart)
+	$0 stop
+	i=60
+	while [ -e $FAIL2BAN_SOCKET ] && [ $i -gt 60 ]
+		sleep 1
+		i=$[i-1]
+		echo -n "."
+	done
+	echo "."
+	$0 start
+
+	# Remember status and be quiet
+	rc_status
+	;;
+    force-reload)
+	echo -n "Reload service Fail2ban "
+	/sbin/startproc $FAIL2BAN_BIN -q reload
+	rc_status -v
+	;;
+    reload)
+	echo -n "Reload service Fail2ban "
+	/sbin/startproc $FAIL2BAN_BIN -q reload
+	rc_status -v
+	;;
+    status)
+	echo -n "Checking for service Fail2ban "
+	/sbin/checkproc $FAIL2BAN_SERVER
+	rc_status -v
+	;;
+    probe)

From 54e4d012d14f0b38db7864a391b7cb9870aeb3a7 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 22 Feb 2007 20:52:35 +0000
Subject: [PATCH 497/549] - Fixed bug #1664386. Thanks to Harry Rarig

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@551 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/sshd.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 8e9c22e2..fa1d88ad 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -15,7 +15,7 @@
 # Values:  TEXT
 #
 failregex = Authentication failure for .* from <HOST>
-            Failed [-/\w+]+ for .* from <HOST>
+            Failed [-/\w]+ for .* from <HOST>
             ROOT LOGIN REFUSED .* FROM <HOST>
             [iI](?:llegal|nvalid) user .* from <HOST>
 

From f02a915de1f2505c8b1054b2c9137c4af984d004 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 22 Feb 2007 21:11:30 +0000
Subject: [PATCH 498/549] - Added a new example for vsftpd. Thanks to Christian
 Rauch

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@552 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/jail.conf | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/config/jail.conf b/config/jail.conf
index c95e01bb..f2854691 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -117,6 +117,18 @@ logpath  = /var/log/vsftpd.log
 maxretry = 5
 bantime  = 1800
 
+# Same as above but with banning the IP address.
+
+[vsftpd-iptables]
+
+enabled  = false
+filter   = vsftpd
+action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
+           mail-whois[name=VSFTPD, dest=yourmail@mail.com]
+logpath  = /var/log/vsftpd.log
+maxretry = 5
+bantime  = 1800
+
 # Ban hosts which agent identifies spammer robots crawling the web
 # for email addresses. The mail outputs are buffered.
 

From 6426cf75aab17dafb221441b95249ab5fe51dba3 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 25 Feb 2007 23:53:22 +0000
Subject: [PATCH 499/549] - Moved every locking statements in a try..finally
 block

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@553 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG              |   1 +
 server/banmanager.py   |  16 +++--
 server/datedetector.py | 137 ++++++++++++++++++++++-------------------
 server/failmanager.py  |  69 ++++++++++++---------
 4 files changed, 123 insertions(+), 100 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 8605717c..72e7615a 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -13,6 +13,7 @@ ver. 0.?.? (2007/??/??) - ???
 - Added new filters/actions. Thanks to Yaroslav Halchenko
 - Added Suse init script and modified gentoo-initd. Thanks to
   Christian Rauch
+- Moved every locking statements in a try..finally block
 
 ver. 0.7.7 (2007/02/08) - release candidate
 ----------
diff --git a/server/banmanager.py b/server/banmanager.py
index 033f317c..254f4c61 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -62,9 +62,11 @@ class BanManager:
 	# @param value the time
 	
 	def setBanTime(self, value):
-		self.__lock.acquire()
-		self.__banTime = int(value)
-		self.__lock.release()
+		try:
+			self.__lock.acquire()
+			self.__banTime = int(value)
+		finally:
+			self.__lock.release()
 	
 	##
 	# Get the ban time.
@@ -85,9 +87,11 @@ class BanManager:
 	# @param value total number
 	
 	def setBanTotal(self, value):
-		self.__lock.acquire()
-		self.__banTotal = value
-		self.__lock.release()
+		try:
+			self.__lock.acquire()
+			self.__banTotal = value
+		finally:
+			self.__lock.release()
 	
 	##
 	# Get the total number of banned address.
diff --git a/server/datedetector.py b/server/datedetector.py
index 9e7fbb36..6c475c75 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -42,44 +42,48 @@ class DateDetector:
 		self.__defTemplate = DateStrptime()
 	
 	def addDefaultTemplate(self):
-		# standard
-		template = DateStrptime()
-		template.setName("Month Day Hour:Minute:Second")
-		template.setRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
-		template.setPattern("%b %d %H:%M:%S")
-		self.__templates.append(template)
-		# asctime
-		template = DateStrptime()
-		template.setName("Weekday Month Day Hour:Minute:Second Year")
-		template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}")
-		template.setPattern("%a %b %d %H:%M:%S %Y")
-		self.__templates.append(template)
-		# simple date
-		template = DateStrptime()
-		template.setName("Year/Month/Day Hour:Minute:Second")
-		template.setRegex("\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
-		template.setPattern("%Y/%m/%d %H:%M:%S")
-		self.__templates.append(template)
-		# Apache format [31/Oct/2006:09:22:55 -0000]
-		template = DateStrptime()
-		template.setName("Day/Month/Year:Hour:Minute:Second")
-		template.setRegex("\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}")
-		template.setPattern("%d/%b/%Y:%H:%M:%S")
-		self.__templates.append(template)
-		# Exim 2006-12-21 06:43:20
-		template = DateStrptime()
-		template.setName("Year-Month-Day Hour:Minute:Second")
-		template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
-		template.setPattern("%Y-%m-%d %H:%M:%S")
-		self.__templates.append(template)
-		# TAI64N
-		template = DateTai64n()
-		template.setName("TAI64N")
-		self.__templates.append(template)
-		# Epoch
-		template = DateEpoch()
-		template.setName("Epoch")
-		self.__templates.append(template)
+		try:
+			self.__lock.acquire()
+			# standard
+			template = DateStrptime()
+			template.setName("Month Day Hour:Minute:Second")
+			template.setRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+			template.setPattern("%b %d %H:%M:%S")
+			self.__templates.append(template)
+			# asctime
+			template = DateStrptime()
+			template.setName("Weekday Month Day Hour:Minute:Second Year")
+			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}")
+			template.setPattern("%a %b %d %H:%M:%S %Y")
+			self.__templates.append(template)
+			# simple date
+			template = DateStrptime()
+			template.setName("Year/Month/Day Hour:Minute:Second")
+			template.setRegex("\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
+			template.setPattern("%Y/%m/%d %H:%M:%S")
+			self.__templates.append(template)
+			# Apache format [31/Oct/2006:09:22:55 -0000]
+			template = DateStrptime()
+			template.setName("Day/Month/Year:Hour:Minute:Second")
+			template.setRegex("\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}")
+			template.setPattern("%d/%b/%Y:%H:%M:%S")
+			self.__templates.append(template)
+			# Exim 2006-12-21 06:43:20
+			template = DateStrptime()
+			template.setName("Year-Month-Day Hour:Minute:Second")
+			template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
+			template.setPattern("%Y-%m-%d %H:%M:%S")
+			self.__templates.append(template)
+			# TAI64N
+			template = DateTai64n()
+			template.setName("TAI64N")
+			self.__templates.append(template)
+			# Epoch
+			template = DateEpoch()
+			template.setName("Epoch")
+			self.__templates.append(template)
+		finally:
+			self.__lock.release()
 	
 	def getTemplates(self):
 		return self.__templates
@@ -100,14 +104,15 @@ class DateDetector:
 		if self.__defTemplate.isValid():
 			return self.__defTemplate.matchDate(line)
 		else:
-			self.__lock.acquire()
-			for template in self.__templates:
-				match = template.matchDate(line)
-				if not match == None:
-					self.__lock.release()
-					return match
-			self.__lock.release()
-			return None
+			try:
+				self.__lock.acquire()
+				for template in self.__templates:
+					match = template.matchDate(line)
+					if not match == None:
+						return match
+				return None
+			finally:
+				self.__lock.release()
 
 	def getTime(self, line):
 		if self.__defTemplate.isValid():
@@ -117,19 +122,20 @@ class DateDetector:
 			except ValueError:
 				return None
 		else:
-			self.__lock.acquire()
-			for template in self.__templates:
-				try:
-					date = template.getDate(line)
-					if date == None:
-						continue
-					template.incHits()
-					self.__lock.release()
-					return date
-				except ValueError:
-					pass
-			self.__lock.release()
-			return None
+			try:
+				self.__lock.acquire()
+				for template in self.__templates:
+					try:
+						date = template.getDate(line)
+						if date == None:
+							continue
+						template.incHits()
+						return date
+					except ValueError:
+						pass
+				return None
+			finally:
+				self.__lock.release()
 
 	def getUnixTime(self, line):
 		date = self.getTime(line)
@@ -143,8 +149,11 @@ class DateDetector:
 	# in this object and thus should be called from time to time.
 	
 	def sortTemplate(self):
-		self.__lock.acquire()
-		logSys.debug("Sorting the template list")
-		self.__templates.sort(cmp = lambda x, y: cmp(x.getHits(), y.getHits()), 
-							reverse=True)
-		self.__lock.release()
+		try:
+			self.__lock.acquire()
+			logSys.debug("Sorting the template list")
+			self.__templates.sort(cmp = lambda x, y:
+								cmp(x.getHits(), y.getHits()), 
+								reverse = True)
+		finally:
+			self.__lock.release()
diff --git a/server/failmanager.py b/server/failmanager.py
index 2a43c9f1..9101ac62 100644
--- a/server/failmanager.py
+++ b/server/failmanager.py
@@ -42,9 +42,11 @@ class FailManager:
 		self.__failTotal = 0
 	
 	def setFailTotal(self, value):
-		self.__lock.acquire()
-		self.__failTotal = value
-		self.__lock.release()
+		try:
+			self.__lock.acquire()
+			self.__failTotal = value
+		finally:
+			self.__lock.release()
 		
 	def getFailTotal(self):
 		try:
@@ -54,9 +56,11 @@ class FailManager:
 			self.__lock.release()
 	
 	def setMaxRetry(self, value):
-		self.__lock.acquire()
-		self.__maxRetry = value
-		self.__lock.release()
+		try:
+			self.__lock.acquire()
+			self.__maxRetry = value
+		finally:
+			self.__lock.release()
 	
 	def getMaxRetry(self):
 		try:
@@ -66,9 +70,11 @@ class FailManager:
 			self.__lock.release()
 	
 	def setMaxTime(self, value):
-		self.__lock.acquire()
-		self.__maxTime = value
-		self.__lock.release()
+		try:
+			self.__lock.acquire()
+			self.__maxTime = value
+		finally:
+			self.__lock.release()
 	
 	def getMaxTime(self):
 		try:
@@ -78,20 +84,22 @@ class FailManager:
 			self.__lock.release()
 
 	def addFailure(self, ticket):
-		self.__lock.acquire()
-		ip = ticket.getIP()
-		unixTime = ticket.getTime()
-		if self.__failList.has_key(ip):
-			fData = self.__failList[ip]
-			fData.inc()
-			fData.setLastTime(unixTime)
-		else:
-			fData = FailData()
-			fData.inc()
-			fData.setLastTime(unixTime)
-			self.__failList[ip] = fData
-		self.__failTotal += 1
-		self.__lock.release()
+		try:
+			self.__lock.acquire()
+			ip = ticket.getIP()
+			unixTime = ticket.getTime()
+			if self.__failList.has_key(ip):
+				fData = self.__failList[ip]
+				fData.inc()
+				fData.setLastTime(unixTime)
+			else:
+				fData = FailData()
+				fData.inc()
+				fData.setLastTime(unixTime)
+				self.__failList[ip] = fData
+			self.__failTotal += 1
+		finally:
+			self.__lock.release()
 	
 	def size(self):
 		try:
@@ -101,12 +109,14 @@ class FailManager:
 			self.__lock.release()
 	
 	def cleanup(self, time):
-		self.__lock.acquire()
-		tmp = self.__failList.copy()
-		for item in tmp:
-			if tmp[item].getLastTime() < time - self.__maxTime:
-				self.__delFailure(item)
-		self.__lock.release()
+		try:
+			self.__lock.acquire()
+			tmp = self.__failList.copy()
+			for item in tmp:
+				if tmp[item].getLastTime() < time - self.__maxTime:
+					self.__delFailure(item)
+		finally:
+			self.__lock.release()
 	
 	def __delFailure(self, ip):
 		if self.__failList.has_key(ip):
@@ -129,4 +139,3 @@ class FailManager:
 
 class FailManagerEmpty(Exception):
 	pass
-	
\ No newline at end of file

From 0b9c41c015a3274b44952e363edca3d9a79230d8 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 7 Mar 2007 20:47:41 +0000
Subject: [PATCH 500/549] - Removed actionstart and actionstop which are now
 obsolete

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@554 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/hostsdeny.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf
index 3282a4cb..c7b836fc 100644
--- a/config/action.d/hostsdeny.conf
+++ b/config/action.d/hostsdeny.conf
@@ -11,13 +11,13 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = touch <tmpfile>
+actionstart = 
 
 # Option:  actionend
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = rm -f <tmpfile>
+actionstop = 
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command

From 9cb7831758f1bdfbcec86eb71318958d17f1304a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 7 Mar 2007 20:53:37 +0000
Subject: [PATCH 501/549] - Catched socket.error raised by socket.accept on
 some platform - Modified some socket settings

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@555 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/ssocket.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/server/ssocket.py b/server/ssocket.py
index dfc69fca..f56f7199 100644
--- a/server/ssocket.py
+++ b/server/ssocket.py
@@ -68,7 +68,7 @@ class SSocket(Thread):
 		#self.__ssock.bind(("localhost", 2222))
 		self.__ssock.bind(sock)
 		# Become a server socket
-		self.__ssock.listen(5)
+		self.__ssock.listen(1)
 	
 	def run(self):
 		self.__isRunning = True
@@ -80,6 +80,9 @@ class SSocket(Thread):
 			except socket.timeout:
 				# Do nothing here
 				pass
+			except socket.error:
+				# Do nothing here
+				pass
 		self.__ssock.close()
 		# Remove socket
 		if os.path.exists(self.__socket):
@@ -122,7 +125,7 @@ class SocketWorker(Thread):
 	def __receive(sock):
 		msg = ''
 		while msg.rfind(SSocket.END_STRING) == -1:
-			chunk = sock.recv(6)
+			chunk = sock.recv(128)
 			if chunk == '':
 				raise RuntimeError, "socket connection broken"
 			msg = msg + chunk

From bde70ebc003e2afffc44a0f0ba2223730f85f356 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 7 Mar 2007 20:54:32 +0000
Subject: [PATCH 502/549] - Added more comments

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@556 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/action.py  | 88 +++++++++++++++++++++++++++++++++++++++++++++++
 server/actions.py | 23 +++++++++++++
 server/mytime.py  | 26 ++++++++++++++
 3 files changed, 137 insertions(+)

diff --git a/server/action.py b/server/action.py
index f7b5458e..10dfd479 100644
--- a/server/action.py
+++ b/server/action.py
@@ -54,18 +54,48 @@ class Action:
 		self.__actionStop = ''
 		logSys.debug("Created Action")
 	
+	##
+	# Sets the action name.
+	#
+	# @param name the name of the action
+	
 	def setName(self, name):
 		self.__name = name
 	
+	##
+	# Returns the action name.
+	#
+	# @return the name of the action
+	
 	def getName(self):
 		return self.__name
 	
+	##
+	# Sets a "CInfo".
+	#
+	# CInfo are statically defined properties. They can be definied by
+	# the user and are used to set e-mail addresses, port, host or
+	# anything that should not change during the life of the server.
+	#
+	# @param key the property name
+	# @param value the property value
+	
 	def setCInfo(self, key, value):
 		self.__cInfo[key] = value
 	
+	##
+	# Returns a "CInfo".
+	#
+	# @param key the property name
+	
 	def getCInfo(self, key):
 		return self.__cInfo[key]
 	
+	##
+	# Removes a "CInfo".
+	#
+	# @param key the property name
+	
 	def delCInfo(self, key):
 		del self.__cInfo[key]
 	
@@ -86,6 +116,14 @@ class Action:
 	def getActionStart(self):
 		return self.__actionStart
 	
+	##
+	# Executes the action "start" command.
+	#
+	# Replaces the tags in the action command with value of "cInfo"
+	# and executes the resulting command.
+	#
+	# @return True if the command succeeded
+	
 	def execActionStart(self):
 		startCmd = Action.replaceTag(self.__actionStart, self.__cInfo)
 		return Action.executeCmd(startCmd)
@@ -107,6 +145,11 @@ class Action:
 	def getActionBan(self):
 		return self.__actionBan
 	
+	##
+	# Executes the action "ban" command.
+	#
+	# @return True if the command succeeded
+	
 	def execActionBan(self, aInfo):
 		return self.__processCmd(self.__actionBan, aInfo)
 	
@@ -127,6 +170,11 @@ class Action:
 	def getActionUnban(self):
 		return self.__actionUnban
 	
+	##
+	# Executes the action "unban" command.
+	#
+	# @return True if the command succeeded
+	
 	def execActionUnban(self, aInfo):
 		return self.__processCmd(self.__actionUnban, aInfo)
 	
@@ -164,10 +212,25 @@ class Action:
 	def getActionStop(self):
 		return self.__actionStop
 	
+	##
+	# Executes the action "stop" command.
+	#
+	# Replaces the tags in the action command with value of "cInfo"
+	# and executes the resulting command.
+	#
+	# @return True if the command succeeded
+	
 	def execActionStop(self):
 		stopCmd = Action.replaceTag(self.__actionStop, self.__cInfo)
 		return Action.executeCmd(stopCmd)
 	
+	##
+	# Replaces tags in query with property values in aInfo.
+	#
+	# @param query the query string with tags
+	# @param aInfo the properties
+	# @return a string
+	
 	@staticmethod
 	def replaceTag(query, aInfo):
 		""" Replace tags in query
@@ -179,6 +242,19 @@ class Action:
 		string = string.replace("<br>", '\n')
 		return string
 	
+	##
+	# Executes a command with preliminary checks and substitutions.
+	#
+	# Before executing any commands, executes the "check" command first
+	# in order to check if prerequirements are met. If this check fails,
+	# it tries to restore a sane environnement before executing the real
+	# command.
+	# Replaces "aInfo" and "cInfo" in the query too.
+	#
+	# @param cmd The command to execute
+	# @param aInfo Dynamic properties
+	# @return True if the command succeeded
+	
 	def __processCmd(self, cmd, aInfo = None):
 		""" Executes an OS command.
 		"""
@@ -209,6 +285,18 @@ class Action:
 		
 		return Action.executeCmd(realCmd)
 
+	##
+	# Executes a command.
+	#
+	# We need a shell here because commands are mainly shell script. They
+	# contain pipe, redirection, etc.
+	# 
+	# @todo Force the use of bash!?
+	# @todo Kill the command after a given timeout
+	#
+	# @param realCmd the command to execute
+	# @return True if the command succeeded
+
 	@staticmethod
 	def executeCmd(realCmd):
 		logSys.debug(realCmd)
diff --git a/server/actions.py b/server/actions.py
index a18d2f4f..a332a46c 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -56,22 +56,45 @@ class Actions(JailThread):
 		## The ban manager.
 		self.__banManager = BanManager()
 	
+	##
+	# Adds an action.
+	#
+	# @param name The action name
+	
 	def addAction(self, name):
 		action = Action(name)
 		self.__actions.append(action)
 	
+	##
+	# Removes an action.
+	#
+	# @param name The action name
+	
 	def delAction(self, name):
 		for action in self.__actions:
 			if action.getName() == name:
 				self.__actions.remove(action)
 				break
 	
+	##
+	# Returns an action.
+	#
+	# Raises a KeyError exception if the action does not exist.
+	#
+	# @param name the action name
+	# @return the action
+	
 	def getAction(self, name):
 		for action in self.__actions:
 			if action.getName() == name:
 				return action
 		raise KeyError
 	
+	##
+	# Returns the last defined action.
+	#
+	# @return The last defined action.
+	
 	def getLastAction(self):
 		action = self.__actions.pop()
 		self.__actions.append(action)
diff --git a/server/mytime.py b/server/mytime.py
index 57fee41e..2b7dfd0a 100644
--- a/server/mytime.py
+++ b/server/mytime.py
@@ -26,14 +26,35 @@ __license__ = "GPL"
 
 import time
 
+##
+# MyTime class.
+#
+# This class is a wrapper around time.time()  and time.gmtime(). When
+# performing unit test, it is very useful to get a fixed value from these
+# functions.
+# Thus, time.time() and time.gmtime() should never be called directly.
+# This wrapper should be called instead. The API are equivalent.
+
 class MyTime:
 	
 	myTime = None
 	
+	##
+	# Sets the current time.
+	#
+	# Use None in order to always get the real current time.
+	#
+	# @param t the time to set or None
+	
 	@staticmethod
 	def setTime(t):
 		MyTime.myTime = t
 	
+	##
+	# Equivalent to time.time()
+	#
+	# @return time.time() if setTime was called with None
+	
 	@staticmethod
 	def time():
 		if MyTime.myTime == None:
@@ -41,6 +62,11 @@ class MyTime:
 		else:
 			return MyTime.myTime
 	
+	##
+	# Equivalent to time.gmtime()
+	#
+	# @return time.gmtime() if setTime was called with None
+	
 	@staticmethod
 	def gmtime():
 		if MyTime.myTime == None:

From 7f92be5f7f2bf115ec5c4984885531ad553d3632 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 7 Mar 2007 20:55:08 +0000
Subject: [PATCH 503/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@557 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 TODO | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/TODO b/TODO
index 87f64929..288a34e8 100644
--- a/TODO
+++ b/TODO
@@ -13,6 +13,8 @@ Legend:
 # partially done
 * done
 
+- Removed relative imports
+
 - Discuss where Fail2ban should be installed (/usr/share,
   /usr/lib/python/site-packages/, etc)
 
@@ -22,7 +24,7 @@ Legend:
 - Add timeout to external commands (signal alarm, watchdog
   thread, etc)
 
