mirror of https://github.com/fail2ban/fail2ban
- Added Gamin (file and directory monitoring system) support
- If Gamin is not available, polling is used git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@355 a942ae1a-1317-0410-a47c-b1dcaea8d6050.x
Cyril Jaquier
parent
e146d07394
commit
7f7361a282
|
|
@ -11,6 +11,7 @@ ver. 0.7.3 (2006/??/??) - beta
|
|||
----------
|
||||
- Added man pages. Thanks to Yaroslav Halchenko
|
||||
- Added wildcard support for "logpath"
|
||||
- Added Gamin (file and directory monitoring system) support
|
||||
|
||||
ver. 0.7.2 (2006/09/10) - beta
|
||||
----------
|
||||
|
|
|
|||
2
MANIFEST
2
MANIFEST
|
|
@ -18,6 +18,8 @@ client/csocket.py
|
|||
server/ssocket.py
|
||||
server/banticket.py
|
||||
server/filter.py
|
||||
server/filtergamin.py
|
||||
server/filterpoll.py
|
||||
server/server.py
|
||||
server/datestrptime.py
|
||||
server/failticket.py
|
||||
|
|
|
|||
6
README
6
README
|
|
@ -19,7 +19,11 @@ website: http://fail2ban.sourceforge.net
|
|||
Installation:
|
||||
-------------
|
||||
|
||||
Require: python-2.4 (http://www.python.org)
|
||||
Required:
|
||||
>=python-2.4 (http://www.python.org)
|
||||
|
||||
Optional:
|
||||
>=gamin-0.0.21 (http://www.gnome.org/~veillard/gamin)
|
||||
|
||||
To install, just do:
|
||||
|
||||
|
|
|
|||
|
|
@ -68,35 +68,26 @@ class Filter(JailThread):
|
|||
self.findTime = 6000
|
||||
## The ignore IP list.
|
||||
self.ignoreIpList = []
|
||||
self.modified = False
|
||||
## The time of the last modification of the file.
|
||||
self.lastModTime = dict()
|
||||
## The last position of the file.
|
||||
self.lastPos = dict()
|
||||
## The last date in tht log file.
|
||||
self.lastDate = dict()
|
||||
self.file404Cnt = dict()
|
||||
|
||||
self.dateDetector = DateDetector()
|
||||
self.dateDetector.addDefaultTemplate()
|
||||
logSys.info("Created Filter")
|
||||
|
||||
|
||||
##
|
||||
# Add a log file path
|
||||
#
|
||||
# @param path log file path
|
||||
|
||||
def addLogPath(self, path):
|
||||
try:
|
||||
self.logPath.index(path)
|
||||
logSys.error(path + " already exists")
|
||||
except ValueError:
|
||||
self.logPath.append(path)
|
||||
# Initialize default values
|
||||
self.lastDate[path] = 0
|
||||
self.lastModTime[path] = 0
|
||||
self.lastPos[path] = 0
|
||||
self.file404Cnt[path] = 0
|
||||
logSys.info("Added logfile = %s" % path)
|
||||
raise Exception("addLogPath() is abstract")
|
||||
|
||||
##
|
||||
# Delete a log path
|
||||
|
|
@ -104,14 +95,7 @@ class Filter(JailThread):
|
|||
# @param path the log file to delete
|
||||
|
||||
def delLogPath(self, path):
|
||||
try:
|
||||
self.logPath.remove(path)
|
||||
del self.lastDate[path]
|
||||
del self.lastModTime[path]
|
||||
del self.lastPos[path]
|
||||
logSys.info("Removed logfile = %s" % path)
|
||||
except ValueError:
|
||||
logSys.error(path + " is not monitored")
|
||||
raise Exception("delLogPath() is abstract")
|
||||
|
||||
##
|
||||
# Get the log file path
|
||||
|
|
@ -236,27 +220,7 @@ class Filter(JailThread):
|
|||
# @return True when the thread exits nicely
|
||||
|
||||
def run(self):
|
||||
self.setActive(True)
|
||||
prevModified = False
|
||||
while self.isActive():
|
||||
if not self.isIdle:
|
||||
if prevModified:
|
||||
self.dateDetector.sortTemplate()
|
||||
prevModified = False
|
||||
for file in self.logPath:
|
||||
if self.isModified(file):
|
||||
self.getFailures(file)
|
||||
prevModified = True
|
||||
try:
|
||||
ticket = self.failManager.toBan()
|
||||
self.jail.putFailTicket(ticket)
|
||||
except FailManagerEmpty:
|
||||
self.failManager.cleanup(time.time())
|
||||
time.sleep(self.sleepTime)
|
||||
else:
|
||||
time.sleep(self.sleepTime)
|
||||
logSys.debug(self.jail.getName() + ": filter terminated")
|
||||
return True
|
||||
raise Exception("run() is abstract")
