diff --git a/.gitignore b/.gitignore index 76a33e60..a8942050 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ htmlcov *.rej *.bak __pycache__ +.vagrant/ diff --git a/.travis.yml b/.travis.yml index 41eeca27..9a92a7f6 100644 --- a/.travis.yml +++ b/.travis.yml @@ -6,6 +6,7 @@ python: - "2.7" - "3.2" - "3.3" + - "3.4" - "pypy" before_install: - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get update -qq; fi diff --git a/3rdparty/logwatch/fail2ban b/3rdparty/logwatch/fail2ban new file mode 100755 index 00000000..087eb529 --- /dev/null +++ b/3rdparty/logwatch/fail2ban @@ -0,0 +1,181 @@ +#!/usr/bin/perl +########################################################################## +# $Id: fail2ban 150 2013-06-18 22:19:38Z mtremaine $ +########################################################################## +# $Log: fail2ban,v $ +# Revision 1.5 2008/08/18 16:07:46 mike +# Patches from Paul Gear -mgt +# +# Revision 1.4 2008/06/30 23:07:51 kirk +# fixed copyright holders for files where I know who they should be +# +# Revision 1.3 2008/03/24 23:31:26 kirk +# added copyright/license notice to each script +# +# Revision 1.2 2006/12/15 04:53:59 bjorn +# Additional filtering, by Willi Mann. +# +# Revision 1.1 2006/05/30 19:04:26 bjorn +# Added fail2ban service, written by Yaroslav Halchenko. +# +# Written by Yaroslav Halchenko for fail2ban +# +########################################################################## + +######################################################## +## Copyright (c) 2008 Yaroslav Halchenko +## Covered under the included MIT/X-Consortium License: +## http://www.opensource.org/licenses/mit-license.php +## All modifications and contributions by other persons to +## this script are assumed to have been donated to the +## Logwatch project and thus assume the above copyright +## and licensing terms. If you want to make contributions +## under your own copyright or a different license this +## must be explicitly stated in the contribution an the +## Logwatch project reserves the right to not accept such +## contributions. If you have made significant +## contributions to this script and want to claim +## copyright please contact logwatch-devel@lists.sourceforge.net. +######################################################### + +use strict; +use Logwatch ':all'; + +my $Debug = $ENV{'LOGWATCH_DEBUG'} || 0; +my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0; +my $IgnoreHost = $ENV{'sshd_ignore_host'} || ""; +my $DebugCounter = 0; +my $ReInitializations = 0; +my @IptablesErrors = (); +my @ActionErrors = (); +my $NotValidIP = 0; # reported invalid IPs number +my @OtherList = (); + +my %ServicesBans = (); + +if ( $Debug >= 5 ) { + print STDERR "\n\nDEBUG: Inside Fail2Ban Filter \n\n"; + $DebugCounter = 1; +} + +while (defined(my $ThisLine = )) { + if ( $Debug >= 5 ) { + print STDERR "DEBUG($DebugCounter): $ThisLine"; + $DebugCounter++; + } + chomp($ThisLine); + if ( ($ThisLine =~ /..,... DEBUG: /) or + ($ThisLine =~ /..,... \S*\s*: DEBUG /) or # syntax of 0.7.? fail2ban + ($ThisLine =~ /..,... INFO: (Fail2Ban v.* is running|Exiting|Enabled sections:)/) or + ($ThisLine =~ /INFO\s+Log rotation detected for/) or + ($ThisLine =~ /INFO\s+Jail.+(?:stopped|started|uses poller)/) or + ($ThisLine =~ /INFO\s+Changed logging target to/) or + ($ThisLine =~ /INFO\s+Creating new jail/) or + ($ThisLine =~ /..,... \S+\s*: INFO\s+(Set |Socket|Exiting|Gamin|Created|Added|Using)/) or # syntax of 0.7.? fail2ban + ($ThisLine =~ /..,... WARNING: Verbose level is /) or + ($ThisLine =~ /..,... WARNING: Restoring firewall rules/) + ) + { + if ( $Debug >= 6 ) { + print STDERR "DEBUG($DebugCounter): line ignored\n"; + } + } elsif ( my ($Service,$Action,$Host) = ($ThisLine =~ m/WARNING:?\s\[?(.*?)[]:]?\s(Ban|Unban)[^\.]* (\S+)/)) { + if ( $Debug >= 6 ) { + print STDERR "DEBUG($DebugCounter): Found $Action for $Service from $Host\n"; + } + $ServicesBans{$Service}{$Host}{$Action}++; + $ServicesBans{$Service}{"(all)"}{$Action}++; + } elsif ( my ($Service,$Host,$NumFailures) = ($ThisLine =~ m/INFO: (\S+): (.