-- New backend: pynotify
+- New backend: pyinotify
 
 - Uniformize filters and actions name. Use the software name
   (openssh, postfix, proftp)

From 64226d09c0a81fecee68e9e7602b054ebb701e39 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 7 Mar 2007 21:32:33 +0000
Subject: [PATCH 504/549] - Improved failregex a bit - Added TrackBack/1.02

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@558 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/apache-badbots.conf | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/config/filter.d/apache-badbots.conf b/config/filter.d/apache-badbots.conf
index 4feb70d7..a700c863 100644
--- a/config/filter.d/apache-badbots.conf
+++ b/config/filter.d/apache-badbots.conf
@@ -5,18 +5,19 @@
 #
 # Author: Yaroslav Halchenko
 #
-#
 
 [Definition]
-badbotscustom = EmailCollector|WebEMailExtrac
+
+badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02
 badbots = atSpider/1\.0|autoemailspider|China Local Browse 2\.6|ContentSmartz|DataCha0s/2\.0|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|MVAClient|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|sogou spider|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|WebVulnCrawl\.blogspot\.com/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
 
 # Option:  failregex
-# Notes.:  Regexp to catch known spambots and software alike. Please verify that
-#          it is your intent to block IPs which were driven by abovementioned bots
+# Notes.:  Regexp to catch known spambots and software alike. Please verify
+#          that it is your intent to block IPs which were driven by
+#          abovementioned bots.
 # Values:  TEXT
 #
-failregex = ^(?P<host>\S*) -.*"GET.*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
+failregex = ^<HOST> -.*"(GET|POST).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From a85f562855422e344b207254a81b2241c7e1ed59 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 13 Mar 2007 23:18:54 +0000
Subject: [PATCH 505/549] =?UTF-8?q?-=20Updated=20Gentoo=20script.=20Thanks?=
 =?UTF-8?q?=20to=20Rapha=C3=ABl=20Marichez?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@559 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 files/gentoo-confd | 8 ++++++++
 files/gentoo-initd | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 files/gentoo-confd

diff --git a/files/gentoo-confd b/files/gentoo-confd
new file mode 100644
index 00000000..00d19f8b
--- /dev/null
+++ b/files/gentoo-confd
@@ -0,0 +1,8 @@
+# Config file for /etc/init.d/fail2ban
+#
+# For information on options, see "/usr/bin/fail2ban-client -h".
+
+FAIL2BAN_OPTIONS=""
+
+# Force execution of the server even if the socket already exists:
+#FAIL2BAN_OPTIONS="-x"
diff --git a/files/gentoo-initd b/files/gentoo-initd
index 6041f243..0b0878ae 100755
--- a/files/gentoo-initd
+++ b/files/gentoo-initd
@@ -21,7 +21,7 @@
 
 opts="start stop restart reload showlog"
 
-FAIL2BAN="/usr/bin/fail2ban-client"
+FAIL2BAN="/usr/bin/fail2ban-client ${FAIL2BAN_OPTIONS}"
 
 depend() {
 	need net

From ee234d424c07281989fe6e8b94c96f54244c512e Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 19 Mar 2007 20:32:28 +0000
Subject: [PATCH 506/549] - Added pure-ftpd filter. Thanks to Yaroslav
 Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@560 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST                       | 23 ++++++++++++++---------
 config/filter.d/pure-ftpd.conf | 29 +++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 9 deletions(-)
 create mode 100644 config/filter.d/pure-ftpd.conf

diff --git a/MANIFEST b/MANIFEST
index d49b19bc..83d7ae6a 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -60,26 +60,30 @@ common/__init__.py
 common/version.py
 common/protocol.py
 config/jail.conf
-config/filter.d/postfix.conf
-config/filter.d/vsftpd.conf
 config/filter.d/apache-auth.conf
+config/filter.d/apache-badbots.conf
 config/filter.d/apache-noscript.conf
-config/filter.d/qmail.conf
-config/filter.d/couriersmtp.conf
 config/filter.d/courierlogin.conf
-config/filter.d/sshd.conf
+config/filter.d/couriersmtp.conf
+config/filter.d/exim.conf
+config/filter.d/postfix.conf
 config/filter.d/proftpd.conf
+config/filter.d/pure-ftpd.conf
+config/filter.d/qmail.conf
 config/filter.d/sasl.conf
+config/filter.d/sshd.conf
+config/filter.d/sshd-ddos.conf
+config/filter.d/vsftpd.conf
 config/filter.d/wuftpd.conf
+config/action.d/hostsdeny.conf
+config/action.d/ipfw.conf
 config/action.d/iptables.conf
 config/action.d/iptables-multiport.conf
 config/action.d/iptables-new.conf
-config/action.d/ipfw.conf
-config/action.d/mail-whois.conf
-config/action.d/mail-whois-lines.conf
 config/action.d/mail.conf
 config/action.d/mail-buffered.conf
-config/action.d/hostsdeny.conf
+config/action.d/mail-whois.conf
+config/action.d/mail-whois-lines.conf
 config/action.d/shorewall.conf
 config/fail2ban.conf
 man/fail2ban-client.1
@@ -90,6 +94,7 @@ man/fail2ban-regex.1
 man/fail2ban-regex.h2m
 man/generate-man
 files/gentoo-initd
+files/gentoo-confd
 files/redhat-initd
 files/cacti/fail2ban_stats.sh
 files/cacti/cacti_host_template_fail2ban.xml
diff --git a/config/filter.d/pure-ftpd.conf b/config/filter.d/pure-ftpd.conf
new file mode 100644
index 00000000..31557468
--- /dev/null
+++ b/config/filter.d/pure-ftpd.conf
@@ -0,0 +1,29 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified: Yaroslav Halchenko for pure-ftpd
+#
+# $Revision: 3$
+#
+
+[Definition]
+
+# Error message specified in multiple languages
+__errmsg = (?:Authentication failed for user|Erreur d'authentification pour l'utilisateur)
+
+#
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile. The
+#         host must be matched by a group named "host". The tag "<HOST>" can
+#         be used for standard IP/hostname matching and is only an alias for
+#         (?:::f{4,6}:)?(?P<host>\S+)
+# Values: TEXT
+#
+failregex = pure-ftpd: (.+?@<HOST>) \[WARNING\] %(__errmsg)s \[.+\]$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
+

From bf72fe7188025c2e423e3bd383c02292e72a423f Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 21 Mar 2007 21:44:07 +0000
Subject: [PATCH 507/549] - Updated for 0.7.8

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@561 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG         | 4 ++--
 README            | 6 +++---
 common/version.py | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 72e7615a..29302ebe 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.7)                           2007/02/08
+Fail2Ban (version 0.7.8)                           2007/03/21
 =============================================================
 
-ver. 0.?.? (2007/??/??) - ???
+ver. 0.7.8 (2007/03/21) - release candidate
 ----------
 - Fixed asctime pattern in datedetector.py
 - Added new filters/actions. Thanks to Yaroslav Halchenko
diff --git a/README b/README
index 0c798e89..d73b72d9 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.7)                           2007/02/08
+Fail2Ban (version 0.7.8)                           2007/03/21
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -28,8 +28,8 @@ Optional:
 
 To install, just do:
 
-> tar xvfj fail2ban-0.7.7.tar.bz2
-> cd fail2ban-0.7.7
+> tar xvfj fail2ban-0.7.8.tar.bz2
+> cd fail2ban-0.7.8
 > python setup.py install
 
 This will install Fail2Ban into /usr/share/fail2ban. The
diff --git a/common/version.py b/common/version.py
index 22f09605..e5f3d7c3 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.7-SVN"
+version = "0.7.8"

From c768980784fb87fcde0d40ed56fcd2bf53d8914a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 22 Mar 2007 22:17:41 +0000
Subject: [PATCH 508/549] - Close opened handlers. Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@563 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/server.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/server/server.py b/server/server.py
index aa481045..f49a967d 100644
--- a/server/server.py
+++ b/server/server.py
@@ -326,15 +326,18 @@ class Server:
 			else:
 				# Target should be a file
 				try:
-					open(target, "a")
+					open(target, "a").close()
 					hdlr = logging.FileHandler(target)
 				except IOError:
 					logSys.error("Unable to log to " + target)
 					logSys.info("Logging to previous target " + self.__logTarget)
 					return False
 			self.__logTarget = target
-			# Remove previous handler
-			logging.getLogger("fail2ban").handlers = []
+			# Removes previous handlers
+			for handler in logging.getLogger("fail2ban").handlers:
+				# Closes the handler.
+				handler.close()
+				logging.getLogger("fail2ban").removeHandler(handler)
 			# set a format which is simpler for console use
 			formatter = logging.Formatter("%(asctime)s %(name)-16s: %(levelname)-6s %(message)s")
 			# tell the handler to use this format

From fddce1cbdc3c2ce95b7155dc27fcb524ec3c2119 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 22 Mar 2007 22:18:46 +0000
Subject: [PATCH 509/549] - Clean up resources. Does not seem to free resources
 correctly. Gamin bug???

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@564 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/filtergamin.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server/filtergamin.py b/server/filtergamin.py
index d0f8adcb..bb5b00b3 100644
--- a/server/filtergamin.py
+++ b/server/filtergamin.py
@@ -117,5 +117,15 @@ class FilterGamin(Filter):
 				time.sleep(self.getSleepTime())
 			else:
 				time.sleep(self.getSleepTime())
+		# Cleanup Gamin
+		self.__cleanup()
 		logSys.debug(self.jail.getName() + ": filter terminated")
 		return True
+
+	##
+	# Desallocates the resources used by Gamin.
+
+	def __cleanup(self):
+		for path in Filter.getLogPath(self):
+			self.monitor.stop_watch(path)
+		del self.monitor

From f260372bb2005508d083ecc67d672ddcc4ff686a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 22 Mar 2007 22:20:36 +0000
Subject: [PATCH 510/549] - Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@565 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG         | 6 +++++-
 common/version.py | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 29302ebe..f2a5b6bc 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,13 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.8)                           2007/03/21
+Fail2Ban (version 0.?.?)                           2007/??/??
 =============================================================
 
+ver. 0.?.? (2007/??/??) - ???
+----------
+- Close opened handlers. Thanks to Yaroslav Halchenko
+
 ver. 0.7.8 (2007/03/21) - release candidate
 ----------
 - Fixed asctime pattern in datedetector.py
diff --git a/common/version.py b/common/version.py
index e5f3d7c3..223a4cb8 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.8"
+version = "0.7.8-SVN"

From b40b9d88d290d1b8422e92f42b1e40385ef6712d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 26 Mar 2007 21:08:09 +0000
Subject: [PATCH 511/549] - Added a new line before "Regards,"

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@566 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/mail-buffered.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/action.d/mail-buffered.conf b/config/action.d/mail-buffered.conf
index 6be60a63..fb2eb4da 100644
--- a/config/action.d/mail-buffered.conf
+++ b/config/action.d/mail-buffered.conf
@@ -54,7 +54,7 @@ actionban = echo `date`": <ip> (<failures> failures)" >> <tmpfile>
                 echo -en "Hi,\n
                 These hosts have been banned by Fail2Ban.\n
                 `cat <tmpfile>`
-                Regards,\n
+                \nRegards,\n
                 Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary" <dest>
                 rm <tmpfile>
             fi

From 090518ddafe77e6b586ca555a62ff5064ea1925a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 26 Mar 2007 21:17:31 +0000
Subject: [PATCH 512/549] - Fixed "reload" bug. Many many thanks to Yaroslav
 Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@567 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG             | 1 +
 server/actions.py     | 4 ++--
 server/filter.py      | 2 +-
 server/filtergamin.py | 2 +-
 server/filterpoll.py  | 2 +-
 server/jail.py        | 8 ++++----
 server/jailthread.py  | 2 +-
 server/server.py      | 8 ++++----
 8 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index f2a5b6bc..52d7da11 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -10,6 +10,7 @@ Fail2Ban (version 0.?.?)                           2007/??/??
 ver. 0.?.? (2007/??/??) - ???
 ----------
 - Close opened handlers. Thanks to Yaroslav Halchenko
+- Fixed "reload" bug. Many many thanks to Yaroslav Halchenko
 
 ver. 0.7.8 (2007/03/21) - release candidate
 ----------
diff --git a/server/actions.py b/server/actions.py
index a332a46c..06f15ec6 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -125,10 +125,10 @@ class Actions(JailThread):
 	# @return True when the thread exits nicely
 	
 	def run(self):
+		self.setActive(True)
 		for action in self.__actions:
 			action.execActionStart()
-		self.setActive(True)
-		while self.isActive():
+		while self._isActive():
 			if not self.getIdle():
 				#logSys.debug(self.jail.getName() + ": action")
 				ret = self.__checkBan()
diff --git a/server/filter.py b/server/filter.py
index ed63299d..131c6d02 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -385,7 +385,7 @@ class Filter(JailThread):
 		self.__setFilePos()
 		lastLine = None
 		for line in self.__crtHandler:
-			if not self.isActive():
+			if not self._isActive():
 				# The jail has been stopped
 				break
 			try:
diff --git a/server/filtergamin.py b/server/filtergamin.py
index bb5b00b3..37b8d488 100644
--- a/server/filtergamin.py
+++ b/server/filtergamin.py
@@ -99,7 +99,7 @@ class FilterGamin(Filter):
 
 	def run(self):
 		self.setActive(True)
-		while self.isActive():
+		while self._isActive():
 			if not self.getIdle():
 				# We cannot block here because we want to be able to
 				# exit.
diff --git a/server/filterpoll.py b/server/filterpoll.py
index 3afd587f..a13f9e71 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -93,7 +93,7 @@ class FilterPoll(Filter):
 
 	def run(self):
 		self.setActive(True)
-		while self.isActive():
+		while self._isActive():
 			if not self.getIdle():
 				# Get file modification
 				for f in self.getLogPath():
diff --git a/server/jail.py b/server/jail.py
index 00d0b96c..363097a6 100644
--- a/server/jail.py
+++ b/server/jail.py
@@ -89,10 +89,10 @@ class Jail:
 		self.__filter.join()
 		self.__action.join()
 	
-	def isActive(self):
-		isActive0 = self.__filter.isActive()
-		isActive1 = self.__action.isActive()
-		return isActive0 or isActive1
+	def isAlive(self):
+		isAlive0 = self.__filter.isAlive()
+		isAlive1 = self.__action.isAlive()
+		return isAlive0 or isAlive1
 	
 	def setIdle(self, value):
 		self.__filter.setIdle(value)
diff --git a/server/jailthread.py b/server/jailthread.py
index 8a3c6d30..44667ff0 100644
--- a/server/jailthread.py
+++ b/server/jailthread.py
@@ -105,7 +105,7 @@ class JailThread(Thread):
 	# Check if the filter thread is running.
 	# @return True if the thread is running
 	
-	def isActive(self):
+	def _isActive(self):
 		return self.__isRunning
 	
 	##
diff --git a/server/server.py b/server/server.py
index f49a967d..832cfaa7 100644
--- a/server/server.py
+++ b/server/server.py
@@ -96,7 +96,7 @@ class Server:
 	def startJail(self, name):
 		try:
 			self.__lock.acquire()
-			if not self.isActive(name):
+			if not self.isAlive(name):
 				self.__jails.get(name).start()
 		finally:
 			self.__lock.release()
@@ -104,7 +104,7 @@ class Server:
 	def stopJail(self, name):
 		try:
 			self.__lock.acquire()
-			if self.isActive(name):
+			if self.isAlive(name):
 				self.__jails.get(name).stop()
 				self.delJail(name)
 		finally:
@@ -118,8 +118,8 @@ class Server:
 		finally:
 			self.__lock.release()
 	
-	def isActive(self, name):
-		return self.__jails.get(name).isActive()
+	def isAlive(self, name):
+		return self.__jails.get(name).isAlive()
 	
 	def setIdleJail(self, name, value):
 		self.__jails.get(name).setIdle(value)

From 6145a88fe872aee1c78e6a2541db472c33b823da Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 1 Apr 2007 20:42:05 +0000
Subject: [PATCH 513/549] - Added date format for asctime without year

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@568 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG              | 1 +
 server/datedetector.py | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index 52d7da11..8ad146ee 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -11,6 +11,7 @@ ver. 0.?.? (2007/??/??) - ???
 ----------
 - Close opened handlers. Thanks to Yaroslav Halchenko
 - Fixed "reload" bug. Many many thanks to Yaroslav Halchenko
+- Added date format for asctime without year
 
 ver. 0.7.8 (2007/03/21) - release candidate
 ----------
diff --git a/server/datedetector.py b/server/datedetector.py
index 6c475c75..6b9986f5 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -56,6 +56,12 @@ class DateDetector:
 			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}")
 			template.setPattern("%a %b %d %H:%M:%S %Y")
 			self.__templates.append(template)
+			# asctime without year
+			template = DateStrptime()
+			template.setName("Weekday Month Day Hour:Minute:Second")
+			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+			template.setPattern("%a %b %d %H:%M:%S")
+			self.__templates.append(template)
 			# simple date
 			template = DateStrptime()
 			template.setName("Year/Month/Day Hour:Minute:Second")

From ac54c8b4f1ad6c0ca0d5de014f474f596d898f66 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 18 Apr 2007 20:22:54 +0000
Subject: [PATCH 514/549] - Modified filters config. Thanks to Michael C.
 Haller

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@569 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                        | 1 +
 config/filter.d/apache-auth.conf | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 8ad146ee..9dab34e6 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -12,6 +12,7 @@ ver. 0.?.? (2007/??/??) - ???
 - Close opened handlers. Thanks to Yaroslav Halchenko
 - Fixed "reload" bug. Many many thanks to Yaroslav Halchenko
 - Added date format for asctime without year
+- Modified filters config. Thanks to Michael C. Haller
 
 ver. 0.7.8 (2007/03/21) - release candidate
 ----------
diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 87d6edef..20553d91 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -14,7 +14,9 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = [[]client <HOST>[]] user .*(?:: authentication failure|not found)
+failregex = [[]client <HOST>[]] user .* authentication failure
+            [[]client <HOST>[]] user .* not found
+            [[]client <HOST>[]] user .* password mismatch
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From bfab0409a2012c0b06d6b2ab0f3c1585f7748e3b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 19 Apr 2007 21:43:45 +0000
Subject: [PATCH 515/549] - Replaced -d with -f. We are looking for a file, not
 a directory

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@570 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                          | 1 +
 config/action.d/mail-buffered.conf | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 9dab34e6..eedf5848 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -13,6 +13,7 @@ ver. 0.?.? (2007/??/??) - ???
 - Fixed "reload" bug. Many many thanks to Yaroslav Halchenko
 - Added date format for asctime without year
 - Modified filters config. Thanks to Michael C. Haller
+- Fixed a small bug in mail-buffered.conf
 
 ver. 0.7.8 (2007/03/21) - release candidate
 ----------
diff --git a/config/action.d/mail-buffered.conf b/config/action.d/mail-buffered.conf
index fb2eb4da..973d48ec 100644
--- a/config/action.d/mail-buffered.conf
+++ b/config/action.d/mail-buffered.conf
@@ -21,7 +21,7 @@ actionstart = echo -en "Hi,\n
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = if [ -d <tmpfile> ]; then
+actionstop = if [ -f <tmpfile> ]; then
                  echo -en "Hi,\n
                  These hosts have been banned by Fail2Ban.\n
                  `cat <tmpfile>`

From b813cc58b9a7d8deb8a81daba07a6fc0b7124a16 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 19 Apr 2007 21:57:27 +0000
Subject: [PATCH 516/549] - Prepared release 0.7.9

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@571 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG             | 4 ++--
 README                | 9 +++++----
 common/version.py     | 2 +-
 man/fail2ban-client.1 | 4 ++--
 man/fail2ban-regex.1  | 4 ++--
 man/fail2ban-server.1 | 4 ++--
 6 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index eedf5848..c273e929 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.?.?)                           2007/??/??
+Fail2Ban (version 0.7.9)                           2007/04/19
 =============================================================
 
-ver. 0.?.? (2007/??/??) - ???
+ver. 0.7.9 (2007/04/19) - release candidate
 ----------
 - Close opened handlers. Thanks to Yaroslav Halchenko
 - Fixed "reload" bug. Many many thanks to Yaroslav Halchenko
diff --git a/README b/README
index d73b72d9..22262f4b 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.8)                           2007/03/21
+Fail2Ban (version 0.7.9)                           2007/04/19
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -28,8 +28,8 @@ Optional:
 
 To install, just do:
 
-> tar xvfj fail2ban-0.7.8.tar.bz2
-> cd fail2ban-0.7.8
+> tar xvfj fail2ban-0.7.9.tar.bz2
+> cd fail2ban-0.7.9
 > python setup.py install
 
 This will install Fail2Ban into /usr/share/fail2ban. The
@@ -73,7 +73,8 @@ Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
 Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
 Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
 Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
-René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch
+René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch,
+Michael C. Haller
 
 License:
 --------
diff --git a/common/version.py b/common/version.py
index 223a4cb8..104ae403 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.8-SVN"
+version = "0.7.9"
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 8b396854..2c4f7205 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,11 +1,11 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "February 2007" "fail2ban-client v0.7.7" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "April 2007" "fail2ban-client v0.7.9" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH DESCRIPTION
 [?1034hUsage: ../fail2ban\-client [OPTIONS] <COMMAND>
 .PP
-Fail2Ban v0.7.7 reads log file that contains password failure report
+Fail2Ban v0.7.9 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index d9e8ef0f..1d772cbb 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-REGEX "1" "February 2007" "fail2ban-regex v0.7.7" "User Commands"
+.TH FAIL2BAN-REGEX "1" "April 2007" "fail2ban-regex v0.7.9" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
 .B fail2ban-regex
 [\fIOPTIONS\fR] \fI<LOG> <REGEX>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.7 reads log file that contains password failure report
+Fail2Ban v0.7.9 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 This tools can test regular expressions for "fail2ban".
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index dc79c090..46efd735 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "February 2007" "fail2ban-server v0.7.7" "User Commands"
+.TH FAIL2BAN-SERVER "1" "April 2007" "fail2ban-server v0.7.9" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.7.7 reads log file that contains password failure report
+Fail2Ban v0.7.9 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with