|
||||
|
||||
##
|
||||
# Add an IP to the ignore list.
|
||||
|
|
@ -311,31 +275,6 @@ class Filter(JailThread):
|
|||
def closeLogFile(self):
|
||||
self.crtFilename = None
|
||||
self.crtHandler.close()
|
||||
|
||||
##
|
||||
# Checks if the log file has been modified.
|
||||
#
|
||||
# Checks if the log file has been modified using os.stat().
|
||||
# @return True if log file has been modified
|
||||
|
||||
def isModified(self, filename):
|
||||
try:
|
||||
logStats = os.stat(filename)
|
||||
self.file404Cnt[filename] = 0
|
||||
if self.lastModTime[filename] == logStats.st_mtime:
|
||||
return False
|
||||
else:
|
||||
logSys.debug(filename + " has been modified")
|
||||
self.lastModTime[filename] = logStats.st_mtime
|
||||
return True
|
||||
except OSError:
|
||||
logSys.error("Unable to get stat on " + filename)
|
||||
self.file404Cnt[filename] = self.file404Cnt[filename] + 1
|
||||
if self.file404Cnt[filename] > 2:
|
||||
logSys.warn("Too much read error. Set the jail idle")
|
||||
self.jail.setIdle(True)
|
||||
self.file404Cnt[filename] = 0
|
||||
return False
|
||||
|
||||
##
|
||||
# Set the file position.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,132 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision$
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision$"
|
||||
__date__ = "$Date$"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
from failmanager import FailManager
|
||||
from failmanager import FailManagerEmpty
|
||||
from failticket import FailTicket
|
||||
from datedetector import DateDetector
|
||||
from filter import Filter
|
||||
|
||||
import time, logging, gamin
|
||||
|
||||
# Gets the instance of the logger.
|
||||
logSys = logging.getLogger("fail2ban.filter")
|
||||
|
||||
##
|
||||
# Log reader class.
|
||||
#
|
||||
# This class reads a log file and detects login failures or anything else
|
||||
# that matches a given regular expression. This class is instanciated by
|
||||
# a Jail object.
|
||||
|
||||
class FilterGamin(Filter):
|
||||
|
||||
##
|
||||
# Constructor.
|
||||
#
|
||||
# Initialize the filter object with default values.
|
||||
# @param jail the jail object
|
||||
|
||||
def __init__(self, jail):
|
||||
Filter.__init__(self, jail)
|
||||
|
||||
self.monitor = gamin.WatchMonitor()
|
||||
|
||||
logSys.info("Created FilterGamin")
|
||||
|
||||
|
||||
def callback(self, path, event):
|
||||
logSys.debug("Got event: " + `event` + " for " + path)
|
||||
if event in (gamin.GAMCreated, gamin.GAMChanged, gamin.GAMExists):
|
||||
logSys.debug("File changed: " + path)
|
||||
self.getFailures(path)
|
||||
self.modified = True
|
||||
|
||||
|
||||
##
|
||||
# Add a log file path
|
||||
#
|
||||
# @param path log file path
|
||||
|
||||
def addLogPath(self, path):
|
||||
try:
|
||||
self.logPath.index(path)
|
||||
logSys.error(path + " already exists")
|
||||
except ValueError:
|
||||
self.monitor.watch_file(path, self.callback)
|
||||
self.logPath.append(path)
|
||||
# Initialize default values
|
||||
self.lastDate[path] = 0
|
||||
self.lastModTime[path] = 0
|
||||
self.lastPos[path] = 0
|
||||
logSys.info("Added logfile = %s" % path)
|
||||
|
||||
##
|
||||
# Delete a log path
|
||||
#
|
||||
# @param path the log file to delete
|
||||
|
||||
def delLogPath(self, path):
|
||||
try:
|
||||
self.monitor.stop_watch(path)
|
||||
self.logPath.remove(path)
|
||||
del self.lastDate[path]
|
||||
del self.lastModTime[path]
|
||||
del self.lastPos[path]
|
||||
logSys.info("Removed logfile = %s" % path)
|
||||
except ValueError:
|
||||
logSys.error(path + " is not monitored")
