From 802dbea0365b025706ef89b325068967c3c6d513 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 27 Sep 2005 15:45:26 +0000 Subject: [PATCH] fixed Debian bugs 329722, 330311 --- config/fail2ban.conf.default | 14 ++++++++------ debian/README.Debian | 22 +++++++++++++++++++--- debian/changelog | 7 ++++++- fail2ban.py | 3 ++- 4 files changed, 35 insertions(+), 11 deletions(-) diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default index 48674cf8..29feb909 100644 --- a/config/fail2ban.conf.default +++ b/config/fail2ban.conf.default @@ -109,27 +109,29 @@ port = 25 # Notes.: e-mail address of the sender. # Values: MAIL Default: fail2ban # -from = fail2ban +from = fail2ban@localhost # Option: to # Notes.: e-mail addresses of the receiver. Addresses are space # separated. # Values: MAIL Default: root # -to = root +to = root@localhost # Option: subject # Notes.: subject of the e-mail. -# Tags: IP address +# Tags:
active section (eg ssh, apache, etc) +# IP address # number of failures # unix timestamp of the last failure -# Values: TEXT Default: [Fail2Ban] Banned +# Values: TEXT Default: [Fail2Ban:
] Banned # -subject = [Fail2Ban] Banned +subject = [Fail2Ban:
] Banned # Option: message # Notes.: message of the e-mail. -# Tags: IP address +# Tags:
active section (eg ssh, apache, etc) +# IP address # number of failures # unix timestamp of the last failure #
new line diff --git a/debian/README.Debian b/debian/README.Debian index 034ccb3f..0e6bdc0f 100644 --- a/debian/README.Debian +++ b/debian/README.Debian @@ -10,10 +10,18 @@ Currently the main difference with upstream: python libraries are placed under /usr/share/fail2ban insteadh of /usr/lib/fail2ban to comply with policy regarding architecture independent resources. +Default behavior: +----------------- + Only handling of ssh files is enabled by default. If you want to use fail2ban with apache, please enable apache section manually in /etc/fail2ban.conf. +Troubleshooting: +--------------- + +Broken chain: + Currently no checks if an iptables queue generated at the beginning (fail2ban-http and fail2ban-ssh) exists. So if your firewall resets the iptable rules -- it is your responsibility to restart fail2ban. Also you can @@ -21,7 +29,15 @@ augment fwban and fwunban rules and include as first lines full definitions of fwstart. That is nasty solution and probably it will get resolved in the future. -See TODO.Debian for more details, as well as the Debian Bug -Tracking system. +Mailing: - -- Yaroslav O. Halchenko , Fri Sep 9 14:55:29 2005 +As it was reported (bug #329722) you might need to provide a full +e-mail address in fail2ban.conf option MAIL:from to make your mail +server accept that email. I've added @localhost to both MAIL:from and +MAIL:to in the default configuration shipped with Debian. It seems to +work nicely now + +See TODO.Debian for more details, as well as the Debian Bug Tracking +system. + + -- Yaroslav O. Halchenko , Tue Sep 27 11:36:41 2005 diff --git a/debian/changelog b/debian/changelog index 445a5515..20867022 100644 --- a/debian/changelog +++ b/debian/changelog @@ -4,8 +4,13 @@ fail2ban (0.5.4-2) unstable; urgency=low problems finding iptables in the cases when PATH was not exported outside (cfengine, broken shell environment) (closes: #329304) * Removed -b from start-stop-daemon because fail2ban detahes on its own + * Added @localhost to MAIL:from and MAIL:to in fail2ban.conf and placed + a note to README.Debian regarding necessity to specify full email + address in MAIL:from (closes: #329722) + * Added a keyword
in parsing of the subject and the body of an + email sent out by fail2ban (closes: #330311) - -- Yaroslav Halchenko Wed, 21 Sep 2005 08:09:06 -0400 + -- Yaroslav Halchenko Wed, 27 Sep 2005 08:09:06 -0400 fail2ban (0.5.4-1) unstable; urgency=low diff --git a/fail2ban.py b/fail2ban.py index d4d13b47..69ee4cb3 100755 --- a/fail2ban.py +++ b/fail2ban.py @@ -429,7 +429,8 @@ def main(): if failTime < unixTime - findTime: del element[3][attempt] elif fails[attempt][0] >= element[1].getMaxRetry(): - aInfo = {"ip": attempt, + aInfo = {"section": element[0], + "ip": attempt, "failures": element[3][attempt][0], "failtime": failTime} logSys.info(element[0] + ": " + aInfo["ip"] +