From 76c5bd80e594523552fb5993bf1911a144690759 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 1 May 2007 22:41:41 +0000
Subject: [PATCH 517/549] - Updated to SVN version

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@573 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 common/version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/common/version.py b/common/version.py
index 104ae403..795849fd 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.9"
+version = "0.7.9-SVN"

From 1e767cd8e3a1d5ad606d1043ba2cdd6a97965f6b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 1 May 2007 22:42:10 +0000
Subject: [PATCH 518/549] - Fixed RedHat init script. Thanks to Jonathan
 Underwood

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@574 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG          |  6 +++++-
 README             |  2 +-
 files/redhat-initd | 11 +++++++----
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index c273e929..f3a6f7f0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,13 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.9)                           2007/04/19
+Fail2Ban (version 0.8.0)                           2007/05/??
 =============================================================
 
+ver. 0.8.0 (2007/05/??) - stable
+----------
+- Fixed RedHat init script. Thanks to Jonathan Underwood
+
 ver. 0.7.9 (2007/04/19) - release candidate
 ----------
 - Close opened handlers. Thanks to Yaroslav Halchenko
diff --git a/README b/README
index 22262f4b..8eacfebe 100644
--- a/README
+++ b/README
@@ -74,7 +74,7 @@ Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
 Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
 Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
 René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch,
-Michael C. Haller
+Michael C. Haller, Jonathan Underwood
 
 License:
 --------
diff --git a/files/redhat-initd b/files/redhat-initd
index 12867615..205294cf 100755
--- a/files/redhat-initd
+++ b/files/redhat-initd
@@ -20,14 +20,14 @@ FAIL2BAN="/usr/bin/fail2ban-client"
 RETVAL=0
 
 getpid() {
-        #pid=`ps -ef | grep fail2ban-|grep -v grep|grep -v bash|awk '{print $2}'`
-        pid=`ps -ef | grep fail2ban-|grep -v grep|awk '{print $2}'`
+    pid=`ps -ef | grep fail2ban-|grep -v grep|awk '{print $2}'`
 }
 
 start() {
     echo -n $"Starting fail2ban: "
     getpid
     if [ -z "$pid" ]; then
+	rm -rf /tmp/fail2ban.sock # in case of unclean shutdown
         $FAIL2BAN start > /dev/null
         RETVAL=$?
     fi
@@ -47,7 +47,6 @@ stop() {
     RETVAL=$?
     if [ -n "$pid" ]; then
         $FAIL2BAN stop > /dev/null
-    fi
     sleep 1
     getpid
     if [ -z "$pid" ]; then
@@ -56,6 +55,9 @@ stop() {
     else
         echo_failure
     fi
+    else
+        echo_failure
+    fi
     echo
     return $RETVAL
 }
@@ -72,13 +74,14 @@ case "$1" in
         getpid
         if [ -n "$pid" ]; then
                 echo "Fail2ban (pid $pid) is running..."
+                $FAIL2BAN status
         else
                 RETVAL=1
                 echo "Fail2ban is stopped"
         fi
         ;;
   restart)
-  		stop
+        stop
         start
         ;;
   *)

From a4c9798b186270144b51bb3080eee2c791e318b2 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 3 May 2007 20:03:13 +0000
Subject: [PATCH 519/549] - Added Solaris 10 files. Thanks to Hanno 'Rince'
 Wagner

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@575 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                  |  1 +
 README                     |  2 +-
 files/solaris-fail2ban.xml | 74 ++++++++++++++++++++++++++++++++++++++
 files/solaris-svc-fail2ban | 47 ++++++++++++++++++++++++
 4 files changed, 123 insertions(+), 1 deletion(-)
 create mode 100644 files/solaris-fail2ban.xml
 create mode 100644 files/solaris-svc-fail2ban

diff --git a/CHANGELOG b/CHANGELOG
index f3a6f7f0..0ba11dcb 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -10,6 +10,7 @@ Fail2Ban (version 0.8.0)                           2007/05/??
 ver. 0.8.0 (2007/05/??) - stable
 ----------
 - Fixed RedHat init script. Thanks to Jonathan Underwood
+- Added Solaris 10 files. Thanks to Hanno 'Rince' Wagner
 
 ver. 0.7.9 (2007/04/19) - release candidate
 ----------
diff --git a/README b/README
index 8eacfebe..dea0b5ee 100644
--- a/README
+++ b/README
@@ -74,7 +74,7 @@ Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
 Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
 Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
 René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch,
-Michael C. Haller, Jonathan Underwood
+Michael C. Haller, Jonathan Underwood, Hanno 'Rince' Wagner
 
 License:
 --------
diff --git a/files/solaris-fail2ban.xml b/files/solaris-fail2ban.xml
new file mode 100644
index 00000000..c6ff0159
--- /dev/null
+++ b/files/solaris-fail2ban.xml
@@ -0,0 +1,74 @@
+<?xml version='1.0'?>
+<!DOCTYPE service_bundle SYSTEM '/usr/share/lib/xml/dtd/service_bundle.dtd.1'>
+<!--
+	Hanno 'Rince' Wagner 03 2007
+	Service manifest for fail2ban
+	E-Mail: wagner@rince.de
+-->
+
+<service_bundle type='manifest' name='fail2ban:fail2ban'>
+
+<service
+	name='network/fail2ban'
+	type='service'
+	version='1'>
+	<create_default_instance enabled='false' />
+	<single_instance />
+
+	<dependency name='fs'
+		grouping='require_all'
+		restart_on='none'
+		type='service'>
+		<service_fmri value='svc:/system/filesystem/local' />
+	</dependency>
+
+	<dependency name='net'
+		grouping='require_all'
+		restart_on='none'
+		type='service'>
+		<service_fmri value='svc:/network/loopback' />
+	</dependency>
+
+
+	<exec_method
+		type='method'
+		name='start'
+		exec='/lib/svc/method/svc-fail2ban start'
+		timeout_seconds='-1'>
+		<method_context>
+			<method_credential user='root' group='root' />
+		</method_context>
+	</exec_method>
+
+	<exec_method
+		type='method'
+		name='stop'
+		exec='/lib/svc/method/svc-fail2ban stop'
+		timeout_seconds='-1'>
+	</exec_method>
+
+        <exec_method
+                type='method'
+                name='reload'
+                exec='/lib/svc/method/svc-fail2ban reload'
+                timeout_seconds='-1'>
+        </exec_method>
+
+       <exec_method
+                type='method'
+                name='refresh'
+                exec='/lib/svc/method/svc-fail2ban refresh'
+                timeout_seconds='-1'>
+        </exec_method>
+
+
+	<exec_method
+		type='method'
+		name='restart'
+		exec='/lib/svc/method/svc-fail2ban restart'
+		timeout_seconds='-1'>
+	</exec_method>
+
+</service>
+
+</service_bundle>
diff --git a/files/solaris-svc-fail2ban b/files/solaris-svc-fail2ban
new file mode 100644
index 00000000..9f75f9f6
--- /dev/null
+++ b/files/solaris-svc-fail2ban
@@ -0,0 +1,47 @@
+#!/usr/bin/bash -e
+#
+# fail2ban		This init.d script is used to start fail2ban.
+# (C) by Hanno Wagner <wagner@rince.de>, License is GPL
+ 
+#set -x
+
+. /lib/svc/share/smf_include.sh
+
+set -e
+
+
+F2B_CONF="/etc/fail2ban/fail2ban.conf"
+if [ -n "$2" ] && [ -f "$F2B_CONF" ]; then
+  F2B_CONF="$2"
+fi
+
+ENV="/usr/bin/env -i LANG=C PATH=/usr/local/bin:/usr/bin:/bin:/opt/sfw/bin:/usr/sfw/bin"
+
+case $1 in
+	start)
+		[ -f /etc/fail2ban.conf ] || touch /etc/fail2ban.conf
+		echo "Starting fail2ban-server with $F2B_CONF"
+		eval $ENV /usr/local/bin/fail2ban-client start &
+	;;
+	stop)
+		echo "Stopping fail2ban-server with $F2B_CONF"
+		eval $ENV /usr/local/bin/fail2ban-client stop &
+	;;
+	reload | refresh )
+		echo "Reloading fail2ban-server with $F2B_CONF"
+		eval $ENV /usr/local/bin/fail2ban-client reload &
+	;;
+	restart | force-reload)
+		echo "Forcing reload of fail2ban-server with $F2B_CONF"
+		eval $ENV /usr/local/bin/fail2ban-client stop &
+		sleep 2
+		eval $ENV /usr/local/bin/fail2ban-client start &
+	;;
+	status)
+		/usr/local/bin/fail2ban-client status &
+	;;
+	*)
+		echo "Usage: /lib/svc/method/svc-fail2ban start|stop|status|refresh|restart|reload|force-reload" >&2
+		exit 2
+	;;
+esac

From c045a20152862e49bff2d8e0d980ee5db199f38b Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 3 May 2007 20:04:44 +0000
Subject: [PATCH 520/549] - Added Solaris 10 files

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@576 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MANIFEST b/MANIFEST
index 83d7ae6a..60f13e54 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -96,6 +96,8 @@ man/generate-man
 files/gentoo-initd
 files/gentoo-confd
 files/redhat-initd
+files/solaris-fail2ban.xml
+files/solaris-svc-fail2ban
 files/cacti/fail2ban_stats.sh
 files/cacti/cacti_host_template_fail2ban.xml
 files/cacti/README

From b4586138db5105195ca74b1290893f89633f3c01 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 3 May 2007 20:26:56 +0000
Subject: [PATCH 521/549] - Added common/ source directory

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@577 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 doc/Doxyfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/Doxyfile b/doc/Doxyfile
index 1c571f36..53d3bcd0 100644
--- a/doc/Doxyfile
+++ b/doc/Doxyfile
@@ -459,7 +459,7 @@ WARN_LOGFILE           =
 # directories like "/usr/src/myproject". Separate the files or directories 
 # with spaces.
 
-INPUT                  = ../server ../client ../testcases ../
+INPUT                  = ../common ../server ../client ../testcases ../
 
 # If the value of the INPUT tag contains directories, you can use the 
 # FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp 

From 128515ddf1f2e937549e9f68df56f76b4cfeae2d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 3 May 2007 20:30:28 +0000
Subject: [PATCH 522/549] - 0.8 is finally here :)

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@578 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG             |  4 ++--
 README                | 11 +++++------
 common/version.py     |  2 +-
 man/fail2ban-client.1 |  4 ++--
 man/fail2ban-regex.1  |  4 ++--
 man/fail2ban-server.1 |  4 ++--
 6 files changed, 14 insertions(+), 15 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 0ba11dcb..94a7b411 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.8.0)                           2007/05/??
+Fail2Ban (version 0.8.0)                           2007/05/03
 =============================================================
 
-ver. 0.8.0 (2007/05/??) - stable
+ver. 0.8.0 (2007/05/03) - stable
 ----------
 - Fixed RedHat init script. Thanks to Jonathan Underwood
 - Added Solaris 10 files. Thanks to Hanno 'Rince' Wagner
diff --git a/README b/README
index dea0b5ee..7a4aa86f 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.7.9)                           2007/04/19
+Fail2Ban (version 0.8.0)                           2007/05/03
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -28,16 +28,15 @@ Optional:
 
 To install, just do:
 
-> tar xvfj fail2ban-0.7.9.tar.bz2
-> cd fail2ban-0.7.9
+> tar xvfj fail2ban-0.8.0.tar.bz2
+> cd fail2ban-0.8.0
 > python setup.py install
 
 This will install Fail2Ban into /usr/share/fail2ban. The
 executable scripts are placed into /usr/bin.
 
-Gentoo: ebuilds are available on the website.
-Debian: Fail2Ban is in Debian unstable.
-RedHat: packages are available on the website.
+It is possible that Fail2ban is already packaged for your
+distribution. In this case, you should use it.
 
 Fail2Ban should be correctly installed now. Just type:
 
diff --git a/common/version.py b/common/version.py
index 795849fd..929c2225 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.7.9-SVN"
+version = "0.8.0"
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 2c4f7205..3dd4111b 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,11 +1,11 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "April 2007" "fail2ban-client v0.7.9" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "May 2007" "fail2ban-client v0.8.0" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH DESCRIPTION
 [?1034hUsage: ../fail2ban\-client [OPTIONS] <COMMAND>
 .PP
-Fail2Ban v0.7.9 reads log file that contains password failure report
+Fail2Ban v0.8.0 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index 1d772cbb..a7fae822 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-REGEX "1" "April 2007" "fail2ban-regex v0.7.9" "User Commands"
+.TH FAIL2BAN-REGEX "1" "May 2007" "fail2ban-regex v0.8.0" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
 .B fail2ban-regex
 [\fIOPTIONS\fR] \fI<LOG> <REGEX>\fR
 .SH DESCRIPTION
-Fail2Ban v0.7.9 reads log file that contains password failure report
+Fail2Ban v0.8.0 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 This tools can test regular expressions for "fail2ban".
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index 46efd735..d8ed93cd 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "April 2007" "fail2ban-server v0.7.9" "User Commands"
+.TH FAIL2BAN-SERVER "1" "May 2007" "fail2ban-server v0.8.0" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.7.9 reads log file that contains password failure report
+Fail2Ban v0.8.0 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with

From 1e2ddec48592ff7ff7abe2ce4cef742deec2853c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Jun 2007 21:29:18 +0000
Subject: [PATCH 524/549] - Fixed vulnerability in sshd.conf. Thanks to Daniel
 B. Cid

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@587 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                 | 6 +++++-
 config/filter.d/sshd.conf | 9 +++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 94a7b411..67f301bc 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,13 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.8.0)                           2007/05/03
+Fail2Ban (version 0.8.1)                           2007/??/??
 =============================================================
 
+ver. 0.8.1 (2007/??/??) - stable
+----------
+- Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
+
 ver. 0.8.0 (2007/05/03) - stable
 ----------
 - Fixed RedHat init script. Thanks to Jonathan Underwood
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index fa1d88ad..39416f43 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -14,10 +14,11 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = Authentication failure for .* from <HOST>
-            Failed [-/\w]+ for .* from <HOST>
-            ROOT LOGIN REFUSED .* FROM <HOST>
-            [iI](?:llegal|nvalid) user .* from <HOST>
+failregex = Authentication failure for .* from <HOST>$
+            Failed [-/\w]+ for .* from <HOST>$
+            ROOT LOGIN REFUSED .* FROM <HOST>$
+            [iI](?:llegal|nvalid) user .* from <HOST>$
+            User .* from <HOST> not allowed because not listed in AllowUsers$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 6d129491f7db5f3ac2688be35e96ea913932a241 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Jun 2007 21:43:25 +0000
Subject: [PATCH 525/549] - Expand <HOST> in ignoreregex. Thanks to Yaroslav
 Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@589 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/failregex.py | 4 +---
 server/regex.py     | 3 +++
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/server/failregex.py b/server/failregex.py
index 275380b9..9889ca67 100644
--- a/server/failregex.py
+++ b/server/failregex.py
@@ -40,9 +40,7 @@ class FailRegex(Regex):
 	# avoid construction of invalid object.
 	# @param value the regular expression
 	
-	def __init__(self, value):
-		# Replace "<HOST>" with default regular expression for host.
-		regex = value.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>\S+)")
+	def __init__(self, regex):
 		# Initializes the parent.
 		Regex.__init__(self, regex)
 		# Check for group "host"
diff --git a/server/regex.py b/server/regex.py
index d3d6eee4..22fb6797 100644
--- a/server/regex.py
+++ b/server/regex.py
@@ -42,6 +42,9 @@ class Regex:
 	
 	def __init__(self, regex):
 		self._matchCache = None
+		# Perform shortcuts expansions.
+		# Replace "<HOST>" with default regular expression for host.
+		regex = regex.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>\S+)")
 		if regex.lstrip() == '':
 			raise RegexException("Cannot add empty regex")
 		try:

From ad010a667e5686ef55508fcf584ca8caa71124fd Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Jun 2007 21:43:44 +0000
Subject: [PATCH 526/549] - Expand <HOST> in ignoreregex. Thanks to Yaroslav
 Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@590 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG b/CHANGELOG
index 67f301bc..823ab2d6 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -10,6 +10,7 @@ Fail2Ban (version 0.8.1)                           2007/??/??
 ver. 0.8.1 (2007/??/??) - stable
 ----------
 - Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
+- Expand <HOST> in ignoreregex. Thanks to Yaroslav Halchenko
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------

From e2334db7a6ab60cb017135c5263b6de823431e60 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Jun 2007 21:57:10 +0000
Subject: [PATCH 527/549] - Improved regular expressions. Thanks to Yaroslav
 Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@592 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                      | 1 +
 config/filter.d/pure-ftpd.conf | 2 +-
 config/filter.d/sshd-ddos.conf | 2 +-
 config/filter.d/vsftpd.conf    | 2 +-
 config/filter.d/wuftpd.conf    | 4 ++--
 5 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 823ab2d6..65d5ceb2 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -11,6 +11,7 @@ ver. 0.8.1 (2007/??/??) - stable
 ----------
 - Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
 - Expand <HOST> in ignoreregex. Thanks to Yaroslav Halchenko
+- Improved regular expressions. Thanks to Yaroslav Halchenko
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/config/filter.d/pure-ftpd.conf b/config/filter.d/pure-ftpd.conf
index 31557468..1933d6e0 100644
--- a/config/filter.d/pure-ftpd.conf
+++ b/config/filter.d/pure-ftpd.conf
@@ -19,7 +19,7 @@ __errmsg = (?:Authentication failed for user|Erreur d'authentification pour l'ut
 #         (?:::f{4,6}:)?(?P<host>\S+)
 # Values: TEXT
 #
-failregex = pure-ftpd: (.+?@<HOST>) \[WARNING\] %(__errmsg)s \[.+\]$
+failregex = pure-ftpd(?:\[\d+\])?: (.+?@<HOST>) \[WARNING\] %(__errmsg)s \[.+\]$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/sshd-ddos.conf b/config/filter.d/sshd-ddos.conf
index 2a907e88..9720ab4a 100644
--- a/config/filter.d/sshd-ddos.conf
+++ b/config/filter.d/sshd-ddos.conf
@@ -14,7 +14,7 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = sshd\[\S*\]: Did not receive identification string from <HOST>
+failregex = sshd(?:\[\d+\])?: Did not receive identification string from <HOST>$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index 34e3da92..3c4bb11b 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -14,7 +14,7 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values: TEXT
 #
-failregex = vsftpd: .* authentication failure; .* rhost=<HOST>$
+failregex = vsftpd(?:\[\d+\])?: .* authentication failure; .* rhost=<HOST>$
             \[.+\] FAIL LOGIN: Client "<HOST>"$
 
 # Option:  ignoreregex
diff --git a/config/filter.d/wuftpd.conf b/config/filter.d/wuftpd.conf
index e7981e1e..2d08022d 100644
--- a/config/filter.d/wuftpd.conf
+++ b/config/filter.d/wuftpd.conf
@@ -2,7 +2,7 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision:  $
+# $Revision$
 #
 
 [Definition]
@@ -11,4 +11,4 @@
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT
 #
-failregex = wu-ftpd\[\d+\]:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>
+failregex = wu-ftpd(?:\[\d+\])?:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>$

From 32d1132416f103f072826d24ed5ef269db20abdd Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Jun 2007 22:18:46 +0000
Subject: [PATCH 528/549] - Changed location

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@594 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 .pydevproject | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.pydevproject b/.pydevproject
index 07eba934..d71fe688 100644
--- a/.pydevproject
+++ b/.pydevproject
@@ -4,9 +4,9 @@
 <pydev_project>
 <pydev_property name="org.python.pydev.PYTHON_PROJECT_VERSION">python 2.4</pydev_property>
 <pydev_pathproperty name="org.python.pydev.PROJECT_SOURCE_PATH">
-<path>/fail2ban-unstable/client</path>
-<path>/fail2ban-unstable/server</path>
-<path>/fail2ban-unstable/testcases</path>
-<path>/fail2ban-unstable</path>
+<path>/fail2ban-0.8/client</path>
+<path>/fail2ban-0.8/server</path>
+<path>/fail2ban-0.8/testcases</path>
+<path>/fail2ban-0.8</path>
 </pydev_pathproperty>
 </pydev_project>