+) has (\d+) login failure\(s\). Banned./)) { + if ($Debug >= 4) { + print STDERR "DEBUG: Found host $Host trying to access $Service - failed $NumFailures times\n"; + } + push @{$ServicesBans{$Service}{$Host}{'Failures'}}, $NumFailures; + } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ ERROR:\s(.*):\s(\S+)\salready in ban list/)) { + $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++; + } elsif ( my ($Service,$Host) = ($ThisLine =~ m/WARNING\s*\[(.*)\]\s*(\S+)\s*already banned/)) { + $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++; + } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ WARNING:\s(.*):\sReBan (\S+)/)) { + $ServicesBans{$Service}{$Host}{'ReBan'}++; + } elsif ($ThisLine =~ / ERROR:?\s*(Execution of command )?\'?iptables/) { + push @IptablesErrors, "$ThisLine\n"; + } elsif ($ThisLine =~ /ERROR.*returned \d+$/) { + push @ActionErrors, "$ThisLine\n"; + } elsif (($ThisLine =~ /..,... WARNING: \#\S+ reinitialization of firewalls/) or + ($ThisLine =~ / ERROR\s*Invariant check failed. Trying to restore a sane environment/)) { + $ReInitializations++; + } elsif ($ThisLine =~ /..,... WARNING: is not a valid IP address/) { + # just ignore - this will be fixed within fail2ban and is harmless warning + } + else + { + # Report any unmatched entries... + push @OtherList, "$ThisLine\n"; + } +} + +########################################################### + + +if (keys %ServicesBans) { + printf("\nBanned services with Fail2Ban: Bans:Unbans\n"); + foreach my $service (sort {$a cmp $b} keys %ServicesBans) { + printf(" %-55s [%3d:%-3d]\n", "$service:", + $ServicesBans{$service}{'(all)'}{'Ban'}, + $ServicesBans{$service}{'(all)'}{'Unban'}); + delete $ServicesBans{$service}{'(all)'}; + my $totalSort = TotalCountOrder(%{$ServicesBans{$service}}, \&SortIP); + if ($Detail >= 5) { + foreach my $ip (sort $totalSort keys %{$ServicesBans{$service}}) { + my $name = LookupIP($ip); + printf(" %-53s %3d:%-3d\n", + $name, + $ServicesBans{$service}{$ip}{'Ban'}, + $ServicesBans{$service}{$ip}{'Unban'}); + if (($Detail >= 10) and ($ServicesBans{$service}{$ip}{'Failures'}>0)) { + print " Failed "; + foreach my $fails (@{$ServicesBans{$service}{$ip}{'Failures'}}) { + print " $fails"; + } + print " times"; + printf("\n %d Duplicate Ban attempts", $ServicesBans{$service}{$ip}{'AlreadyInTheList'}) ; + printf("\n %d ReBans due to rules reinitilizations", $ServicesBans{$service}{$ip}{'ReBan'}) ; + print "\n"; + } + } + } + } +} + + +if ($Detail>0) { + if ($#IptablesErrors > 0) { + printf("\n%d faulty iptables invocation(s)", $#IptablesErrors); + if ($Detail > 5) { + print ":\n"; + print @IptablesErrors ; + } + } + if ($#ActionErrors > 0) { + printf("\n%d error(s) returned from actions", $#ActionErrors); + if ($Detail > 5) { + print ":\n"; + print @ActionErrors ; + } + } + if ($ReInitializations > 0) { + printf("\n%d fail2ban rules reinitialization(s)", $ReInitializations); + } + if ($#OtherList >= 0) { + print "\n**Unmatched Entries**\n"; + print @OtherList; + } +} + +exit(0); + +# vi: shiftwidth=3 tabstop=3 syntax=perl et +# Local Variables: +# mode: perl +# perl-indent-level: 3 +# indent-tabs-mode: nil +# End: diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 00000000..a668fa3d --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,17 @@ +Guidelines on Fail2Ban contributions +==================================== + +### You found a severe security vulnerability in Fail2Ban? +email details to fail2ban-vulnerabilities at lists dot sourceforge dot net . + +### You need some new features, you found bugs? +visit [Issues](https://github.com/fail2ban/fail2ban/issues) +and if your issue is not yet known -- file a bug report. See +[Fail2Ban wiki](http://www.fail2ban.org/wiki/index.php/HOWTO_Seek_Help) +on further instructions. + +### You would like to troubleshoot or discuss? +join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users) + +### You would like to contribute (new filters/actions/code/documentation)? +send a [pull request](https://github.com/fail2ban/fail2ban/pulls) diff --git a/ChangeLog b/ChangeLog index 66df9639..6a9bf03f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,24 +10,69 @@ Fail2Ban (version 0.9.0.dev) 2014/xx/xx ver. 0.9.1 (2014/xx/xx) - better, faster, stronger ---------- +- Refactoring (IMPORTANT -- Please review your setup and configuration): + * iptables-common.conf replaced iptables-blocktype.conf + (iptables-blocktype.local should still be read) and now also + provides defaults for the chain, port, protocol and name tags + - Fixes: + * UTF-8 fixes in pure-ftp thanks to Johannes Weberhofer. Closes gh-806. * systemd backend error on bad utf-8 in python3 * badips.py action error when logging HTTP error raised with badips request * fail2ban-regex failed to work in python3 due to space/tab mix + * recidive regex samples incorrect log level * journalmatch for recidive incorrect PRIORITY * loglevel couldn't be changed in fail2ban.conf * Handle case when no sqlite library is available for persistent database * Only reban once per IP from database on fail2ban restart * Nginx filter to support missing server_name. Closes gh-676 + * fail2ban-regex assertion error caused by miscount missed lines with + multiline regex + * Fix actions failing to execute for Python 3.4.0. Workaround for + http://bugs.python.org/issue21207 + * Database now returns persistent bans on restart (bantime < 0) + * Recursive action tags now fully processed. Fixes issue with bsd-ipfw + action + * Fixed TypeError with "ipfailures" and "ipjailfailures" action tags. + Thanks Serg G. Brester + * Correct times for non-timezone date times formats during DST + * Pass a copy of, not original, aInfo into actions to avoid side-effects + * Per-distribution paths to the exim's main log + * Ignored IPs are no longer banned when being restored from persistent + database + * Manually unbanned IPs are now removed from persistent database, such they + wont be banned again when Fail2Ban is restarted + * Pass "bantime" parameter to the actions in default jail's action + definition(s) + * filters.d/sieve.conf - fixed typo in _daemon. Thanks Jisoo Park + * cyrus-imap -- also catch also failed logins via secured (imaps/pop3s). + Regression was introduced while strengthening failregex in 0.8.11 (bd175f) + Debian bug #755173 + * postfix-sasl -- added journalmatch. Thanks Luc Maisonobe - New features: - + - New filters: + - monit Thanks Jason H Martin + - directadmin Thanks niorg + - New actions: + - symbiosis-blacklist-allports for Bytemark symbiosis firewall + - fail2ban-client can fetch the running server version + - Added Cloudflare API action - Enhancements * Fail2ban-regex - add print-all-matched option. Closes gh-652 * Suppress fail2ban-client warnings for non-critical config options + * Match non "Bye Bye" disconnect messages for sshd locked account regex + * courier-smtp filter: + - match lines with user names + - match lines containing "535 Authentication failed" attempts + * Add tag to iptables-ipsets + * Realign fail2ban log output with white space to improve readability. Does + not affect SYSLOG output + * Log unhandled exceptions + * cyrus-imap: catch "user not found" attempts -ver. 0.9.0 (2014/03/14 - beta +ver. 0.9.0 (2014/03/14) - beta ---------- Carries all fixes, features and enhancements from 0.8.13 (unreleased) with diff --git a/MANIFEST b/MANIFEST index 7df49199..92edcca8 100644 --- a/MANIFEST +++ b/MANIFEST @@ -258,7 +258,7 @@ config/action.d/dummy.conf config/action.d/firewallcmd-new.conf config/action.d/firewallcmd-ipset.conf config/action.d/iptables-ipset-proto6-allports.conf -config/action.d/iptables-blocktype.conf +config/action.d/iptables-common.conf config/action.d/iptables-ipset-proto4.conf config/action.d/iptables-ipset-proto6.conf config/action.d/iptables-xt_recent-echo.conf diff --git a/README.Solaris b/README.Solaris index e41e3811..c654b7c0 100644 --- a/README.Solaris +++ b/README.Solaris @@ -6,20 +6,20 @@ By Roy Sigurd Karlsbakk ABOUT -This readme is meant for those wanting to install fail2ban on Solaris 10, +This README is