|
||||
|
||||
|
||||
##
|
||||
# Main loop.
|
||||
#
|
||||
# This function is the main loop of the thread. It checks if the
|
||||
# file has been modified and looks for failures.
|
||||
# @return True when the thread exits nicely
|
||||
|
||||
def run(self):
|
||||
self.setActive(True)
|
||||
while self.isActive():
|
||||
if not self.isIdle:
|
||||
# We cannot block here because we want to be able to
|
||||
# exit.
|
||||
if self.monitor.event_pending():
|
||||
self.monitor.handle_events()
|
||||
|
||||
if self.modified:
|
||||
try:
|
||||
ticket = self.failManager.toBan()
|
||||
self.jail.putFailTicket(ticket)
|
||||
except FailManagerEmpty:
|
||||
self.failManager.cleanup(time.time())
|
||||
self.dateDetector.sortTemplate()
|
||||
self.modified = False
|
||||
time.sleep(self.sleepTime)
|
||||
else:
|
||||
time.sleep(self.sleepTime)
|
||||
logSys.debug(self.jail.getName() + ": filter terminated")
|
||||
return True
|
||||
|
|
@ -0,0 +1,149 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 354 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 354 $"
|
||||
__date__ = "$Date: 2006-09-13 23:31:22 +0200 (Wed, 13 Sep 2006) $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
from failmanager import FailManager
|
||||
from failmanager import FailManagerEmpty
|
||||
from failticket import FailTicket
|
||||
from datedetector import DateDetector
|
||||
from filter import Filter
|
||||
|
||||
import time, logging, os
|
||||
|
||||
# Gets the instance of the logger.
|
||||
logSys = logging.getLogger("fail2ban.filter")
|
||||
|
||||
##
|
||||
# Log reader class.
|
||||
#
|
||||
# This class reads a log file and detects login failures or anything else
|
||||
# that matches a given regular expression. This class is instanciated by
|
||||
# a Jail object.
|
||||
|
||||
class FilterPoll(Filter):
|
||||
|
||||
##
|
||||
# Constructor.
|
||||
#
|
||||
# Initialize the filter object with default values.
|
||||
# @param jail the jail object
|
||||
|
||||
def __init__(self, jail):
|
||||
Filter.__init__(self, jail)
|
||||
|
||||
self.file404Cnt = dict()
|
||||
|
||||
logSys.info("Created FilterPoll")
|
||||
|
||||
##
|
||||
# Add a log file path
|
||||
#
|
||||
# @param path log file path
|
||||
|
||||
def addLogPath(self, path):
|
||||
try:
|
||||
self.logPath.index(path)
|
||||
logSys.error(path + " already exists")
|
||||
except ValueError:
|
||||
self.logPath.append(path)
|
||||
# Initialize default values
|
||||
self.lastDate[path] = 0
|
||||
self.lastModTime[path] = 0
|
||||
self.lastPos[path] = 0
|
||||
self.file404Cnt[path] = 0
|
||||
logSys.info("Added logfile = %s" % path)
|
||||
|
||||
##
|
||||
# Delete a log path
|
||||
#
|
||||
# @param path the log file to delete
|
||||
|
||||
def delLogPath(self, path):
|
||||
try:
|
||||
self.logPath.remove(path)
|
||||
del self.lastDate[path]
|
||||
del self.lastModTime[path]
|
||||
del self.lastPos[path]
|
||||
del self.file404Cnt[path]
|
||||
logSys.info("Removed logfile = %s" % path)
|
||||
except ValueError:
|
||||
logSys.error(path + " is not monitored")