From 08c2c557427617ced54d227b129e16d292f21eb8 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 5 Jul 2007 16:10:33 +0000
Subject: [PATCH 529/549] =?UTF-8?q?-=20Added=20sendmail=20actions.=20The?=
 =?UTF-8?q?=20action=20started=20with=20"mail"=20are=20now=20deprecated.?=
 =?UTF-8?q?=20Thanks=20to=20Rapha=C3=ABl=20Marichez=20-=20Fixed=20a=20smal?=
 =?UTF-8?q?l=20typo?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@595 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                                 |   2 +
 MANIFEST                                  |   4 +
 config/action.d/mail-buffered.conf        |   2 +-
 config/action.d/mail-whois-lines.conf     |   2 +-
 config/action.d/mail-whois.conf           |   2 +-
 config/action.d/mail.conf                 |   2 +-
 config/action.d/sendmail-buffered.conf    | 105 ++++++++++++++++++++++
 config/action.d/sendmail-whois-lines.conf |  88 ++++++++++++++++++
 config/action.d/sendmail-whois.conf       |  82 +++++++++++++++++
 config/action.d/sendmail.conf             |  80 +++++++++++++++++
 config/jail.conf                          |  20 ++---
 11 files changed, 375 insertions(+), 14 deletions(-)
 create mode 100644 config/action.d/sendmail-buffered.conf
 create mode 100644 config/action.d/sendmail-whois-lines.conf
 create mode 100644 config/action.d/sendmail-whois.conf
 create mode 100644 config/action.d/sendmail.conf

diff --git a/CHANGELOG b/CHANGELOG
index 65d5ceb2..fe76ac7c 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -12,6 +12,8 @@ ver. 0.8.1 (2007/??/??) - stable
 - Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
 - Expand <HOST> in ignoreregex. Thanks to Yaroslav Halchenko
 - Improved regular expressions. Thanks to Yaroslav Halchenko
+- Added sendmail actions. The action started with "mail" are
+  now deprecated. Thanks to Raphaël Marichez
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/MANIFEST b/MANIFEST
index 60f13e54..7de5196b 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -84,6 +84,10 @@ config/action.d/mail.conf
 config/action.d/mail-buffered.conf
 config/action.d/mail-whois.conf
 config/action.d/mail-whois-lines.conf
+config/action.d/sendmail.conf
+config/action.d/sendmail-buffered.conf
+config/action.d/sendmail-whois.conf
+config/action.d/sendmail-whois-lines.conf
 config/action.d/shorewall.conf
 config/fail2ban.conf
 man/fail2ban-client.1
diff --git a/config/action.d/mail-buffered.conf b/config/action.d/mail-buffered.conf
index 973d48ec..a39ca2b2 100644
--- a/config/action.d/mail-buffered.conf
+++ b/config/action.d/mail-buffered.conf
@@ -12,7 +12,7 @@
 # Values:  CMD
 #
 actionstart = echo -en "Hi,\n
-              The jail <name> has been started successfuly.\n
+              The jail <name> has been started successfully.\n
               Output will be buffered until <lines> lines are available.\n
               Regards,\n
               Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
diff --git a/config/action.d/mail-whois-lines.conf b/config/action.d/mail-whois-lines.conf
index c4bb9784..7e371557 100644
--- a/config/action.d/mail-whois-lines.conf
+++ b/config/action.d/mail-whois-lines.conf
@@ -12,7 +12,7 @@
 # Values:  CMD
 #
 actionstart = echo -en "Hi,\n
-              The jail <name> has been started successfuly.\n
+              The jail <name> has been started successfully.\n
               Regards,\n
               Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
 
diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf
index 044aa05b..39f7fdac 100644
--- a/config/action.d/mail-whois.conf
+++ b/config/action.d/mail-whois.conf
@@ -12,7 +12,7 @@
 # Values:  CMD
 #
 actionstart = echo -en "Hi,\n
-              The jail <name> has been started successfuly.\n
+              The jail <name> has been started successfully.\n
               Regards,\n
               Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
 
diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf
index 2757aa74..7c901894 100644
--- a/config/action.d/mail.conf
+++ b/config/action.d/mail.conf
@@ -12,7 +12,7 @@
 # Values:  CMD
 #
 actionstart = echo -en "Hi,\n
-              The jail <name> has been started successfuly.\n
+              The jail <name> has been started successfully.\n
               Regards,\n
               Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
 
diff --git a/config/action.d/sendmail-buffered.conf b/config/action.d/sendmail-buffered.conf
new file mode 100644
index 00000000..836ed384
--- /dev/null
+++ b/config/action.d/sendmail-buffered.conf
@@ -0,0 +1,105 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = echo -en "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Output will be buffered until <lines> lines are available.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = if [ -f <tmpfile> ]; then
+                 echo -en "Subject: [Fail2Ban] <name>: stopped
+                 From: Fail2Ban <<sender>>
+                 To: <dest>\n
+                 Hi,\n
+                 These hosts have been banned by Fail2Ban.\n
+                 `cat <tmpfile>`
+                 Regards,\n
+                 Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+                 rm <tmpfile>
+             fi
+             echo -en "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = echo `date`": <ip> (<failures> failures)" >> <tmpfile>
+            LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
+            if [ $LINE -eq <lines> ]; then
+                echo -en "Subject: [Fail2Ban] <name>: stopped
+                From: Fail2Ban <<sender>>
+                To: <dest>\n
+                Hi,\n
+                These hosts have been banned by Fail2Ban.\n
+                `cat <tmpfile>`
+                Regards,\n
+                Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+                rm <tmpfile>
+            fi
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+
+# Default number of lines that are buffered
+#
+lines = 5
+
+# Default temporary file
+#
+tmpfile = /tmp/fail2ban-mail.txt
+
diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf
new file mode 100644
index 00000000..68555ad2
--- /dev/null
+++ b/config/action.d/sendmail-whois-lines.conf
@@ -0,0 +1,88 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = echo -en "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = echo -en "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = echo -en "Subject: [Fail2Ban] <name>: banned <ip>
+            From: Fail2Ban <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here are more information about <ip>:\n
+            `/usr/bin/whois <ip>`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `/bin/grep '\<<ip>\>' <logpath>`\n\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+
+# Path to the log files which contain relevant lines for the abuser IP
+#
+logpath = /dev/null
+
diff --git a/config/action.d/sendmail-whois.conf b/config/action.d/sendmail-whois.conf
new file mode 100644
index 00000000..9f72ca7d
--- /dev/null
+++ b/config/action.d/sendmail-whois.conf
@@ -0,0 +1,82 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = echo -en "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = echo -en "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = echo -en "Subject: [Fail2Ban] <name>: banned <ip>
+            From: Fail2Ban <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here are more information about <ip>:\n
+            `/usr/bin/whois <ip>`\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+
diff --git a/config/action.d/sendmail.conf b/config/action.d/sendmail.conf
new file mode 100644
index 00000000..367d9119
--- /dev/null
+++ b/config/action.d/sendmail.conf
@@ -0,0 +1,80 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = echo -en "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = echo -en "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = echo -en "Subject: [Fail2Ban] <name>: banned <ip>
+            From: Fail2Ban <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+
diff --git a/config/jail.conf b/config/jail.conf
index f2854691..8dbbfd13 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -45,7 +45,7 @@ backend = auto
 enabled  = false
 filter   = sshd
 action   = iptables[name=SSH, port=ssh, protocol=tcp]
-           mail-whois[name=SSH, dest=yourmail@mail.com]
+           sendmail-whois[name=SSH, dest=you@mail.com, sender=fail2ban@mail.com]
 logpath  = /var/log/sshd.log
 maxretry = 5
 
@@ -54,7 +54,7 @@ maxretry = 5
 enabled  = false
 filter   = proftpd
 action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
-           mail-whois[name=ProFTPD, dest=yourmail@mail.com]
+           sendmail-whois[name=ProFTPD, dest=you@mail.com]
 logpath  = /var/log/proftpd/proftpd.log
 maxretry = 6
 
@@ -66,7 +66,7 @@ enabled  = false
 filter   = sasl
 backend  = polling
 action   = iptables[name=sasl, port=smtp, protocol=tcp]
-           mail-whois[name=sasl, dest=yourmail@mail.com]
+           sendmail-whois[name=sasl, dest=you@mail.com]
 logpath  = /var/log/mail.log
 
 # Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
@@ -77,7 +77,7 @@ logpath  = /var/log/mail.log
 enabled     = false
 filter      = sshd
 action      = hostsdeny
-              mail-whois[name=SSH, dest=yourmail@mail.com]
+              sendmail-whois[name=SSH, dest=you@mail.com]
 ignoreregex = for myuser from
 logpath     = /var/log/sshd.log
 
@@ -101,7 +101,7 @@ maxretry = 6
 enabled  = false
 filter   = postfix
 action   = hostsdeny[file=/not/a/standard/path/hosts.deny]
-           mail[name=Postfix, dest=yourmail@mail.com]
+           sendmail[name=Postfix, dest=you@mail.com]
 logpath  = /var/log/postfix.log
 bantime  = 300
 
@@ -112,7 +112,7 @@ bantime  = 300
 
 enabled  = false
 filter   = vsftpd
-action   = mail-whois[name=VSFTPD, dest=yourmail@mail.com]
+action   = sendmail-whois[name=VSFTPD, dest=you@mail.com]
 logpath  = /var/log/vsftpd.log
 maxretry = 5
 bantime  = 1800
@@ -124,7 +124,7 @@ bantime  = 1800
 enabled  = false
 filter   = vsftpd
 action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
-           mail-whois[name=VSFTPD, dest=yourmail@mail.com]
+           sendmail-whois[name=VSFTPD, dest=you@mail.com]
 logpath  = /var/log/vsftpd.log
 maxretry = 5
 bantime  = 1800
@@ -137,7 +137,7 @@ bantime  = 1800
 enabled  = false
 filter   = apache-badbots
 action   = iptables-multiport[name=BadBots, port="http,https"]
-           mail-buffered[name=BadBots, lines=5, dest=yourmail@mail.com]
+           sendmail-buffered[name=BadBots, lines=5, dest=you@mail.com]
 logpath  = /var/www/*/logs/access_log
 bantime  = 172800
 maxretry = 1
@@ -149,7 +149,7 @@ maxretry = 1
 enabled  = false
 filter   = apache-noscript
 action   = shorewall
-           mail[name=Postfix, dest=yourmail@mail.com]
+           sendmail[name=Postfix, dest=you@mail.com]
 logpath  = /var/log/apache2/error_log
 
 # This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip"
@@ -162,6 +162,6 @@ logpath  = /var/log/apache2/error_log
 enabled  = false
 filter   = sshd
 action   = ipfw[localhost=192.168.0.1]
-           mail-whois[name="SSH,IPFW", dest=yourmail@mail.com]
+           sendmail-whois[name="SSH,IPFW", dest=you@mail.com]
 logpath  = /var/log/auth.log
 ignoreip = 168.192.0.1

From ada2d7234e5546dc020bba27ce10a67ecc2456fe Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 10 Jul 2007 19:54:01 +0000
Subject: [PATCH 530/549] - Added "ignoreregex" support to fail2ban-regex

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@596 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG        |   1 +
 fail2ban-regex   | 103 +++++++++++++++++++++++++++++++++++++++++++----
 server/filter.py |  23 ++++++++---
 3 files changed, 113 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index fe76ac7c..d4c19632 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -14,6 +14,7 @@ ver. 0.8.1 (2007/??/??) - stable
 - Improved regular expressions. Thanks to Yaroslav Halchenko
 - Added sendmail actions. The action started with "mail" are
   now deprecated. Thanks to Raphaël Marichez
+- Added "ignoreregex" support to fail2ban-regex
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/fail2ban-regex b/fail2ban-regex
index 28ea4b43..2f987e0c 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -68,6 +68,7 @@ class Fail2banRegex:
 	
 	def __init__(self):
 		self.__filter = Filter(None)
+		self.__ignoreregex = list()
 		self.__failregex = list()
 		# Setup logging
 		logging.getLogger("fail2ban").handlers = []
@@ -92,7 +93,7 @@ class Fail2banRegex:
 	
 	@staticmethod
 	def dispUsage():
-		print "Usage: "+sys.argv[0]+" [OPTIONS] <LOG> <REGEX>"
+		print "Usage: "+sys.argv[0]+" [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]"
 		print
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
@@ -111,6 +112,10 @@ class Fail2banRegex:
 		print "    string                  a string representing a 'failregex'"
 		print "    filename                path to a filter file (filter.d/sshd.conf)"
 		print
+		print "IgnoreRegex:"
+		print "    string                  a string representing an 'ignoreregex'"
+		print "    filename                path to a filter file (filter.d/sshd.conf)"
+		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	
 	def getCmdLineOptions(self, optList):
@@ -128,6 +133,35 @@ class Fail2banRegex:
 	def logIsFile(value):
 		return os.path.isfile(value)
 
+	def readIgnoreRegex(self, value):
+		if os.path.isfile(value):
+			reader = SafeConfigParser()
+			try:
+				reader.read(value)
+				print "Use ignoreregex file : " + value
+				self.__ignoreregex = [RegexStat(m)
+									for m in reader.get("Definition", "ignoreregex").split('\n')]
+			except NoSectionError:
+				print "No [Definition] section in " + value
+				print
+				return False
+			except NoOptionError:
+				print "No failregex option in " + value
+				print
+				return False
+			except MissingSectionHeaderError:
+				print "No section headers in " + value
+				print
+				return False
+		else:
+			if len(value) > 53:
+				stripReg = value[0:50] + "..."
+			else:
+				stripReg = value
+			print "Use ignoreregex line : " + stripReg
+			self.__ignoreregex = [RegexStat(value)]
+		return True
+
 	def readRegex(self, value):
 		if os.path.isfile(value):
 			reader = SafeConfigParser()
@@ -157,8 +191,27 @@ class Fail2banRegex:
 			self.__failregex = [RegexStat(value)]
 		return True
 	
+	def testIgnoreRegex(self, line):
+		found = False
+		for regex in self.__ignoreregex:
+			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
+			try:
+				self.__filter.addIgnoreRegex(regex.getFailRegex())
+				try:
+					ret = self.__filter.ignoreLine(line)
+					if ret:
+						regex.inc()
+				except RegexException, e:
+					print e
+					return False
+			finally:
+				self.__filter.delIgnoreRegex(0)
+				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
+	
 	def testRegex(self, line):
 		found = False
+		for regex in self.__ignoreregex:
+			self.__filter.addIgnoreRegex(regex.getFailRegex())
 		for regex in self.__failregex:
 			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
 			try:
@@ -182,6 +235,8 @@ class Fail2banRegex:
 			finally:
 				self.__filter.delFailRegex(0)
 				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
+		for regex in self.__ignoreregex:
+					self.__filter.delIgnoreRegex(0)
 	
 	def printStats(self):
 		print
@@ -191,25 +246,51 @@ class Fail2banRegex:
 		
 		# Print title
 		cnt = 1
-		print "Failregex:"
+		print "Failregex"
+		print "|- Regular expressions:"
 		for failregex in self.__failregex:
-			print "[" + str(cnt) + "] " + failregex.getFailRegex()
+			print "|  [" + str(cnt) + "] " + failregex.getFailRegex()
 			cnt += 1
+		cnt = 1
 		
-		print
+		print "|"
 		
 		# Print stats
 		cnt = 1
 		total = 0
-		print "Number of matches:"
+		print "`- Number of matches:"
 		for failregex in self.__failregex:
 			match = failregex.getStats()
 			total += match
-			print "[" + str(cnt) + "] " + str(match) + " match(es)"
+			print "   [" + str(cnt) + "] " + str(match) + " match(es)"
 			cnt += 1
 		
 		print
 		
+		# Print title
+		cnt = 1
+		print "Ignoreregex"
+		print "|- Regular expressions:"
+		for failregex in self.__ignoreregex:
+			print "|  [" + str(cnt) + "] " + failregex.getFailRegex()
+			cnt += 1
+		cnt = 1
+		
+		print "|"
+		
+		# Print stats
+		cnt = 1
+		print "`- Number of matches:"
+		for failregex in self.__ignoreregex:
+			match = failregex.getStats()
+			print "   [" + str(cnt) + "] " + str(match) + " match(es)"
+			cnt += 1
+		
+		print
+		print "Summary"
+		print "======="
+		print
+		
 		if total == 0:
 			print "Sorry, no match"
 			print
@@ -236,7 +317,7 @@ class Fail2banRegex:
 			
 			print "Date template hits:"
 			for template in self.__filter.dateDetector.getTemplates():
-				print `template.getHits()` + " hit: " + template.getName()
+				print `template.getHits()` + " hit(s): " + template.getName()
 			
 			print
 			
@@ -260,7 +341,7 @@ if __name__ == "__main__":
 	# Process command line
 	fail2banRegex.getCmdLineOptions(optList)
 	# We need exactly 3 parameters
-	if not len(sys.argv) == 3:
+	if not len(sys.argv) in (3, 4):
 		fail2banRegex.dispUsage()
 		sys.exit(-1)
 	else:
@@ -269,6 +350,10 @@ if __name__ == "__main__":
 		print "============="
 		print
 
+		if len(sys.argv) == 4:
+			if fail2banRegex.readIgnoreRegex(sys.argv[3]) == False:
+				sys.exit(-1)
+
 		if fail2banRegex.readRegex(sys.argv[2]) == False:
 			sys.exit(-1)
 
@@ -278,6 +363,7 @@ if __name__ == "__main__":
 				print "Use log file   : " + sys.argv[1]
 				print
 				for line in hdlr:
+					fail2banRegex.testIgnoreRegex(line)
 					fail2banRegex.testRegex(line)
 			except IOError, e:
 				print e
@@ -290,6 +376,7 @@ if __name__ == "__main__":
 				stripLog = sys.argv[1]
 			print "Use single line: " + stripLog
 			print
+			fail2banRegex.testIgnoreRegex(sys.argv[1])
 			fail2banRegex.testRegex(sys.argv[1])
 		
 		if fail2banRegex.printStats():
diff --git a/server/filter.py b/server/filter.py
index 131c6d02..b567445a 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -413,6 +413,20 @@ class Filter(JailThread):
 		self.__closeLogFile()
 		return True
 
+	##
+	# Returns true if the line should be ignored.
+	#
+	# Uses ignoreregex.
+	# @param line: the line
+	# @return: a boolean
+
+	def ignoreLine(self, line):
+		for ignoreRegex in self.__ignoreRegex:
+			ignoreRegex.search(line)
+			if ignoreRegex.hasMatched():
+				return True
+		return False
+
 	##
 	# Finds the failure in a line.
 	#
@@ -423,12 +437,9 @@ class Filter(JailThread):
 	def findFailure(self, line):
 		failList = list()
 		# Checks if we must ignore this line.
-		for ignoreRegex in self.__ignoreRegex:
-			ignoreRegex.search(line)
-			if ignoreRegex.hasMatched():
-				# The ignoreregex matched. Return.
-				logSys.debug("Ignoring this line")
-				return failList
+		if self.ignoreLine(line):
+			# The ignoreregex matched. Return.
+			return failList
 		# Iterates over all the regular expressions.
 		for failRegex in self.__failRegex:
 			failRegex.search(line)

From 568264d6c72cb828f390b684f105b11cee20191d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 10 Jul 2007 20:04:57 +0000
Subject: [PATCH 531/549] - Updated suse-initd and added it to MANIFEST. Thanks
 to Christian Rauch

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@597 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG        |   2 +
 MANIFEST         |   1 +
 files/suse-initd | 109 +++++++++++++++++++++++++----------------------
 3 files changed, 62 insertions(+), 50 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index d4c19632..85ac9a04 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -15,6 +15,8 @@ ver. 0.8.1 (2007/??/??) - stable
 - Added sendmail actions. The action started with "mail" are
   now deprecated. Thanks to Raphaël Marichez
 - Added "ignoreregex" support to fail2ban-regex
+- Updated suse-initd and added it to MANIFEST. Thanks to
+  Christian Rauch
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/MANIFEST b/MANIFEST
index 7de5196b..b4a3a698 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -102,6 +102,7 @@ files/gentoo-confd
 files/redhat-initd
 files/solaris-fail2ban.xml
 files/solaris-svc-fail2ban
+files/suse-initd
 files/cacti/fail2ban_stats.sh
 files/cacti/cacti_host_template_fail2ban.xml
 files/cacti/README
diff --git a/files/suse-initd b/files/suse-initd
index 06e481fe..bbd679aa 100755
--- a/files/suse-initd
+++ b/files/suse-initd
@@ -6,26 +6,26 @@
 #
 ### BEGIN INIT INFO
 # Provides:          fail2ban
-# Required-Start:    $syslog $remote_fs postfix
+# Required-Start:    $syslog $remote_fs sendmail
 # Required-Stop:     $syslog $remote_fs
 # Should-Stop: $time ypbind sendmail
 # Default-Start:     3 5
 # Default-Stop:      0 1 2 6
 # Description:       startup Fail2Ban
 ### END INIT INFO
-PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/sbin:/usr/bin:/bin
 FAIL2BAN_BIN=/usr/local/bin/fail2ban-client
 FAIL2BAN_SERVER=/usr/local/bin/fail2ban-server
 FAIL2BAN_SOCKET=/tmp/fail2ban.sock
-test -x $FAIL2BAN_BIN || { echo "$FAIL2BAN_BIN not installed"; 
-	if [ "$1" = "stop" ]; then exit 0;
-	else exit 5; fi; }
+test -x $FAIL2BAN_BIN || { echo "$FAIL2BAN_BIN not installed";
+        if [ "$1" = "stop" ]; then exit 0;
+        else exit 5; fi; }
 
 # Check for existence of needed config file and read it
 FAIL2BAN_CONFIG=/etc/fail2ban/fail2ban.conf
 test -r $FAIL2BAN_CONFIG || { echo "$FAIL2BAN_CONFIG not existing";
-	if [ "$1" = "stop" ]; then exit 0;
-	else exit 6; fi; }
+        if [ "$1" = "stop" ]; then exit 0;
+        else exit 6; fi; }
 
 . /etc/rc.status
 
@@ -34,54 +34,63 @@ rc_reset
 
 case "$1" in
     start)
-	echo -n "Starting Fail2Ban "
-	/sbin/startproc $FAIL2BAN_BIN -q start 2>1 > /dev/null
-	rc_status -v
-	;;
+        echo -n "Starting Fail2Ban "
+        /sbin/startproc $FAIL2BAN_BIN start &>/dev/null
+        rc_status -v
+        ;;
     stop)
-	echo -n "Shutting down Fail2ban "
-	/sbin/startproc $FAIL2BAN_BIN -q stop
-	rc_status -v
-	;;
+        echo -n "Shutting down Fail2ban "
+        /sbin/startproc $FAIL2BAN_BIN -q stop
+        rc_status -v
+        ;;
     try-restart|condrestart)
-	if test "$1" = "condrestart"; then
-		echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}"
-	fi
-	$0 status
-	if test $? = 0; then
-		$0 restart
-	else
-		rc_reset	# Not running is not a failure.
-	fi
-	rc_status
-	;;
+        if test "$1" = "condrestart"; then
+                echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}"
+        fi
+        $0 status
+        if test $? = 0; then
+                $0 restart
+        else
+                rc_reset        # Not running is not a failure.
+        fi
+        rc_status
+        ;;
     restart)
-	$0 stop
-	i=60
-	while [ -e $FAIL2BAN_SOCKET ] && [ $i -gt 60 ]
-		sleep 1
-		i=$[i-1]
-		echo -n "."
-	done
-	echo "."
-	$0 start
+        $0 stop
+        echo -n "-wait a minute "
+        i=60
+        while [ -e $FAIL2BAN_SOCKET ] && [ $i -gt 0 ]; do
+                sleep 1
+                i=$[$i-1]
+                echo -n "."
+        done
+        echo "."
+        $0 start
 