meant for those wanting to install fail2ban on Solaris 10, OpenSolaris, OpenIndiana etc. To some degree it may as well be useful for users of older Solaris versions and Nexenta, but don't rely on it. READ ME FIRST If I use the term Solaris, I am talking about any Solaris dialect, that is, the -official Sun/Oracle ones or derivates. If I describe an OS as +official Sun/Oracle ones or derivatives. If I describe an OS as "OpenSolaris-based", it means it's either OpenSolaris, OpenIndiana or one of the other, but /not/ the Nexenta family, since this only uses the OpenSolaris/ IllumOS kernel and not the userland. If I say Solaris 10, I mean Solaris 10 and perhaps, if you're lucky and have some good gods on your side, it may also apply to Solaris 9 or even 8 and hopefully in the new Solaris 11 whenever that may be -released. Quoted lines of code, settings et cetera are indented with two spaces. +released. Quoted lines of code, settings etc. are indented with two spaces. This does _not_ mean you should use that indentation, especially in config files where they can be harmful. Optional settings are prefixed with OPT: while required settings are prefixed with REQ:. If no prefix is found, regard it as a @@ -111,7 +111,7 @@ GOTCHAS AND FIXMES svcadm enable fail2ban * If svcs -xv says that fail2ban failed to start or svcs says it's in maintenance mode - check /var/svc/log/network-fail2ban:default.log for clues. + check /var/svc/log/network-fail2ban:default.log for clues. Check permissions on /var/adm, /var/adm/auth.log /var/adm/fail2ban.log and /var/run/fail2ban You may need to: diff --git a/README.md b/README.md index 308136a1..2679fe53 100644 --- a/README.md +++ b/README.md @@ -68,24 +68,12 @@ Code status: Contact: -------- -### You found a severe security vulnerability in Fail2Ban? -email details to fail2ban-vulnerabilities at lists dot sourceforge dot net . - -### You need some new features, you found bugs? -visit [Issues](https://github.com/fail2ban/fail2ban/issues) -and if your issue is not yet known -- file a bug report. See -[Fail2Ban wiki](http://www.fail2ban.org/wiki/index.php/HOWTO_Seek_Help) -on further instructions. - -### You would like to troubleshoot or discuss? -join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users) - -### You would like to contribute (new filters/actions/code/documentation)? -send a pull request +### Bugs, feature requests, discussions? +See [CONTRIBUTING.md](https://github.com/fail2ban/fail2ban/blob/master/CONTRIBUTING.md) ### You just appreciate this program: -send kudos to the original author ([Cyril Jaquier](mailto: Cyril Jaquier ) -or better to the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users) +send kudos to the original author ([Cyril Jaquier](mailto: Cyril Jaquier )) +or *better* to the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users) since Fail2Ban is "community-driven" for years now. Thanks: diff --git a/THANKS b/THANKS index 2c084dee..b9288d4d 100644 --- a/THANKS +++ b/THANKS @@ -44,10 +44,14 @@ Hank Leininger Hanno 'Rince' Wagner Helmut Grohne Iain Lea +Ioan Indreias Ivo Truxa John Thoe Jacques Lav!gnotte -Ioan Indreias +Johannes Weberhofer +Jason H Martin +Jisoo Park +Joel M Snyder Jonathan Kamens Jonathan Lanning Jonathan Underwood @@ -60,6 +64,7 @@ kjohnsonecl kojiro Lars Kneschke Lee Clemens +leftyfb (Mike Rushton) Manuel Arostegui Ramirez Marcel Dopita Mark Edgington @@ -75,8 +80,10 @@ Michael Hanselmann Mika (mkl) Nick Munger onorua +Paul Marrapese Noel Butler Patrick Börjesson +Pressy Raphaël Marichez RealRancor René Berber @@ -84,7 +91,10 @@ Robert Edeker Rolf Fokkens Roman Gelfand Russell Odom +SATO Kentaro +Sean DuBois Sebastian Arcus +Serg G. Brester Sireyessire silviogarbes Stefan Tatschner diff --git a/Vagrantfile b/Vagrantfile new file mode 100644 index 00000000..120ffd7f --- /dev/null +++ b/Vagrantfile @@ -0,0 +1,30 @@ +Vagrant.configure("2") do |config| + + config.vm.define "secure" do |secure| + secure.vm.box = "ubuntu/trusty64" + secure.vm.hostname = "secure.dev.fail2ban.org" + secure.vm.network "private_network", ip: "192.168.200.100" + +# secure.vm.synced_folder 'salt/roots', '/srv/salt' + +# secure.vm.provision :salt do |salt| +# salt.minion_config = 'salt/minion' +# salt.run_highstate = true +# salt.verbose = true +# end + end + + config.vm.define "attacker" do |attacker| + attacker.vm.box = "ubuntu/trusty64" + attacker.vm.hostname = "attacker.dev.fail2ban.org" + attacker.vm.network "private_network", ip: "192.168.200.150" + +# attacker.vm.synced_folder 'salt/roots', '/srv/salt' + +# attacker.vm.provision :salt do |salt| +# salt.minion_config = 'salt/minion' +# salt.run_highstate = true +# salt.verbose = true +# end + end +end diff --git a/bin/fail2ban-client b/bin/fail2ban-client index 8737c49d..89e0a903 100755 --- a/bin/fail2ban-client +++ b/bin/fail2ban-client @@ -30,9 +30,10 @@ from fail2ban.protocol import printFormatted from fail2ban.client.csocket import CSocket from fail2ban.client.configurator import Configurator from fail2ban.client.beautifier import Beautifier +from fail2ban.helpers import getLogger # Gets the instance of the logger. -logSys = logging.getLogger("fail2ban.client") +logSys = getLogger("fail2ban") ## # @@ -51,6 +52,7 @@ class Fail2banClient: self.__conf["conf"] = "/etc/fail2ban" self.__conf["dump"] = False self.__conf["force"] = False + self.__conf["background"] = True self.__conf["verbose"] = 1 self.__conf["interactive"] = False self.__conf["socket"] = None @@ -83,6 +85,8 @@ class Fail2banClient: print " -v increase verbosity" print " -q decrease verbosity" print " -x force execution of the server (remove socket file)" + print " -b start server in background (default)" + print " -f start server in foreground (note that the client forks once itself)" print " -h, --help display this help message" print " -V, --version print the version" print @@ -125,6 +129,10 @@ class Fail2banClient: self.__conf["force"] = True elif opt[0] == "-i": self.__conf["interactive"] = True + elif opt[0] == "-b": + self.__conf["background"] = True + elif opt[0] == "-f": + self.__conf["background"] = False elif opt[0] in ["-h", "--help"]: self.dispUsage() sys.exit(0) @@ -194,7 +202,8 @@ class Fail2banClient: # Start the server self.__startServerAsync(self.__conf["socket"], self.__conf["pidfile"], - self.__conf["force"]) + self.__conf["force"], + self.__conf["background"]) try: # Wait for the server to start self.__waitOnServer() @@ -242,14 +251,12 @@ class Fail2banClient: # # Start the Fail2ban server in daemon mode. - def __startServerAsync(self, socket, pidfile, force = False): + def __startServerAsync(self, socket, pidfile, force = False, background = True): # Forks the current process. pid = os.fork() if pid == 0: args = list() args.append(self.SERVER) - # Start in background mode. - args.append("-b") # Set the socket path. args.append("-s") args.append(socket) @@ -259,6 +266,12 @@ class Fail2banClient: # Force the execution if needed. if force: args.append("-x") + # Start in foreground mode if requested. + if background: + args.append("-b") + else: + args.append("-f") + try: # Use the current directory. exe = os.path.abspath(os.path.join(sys.path[0], self.SERVER)) @@ -312,7 +325,7 @@ class Fail2banClient: # Reads the command line options. try: - cmdOpts = 'hc:s:p:xdviqV' + cmdOpts = 'hc:s:p:xfbdviqV' cmdLongOpts = ['help', 'version'] optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts) except getopt.GetoptError: diff --git a/bin/fail2ban-regex b/bin/fail2ban-regex index ef198dcb..5644dd37 100755 --- a/bin/fail2ban-regex +++ b/bin/fail2ban-regex @@ -25,11 +25,11 @@ This tools can test regular expressions for "fail2ban". """ -__author__ = "Cyril Jaquier, Yaroslav Halchenko" -__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2013 Yaroslav Halchenko" +__author__ = "Fail2Ban Developers" +__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko" __license__ = "GPL" -import getopt, sys, time, logging, os, locale, shlex, urllib +import getopt, sys, time, logging, os, locale, shlex, time, urllib from optparse import OptionParser, Option from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError @@ -45,9 +45,9 @@ from fail2ban.client.filterreader import FilterReader from fail2ban.server.filter import Filter from fail2ban.server.failregex import RegexException -from fail2ban.tests.utils import FormatterWithTraceBack +from fail2ban.helpers import FormatterWithTraceBack, getLogger # Gets the instance of the logger. -logSys = logging.getLogger("fail2ban") +logSys = getLogger("fail2ban") def debuggexURL(sample, regex): q = urllib.urlencode({ 're': regex.replace('', '(?