diff --git a/debian/changelog b/debian/changelog index 0fdf1395..092dbf26 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,38 @@ +fail2ban (0.7.6-1~pre1) UNRELEASED; urgency=low + + * New upstream release, which incorporates fixes introduced in 3~pre + non-released versions (which were suggested to the users to overcome + problems reported in bug reports). In particular attention should be paid + to upstream changelog entries + + - Several "failregex" and "ignoreregex" are now accepted. + Creation of rules should be easier now. + + This is an alternative solution to 'multiple ' entries fix, + which is not applied to this shipped version - pay cautios if upgrading + from 0.7.5-3~pre? + + - Allow comma in action options. The value of the option must + be escaped with " or '. + + That allowed to implement requested ability to ban multiple ports + at once (See 373592). README.Debian and jail.conf adjusted to reflect + possible use of iptables-mport + + - Now Fail2ban goes in /usr/share/fail2ban instead of + /usr/lib/fail2ban. This is more compliant with FHS. + Patch 00_share_insteadof_lib no longer applied + + * Refactored installed by debian package jail.conf: + + - Added option banaction which is to incorporate banning agent + (usually some flavor of iptables rule), which can then be easily + overriden globally or per section + + - Multiple actions are defined as action_* to serve as shortcuts + + -- Yaroslav Halchenko Thu, 4 Jan 2007 12:21:30 -0500 + fail2ban (0.7.5-3~pre6) unstable; urgency=low * Fail2ban now bans vsftpd logins (corrected logfile path and failregex) diff --git a/debian/jail.conf b/debian/jail.conf index 95223d42..ec2418b1 100644 --- a/debian/jail.conf +++ b/debian/jail.conf @@ -33,31 +33,48 @@ backend = polling # jail.{conf,local} configuration files. destemail = root@localhost -# Default action to take: ban only -action = iptables[name=%(__name__)s, port=%(port)s] +# +# ACTIONS +# + +# Default banning action (e.g. iptables, iptables-new, +# iptables-multiport, etc) It is used to define action_* variables. Can +# be overriden globally or per section within jail.local file +banaction = iptables + +# The simplest action to take: ban only +action_i = %(banaction)s[name=%(__name__)s, port="%(port)s"] # Following actions can be chosen as an alternatives to the above action. -# To activate, just copy/paste+uncomment chosen 2 (excluding comments) lines -# into jail.local -# Default action to take: ban & send an e-mail with whois report -# to the destemail. -# action = iptables[name=%(__name__)s, port=%(port)s] -# mail-whois[name=%(__name__)s, dest=%(destemail)s] +# Action to take: ban & send an e-mail with whois report to the destemail. +action_i_mw = %(banaction)s[name=%(__name__)s, port="%(port)s"] + mail-whois[name=%(__name__)s, dest="%(destemail)s"] -# Default action to take: ban & send an e-mail with whois report +# Action to take: ban & send an e-mail with whois report # and relevant log lines to the destemail. -# action = iptables[name=%(__name__)s, port=%(port)s] -# mail-whois-lines[name=%(__name__)s, dest=%(destemail)s, logpath=%(logpath)s] +action_i_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s"] + mail-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s] -# Next jails corresponds to the standard configuration in Fail2ban 0.6 -# which was shipped in Debian. Please enable any defined here jail by including +# Choose default action. To change, just override value of 'action' with the +# chosen action (e.g. action_i_mw, action_i_mwl, etc) in jail.local +# globally (section [DEFAULT]) or per specific section (e.g. ssh) +action = action_i + # -# [SECTION_NAME] +# JAILS +# + +# Next jails corresponds to the standard configuration in Fail2ban 0.6 which +# was shipped in Debian. Please enable any defined here jail by including +# +# [SECTION_NAME] # enabled = true # # in /etc/fail2ban/jail.local. # +# Optionally you may override any other parameter (e.g. banaction, +# action, port, logpath, etc) in that section within jail.local [ssh] @@ -88,6 +105,14 @@ filter = apache-auth logpath = /var/log/apache*/*access.log maxretry = 6 +[apache-multiport] + +enabled = false +banaction = iptables-multiport +port = http,https +filter = apache-auth +logpath = /var/log/apache*/*access.log +maxretry = 6 [apache-noscript] diff --git a/debian/patches/00_iptables-mports.dpatch b/debian/patches/00_iptables-mports.dpatch new file mode 100755 index 00000000..bb84a70e --- /dev/null +++ b/debian/patches/00_iptables-mports.dpatch @@ -0,0 +1,80 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 00_iptables-mports.dpatch by Yaroslav Halchenko +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: No description. + +@DPATCH@ +diff -urNad fail2ban-0.7.5~/config/action.d/iptables-multiport.conf fail2ban-0.7.5/config/action.d/iptables-multiport.conf +--- fail2ban-0.7.5~/config/action.d/iptables-multiport.conf 1969-12-31 19:00:00.000000000 -0500 ++++ fail2ban-0.7.5/config/action.d/iptables-multiport.conf 2007-01-04 12:28:46.000000000 -0500 +@@ -0,0 +1,69 @@ ++# Fail2Ban configuration file ++# ++# Author: Cyril Jaquier ++# Modified by Yaroslav Halchenko for multiport banning ++# $Revision: 455 $ ++# ++ ++[Definition] ++ ++# Option: fwstart ++# Notes.: command executed once at the start of Fail2Ban. ++# Values: CMD ++# ++actionstart = iptables -N fail2ban- ++ iptables -A fail2ban- -j RETURN ++ iptables -I INPUT -p -m multiport --dports -j fail2ban- ++ ++# Option: fwend ++# Notes.: command executed once at the end of Fail2Ban ++# Values: CMD ++# ++actionstop = iptables -D INPUT -p -m multiport --dports -j fail2ban- ++ iptables -F fail2ban- ++ iptables -X fail2ban- ++ ++# Option: fwcheck ++# Notes.: command executed once before each fwban command ++# Values: CMD ++# ++actioncheck = iptables -L INPUT | grep -q fail2ban- ++ ++# Option: fwban ++# Notes.: command executed when banning an IP. Take care that the ++# command is executed with Fail2Ban user rights. ++# Tags: IP address ++# number of failures ++#