-	# Remember status and be quiet
-	rc_status
-	;;
+        # Remember status and be quiet
+        rc_status
+        ;;
     force-reload)
-	echo -n "Reload service Fail2ban "
-	/sbin/startproc $FAIL2BAN_BIN -q reload
-	rc_status -v
-	;;
+        echo -n "Reload service Fail2ban "
+        /sbin/startproc $FAIL2BAN_BIN -q reload
+        rc_status -v
+        ;;
     reload)
-	echo -n "Reload service Fail2ban "
-	/sbin/startproc $FAIL2BAN_BIN -q reload
-	rc_status -v
-	;;
+        echo -n "Reload service Fail2ban "
+        /sbin/startproc $FAIL2BAN_BIN -q reload
+        rc_status -v
+        ;;
     status)
-	echo -n "Checking for service Fail2ban "
-	/sbin/checkproc $FAIL2BAN_SERVER
-	rc_status -v
-	;;
+        echo -n "Checking for service Fail2ban "
+        /sbin/checkproc $FAIL2BAN_SERVER
+        rc_status -v
+        ;;
     probe)
+        test /etc/fail2ban/fail2ban.conf -nt /var/run/fail2ban.pid && echo reload
+        ;;
+    *)
+        echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}"
+        exit 1
+        ;;
+esac
+rc_exit
\ No newline at end of file

From f714c96d0e53ea93010fc3d0d8e9ff9a03497d36 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 10 Jul 2007 20:24:44 +0000
Subject: [PATCH 532/549] - Updated regular expressions

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@598 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                 |  1 +
 config/filter.d/sshd.conf | 11 ++++++-----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 85ac9a04..acf9f939 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -12,6 +12,7 @@ ver. 0.8.1 (2007/??/??) - stable
 - Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
 - Expand <HOST> in ignoreregex. Thanks to Yaroslav Halchenko
 - Improved regular expressions. Thanks to Yaroslav Halchenko
+  and others
 - Added sendmail actions. The action started with "mail" are
   now deprecated. Thanks to Raphaël Marichez
 - Added "ignoreregex" support to fail2ban-regex
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 39416f43..98b5ceae 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -14,11 +14,12 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = Authentication failure for .* from <HOST>$
-            Failed [-/\w]+ for .* from <HOST>$
-            ROOT LOGIN REFUSED .* FROM <HOST>$
-            [iI](?:llegal|nvalid) user .* from <HOST>$
-            User .* from <HOST> not allowed because not listed in AllowUsers$
+failregex = Authentication failure for .+ from <HOST>(?: port \d+ ssh2)?$
+            Failed [-/\w]+ for .+ from <HOST>(?: port \d+ ssh2)?$
+            ROOT LOGIN REFUSED .+ FROM <HOST>(?: port \d+ ssh2)?$
+            [iI](?:llegal|nvalid) user .+ from <HOST>(?: port \d+ ssh2)?$
+            User .+ from <HOST> not allowed because not listed in AllowUsers$
+            User .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 2816bca55bea3d0b9dd9b3275306027ebb41e393 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 11 Jul 2007 22:12:45 +0000
Subject: [PATCH 533/549] - Tightening up the pid check in redhat-initd. Thanks
 to David Nutter

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@599 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG          | 2 ++
 files/redhat-initd | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index acf9f939..1cc72723 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -18,6 +18,8 @@ ver. 0.8.1 (2007/??/??) - stable
 - Added "ignoreregex" support to fail2ban-regex
 - Updated suse-initd and added it to MANIFEST. Thanks to
   Christian Rauch
+- Tightening up the pid check in redhat-initd. Thanks to
+  David Nutter
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/files/redhat-initd b/files/redhat-initd
index 205294cf..529aef25 100755
--- a/files/redhat-initd
+++ b/files/redhat-initd
@@ -20,7 +20,7 @@ FAIL2BAN="/usr/bin/fail2ban-client"
 RETVAL=0
 
 getpid() {
-    pid=`ps -ef | grep fail2ban-|grep -v grep|awk '{print $2}'`
+    pid=`ps -eo pid,comm | grep fail2ban- | awk '{ print $1 }'`
 }
 
 start() {

From 6d7b93c826dfd1ef701a0dea9aea60fba2d59710 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 11 Jul 2007 22:13:07 +0000
Subject: [PATCH 534/549] - Updated contributors

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@600 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 README | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README b/README
index 7a4aa86f..f2c1d31e 100644
--- a/README
+++ b/README
@@ -73,7 +73,8 @@ Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
 Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
 Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
 René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch,
-Michael C. Haller, Jonathan Underwood, Hanno 'Rince' Wagner
+Michael C. Haller, Jonathan Underwood, Hanno 'Rince' Wagner,
+Daniel B. Cid, David Nutter, Raphaël Marichez
 
 License:
 --------

From 9ac663a1214287312fe314d9d5f1f3a3265b1127 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 11 Jul 2007 22:27:16 +0000
Subject: [PATCH 535/549] - Added webmin authentication filter. Thanks to
 Guillaume Delvit

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@601 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                        |  2 ++
 MANIFEST                         |  1 +
 config/filter.d/webmin-auth.conf | 28 ++++++++++++++++++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 config/filter.d/webmin-auth.conf

diff --git a/CHANGELOG b/CHANGELOG
index 1cc72723..59417a31 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -20,6 +20,8 @@ ver. 0.8.1 (2007/??/??) - stable
   Christian Rauch
 - Tightening up the pid check in redhat-initd. Thanks to
   David Nutter
+- Added webmin authentication filter. Thanks to Guillaume
+  Delvit
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/MANIFEST b/MANIFEST
index b4a3a698..b91adaa8 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -74,6 +74,7 @@ config/filter.d/sasl.conf
 config/filter.d/sshd.conf
 config/filter.d/sshd-ddos.conf
 config/filter.d/vsftpd.conf
+config/filter.d/webmin-auth.conf
 config/filter.d/wuftpd.conf
 config/action.d/hostsdeny.conf
 config/action.d/ipfw.conf
diff --git a/config/filter.d/webmin-auth.conf b/config/filter.d/webmin-auth.conf
new file mode 100644
index 00000000..ddf081ea
--- /dev/null
+++ b/config/filter.d/webmin-auth.conf
@@ -0,0 +1,28 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Rule by : Delvit Guillaume
+#
+# $Revision$
+#
+
+[Definition]
+
+# patern :      webmin[15673]: Non-existent login as toto from 86.0.6.217
+#               webmin[29544]: Invalid login as root from 86.0.6.217
+#
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = webmin.* Non-existent login as .+ from <HOST>$
+            webmin.* Invalid login as .+ from <HOST>$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

From b239e17a7d33b550380d010e59394e163f9db7a0 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 11 Jul 2007 22:27:29 +0000
Subject: [PATCH 536/549] - Updated contributors

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@602 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 README | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README b/README
index f2c1d31e..73a0cd25 100644
--- a/README
+++ b/README
@@ -74,7 +74,8 @@ Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
 Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
 René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch,
 Michael C. Haller, Jonathan Underwood, Hanno 'Rince' Wagner,
-Daniel B. Cid, David Nutter, Raphaël Marichez
+Daniel B. Cid, David Nutter, Raphaël Marichez, Guillaume
+Delvit
 
 License:
 --------

From e841209f1b0bfce6233847931433f4bf17bf3a70 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 17 Jul 2007 20:41:00 +0000
Subject: [PATCH 537/549] - Added new regex for proftpd. Thanks to Vaclav Misek

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@603 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 README                       | 2 +-
 config/filter.d/proftpd.conf | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/README b/README
index 73a0cd25..8df3d779 100644
--- a/README
+++ b/README
@@ -75,7 +75,7 @@ Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
 René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch,
 Michael C. Haller, Jonathan Underwood, Hanno 'Rince' Wagner,
 Daniel B. Cid, David Nutter, Raphaël Marichez, Guillaume
-Delvit
+Delvit, Vaclav Misek
 
 License:
 --------
diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index 1fc31ef5..45b91c66 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -15,6 +15,7 @@
 # Values: TEXT
 #
 failregex = USER \S+: no such user found from \S* ?\[<HOST>\] to \S+\s*$
+            \(\S*\[<HOST>\]\) - USER \S+ \(Login failed\): Incorrect password.$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 711f936ed0f5a70c011257c54d6293c1816e4d80 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 5 Aug 2007 19:33:15 +0000
Subject: [PATCH 538/549] - Corrected subject

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@604 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/sendmail-buffered.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/action.d/sendmail-buffered.conf b/config/action.d/sendmail-buffered.conf
index 836ed384..621034f0 100644
--- a/config/action.d/sendmail-buffered.conf
+++ b/config/action.d/sendmail-buffered.conf
@@ -25,7 +25,7 @@ actionstart = echo -en "Subject: [Fail2Ban] <name>: started
 # Values:  CMD
 #
 actionstop = if [ -f <tmpfile> ]; then
-                 echo -en "Subject: [Fail2Ban] <name>: stopped
+                 echo -en "Subject: [Fail2Ban] <name>: summary
                  From: Fail2Ban <<sender>>
                  To: <dest>\n
                  Hi,\n
@@ -60,7 +60,7 @@ actioncheck =
 actionban = echo `date`": <ip> (<failures> failures)" >> <tmpfile>
             LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
             if [ $LINE -eq <lines> ]; then
-                echo -en "Subject: [Fail2Ban] <name>: stopped
+                echo -en "Subject: [Fail2Ban] <name>: summary
                 From: Fail2Ban <<sender>>
                 To: <dest>\n
                 Hi,\n

From 7c33b443acbb6802c9aadfee11f7a09224ee612c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 7 Aug 2007 22:11:34 +0000
Subject: [PATCH 539/549] - Removed textToDns() which is not required anymore.
 Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@605 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG        |  2 ++
 server/filter.py | 19 +++----------------
 2 files changed, 5 insertions(+), 16 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 59417a31..da66b0a1 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -22,6 +22,8 @@ ver. 0.8.1 (2007/??/??) - stable
   David Nutter
 - Added webmin authentication filter. Thanks to Guillaume
   Delvit
+- Removed textToDns() which is not required anymore. Thanks
+  to Yaroslav Halchenko
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/server/filter.py b/server/filter.py
index b567445a..04a86d79 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -503,17 +503,6 @@ class DNSUtils:
 						% dns)
 			return list()
 	
-	@staticmethod
-	def textToDns(text):
-		""" Search for possible DNS in an arbitrary text.
-			Thanks to Tom Pike.
-		"""
-		match = DNSUtils.DNS_CRE.match(text)
-		if match:
-			return match
-		else:
-			return None
-	
 	@staticmethod
 	def searchIP(text):
 		""" Search if an IP address if directly available and return
@@ -549,11 +538,9 @@ class DNSUtils:
 				ipList.append(plainIPStr)
 		if not ipList:
 			# Try to get IP from possible DNS
-			dns = DNSUtils.textToDns(text)
-			if not dns == None:
-				ip = DNSUtils.dnsToIp(dns.group(0))
-				for e in ip:
-					ipList.append(e)
+			ip = DNSUtils.dnsToIp(text)
+			for e in ip:
+				ipList.append(e)
 		return ipList
 	
 	@staticmethod

From 26c54c45380a5a84863e8ea64619d8842d7b5854 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:13:09 +0000
Subject: [PATCH 540/549] - Added new action iptables-allports. Thanks to
 Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@606 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                              |  2 +
 config/action.d/iptables-allports.conf | 65 ++++++++++++++++++++++++++
 2 files changed, 67 insertions(+)
 create mode 100644 config/action.d/iptables-allports.conf

diff --git a/CHANGELOG b/CHANGELOG
index da66b0a1..f69366fa 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -24,6 +24,8 @@ ver. 0.8.1 (2007/??/??) - stable
   Delvit
 - Removed textToDns() which is not required anymore. Thanks
   to Yaroslav Halchenko
+- Added new action iptables-allports. Thanks to Yaroslav
+  Halchenko
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/config/action.d/iptables-allports.conf b/config/action.d/iptables-allports.conf
new file mode 100644
index 00000000..a95065d4
--- /dev/null
+++ b/config/action.d/iptables-allports.conf
@@ -0,0 +1,65 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
+# 			made active on all ports from original iptables.conf
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I INPUT -p <protocol> -j fail2ban-<name>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -p <protocol> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+

From 040822f19f755e643ba62133b7285f0fa3db2d62 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:16:22 +0000
Subject: [PATCH 541/549] - Added "named" date format to date detector. Thanks
 to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@607 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG              | 2 ++
 server/datedetector.py | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index f69366fa..b28f6bf3 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -26,6 +26,8 @@ ver. 0.8.1 (2007/??/??) - stable
   to Yaroslav Halchenko
 - Added new action iptables-allports. Thanks to Yaroslav
   Halchenko
+- Added "named" date format to date detector. Thanks to
+  Yaroslav Halchenko
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/server/datedetector.py b/server/datedetector.py
index 6b9986f5..1f3f5828 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -80,6 +80,12 @@ class DateDetector:
 			template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%Y-%m-%d %H:%M:%S")
 			self.__templates.append(template)
+			# named 26-Jul-2007 15:20:52.252 
+			template = DateStrptime()
+			template.setName("Day-Month-Year Hour:Minute:Second[.Millisecond]")
+			template.setRegex("\d{2}-\S{3}-\d{4} \d{2}:\d{2}:\d{2}")
+			template.setPattern("%d-%b-%Y %H:%M:%S")
+			self.__templates.append(template)
 			# TAI64N
 			template = DateTai64n()
 			template.setName("TAI64N")

From a3ace8040b87707bea427ef429d2576b00b3e636 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:21:15 +0000
Subject: [PATCH 542/549] - Added filter file for named (bind9). Thanks to
 Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@608 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                          |  2 ++
 config/filter.d/named-refused.conf | 34 ++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 config/filter.d/named-refused.conf

diff --git a/CHANGELOG b/CHANGELOG
index b28f6bf3..484fb093 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -28,6 +28,8 @@ ver. 0.8.1 (2007/??/??) - stable
   Halchenko
 - Added "named" date format to date detector. Thanks to
   Yaroslav Halchenko
+- Added filter file for named (bind9). Thanks to Yaroslav
+  Halchenko
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/config/filter.d/named-refused.conf b/config/filter.d/named-refused.conf
new file mode 100644
index 00000000..d70e8732
--- /dev/null
+++ b/config/filter.d/named-refused.conf
@@ -0,0 +1,34 @@
+# Fail2Ban configuration file for named (bind9). Trying to generalize the
+#          structure which is general to capture general patterns in log
+#          lines to cover different configurations/distributions
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision$
+#
+
+[Definition]
+
+# if you want to catch only login erros from specific daemons, use smth like
+#_named_rcodes=(?:REFUSED|SERVFAIL)
+# To catch all REFUSED queries only
+_named_rcodes=REFUSED
+_daemon=named
+
+#
+# Shortcuts for easier comprehension of the failregex
+__pid_re=(?:\[\d+\])
+__daemon_re=\(?%(_daemon)s(?:\(\S+\))?\)?:?
+__daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
+#       hostname       daemon_id         spaces
+# this can be optional (for instance if we match named native log files)
+__line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = %(__line_prefix)sunexpected RCODE \(%(_named_rcodes)s\) resolving '.*': <HOST>#\S+$
+		    %(__line_prefix)sclient <HOST>#\S+: query(?: \(cache\))? '.*' denied\s*$
+
+

From 3ef8fbe2e3509640a5d4a281a745606e91f0b81a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:29:13 +0000
Subject: [PATCH 543/549] - Modified failregex again. Thanks to Yaroslav
 Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@609 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/sshd.conf | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 98b5ceae..316af802 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -14,11 +14,11 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = Authentication failure for .+ from <HOST>(?: port \d+ ssh2)?$
-            Failed [-/\w]+ for .+ from <HOST>(?: port \d+ ssh2)?$
-            ROOT LOGIN REFUSED .+ FROM <HOST>(?: port \d+ ssh2)?$
-            [iI](?:llegal|nvalid) user .+ from <HOST>(?: port \d+ ssh2)?$
-            User .+ from <HOST> not allowed because not listed in AllowUsers$
+failregex = (?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
+            Failed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
+            ROOT LOGIN REFUSED.* FROM <HOST>\s*$
+            [iI](?:llegal|nvalid) user .* from <HOST>\s*$
+            User \S+ from <HOST> not allowed because not listed in AllowUsers$
             User .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$
 
 # Option:  ignoreregex

From 49b2e40682e6af68b43a9e2d267d783df710691a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:31:47 +0000
Subject: [PATCH 544/549] - Fixed vsftpd filter. Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@610 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                   | 1 +
 config/filter.d/vsftpd.conf | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 484fb093..fe550610 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -30,6 +30,7 @@ ver. 0.8.1 (2007/??/??) - stable
   Yaroslav Halchenko
 - Added filter file for named (bind9). Thanks to Yaroslav
   Halchenko
+- Fixed vsftpd filter. Thanks to Yaroslav Halchenko
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index 3c4bb11b..9f955fae 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -14,8 +14,8 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values: TEXT
 #
-failregex = vsftpd(?:\[\d+\])?: .* authentication failure; .* rhost=<HOST>$
-            \[.+\] FAIL LOGIN: Client "<HOST>"$
+failregex = vsftpd(?:\[\d+\])?: .* authentication failure; .* rhost=<HOST>\s*$
+            \[.+\] FAIL LOGIN: Client "<HOST>"\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 5fd5a8112a4ec21c372574c472c2b6f334cda9b3 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:49:58 +0000
Subject: [PATCH 545/549] - Added named (bind9) example. Thanks to Yaroslav
 Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@611 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/jail.conf | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/config/jail.conf b/config/jail.conf
index 8dbbfd13..d61e7b6f 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -165,3 +165,41 @@ action   = ipfw[localhost=192.168.0.1]
            sendmail-whois[name="SSH,IPFW", dest=you@mail.com]
 logpath  = /var/log/auth.log
 ignoreip = 168.192.0.1
+
+# These jails block attacks against named (bind9). By default, logging is off
+# with bind9 installation. You will need something like this:
+#
+# logging {
+#     channel lame-servers_file {
+#         file "/var/log/named/lame-servers.log" versions 3 size 30m;
+#         severity dynamic;
+#         print-time yes;
+#     };
+#     category lame-servers {
+#         lame-servers_file;
+#     };
+# }
+#
+# in your named.conf to provide proper logging.
+# This jail blocks UDP traffic for DNS requests.
+
+[named-refused-udp]
+
+enabled  = false
+filter   = named-refused
+action   = iptables-multiport[name=Named, port="domain,953", protocol=udp]
+           sendmail-whois[name=Named, dest=you@mail.com]
+logpath  = /var/log/named/lame-servers.log
+ignoreip = 168.192.0.1
+
+# This jail blocks TCP traffic for DNS requests.
+
+[named-refused-tcp]
+
+enabled  = false
+filter   = named-refused
+action   = iptables-multiport[name=Named, port="domain,953", protocol=tcp]
+           sendmail-whois[name=Named, dest=you@mail.com]
+logpath  = /var/log/named/lame-servers.log
+ignoreip = 168.192.0.1
+

From b2a79a5e49530bac2c8f0d79afbb946e2864af52 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:52:42 +0000
Subject: [PATCH 546/549] - Added new files

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@612 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MANIFEST b/MANIFEST
index b91adaa8..a4cc60ef 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -66,6 +66,7 @@ config/filter.d/apache-noscript.conf
 config/filter.d/courierlogin.conf
 config/filter.d/couriersmtp.conf
 config/filter.d/exim.conf
+config/filter.d/named-refused.conf
 config/filter.d/postfix.conf
 config/filter.d/proftpd.conf
 config/filter.d/pure-ftpd.conf
@@ -79,6 +80,7 @@ config/filter.d/wuftpd.conf
 config/action.d/hostsdeny.conf
 config/action.d/ipfw.conf
 config/action.d/iptables.conf
+config/action.d/iptables-allports.conf
 config/action.d/iptables-multiport.conf
 config/action.d/iptables-new.conf
 config/action.d/mail.conf

From 732c66215fb9f6475f5f76ece2aef5810d440360 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 13 Aug 2007 21:39:26 +0000
Subject: [PATCH 547/549] - Improved regular expressions

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@613 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/sshd.conf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 316af802..1a601bd6 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -15,11 +15,11 @@
 # Values:  TEXT
 #
 failregex = (?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
-            Failed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
+            Failed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?\s*$
             ROOT LOGIN REFUSED.* FROM <HOST>\s*$
             [iI](?:llegal|nvalid) user .* from <HOST>\s*$
-            User \S+ from <HOST> not allowed because not listed in AllowUsers$
-            User .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$
+            User .+ from <HOST> not allowed because not listed in AllowUsers\s*$
+            User .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From e40468dfd3533eb4cd8f196d41b62dd72cfc4d5c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 14 Aug 2007 21:39:15 +0000
Subject: [PATCH 548/549] - Prepared for 0.8.1

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@614 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG             |  4 ++--
 README                |  6 +++---
 common/version.py     |  2 +-
 man/fail2ban-client.1 |  4 ++--
 man/fail2ban-regex.1  | 13 ++++++++++---
 man/fail2ban-server.1 |  4 ++--
 6 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index fe550610..6d05c5c8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.8.1)                           2007/??/??
+Fail2Ban (version 0.8.1)                           2007/08/14
 =============================================================
 
-ver. 0.8.1 (2007/??/??) - stable
+ver. 0.8.1 (2007/08/14) - stable
 ----------
 - Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
 - Expand <HOST> in ignoreregex. Thanks to Yaroslav Halchenko
diff --git a/README b/README
index 8df3d779..5cece798 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.8.0)                           2007/05/03
+Fail2Ban (version 0.8.1)                           2007/08/14
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -28,8 +28,8 @@ Optional:
 
 To install, just do:
 
-> tar xvfj fail2ban-0.8.0.tar.bz2
-> cd fail2ban-0.8.0
+> tar xvfj fail2ban-0.8.1.tar.bz2
+> cd fail2ban-0.8.1
 > python setup.py install
 