|
||||
|
||||
|
||||
##
|
||||
# Main loop.
|
||||
#
|
||||
# This function is the main loop of the thread. It checks if the
|
||||
# file has been modified and looks for failures.
|
||||
# @return True when the thread exits nicely
|
||||
|
||||
def run(self):
|
||||
self.setActive(True)
|
||||
while self.isActive():
|
||||
if not self.isIdle:
|
||||
# Get file modification
|
||||
for file in self.logPath:
|
||||
if self.isModified(file):
|
||||
self.getFailures(file)
|
||||
prevModified = True
|
||||
|
||||
if self.modified:
|
||||
try:
|
||||
ticket = self.failManager.toBan()
|
||||
self.jail.putFailTicket(ticket)
|
||||
except FailManagerEmpty:
|
||||
self.failManager.cleanup(time.time())
|
||||
self.dateDetector.sortTemplate()
|
||||
prevModified = False
|
||||
time.sleep(self.sleepTime)
|
||||
else:
|
||||
time.sleep(self.sleepTime)
|
||||
logSys.debug(self.jail.getName() + ": filter terminated")
|
||||
return True
|
||||
|
||||
##
|
||||
# Checks if the log file has been modified.
|
||||
#
|
||||
# Checks if the log file has been modified using os.stat().
|
||||
# @return True if log file has been modified
|
||||
|
||||
def isModified(self, filename):
|
||||
try:
|
||||
logStats = os.stat(filename)
|
||||
self.file404Cnt[filename] = 0
|
||||
if self.lastModTime[filename] == logStats.st_mtime:
|
||||
return False
|
||||
else:
|
||||
logSys.debug(filename + " has been modified")
|
||||
self.lastModTime[filename] = logStats.st_mtime
|
||||
return True
|
||||
except OSError:
|
||||
logSys.error("Unable to get stat on " + filename)
|
||||
self.file404Cnt[filename] = self.file404Cnt[filename] + 1
|
||||
if self.file404Cnt[filename] > 2:
|
||||
logSys.warn("Too much read error. Set the jail idle")
|
||||
self.jail.setIdle(True)
|
||||
self.file404Cnt[filename] = 0
|
||||
return False
|
||||
|
|
@ -24,17 +24,27 @@ __date__ = "$Date$"
|
|||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
from actions import Actions
|
||||
from filter import Filter
|
||||
import Queue
|
||||
import Queue, logging
|
||||
|
||||
from actions import Actions
|
||||
|
||||
# Gets the instance of the logger.
|
||||
logSys = logging.getLogger("fail2ban.jail")
|
||||
|
||||
class Jail:
|
||||
|
||||
def __init__(self, name):
|
||||
self.name = name
|
||||
self.queue = Queue.Queue()
|
||||
self.filter = Filter(self)
|
||||
try:
|
||||
import gamin
|
||||
logSys.info("Gamin available. Using it instead of poller")
|
||||
from filtergamin import FilterGamin
|
||||
self.filter = FilterGamin(self)
|
||||
except ImportError:
|
||||
logSys.info("Gamin not available. Using poller")
|
||||
from filterpoll import FilterPoll
|
||||
self.filter = FilterPoll(self)
|
||||
self.action = Actions(self)
|
||||
|
||||
def setName(self, name):
|
||||
|
|
|
|||
|
|
@ -25,14 +25,14 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
|||
__license__ = "GPL"
|
||||
|
||||
import unittest, socket
|
||||
from server.filter import Filter
|
||||
from server.filterpoll import FilterPoll
|
||||
from server.failmanager import FailManager
|
||||
|
||||
class IgnoreIP(unittest.TestCase):
|
||||
|
||||
def setUp(self):
|
||||
"""Call before every test case."""
|
||||
self.filter = Filter(None)
|
||||
self.filter = FilterPoll(None)
|
||||
|
||||
def tearDown(self):
|
||||
"""Call after every test case."""
|
||||
|
|
@ -56,7 +56,7 @@ class LogFile(unittest.TestCase):
|
|||
|
||||
def setUp(self):
|
||||
"""Call before every test case."""
|
||||
self.filter = Filter(None)
|
||||
self.filter = FilterPoll(None)
|
||||
self.filter.addLogPath(LogFile.filename)
|
||||
|
||||
def tearDown(self):
|
||||
|
|
@ -73,7 +73,7 @@ class GetFailures(unittest.TestCase):
|
|||
|
||||
def setUp(self):
|
||||
"""Call before every test case."""
|
||||
self.filter = Filter(None)
|
||||
self.filter = FilterPoll(None)
|
||||
self.filter.addLogPath("testcases/files/testcase01.log")
|
||||
self.filter.setTimeRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
|
||||
self.filter.setTimePattern("%b %d %H:%M:%S")
|
||||
|
|
|
|||
Loading…
Reference in New Issue