 This will install Fail2Ban into /usr/share/fail2ban. The
diff --git a/common/version.py b/common/version.py
index 929c2225..aa428745 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.8.0"
+version = "0.8.1"
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 3dd4111b..719ad7f8 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,11 +1,11 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "May 2007" "fail2ban-client v0.8.0" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "August 2007" "fail2ban-client v0.8.1" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH DESCRIPTION
 [?1034hUsage: ../fail2ban\-client [OPTIONS] <COMMAND>
 .PP
-Fail2Ban v0.8.0 reads log file that contains password failure report
+Fail2Ban v0.8.1 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index a7fae822..2556162e 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-REGEX "1" "May 2007" "fail2ban-regex v0.8.0" "User Commands"
+.TH FAIL2BAN-REGEX "1" "August 2007" "fail2ban-regex v0.8.1" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
 .B fail2ban-regex
-[\fIOPTIONS\fR] \fI<LOG> <REGEX>\fR
+[\fIOPTIONS\fR] \fI<LOG> <REGEX> \fR[\fIIGNOREREGEX\fR]
 .SH DESCRIPTION
-Fail2Ban v0.8.0 reads log file that contains password failure report
+Fail2Ban v0.8.1 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 This tools can test regular expressions for "fail2ban".
@@ -31,6 +31,13 @@ a string representing a 'failregex'
 .TP
 \fBfilename\fR
 path to a filter file (filter.d/sshd.conf)
+.SS "IgnoreRegex:"
+.TP
+\fBstring\fR
+a string representing an 'ignoreregex'
+.TP
+\fBfilename\fR
+path to a filter file (filter.d/sshd.conf)
 .SH AUTHOR
 Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
 Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index d8ed93cd..dfa3b185 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "May 2007" "fail2ban-server v0.8.0" "User Commands"
+.TH FAIL2BAN-SERVER "1" "August 2007" "fail2ban-server v0.8.1" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.8.0 reads log file that contains password failure report
+Fail2Ban v0.8.1 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with

From 9ad46bb82fca6d7a090571f250589ff7f49b7757 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 16 Oct 2007 17:01:18 -0400
Subject: [PATCH 549/549] Upgraded to fresh upstream 0.5.2

---
 MANIFEST                     |  27 ---
 PKG-INFO                     |  15 ++
 config/fail2ban.conf.default |   2 +-
 config/gentoo-confd          |   2 +-
 config/gentoo-initd          |   2 +-
 config/redhat-initd          | 156 ++++++-------
 confreader/__init__.py       |   6 +-
 confreader/configreader.py   |   6 +-
 fail2ban                     |   6 +-
 fail2ban.py                  |  35 +--
 firewall/__init__.py         |   6 +-
 firewall/firewall.py         |   6 +-
 log-test/apache              | 108 ---------
 log-test/current             |  11 -
 log-test/test                | 432 -----------------------------------
 logreader/__init__.py        |   6 +-
 logreader/logreader.py       |   9 +-
 setup.py                     |   6 +-
 utils/__init__.py            |   6 +-
 utils/dns.py                 |   6 +-
 utils/mail.py                |   6 +-
 utils/pidlock.py             |   6 +-
 utils/process.py             |   6 +-
 utils/strings.py             |   6 +-
 version.py                   |   6 +-
 25 files changed, 163 insertions(+), 720 deletions(-)
 delete mode 100644 MANIFEST
 create mode 100644 PKG-INFO
 delete mode 100644 log-test/apache
 delete mode 100644 log-test/current
 delete mode 100644 log-test/test

diff --git a/MANIFEST b/MANIFEST
deleted file mode 100644
index b56a8b73..00000000
--- a/MANIFEST
+++ /dev/null
@@ -1,27 +0,0 @@
-README
-CHANGELOG
-TODO
-setup.cfg
-setup.py
-version.py
-fail2ban
-fail2ban.py
-firewall/__init__.py
-firewall/firewall.py
-logreader/__init__.py
-logreader/logreader.py
-confreader/__init__.py
-confreader/configreader.py
-utils/__init__.py
-utils/dns.py
-utils/process.py
-utils/mail.py
-utils/strings.py
-utils/pidlock.py
-config/fail2ban.conf.default
-config/gentoo-initd
-config/gentoo-confd
-config/redhat-initd
-config/debian-initd
-man/fail2ban.8
-man/fail2ban.conf.5
diff --git a/PKG-INFO b/PKG-INFO
new file mode 100644
index 00000000..35bfe63d
--- /dev/null
+++ b/PKG-INFO
@@ -0,0 +1,15 @@
+Metadata-Version: 1.0
+Name: fail2ban
+Version: 0.5.2
+Summary: Ban IPs that make too many password failure
+Home-page: http://fail2ban.sourceforge.net
+Author: Cyril Jaquier
+Author-email: lostcontrol@users.sourceforge.net
+License: GPL
+Description: 
+        Fail2Ban scans log files like /var/log/pwdfail or
+        /var/log/apache/error_log and bans IP that makes
+        too many password failures. It updates firewall rules
+        to reject the IP address or executes user defined
+        commands. It needs log4py.
+Platform: Posix
diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 45f063a7..e13e4045 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -1,6 +1,6 @@
 # Fail2Ban configuration file
 #
-# $Revision$
+# $Revision: 1.8.2.9 $
 #
 # 2005.06.21  modified for readability  Iain Lea  iain@bricbrac.de
 
diff --git a/config/gentoo-confd b/config/gentoo-confd
index e156c368..94f91d8e 100644
--- a/config/gentoo-confd
+++ b/config/gentoo-confd
@@ -16,7 +16,7 @@
 #
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.1 $
 
 # Command line options for Fail2Ban. Refer to "fail2ban.py -h" for
 # valid options.
diff --git a/config/gentoo-initd b/config/gentoo-initd
index 8cab7535..639a6a47 100755
--- a/config/gentoo-initd
+++ b/config/gentoo-initd
@@ -17,7 +17,7 @@
 #
 # Author: Sireyessire, Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.1.2.2 $
 
 opts="start stop restart showlog"
 
diff --git a/config/redhat-initd b/config/redhat-initd
index 6e885ab5..0b3655c3 100644
--- a/config/redhat-initd
+++ b/config/redhat-initd
@@ -1,78 +1,78 @@
-#!/bin/bash
-#
-# fail2ban
-#
-# chkconfig: 345 91 9
-# description: if many unsuccessfull login attempts from some ip address \
-#              during a short period happen, this address is banned \
-#              by the firewall
-#
-# Author: Andrey G. Grozin
-# 
-# $Revision$
-
-# Source function library.
-. /etc/init.d/functions
-
-# Get config.
-. /etc/sysconfig/network
-
-# Check that networking is up.
-[ "${NETWORKING}" = "no" ] && exit 0
-[ -f /etc/fail2ban.conf ] || exit 0
-
-FAIL2BAN="/usr/bin/fail2ban"
-PIDFILE="/var/run/fail2ban.pid"
-
-RETVAL=0
-
-start() {
-    echo -n $"Starting fail2ban: "
-    "${FAIL2BAN}" -b > /dev/null
-    RETVAL=$?
-    echo
-}
-
-stop() {
-    if [ -f "${PIDFILE}" ]; then
-	echo -n $"Stopping fail2ban: "
-	"${FAIL2BAN}" -k > /dev/null
-	echo
-    fi
-}
-
-restart() {
-    stop
-    start
-}
-
-# See how we were called.
-case "$1" in
-  start)
-        start
-        ;;
-  stop)
-        stop
-        ;;
-  status)
-        status fail2ban
-        RETVAL=$?
-        ;;
-  reload)
-        restart
-        ;;
-  restart)
-        restart
-        ;;
-  condrestart)
-        if [ -f "${PIDFILE}" ]; then
-            restart
-        fi
-        ;;
-  *)
-        echo $"Usage: $0 {start|stop|status|restart|condrestart}"
-        exit 1
-        ;;
-esac
-
-exit $RETVAL
+#!/bin/bash
+#
+# fail2ban
+#
+# chkconfig: 345 91 9
+# description: if many unsuccessfull login attempts from some ip address \
+#              during a short period happen, this address is banned \
+#              by the firewall
+#
+# Author: Andrey G. Grozin
+# 
+# $Revision: 1.1.2.2 $
+
+# Source function library.
+. /etc/init.d/functions
+
+# Get config.
+. /etc/sysconfig/network
+
+# Check that networking is up.
+[ "${NETWORKING}" = "no" ] && exit 0
+[ -f /etc/fail2ban.conf ] || exit 0
+
+FAIL2BAN="/usr/bin/fail2ban"
+PIDFILE="/var/run/fail2ban.pid"
+
+RETVAL=0
+
+start() {
+    echo -n $"Starting fail2ban: "
+    "${FAIL2BAN}" -b > /dev/null
+    RETVAL=$?
+    echo
+}
+
+stop() {
+    if [ -f "${PIDFILE}" ]; then
+	echo -n $"Stopping fail2ban: "
+	"${FAIL2BAN}" -k > /dev/null
+	echo
+    fi
+}
+
+restart() {
+    stop
+    start
+}
+
+# See how we were called.
+case "$1" in
+  start)
+        start
+        ;;
+  stop)
+        stop
+        ;;
+  status)
+        status fail2ban
+        RETVAL=$?
+        ;;
+  reload)
+        restart
+        ;;
+  restart)
+        restart
+        ;;
+  condrestart)
+        if [ -f "${PIDFILE}" ]; then
+            restart
+        fi
+        ;;
+  *)
+        echo $"Usage: $0 {start|stop|status|restart|condrestart}"
+        exit 1
+        ;;
+esac
+
+exit $RETVAL
diff --git a/confreader/__init__.py b/confreader/__init__.py
index 76dba873..b920907f 100644
--- a/confreader/__init__.py
+++ b/confreader/__init__.py
@@ -16,10 +16,10 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.1 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2005/02/18 13:26:41 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
\ No newline at end of file
diff --git a/confreader/configreader.py b/confreader/configreader.py
index 150858b5..336a36e0 100644
--- a/confreader/configreader.py
+++ b/confreader/configreader.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.5.2.5 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.5.2.5 $"
+__date__ = "$Date: 2005/08/01 16:31:13 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/fail2ban b/fail2ban
index 25777b3b..6de29b30 100755
--- a/fail2ban
+++ b/fail2ban
@@ -18,11 +18,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.4.2.5 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.4.2.5 $"
+__date__ = "$Date: 2005/08/04 20:51:14 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/fail2ban.py b/fail2ban.py
index 7e5bb516..883e9e82 100755
--- a/fail2ban.py
+++ b/fail2ban.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.20.2.13 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.20.2.13 $"
+__date__ = "$Date: 2005/08/06 18:44:06 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
@@ -137,14 +137,7 @@ def getCmdLineOptions(optList):
 		if opt[0] == "-p":
 			conf["pidlock"] = opt[1]
 		if opt[0] == "-k":
-			pid = checkForPID(conf["pidlock"])
-			if pid:
-				killPID(int(pid))
-				logSys.warn("Killed Fail2Ban with PID "+pid)
-				sys.exit(0)
-			else:
-				logSys.error("No running Fail2Ban found")
-				sys.exit(-1)
+			conf["kill"] = True
 
 def main():
 	""" Fail2Ban main function
@@ -196,6 +189,23 @@ def main():
 	
 	# Gets command line options
 	getCmdLineOptions(optList)
+	
+	# PID lock
+	pidLock.setPath(conf["pidlock"])
+	
+	# Now we can kill properly a running instance if needed
+	try:
+		conf["kill"]
+		pid = pidLock.exists()
+		if pid:
+			killPID(int(pid))
+			logSys.warn("Killed Fail2Ban with PID "+pid)
+			sys.exit(0)
+		else:
+			logSys.error("No running Fail2Ban found")
+			sys.exit(-1)
+	except KeyError:
+		pass
 
 	# Start Fail2Ban in daemon mode
 	if conf["background"]:
@@ -244,9 +254,6 @@ def main():
 		hdlr.setFormatter(formatter)
 		logSys.addHandler(hdlr)
 	
-	# PID lock
-	pidLock.setPath(conf["pidlock"])
-	
 	# Ignores IP list
 	ignoreIPList = conf["ignoreip"].split(' ')
 	
diff --git a/firewall/__init__.py b/firewall/__init__.py
index 76dba873..f25221f9 100644
--- a/firewall/__init__.py
+++ b/firewall/__init__.py
@@ -16,10 +16,10 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.1 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/09 15:33:33 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
\ No newline at end of file
diff --git a/firewall/firewall.py b/firewall/firewall.py
index b0da3826..567c8ce3 100644
--- a/firewall/firewall.py
+++ b/firewall/firewall.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.8.2.6 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.8.2.6 $"
+__date__ = "$Date: 2005/08/01 16:31:42 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/log-test/apache b/log-test/apache
deleted file mode 100644
index 227f8df9..00000000
--- a/log-test/apache
+++ /dev/null
@@ -1,108 +0,0 @@
-[Wed Mar 31 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Mon Jan 03 05:02:15 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:20 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:21 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msadc
-[Mon Jan 03 05:02:22 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/\xe0
-[Mon Jan 03 05:02:23 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msdac
-[Mon Jan 03 05:02:23 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/msdac
-[Mon Jan 03 05:02:24 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/PBServer
-[Mon Jan 03 05:02:24 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/PBServer
-[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/Rpc
-[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/Rpc
-[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/samples
-[Mon Jan 03 05:02:27 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/samples
-[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts..\xc1\x9c..
-[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:28 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:32 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:32 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:33 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:34 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:34 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:38 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:39 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 05:02:39 2005] [error] [client 81.83.248.17] File does not exist: /var/www/jaquier.dyndns.org/htdocs/scripts
-[Mon Jan 03 11:08:29 2005] [error] [client 128.178.150.127] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Mon Jan 03 20:08:52 2005] [error] [client 83.76.202.195] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:19:50 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:19:55 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:01 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:05 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:08 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:12 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:16 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:22 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:26 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:28 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 15:20:38 2005] [error] [client 213.221.138.70] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 20:54:59 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 20:55:04 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 20:55:29 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 21:34:29 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Tue Jan 04 21:34:32 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 00:17:41 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 00:18:03 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 00:18:12 2005] [error] [client 217.251.126.37] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:24:38 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:24:40 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:24:46 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:24:48 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:25:58 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:26:34 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 01:26:37 2005] [error] [client 81.63.51.202] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 10:13:02 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 10:13:07 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 10:13:10 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 10:17:07 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:41:40 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:41:45 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:41:47 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:41:51 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 14:55:30 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:03:44 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:03:48 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:03:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:03:57 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:06:45 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Mar 05 15:07:28 2005] [error] [client 192.168.0.128] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Jan 05 15:08:01 2005] [error] [client 192.168.0.128] user  not found: /phpinfo
-[Wed Jan 05 15:10:45 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/css/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
-[Wed Jan 05 15:10:45 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/images/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
-[Wed Jan 05 15:10:45 2005] [error] [client 192.168.0.128] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:11:09 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 05 15:11:10 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 06 15:11:11 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 06 15:11:13 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 06 15:11:14 2005] [error] [client 192.168.0.128] user test not found: /phpinfo
-[Wed Jan 05 15:11:15 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/css/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
-[Wed Jan 05 15:11:15 2005] [crit] [client 192.168.0.128] (13)Permission denied: /var/www/jaquier.dyndns.org/htdocs/images/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable, referer: http://earth/phpinfo
-[Wed Jan 05 15:11:15 2005] [error] [client 192.168.0.128] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:12:32 2005] [error] [client 212.101.4.200] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:48 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:51 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:52 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:54 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:56 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:13:59 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:14:20 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:14:24 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:14:29 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Jan 05 15:14:34 2005] [error] [client 192.168.0.129] File does not exist: /var/www/jaquier.dyndns.org/htdocs/favicon.ico
-[Wed Mar 10 15:08:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 10 15:09:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 10 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
-[Wed Mar 30 15:11:28 2005] [error] [client www.google.ch] user cyril: authentication failure for "/phpinfo": Password Mismatch
\ No newline at end of file
diff --git a/log-test/current b/log-test/current
deleted file mode 100644
index 18258689..00000000
--- a/log-test/current
+++ /dev/null
@@ -1,11 +0,0 @@
-Jan  7 17:53:15 [sshd] (pam_unix) 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.220.137.36  user=kevin
-Jan  7 17:53:26 [sshd] (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.220.137.36  user=kevin
-Mar  7 17:53:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
-Mar  7 17:55:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 62.220.137.36
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from 192.168.0.128
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from www.google.ch
-Mar  7 17:57:28 [sshd] error: PAM: Authentication failure for kevin from www.google.ch
diff --git a/log-test/test b/log-test/test
deleted file mode 100644
index d370ca46..00000000
--- a/log-test/test
+++ /dev/null
@@ -1,432 +0,0 @@
-Sep 28 13:18:43 [sshd] Failed password for illegal user test from 211.112.229.69 port 59506 ssh2
-Sep 28 13:18:45 [sshd] Failed password for illegal user guest from 211.112.229.69 port 59584 ssh2
-Sep 28 13:18:48 [sshd] Failed password for illegal user admin from 211.112.229.69 port 59668 ssh2
-Sep 28 13:18:51 [sshd] Failed password for illegal user admin from 211.112.229.69 port 59746 ssh2
-Sep 28 13:18:54 [sshd] Failed password for illegal user user from 211.112.229.69 port 59809 ssh2
-Sep 28 13:18:57 [sshd] Failed password for illegal user root from 211.112.229.69 port 59881 ssh2
-Sep 28 13:19:00 [sshd] Failed password for illegal user root from 211.112.229.69 port 59944 ssh2
-Sep 28 13:19:03 [sshd] Failed password for illegal user root from 211.112.229.69 port 59999 ssh2
-Sep 28 13:19:06 [sshd] Failed password for illegal user test from 211.112.229.69 port 60055 ssh2
-Sep 28 21:05:25 [sshd(pam_unix)] authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.128.local.home  user=cyril
-Sep 28 21:05:27 [sshd] error: PAM: Authentication failure for cyril from 192.168.0.128.local.home
-Sep 29 03:45:18 [sshd] Failed password for illegal user nobody from 203.198.168.66 port 55927 ssh2
-Sep 29 03:45:21 [sshd] Failed password for illegal user patrick from 203.198.168.66 port 55973 ssh2
-Sep 29 03:45:23 [sshd] Failed password for illegal user patrick from 203.198.168.66 port 56010 ssh2
-Sep 29 03:45:26 [sshd] Failed password for illegal user root from 203.198.168.66 port 56060 ssh2
-Sep 29 03:45:29 [sshd] Failed password for illegal user root from 203.198.168.66 port 56107 ssh2
-Sep 29 03:45:32 [sshd] Failed password for illegal user root from 203.198.168.66 port 56152 ssh2
-Sep 29 03:45:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 56200 ssh2
-Sep 29 03:45:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 56243 ssh2
-Sep 29 03:45:40 [sshd] Failed password for illegal user rolo from 203.198.168.66 port 56288 ssh2
-Sep 29 03:45:43 [sshd] Failed password for illegal user iceuser from 203.198.168.66 port 56333 ssh2
-Sep 29 03:45:46 [sshd] Failed password for illegal user horde from 203.198.168.66 port 56379 ssh2
-Sep 29 03:45:48 [sshd] Failed password for illegal user cyrus from 203.198.168.66 port 56425 ssh2
-Sep 29 03:45:52 [sshd] Failed password for illegal user www from 203.198.168.66 port 56470 ssh2
-Sep 29 03:45:55 [sshd] Failed password for illegal user wwwrun from 203.198.168.66 port 56534 ssh2
-Sep 29 03:45:58 [sshd] Failed password for illegal user matt from 203.198.168.66 port 56572 ssh2
-Sep 29 03:46:01 [sshd] Failed password for illegal user test from 203.198.168.66 port 56616 ssh2
-Sep 29 03:46:03 [sshd] Failed password for illegal user test from 203.198.168.66 port 56660 ssh2
-Sep 29 03:46:06 [sshd] Failed password for illegal user test from 203.198.168.66 port 56704 ssh2
-Sep 29 03:46:09 [sshd] Failed password for illegal user test from 203.198.168.66 port 56752 ssh2
-Sep 29 03:46:12 [sshd] Failed password for illegal user www-data from 203.198.168.66 port 56795 ssh2
-Sep 29 03:46:15 [sshd] Failed password for illegal user mysql from 203.198.168.66 port 56839 ssh2
-Sep 29 03:46:17 [sshd] Failed password for illegal user operator from 203.198.168.66 port 56882 ssh2
-Sep 29 03:46:20 [sshd] Failed password for illegal user adm from 203.198.168.66 port 56929 ssh2
-Sep 29 03:46:23 [sshd] Failed password for illegal user apache from 203.198.168.66 port 56971 ssh2
-Sep 29 03:46:26 [sshd] Failed password for illegal user irc from 203.198.168.66 port 57011 ssh2
-Sep 29 03:46:29 [sshd] Failed password for illegal user irc from 203.198.168.66 port 57060 ssh2
-Sep 29 03:46:31 [sshd] Failed password for illegal user adm from 203.198.168.66 port 57100 ssh2
-Sep 29 03:46:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 57148 ssh2
-Sep 29 03:46:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 57194 ssh2
-Sep 29 03:46:40 [sshd] Failed password for illegal user root from 203.198.168.66 port 57236 ssh2
-Sep 29 03:46:43 [sshd] Failed password for illegal user jane from 203.198.168.66 port 57281 ssh2
-Sep 29 03:46:45 [sshd] Failed password for illegal user pamela from 203.198.168.66 port 57328 ssh2
-Sep 29 03:46:48 [sshd] Failed password for illegal user root from 203.198.168.66 port 57372 ssh2
-Sep 29 03:46:51 [sshd] Failed password for illegal user root from 203.198.168.66 port 57418 ssh2
-Sep 29 03:46:54 [sshd] Failed password for illegal user root from 203.198.168.66 port 57463 ssh2
-Sep 29 03:46:57 [sshd] Failed password for illegal user root from 203.198.168.66 port 57506 ssh2
-Sep 29 03:46:59 [sshd] Failed password for illegal user root from 203.198.168.66 port 57549 ssh2
-Sep 29 03:47:02 [sshd] Failed password for illegal user cosmin from 203.198.168.66 port 57594 ssh2
-Sep 29 03:47:05 [sshd] Failed password for illegal user root from 203.198.168.66 port 57637 ssh2
-Sep 29 03:47:08 [sshd] Failed password for illegal user root from 203.198.168.66 port 57689 ssh2
-Sep 29 03:47:11 [sshd] Failed password for illegal user root from 203.198.168.66 port 57730 ssh2
-Sep 29 03:47:13 [sshd] Failed password for illegal user root from 203.198.168.66 port 57774 ssh2
-Sep 29 03:47:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 57820 ssh2
-Sep 29 03:47:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 57866 ssh2
-Sep 29 03:47:22 [sshd] Failed password for illegal user root from 203.198.168.66 port 57901 ssh2
-Sep 29 03:47:25 [sshd] Failed password for illegal user root from 203.198.168.66 port 57944 ssh2
-Sep 29 03:47:27 [sshd] Failed password for illegal user root from 203.198.168.66 port 57990 ssh2
-Sep 29 03:47:31 [sshd] Failed password for illegal user root from 203.198.168.66 port 58031 ssh2
-Sep 29 03:47:34 [sshd] Failed password for illegal user root from 203.198.168.66 port 58098 ssh2
-Sep 29 03:47:37 [sshd] Failed password for illegal user root from 203.198.168.66 port 58137 ssh2
-Sep 29 03:47:40 [sshd] Failed password for illegal user root from 203.198.168.66 port 58183 ssh2
-Sep 29 03:47:42 [sshd] Failed password for illegal user root from 203.198.168.66 port 58228 ssh2
-Sep 29 03:47:45 [sshd] Failed password for illegal user root from 203.198.168.66 port 58273 ssh2
-Sep 29 03:47:48 [sshd] Failed password for illegal user root from 203.198.168.66 port 58314 ssh2
-Sep 29 03:47:51 [sshd] Failed password for illegal user root from 203.198.168.66 port 58358 ssh2
-Sep 29 03:47:54 [sshd] Failed password for illegal user root from 203.198.168.66 port 58401 ssh2
-Sep 29 03:47:56 [sshd] Failed password for illegal user root from 203.198.168.66 port 58443 ssh2
-Sep 29 03:47:59 [sshd] Failed password for illegal user root from 203.198.168.66 port 58484 ssh2
-Sep 29 03:48:02 [sshd] Failed password for illegal user root from 203.198.168.66 port 58528 ssh2
-Sep 29 03:48:05 [sshd] Failed password for illegal user root from 203.198.168.66 port 58574 ssh2
-Sep 29 03:48:07 [sshd] Failed password for illegal user root from 203.198.168.66 port 58613 ssh2
-Sep 29 03:48:10 [sshd] Failed password for illegal user root from 203.198.168.66 port 58662 ssh2
-Sep 29 03:48:13 [sshd] Failed password for illegal user root from 203.198.168.66 port 58703 ssh2
-Sep 29 03:48:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 58748 ssh2
-Sep 29 03:48:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 58792 ssh2
-Sep 29 03:48:21 [sshd] Failed password for illegal user root from 203.198.168.66 port 58839 ssh2
-Sep 29 03:48:24 [sshd] Failed password for illegal user root from 203.198.168.66 port 58880 ssh2
-Sep 29 03:48:27 [sshd] Failed password for illegal user root from 203.198.168.66 port 58926 ssh2
-Sep 29 03:48:30 [sshd] Failed password for illegal user root from 203.198.168.66 port 58967 ssh2
-Sep 29 03:48:33 [sshd] Failed password for illegal user root from 203.198.168.66 port 59012 ssh2
-Sep 29 03:48:35 [sshd] Failed password for illegal user root from 203.198.168.66 port 59052 ssh2
-Sep 29 03:48:38 [sshd] Failed password for illegal user root from 203.198.168.66 port 59095 ssh2
-Sep 29 03:48:41 [sshd] Failed password for illegal user root from 203.198.168.66 port 59140 ssh2
-Sep 29 03:48:44 [sshd] Failed password for illegal user root from 203.198.168.66 port 59182 ssh2
-Sep 29 03:48:47 [sshd] Failed password for illegal user cip52 from 203.198.168.66 port 59222 ssh2
-Sep 29 03:48:49 [sshd] Failed password for illegal user cip51 from 203.198.168.66 port 59264 ssh2
-Sep 29 03:48:52 [sshd] Failed password for illegal user root from 203.198.168.66 port 59309 ssh2
-Sep 29 03:48:55 [sshd] Failed password for illegal user noc from 203.198.168.66 port 59351 ssh2
-Sep 29 03:48:58 [sshd] Failed password for illegal user root from 203.198.168.66 port 59395 ssh2
-Sep 29 03:49:01 [sshd] Failed password for illegal user root from 203.198.168.66 port 59432 ssh2
-Sep 29 03:49:04 [sshd] Failed password for illegal user root from 203.198.168.66 port 59479 ssh2
-Sep 29 03:49:07 [sshd] Failed password for illegal user root from 203.198.168.66 port 59951 ssh2
-Sep 29 03:49:11 [sshd] Failed password for illegal user webmaster from 203.198.168.66 port 60006 ssh2
-Sep 29 03:49:14 [sshd] Failed password for illegal user data from 203.198.168.66 port 60463 ssh2
-Sep 29 03:49:17 [sshd] Failed password for illegal user user from 203.198.168.66 port 60880 ssh2
-Sep 29 03:49:20 [sshd] Failed password for illegal user user from 203.198.168.66 port 60947 ssh2
-Sep 29 03:49:23 [sshd] Failed password for illegal user user from 203.198.168.66 port 33137 ssh2
-Sep 29 03:49:26 [sshd] Failed password for illegal user web from 203.198.168.66 port 33572 ssh2
-Sep 29 03:49:31 [sshd] Failed password for illegal user web from 203.198.168.66 port 33630 ssh2
-Sep 29 03:49:34 [sshd] Failed password for illegal user oracle from 203.198.168.66 port 34129 ssh2
-Sep 29 03:49:39 [sshd] Failed password for illegal user sybase from 203.198.168.66 port 34558 ssh2
-Sep 29 03:49:42 [sshd] Failed password for illegal user master from 203.198.168.66 port 35018 ssh2
-Sep 29 03:49:45 [sshd] Failed password for illegal user account from 203.198.168.66 port 35095 ssh2
-Sep 29 03:49:48 [sshd] Failed password for illegal user backup from 203.198.168.66 port 35506 ssh2
-Sep 29 03:49:51 [sshd] Failed password for illegal user server from 203.198.168.66 port 35935 ssh2
-Sep 29 03:49:54 [sshd] Failed password for illegal user adam from 203.198.168.66 port 36016 ssh2
-Sep 29 03:49:57 [sshd] Failed password for illegal user alan from 203.198.168.66 port 36399 ssh2
-Sep 29 03:49:59 [sshd] Failed password for illegal user frank from 203.198.168.66 port 36488 ssh2
-Sep 29 03:50:04 [sshd] Failed password for illegal user george from 203.198.168.66 port 36876 ssh2
-Sep 29 03:50:07 [sshd] Failed password for illegal user henry from 203.198.168.66 port 37333 ssh2
-Sep 29 03:50:11 [sshd] Failed password for illegal user john from 203.198.168.66 port 37423 ssh2
-Sep 29 03:50:14 [sshd] Failed password for illegal user root from 203.198.168.66 port 37837 ssh2
-Sep 29 03:50:16 [sshd] Failed password for illegal user root from 203.198.168.66 port 38210 ssh2
-Sep 29 03:50:19 [sshd] Failed password for illegal user root from 203.198.168.66 port 38286 ssh2
-Sep 29 03:50:22 [sshd] Failed password for illegal user root from 203.198.168.66 port 38653 ssh2
-Sep 29 03:50:26 [sshd] Failed password for illegal user root from 203.198.168.66 port 38749 ssh2
-Sep 29 03:50:29 [sshd] Failed password for illegal user test from 203.198.168.66 port 39162 ssh2
-Sep 29 10:19:26 [sshd] Failed password for illegal user test from 24.19.0.105 port 3765 ssh2
-Sep 29 10:19:32 [sshd] Failed password for illegal user guest from 24.19.0.105 port 3846 ssh2
-Sep 29 10:19:39 [sshd] Failed password for illegal user admin from 24.19.0.105 port 3929 ssh2
-Sep 29 10:19:45 [sshd] Failed password for illegal user admin from 24.19.0.105 port 3992 ssh2
-Sep 29 10:19:49 [sshd] Failed password for illegal user user from 24.19.0.105 port 4057 ssh2
-Sep 29 10:19:54 [sshd] Failed password for illegal user root from 24.19.0.105 port 4115 ssh2
-Sep 29 10:19:58 [sshd] Failed password for illegal user root from 24.19.0.105 port 4170 ssh2
-Sep 29 10:20:01 [sshd] Failed password for illegal user root from 24.19.0.105 port 4202 ssh2
-Sep 29 10:20:04 [sshd] Failed password for illegal user test from 24.19.0.105 port 4242 ssh2
-Oct  1 15:53:46 [sshd] Failed password for illegal user test from 210.51.173.75 port 40940 ssh2
-Oct  1 15:53:53 [sshd] Failed password for illegal user guest from 210.51.173.75 port 41196 ssh2
-Oct  1 15:53:59 [sshd] Failed password for illegal user admin from 210.51.173.75 port 41480 ssh2
-Oct  1 15:54:05 [sshd] Failed password for illegal user admin from 210.51.173.75 port 41738 ssh2
-Oct  1 15:54:12 [sshd] Failed password for illegal user user from 210.51.173.75 port 42036 ssh2
-Oct  1 15:54:18 [sshd] Failed password for illegal user root from 210.51.173.75 port 42393 ssh2
-Oct  1 15:54:24 [sshd] Failed password for illegal user root from 210.51.173.75 port 42721 ssh2
-Oct  1 15:54:30 [sshd] Failed password for illegal user root from 210.51.173.75 port 42984 ssh2
-Oct  1 15:54:36 [sshd] Failed password for illegal user test from 210.51.173.75 port 43299 ssh2
-Oct  2 20:24:36 [sshd] Failed password for illegal user test from 220.64.223.249 port 2460 ssh2
-Oct  2 20:24:39 [sshd] Failed password for illegal user guest from 220.64.223.249 port 2527 ssh2
-Oct  2 20:24:42 [sshd] Failed password for illegal user admin from 220.64.223.249 port 2584 ssh2
-Oct  2 20:24:45 [sshd] Failed password for illegal user admin from 220.64.223.249 port 2645 ssh2
-Oct  2 20:24:48 [sshd] Failed password for illegal user user from 220.64.223.249 port 2708 ssh2
-Oct  2 20:24:51 [sshd] Failed password for illegal user root from 220.64.223.249 port 2794 ssh2
-Oct  2 20:24:54 [sshd] Failed password for illegal user root from 220.64.223.249 port 2868 ssh2
-Oct  2 20:24:58 [sshd] Failed password for illegal user root from 220.64.223.249 port 2931 ssh2
-Oct  2 20:25:01 [sshd] Failed password for illegal user test from 220.64.223.249 port 2994 ssh2
-Oct  3 02:17:47 [sshd] Failed password for illegal user nobody from 216.65.197.170 port 54324 ssh2
-Oct  3 02:17:48 [sshd] Failed password for illegal user patrick from 216.65.197.170 port 54491 ssh2
-Oct  3 02:17:50 [sshd] Failed password for illegal user patrick from 216.65.197.170 port 54669 ssh2
-Oct  3 02:17:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 54845 ssh2
-Oct  3 02:17:53 [sshd] Failed password for illegal user root from 216.65.197.170 port 55021 ssh2
-Oct  3 02:17:55 [sshd] Failed password for illegal user root from 216.65.197.170 port 55201 ssh2
-Oct  3 02:17:57 [sshd] Failed password for illegal user root from 216.65.197.170 port 55381 ssh2
-Oct  3 02:17:59 [sshd] Failed password for illegal user root from 216.65.197.170 port 55553 ssh2
-Oct  3 02:18:00 [sshd] Failed password for illegal user rolo from 216.65.197.170 port 55730 ssh2
-Oct  3 02:18:02 [sshd] Failed password for illegal user iceuser from 216.65.197.170 port 55892 ssh2
-Oct  3 02:18:04 [sshd] Failed password for illegal user horde from 216.65.197.170 port 56054 ssh2
-Oct  3 02:18:05 [sshd] Failed password for illegal user cyrus from 216.65.197.170 port 56231 ssh2
-Oct  3 02:18:07 [sshd] Failed password for illegal user www from 216.65.197.170 port 56412 ssh2
-Oct  3 02:18:09 [sshd] Failed password for illegal user wwwrun from 216.65.197.170 port 56594 ssh2
-Oct  3 02:18:11 [sshd] Failed password for illegal user matt from 216.65.197.170 port 56755 ssh2
-Oct  3 02:18:12 [sshd] Failed password for illegal user test from 216.65.197.170 port 56928 ssh2
-Oct  3 02:18:14 [sshd] Failed password for illegal user test from 216.65.197.170 port 57112 ssh2
-Oct  3 02:18:16 [sshd] Failed password for illegal user test from 216.65.197.170 port 57292 ssh2
-Oct  3 02:18:17 [sshd] Failed password for illegal user test from 216.65.197.170 port 57465 ssh2
-Oct  3 02:18:19 [sshd] Failed password for illegal user www-data from 216.65.197.170 port 57631 ssh2
-Oct  3 02:18:21 [sshd] Failed password for illegal user mysql from 216.65.197.170 port 57802 ssh2
-Oct  3 02:18:22 [sshd] Failed password for illegal user operator from 216.65.197.170 port 57989 ssh2
-Oct  3 02:18:24 [sshd] Failed password for illegal user adm from 216.65.197.170 port 58151 ssh2
-Oct  3 02:18:26 [sshd] Failed password for illegal user apache from 216.65.197.170 port 58319 ssh2
-Oct  3 02:18:28 [sshd] Failed password for illegal user irc from 216.65.197.170 port 58492 ssh2
-Oct  3 02:18:29 [sshd] Failed password for illegal user irc from 216.65.197.170 port 58662 ssh2
-Oct  3 02:18:31 [sshd] Failed password for illegal user adm from 216.65.197.170 port 58818 ssh2
-Oct  3 02:18:33 [sshd] Failed password for illegal user root from 216.65.197.170 port 58976 ssh2
-Oct  3 02:18:34 [sshd] Failed password for illegal user root from 216.65.197.170 port 59147 ssh2
-Oct  3 02:18:36 [sshd] Failed password for illegal user root from 216.65.197.170 port 59306 ssh2
-Oct  3 02:18:38 [sshd] Failed password for illegal user jane from 216.65.197.170 port 59474 ssh2
-Oct  3 02:18:40 [sshd] Failed password for illegal user pamela from 216.65.197.170 port 59644 ssh2
-Oct  3 02:18:41 [sshd] Failed password for illegal user root from 216.65.197.170 port 59797 ssh2
-Oct  3 02:18:43 [sshd] Failed password for illegal user root from 216.65.197.170 port 59963 ssh2
-Oct  3 02:18:45 [sshd] Failed password for illegal user root from 216.65.197.170 port 60139 ssh2
-Oct  3 02:18:47 [sshd] Failed password for illegal user root from 216.65.197.170 port 60308 ssh2
-Oct  3 02:18:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 60479 ssh2
-Oct  3 02:18:50 [sshd] Failed password for illegal user cosmin from 216.65.197.170 port 60654 ssh2
-Oct  3 02:18:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 60830 ssh2
-Oct  3 02:18:54 [sshd] Failed password for illegal user root from 216.65.197.170 port 60992 ssh2
-Oct  3 02:18:55 [sshd] Failed password for illegal user root from 216.65.197.170 port 32945 ssh2
-Oct  3 02:18:58 [sshd] Failed password for illegal user root from 216.65.197.170 port 33101 ssh2
-Oct  3 02:18:59 [sshd] Failed password for illegal user root from 216.65.197.170 port 33343 ssh2
-Oct  3 02:19:02 [sshd] Failed password for illegal user root from 216.65.197.170 port 33501 ssh2
-Oct  3 02:19:03 [sshd] Failed password for illegal user root from 216.65.197.170 port 33733 ssh2
-Oct  3 02:19:05 [sshd] Failed password for illegal user root from 216.65.197.170 port 33892 ssh2
-Oct  3 02:19:07 [sshd] Failed password for illegal user root from 216.65.197.170 port 34066 ssh2
-Oct  3 02:19:08 [sshd] Failed password for illegal user root from 216.65.197.170 port 34212 ssh2
-Oct  3 02:19:10 [sshd] Failed password for illegal user root from 216.65.197.170 port 34376 ssh2
-Oct  3 02:19:12 [sshd] Failed password for illegal user root from 216.65.197.170 port 34535 ssh2
-Oct  3 02:19:14 [sshd] Failed password for illegal user root from 216.65.197.170 port 34704 ssh2
-Oct  3 02:19:16 [sshd] Failed password for illegal user root from 216.65.197.170 port 34853 ssh2
-Oct  3 02:19:18 [sshd] Failed password for illegal user root from 216.65.197.170 port 35092 ssh2
-Oct  3 02:19:19 [sshd] Failed password for illegal user root from 216.65.197.170 port 35261 ssh2
-Oct  3 02:19:21 [sshd] Failed password for illegal user root from 216.65.197.170 port 35425 ssh2
-Oct  3 02:19:23 [sshd] Failed password for illegal user root from 216.65.197.170 port 35583 ssh2
-Oct  3 02:19:24 [sshd] Failed password for illegal user root from 216.65.197.170 port 35753 ssh2
-Oct  3 02:19:26 [sshd] Failed password for illegal user root from 216.65.197.170 port 35901 ssh2
-Oct  3 02:19:28 [sshd] Failed password for illegal user root from 216.65.197.170 port 36068 ssh2
-Oct  3 02:19:30 [sshd] Failed password for illegal user root from 216.65.197.170 port 36227 ssh2
-Oct  3 02:19:33 [sshd] Failed password for illegal user root from 216.65.197.170 port 36453 ssh2
-Oct  3 02:19:34 [sshd] Failed password for illegal user root from 216.65.197.170 port 36673 ssh2
-Oct  3 02:19:36 [sshd] Failed password for illegal user root from 216.65.197.170 port 36823 ssh2
-Oct  3 02:19:38 [sshd] Failed password for illegal user root from 216.65.197.170 port 36981 ssh2
-Oct  3 02:19:39 [sshd] Failed password for illegal user root from 216.65.197.170 port 37152 ssh2
-Oct  3 02:19:41 [sshd] Failed password for illegal user root from 216.65.197.170 port 37310 ssh2
-Oct  3 02:19:43 [sshd] Failed password for illegal user root from 216.65.197.170 port 37484 ssh2
-Oct  3 02:19:45 [sshd] Failed password for illegal user root from 216.65.197.170 port 37644 ssh2
-Oct  3 02:19:46 [sshd] Failed password for illegal user root from 216.65.197.170 port 37827 ssh2
-Oct  3 02:19:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 37989 ssh2
-Oct  3 02:19:50 [sshd] Failed password for illegal user root from 216.65.197.170 port 38163 ssh2
-Oct  3 02:19:52 [sshd] Failed password for illegal user root from 216.65.197.170 port 38329 ssh2
-Oct  3 02:19:54 [sshd] Failed password for illegal user root from 216.65.197.170 port 38559 ssh2
-Oct  3 02:19:56 [sshd] Failed password for illegal user root from 216.65.197.170 port 38735 ssh2
-Oct  3 02:19:58 [sshd] Failed password for illegal user cip52 from 216.65.197.170 port 38893 ssh2
-Oct  3 02:20:00 [sshd] Failed password for illegal user cip51 from 216.65.197.170 port 39109 ssh2
-Oct  3 02:20:01 [sshd] Failed password for illegal user root from 216.65.197.170 port 39282 ssh2
-Oct  3 02:20:03 [sshd] Failed password for illegal user noc from 216.65.197.170 port 39448 ssh2
-Oct  3 02:20:05 [sshd] Failed password for illegal user root from 216.65.197.170 port 39621 ssh2
-Oct  3 02:20:06 [sshd] Failed password for illegal user root from 216.65.197.170 port 39781 ssh2
-Oct  3 02:20:08 [sshd] Failed password for illegal user root from 216.65.197.170 port 39958 ssh2
-Oct  3 02:20:10 [sshd] Failed password for illegal user root from 216.65.197.170 port 40125 ssh2
-Oct  3 02:20:12 [sshd] Failed password for illegal user webmaster from 216.65.197.170 port 40316 ssh2
-Oct  3 02:20:13 [sshd] Failed password for illegal user data from 216.65.197.170 port 40473 ssh2
-Oct  3 02:20:15 [sshd] Failed password for illegal user user from 216.65.197.170 port 40645 ssh2
-Oct  3 02:20:17 [sshd] Failed password for illegal user user from 216.65.197.170 port 40800 ssh2
-Oct  3 02:20:19 [sshd] Failed password for illegal user user from 216.65.197.170 port 40965 ssh2
-Oct  3 02:20:20 [sshd] Failed password for illegal user web from 216.65.197.170 port 41120 ssh2
-Oct  3 02:20:22 [sshd] Failed password for illegal user web from 216.65.197.170 port 41300 ssh2
-Oct  3 02:20:24 [sshd] Failed password for illegal user oracle from 216.65.197.170 port 41468 ssh2
-Oct  3 02:20:25 [sshd] Failed password for illegal user sybase from 216.65.197.170 port 41642 ssh2
-Oct  3 02:20:27 [sshd] Failed password for illegal user master from 216.65.197.170 port 41809 ssh2
-Oct  3 02:20:29 [sshd] Failed password for illegal user account from 216.65.197.170 port 41987 ssh2
-Oct  3 02:20:31 [sshd] Failed password for illegal user backup from 216.65.197.170 port 42143 ssh2
-Oct  3 02:20:32 [sshd] Failed password for illegal user server from 216.65.197.170 port 42316 ssh2
-Oct  3 02:20:34 [sshd] Failed password for illegal user adam from 216.65.197.170 port 42481 ssh2
-Oct  3 02:20:36 [sshd] Failed password for illegal user alan from 216.65.197.170 port 42647 ssh2
-Oct  3 02:20:37 [sshd] Failed password for illegal user frank from 216.65.197.170 port 42817 ssh2
-Oct  3 02:20:39 [sshd] Failed password for illegal user george from 216.65.197.170 port 42993 ssh2
-Oct  3 02:20:41 [sshd] Failed password for illegal user henry from 216.65.197.170 port 43170 ssh2
-Oct  3 02:20:43 [sshd] Failed password for illegal user john from 216.65.197.170 port 43319 ssh2
-Oct  3 02:20:44 [sshd] Failed password for illegal user root from 216.65.197.170 port 43504 ssh2
-Oct  3 02:20:46 [sshd] Failed password for illegal user root from 216.65.197.170 port 43664 ssh2
-Oct  3 02:20:48 [sshd] Failed password for illegal user root from 216.65.197.170 port 43844 ssh2
-Oct  3 02:20:49 [sshd] Failed password for illegal user root from 216.65.197.170 port 44008 ssh2
-Oct  3 02:20:51 [sshd] Failed password for illegal user root from 216.65.197.170 port 44182 ssh2
-Oct  3 02:20:53 [sshd] Failed password for illegal user test from 216.65.197.170 port 44338 ssh2
-Oct  3 06:37:34 [sshd] Failed password for illegal user nobody from 217.56.33.194 port 1969 ssh2
-Oct  3 06:37:36 [sshd] Failed password for illegal user patrick from 217.56.33.194 port 2002 ssh2
-Oct  3 06:37:37 [sshd] Failed password for illegal user patrick from 217.56.33.194 port 2039 ssh2
-Oct  3 06:37:38 [sshd] Failed password for illegal user root from 217.56.33.194 port 2070 ssh2
-Oct  3 06:37:40 [sshd] Failed password for illegal user root from 217.56.33.194 port 2109 ssh2
-Oct  3 06:37:41 [sshd] Failed password for illegal user root from 217.56.33.194 port 2142 ssh2
-Oct  3 06:37:42 [sshd] Failed password for illegal user root from 217.56.33.194 port 2173 ssh2
-Oct  3 06:37:44 [sshd] Failed password for illegal user root from 217.56.33.194 port 2211 ssh2
-Oct  3 06:37:45 [sshd] Failed password for illegal user rolo from 217.56.33.194 port 2244 ssh2
-Oct  3 06:37:46 [sshd] Failed password for illegal user iceuser from 217.56.33.194 port 2272 ssh2
-Oct  3 06:37:48 [sshd] Failed password for illegal user horde from 217.56.33.194 port 2305 ssh2
-Oct  3 06:37:49 [sshd] Failed password for illegal user cyrus from 217.56.33.194 port 2337 ssh2
-Oct  3 06:37:50 [sshd] Failed password for illegal user www from 217.56.33.194 port 2373 ssh2
-Oct  3 06:37:52 [sshd] Failed password for illegal user wwwrun from 217.56.33.194 port 2407 ssh2
-Oct  3 06:37:53 [sshd] Failed password for illegal user matt from 217.56.33.194 port 2439 ssh2
-Oct  3 06:37:55 [sshd] Failed password for illegal user test from 217.56.33.194 port 2466 ssh2
-Oct  3 06:37:56 [sshd] Failed password for illegal user test from 217.56.33.194 port 2501 ssh2
-Oct  3 06:37:57 [sshd] Failed password for illegal user test from 217.56.33.194 port 2533 ssh2
-Oct  3 06:37:59 [sshd] Failed password for illegal user test from 217.56.33.194 port 2567 ssh2
-Oct  3 06:38:00 [sshd] Failed password for illegal user www-data from 217.56.33.194 port 2605 ssh2
-Oct  3 06:38:01 [sshd] Failed password for illegal user mysql from 217.56.33.194 port 2635 ssh2
-Oct  3 06:38:03 [sshd] Failed password for illegal user operator from 217.56.33.194 port 2667 ssh2
-Oct  3 06:38:04 [sshd] Failed password for illegal user adm from 217.56.33.194 port 2697 ssh2
-Oct  3 06:38:05 [sshd] Failed password for illegal user apache from 217.56.33.194 port 2733 ssh2
-Oct  3 06:38:07 [sshd] Failed password for illegal user irc from 217.56.33.194 port 2768 ssh2
-Oct  3 06:38:08 [sshd] Failed password for illegal user irc from 217.56.33.194 port 2804 ssh2
-Oct  3 06:38:09 [sshd] Failed password for illegal user adm from 217.56.33.194 port 2837 ssh2
-Oct  3 06:38:11 [sshd] Failed password for illegal user root from 217.56.33.194 port 2872 ssh2
-Oct  3 06:38:13 [sshd] Failed password for illegal user root from 217.56.33.194 port 2907 ssh2
-Oct  3 06:38:14 [sshd] Failed password for illegal user root from 217.56.33.194 port 2950 ssh2
-Oct  3 06:38:16 [sshd] Failed password for illegal user jane from 217.56.33.194 port 2986 ssh2
-Oct  3 06:38:17 [sshd] Failed password for illegal user pamela from 217.56.33.194 port 3019 ssh2
-Oct  3 06:38:18 [sshd] Failed password for illegal user root from 217.56.33.194 port 3053 ssh2
-Oct  3 06:38:20 [sshd] Failed password for illegal user root from 217.56.33.194 port 3085 ssh2
-Oct  3 06:38:21 [sshd] Failed password for illegal user root from 217.56.33.194 port 3115 ssh2
-Oct  3 06:38:22 [sshd] Failed password for illegal user root from 217.56.33.194 port 3147 ssh2
-Oct  3 06:38:24 [sshd] Failed password for illegal user root from 217.56.33.194 port 3177 ssh2
-Oct  3 06:38:25 [sshd] Failed password for illegal user cosmin from 217.56.33.194 port 3208 ssh2
-Oct  3 06:38:26 [sshd] Failed password for illegal user root from 217.56.33.194 port 3239 ssh2
-Oct  3 06:38:28 [sshd] Failed password for illegal user root from 217.56.33.194 port 3272 ssh2
-Oct  3 06:38:29 [sshd] Failed password for illegal user root from 217.56.33.194 port 3302 ssh2
-Oct  3 06:38:30 [sshd] Failed password for illegal user root from 217.56.33.194 port 3336 ssh2
-Oct  3 06:38:32 [sshd] Failed password for illegal user root from 217.56.33.194 port 3367 ssh2
-Oct  3 06:38:33 [sshd] Failed password for illegal user root from 217.56.33.194 port 3403 ssh2
-Oct  3 06:38:34 [sshd] Failed password for illegal user root from 217.56.33.194 port 3432 ssh2
-Oct  3 06:38:36 [sshd] Failed password for illegal user root from 217.56.33.194 port 3458 ssh2
-Oct  3 06:38:37 [sshd] Failed password for illegal user root from 217.56.33.194 port 3494 ssh2
-Oct  3 06:38:38 [sshd] Failed password for illegal user root from 217.56.33.194 port 3525 ssh2
-Oct  3 06:38:40 [sshd] Failed password for illegal user root from 217.56.33.194 port 3554 ssh2
-Oct  3 06:38:41 [sshd] Failed password for illegal user root from 217.56.33.194 port 3590 ssh2
-Oct  3 06:38:42 [sshd] Failed password for illegal user root from 217.56.33.194 port 3623 ssh2
-Oct  3 06:38:44 [sshd] Failed password for illegal user root from 217.56.33.194 port 3654 ssh2
-Oct  3 06:38:45 [sshd] Failed password for illegal user root from 217.56.33.194 port 3690 ssh2
-Oct  3 06:38:46 [sshd] Failed password for illegal user root from 217.56.33.194 port 3720 ssh2
-Oct  3 06:38:48 [sshd] Failed password for illegal user root from 217.56.33.194 port 3752 ssh2
-Oct  3 06:38:49 [sshd] Failed password for illegal user root from 217.56.33.194 port 3785 ssh2
-Oct  3 06:38:51 [sshd] Failed password for illegal user root from 217.56.33.194 port 3817 ssh2
-Oct  3 06:38:52 [sshd] Failed password for illegal user root from 217.56.33.194 port 3853 ssh2
-Oct  3 06:38:53 [sshd] Failed password for illegal user root from 217.56.33.194 port 3886 ssh2
-Oct  3 06:38:55 [sshd] Failed password for illegal user root from 217.56.33.194 port 3923 ssh2
-Oct  3 06:38:56 [sshd] Failed password for illegal user root from 217.56.33.194 port 3955 ssh2
-Oct  3 06:38:57 [sshd] Failed password for illegal user root from 217.56.33.194 port 3983 ssh2
-Oct  3 06:38:59 [sshd] Failed password for illegal user root from 217.56.33.194 port 4016 ssh2
-Oct  3 06:39:00 [sshd] Failed password for illegal user root from 217.56.33.194 port 4045 ssh2
-Oct  3 06:39:01 [sshd] Failed password for illegal user root from 217.56.33.194 port 4073 ssh2
-Oct  3 06:39:03 [sshd] Failed password for illegal user root from 217.56.33.194 port 4110 ssh2
-Oct  3 06:39:04 [sshd] Failed password for illegal user root from 217.56.33.194 port 4140 ssh2
-Oct  3 06:39:05 [sshd] Failed password for illegal user root from 217.56.33.194 port 4171 ssh2
-Oct  3 06:39:07 [sshd] Failed password for illegal user root from 217.56.33.194 port 4201 ssh2
-Oct  3 06:39:08 [sshd] Failed password for illegal user root from 217.56.33.194 port 4235 ssh2
-Oct  3 06:39:09 [sshd] Failed password for illegal user root from 217.56.33.194 port 4267 ssh2
-Oct  3 06:39:11 [sshd] Failed password for illegal user root from 217.56.33.194 port 4300 ssh2
-Oct  3 06:39:12 [sshd] Failed password for illegal user root from 217.56.33.194 port 4326 ssh2
-Oct  3 06:39:13 [sshd] Failed password for illegal user root from 217.56.33.194 port 4358 ssh2
-Oct  3 06:39:15 [sshd] Failed password for illegal user cip52 from 217.56.33.194 port 4390 ssh2
-Oct  3 06:39:16 [sshd] Failed password for illegal user cip51 from 217.56.33.194 port 4427 ssh2
-Oct  3 06:39:18 [sshd] Failed password for illegal user root from 217.56.33.194 port 4459 ssh2
-Oct  3 06:39:19 [sshd] Failed password for illegal user noc from 217.56.33.194 port 4492 ssh2
-Oct  3 06:39:20 [sshd] Failed password for illegal user root from 217.56.33.194 port 4526 ssh2
-Oct  3 06:39:22 [sshd] Failed password for illegal user root from 217.56.33.194 port 4557 ssh2
-Oct  3 06:39:23 [sshd] Failed password for illegal user root from 217.56.33.194 port 4588 ssh2
-Oct  3 06:39:24 [sshd] Failed password for illegal user root from 217.56.33.194 port 4618 ssh2
-Oct  3 06:39:26 [sshd] Failed password for illegal user webmaster from 217.56.33.194 port 4652 ssh2
-Oct  3 06:39:27 [sshd] Failed password for illegal user data from 217.56.33.194 port 4679 ssh2
-Oct  3 06:39:28 [sshd] Failed password for illegal user user from 217.56.33.194 port 4716 ssh2
-Oct  3 06:39:30 [sshd] Failed password for illegal user user from 217.56.33.194 port 4744 ssh2
-Oct  3 06:39:31 [sshd] Failed password for illegal user user from 217.56.33.194 port 4777 ssh2
-Oct  3 06:39:32 [sshd] Failed password for illegal user web from 217.56.33.194 port 4808 ssh2
-Oct  3 06:39:34 [sshd] Failed password for illegal user web from 217.56.33.194 port 4842 ssh2
-Oct  3 06:39:35 [sshd] Failed password for illegal user oracle from 217.56.33.194 port 4869 ssh2
-Oct  3 06:39:36 [sshd] Failed password for illegal user sybase from 217.56.33.194 port 4899 ssh2
-Oct  3 06:39:38 [sshd] Failed password for illegal user master from 217.56.33.194 port 4933 ssh2
-Oct  3 06:39:39 [sshd] Failed password for illegal user account from 217.56.33.194 port 4969 ssh2
-Oct  3 06:39:40 [sshd] Failed password for illegal user backup from 217.56.33.194 port 4999 ssh2
-Oct  3 06:39:42 [sshd] Failed password for illegal user server from 217.56.33.194 port 1051 ssh2
-Oct  3 06:39:43 [sshd] Failed password for illegal user adam from 217.56.33.194 port 1082 ssh2
-Oct  3 06:39:44 [sshd] Failed password for illegal user alan from 217.56.33.194 port 1114 ssh2
-Oct  3 06:39:46 [sshd] Failed password for illegal user frank from 217.56.33.194 port 1141 ssh2
-Oct  3 06:39:47 [sshd] Failed password for illegal user george from 217.56.33.194 port 1174 ssh2
-Oct  3 06:39:49 [sshd] Failed password for illegal user henry from 217.56.33.194 port 1205 ssh2
-Oct  3 06:39:50 [sshd] Failed password for illegal user john from 217.56.33.194 port 1236 ssh2
-Oct  3 06:39:51 [sshd] Failed password for illegal user root from 217.56.33.194 port 1271 ssh2
-Oct  3 06:39:53 [sshd] Failed password for illegal user root from 217.56.33.194 port 1300 ssh2
-Oct  3 06:39:55 [sshd] Failed password for illegal user root from 217.56.33.194 port 1332 ssh2
-Oct  3 06:39:56 [sshd] Failed password for illegal user root from 217.56.33.194 port 1380 ssh2
-Oct  3 06:39:57 [sshd] Failed password for illegal user root from 217.56.33.194 port 1412 ssh2
-Oct  3 06:39:59 [sshd] Failed password for illegal user test from 217.56.33.194 port 1449 ssh2
-Oct  4 04:43:59 [sshd] Failed password for illegal user test from 212.204.226.21 port 60349 ssh2
-Oct  4 04:44:03 [sshd] Failed password for illegal user guest from 212.204.226.21 port 60394 ssh2
-Oct  4 04:44:06 [sshd] Failed password for illegal user admin from 212.204.226.21 port 60540 ssh2
-Oct  4 04:44:08 [sshd] Failed password for illegal user admin from 212.204.226.21 port 60620 ssh2
-Oct  4 04:44:11 [sshd] Failed password for illegal user user from 212.204.226.21 port 60679 ssh2
-Oct  4 04:44:14 [sshd] Failed password for illegal user root from 212.204.226.21 port 60773 ssh2
-Oct  4 04:44:15 [sshd] Failed password for illegal user root from 212.204.226.21 port 60828 ssh2
-Oct  4 04:44:18 [sshd] Failed password for illegal user root from 212.204.226.21 port 60880 ssh2
-Oct  4 04:44:21 [sshd] Failed password for illegal user test from 212.204.226.21 port 60957 ssh2
-Oct  4 09:32:21 [sshd] Failed password for illegal user test from 62.141.56.70 port 45600 ssh2
-Oct  4 09:32:27 [sshd] Failed password for illegal user guest from 62.141.56.70 port 47635 ssh2
-Oct  4 09:32:32 [sshd] Failed password for illegal user admin from 62.141.56.70 port 49967 ssh2
-Oct  4 09:32:37 [sshd] Failed password for illegal user admin from 62.141.56.70 port 52093 ssh2
-Oct  4 09:32:42 [sshd] Failed password for illegal user user from 62.141.56.70 port 53840 ssh2
-Oct  4 09:32:47 [sshd] Failed password for illegal user root from 62.141.56.70 port 55568 ssh2
-Oct  4 09:32:51 [sshd] Failed password for illegal user root from 62.141.56.70 port 57526 ssh2
-Oct  4 09:32:51 [sshd] Failed password for illegal user root from 62.141.56.70 port 58454 ssh2
-Oct  4 09:32:52 [sshd] Failed password for illegal user test from 62.141.56.70 port 58819 ssh2
-Oct  4 14:09:11 [sshd] Failed password for illegal user test from 211.234.125.100 port 46642 ssh2
-Oct  4 14:09:18 [sshd] Failed password for illegal user guest from 211.234.125.100 port 46788 ssh2
-Oct  4 14:09:23 [sshd] Failed password for illegal user admin from 211.234.125.100 port 46886 ssh2
-Oct  4 14:09:30 [sshd] Failed password for illegal user admin from 211.234.125.100 port 46960 ssh2
-Oct  4 14:09:43 [sshd] Failed password for illegal user user from 211.234.125.100 port 47025 ssh2
-Oct  6 04:13:11 [sshd] Failed password for illegal user test from 64.246.30.17 port 58277 ssh2
-Oct  6 04:13:13 [sshd] Failed password for illegal user guest from 64.246.30.17 port 58360 ssh2
-Oct  6 04:13:15 [sshd] Failed password for illegal user admin from 64.246.30.17 port 58428 ssh2
-Oct  6 04:13:17 [sshd] Failed password for illegal user admin from 64.246.30.17 port 58514 ssh2
-Oct  6 22:13:56 [sshd] Failed password for illegal user test from 61.11.98.217 port 45434 ssh2
-Oct  6 22:14:00 [sshd] Failed password for illegal user guest from 61.11.98.217 port 45586 ssh2
-Oct  6 22:14:05 [sshd] Failed password for illegal user admin from 61.11.98.217 port 45672 ssh2
-Oct  6 22:14:10 [sshd] Failed password for illegal user admin from 61.11.98.217 port 45748 ssh2
-Oct  6 22:14:18 [sshd] Failed password for illegal user user from 61.11.98.217 port 45833 ssh2
-Oct  7 00:25:34 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37086 ssh2
-Oct  7 00:25:34 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37086 ssh2
-                - Last output repeated twice -
-Oct  7 00:26:27 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37089 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:26:37 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37092 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:27:21 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37095 ssh2
-                - Last output repeated twice -
-Oct  7 00:51:31 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37130 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:51:48 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37138 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:52:02 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37141 ssh2
-Oct  7 00:56:10 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37153 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:56:41 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37156 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:57:00 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37159 ssh2
-Oct  7 00:58:17 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37162 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:58:29 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37165 ssh2
-                - Last output repeated 2 times -
-Oct  7 00:58:39 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37168 ssh2
-Oct  7 01:00:32 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37171 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:00:44 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37175 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:01:23 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37178 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:03:01 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37181 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:03:12 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37184 ssh2
-                - Last output repeated 2 times -
-Oct  7 01:03:20 [sshd] Failed password for illegal user tata from 128.178.164.52 port 37187 ssh2
-                - Last output repeated 2 times -
-Nov 14 11:47:08 [sshd] Failed password for illegal user test from 69.182.27.122 port 34015 ssh2
-Nov 14 11:47:09 [sshd] Failed password for illegal user guest from 69.182.27.122 port 34068 ssh2
-Nov 14 11:47:11 [sshd] Failed password for illegal user admin from 69.182.27.122 port 34127 ssh2
-Nov 15 11:12:11 yellow sshd[16069]: Failed password for cyril from 212.41.79.210 port 29404 ssh2
-Nov 15 21:54:11 yellow sshd[16069]: Illegal user for cyril from 212.41.79.210 port 29404 ssh2
diff --git a/logreader/__init__.py b/logreader/__init__.py
index 76dba873..60ef5531 100644
--- a/logreader/__init__.py
+++ b/logreader/__init__.py
@@ -16,10 +16,10 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.1 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
\ No newline at end of file
diff --git a/logreader/logreader.py b/logreader/logreader.py
index 0dea9d70..7a27ea29 100644
--- a/logreader/logreader.py
+++ b/logreader/logreader.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.13.2.7 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.13.2.7 $"
+__date__ = "$Date: 2005/08/06 18:43:11 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
@@ -89,7 +89,7 @@ class LogReader:
 			fileHandler = open(self.logPath)
 		except OSError:
 			logSys.error("Unable to open "+self.logPath)
-			sys.exit(-1)
+			
 		return fileHandler
 		
 	def isModified(self):
@@ -99,7 +99,6 @@ class LogReader:
 			self.logStats = os.stat(self.logPath)
 		except OSError:
 			logSys.error("Unable to get stat on "+self.logPath)
-			sys.exit(-1)
 		
 		if self.lastModTime == self.logStats.st_mtime:
 			return False
diff --git a/setup.py b/setup.py
index a2d4b4bc..e71e23ee 100755
--- a/setup.py
+++ b/setup.py
@@ -18,11 +18,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.4.2.3 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.4.2.3 $"
+__date__ = "$Date: 2005/07/28 20:30:34 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/utils/__init__.py b/utils/__init__.py
index 76dba873..7545b531 100644
--- a/utils/__init__.py
+++ b/utils/__init__.py
@@ -16,10 +16,10 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.1 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2005/03/06 17:51:24 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
\ No newline at end of file
diff --git a/utils/dns.py b/utils/dns.py
index 0dc060a9..45b091bc 100644
--- a/utils/dns.py
+++ b/utils/dns.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.7.2.2 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.7.2.2 $"
+__date__ = "$Date: 2005/07/22 21:11:42 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/utils/mail.py b/utils/mail.py
index 5781d89e..44b0954b 100644
--- a/utils/mail.py
+++ b/utils/mail.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.1.2.2 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.1.2.2 $"
+__date__ = "$Date: 2005/08/01 16:35:18 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/utils/pidlock.py b/utils/pidlock.py
index 6eeb0dde..7df9945b 100644
--- a/utils/pidlock.py
+++ b/utils/pidlock.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.1.2.1 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.1.2.1 $"
+__date__ = "$Date: 2005/08/04 20:48:30 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/utils/process.py b/utils/process.py
index 03650212..7f1060cc 100644
--- a/utils/process.py
+++ b/utils/process.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.1.2.4 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.1.2.4 $"
+__date__ = "$Date: 2005/08/04 20:48:30 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/utils/strings.py b/utils/strings.py
index 6ed7ece8..03ccc140 100644
--- a/utils/strings.py
+++ b/utils/strings.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.1.2.2 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.1.2.2 $"
+__date__ = "$Date: 2005/08/01 16:35:18 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/version.py b/version.py
index b589afaa..214d99fe 100644
--- a/version.py
+++ b/version.py
@@ -16,11 +16,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
+# $Revision: 1.12.2.6 $
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__version__ = "$Revision: 1.12.2.6 $"
+__date__ = "$Date: 2005/08/06 15:07:11 $"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"