&.ipv4)'), @@ -223,6 +223,7 @@ class Fail2banRegex(object): self._filter = Filter(None) self._ignoreregex = list() self._failregex = list() + self._time_elapsed = None self._line_stats = LineStats() if opts.maxlines: @@ -344,10 +345,11 @@ class Fail2banRegex(object): pass else: self._line_stats.matched += 1 + self._line_stats.missed -= 1 return line, ret def process(self, test_lines): - + t0 = time.time() for line_no, line in enumerate(test_lines): if isinstance(line, tuple): line_datetimestripped, ret = fail2banRegex.testRegex( @@ -382,6 +384,7 @@ class Fail2banRegex(object): if line_no % 10 == 0 and self._filter.dateDetector is not None: self._filter.dateDetector.sortTemplate() + self._time_elapsed = time.time() - t0 @@ -455,7 +458,10 @@ class Fail2banRegex(object): template.hits, template.name)) pprint_list(out, "[# of hits] date format") - print "\nLines: %s" % self._line_stats + print "\nLines: %s" % self._line_stats, + if self._time_elapsed is not None: + print "[processed in %.2f sec]" % self._time_elapsed, + print if self._print_all_matched: self.printLines('matched') diff --git a/bin/fail2ban-server b/bin/fail2ban-server index aba19ab5..ec0c0dbe 100755 --- a/bin/fail2ban-server +++ b/bin/fail2ban-server @@ -22,13 +22,14 @@ __author__ = "Cyril Jaquier" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" -import getopt, sys, logging, os +import getopt, sys, os from fail2ban.version import version from fail2ban.server.server import Server +from fail2ban.helpers import getLogger # Gets the instance of the logger. -logSys = logging.getLogger("fail2ban") +logSys = getLogger("fail2ban") ## # \mainpage Fail2Ban diff --git a/bin/fail2ban-testcases b/bin/fail2ban-testcases index b3bddf1c..475aa40b 100755 --- a/bin/fail2ban-testcases +++ b/bin/fail2ban-testcases @@ -24,8 +24,8 @@ __author__ = "Cyril Jaquier" __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2012- Yaroslav Halchenko" __license__ = "GPL" - -import unittest, logging, sys, time, os +import logging +import unittest, sys, time, os # Check if local fail2ban module exists, and use if it exists by # modifying the path. This is such that tests can be used in dev @@ -34,7 +34,8 @@ if os.path.exists("fail2ban/__init__.py"): sys.path.insert(0, ".") from fail2ban.version import version -from fail2ban.tests.utils import FormatterWithTraceBack, gatherTests +from fail2ban.tests.utils import gatherTests +from fail2ban.helpers import FormatterWithTraceBack, getLogger from fail2ban.server.mytime import MyTime from optparse import OptionParser, Option @@ -69,7 +70,7 @@ parser = get_opt_parser() # # Logging # -logSys = logging.getLogger("fail2ban") +logSys = getLogger("fail2ban") # Numerical level of verbosity corresponding to a log "level" verbosity = {'heavydebug': 4, diff --git a/config/action.d/badips.py b/config/action.d/badips.py index 6b21e963..250b1dc3 100644 --- a/config/action.d/badips.py +++ b/config/action.d/badips.py @@ -36,7 +36,7 @@ from fail2ban.server.actions import ActionBase from fail2ban.version import version as f2bVersion class BadIPsAction(ActionBase): - """Fail2Ban action which resports bans to badips.com, and also + """Fail2Ban action which reports bans to badips.com, and also blacklist bad IPs listed on badips.com by using another action's ban method. @@ -53,7 +53,7 @@ class BadIPsAction(ActionBase): age : str, optional Age of last report for bad IPs, per badips.com syntax. Default "24h" (24 hours) - key : str, optional + key : str, optional Key issued by badips.com to report bans, for later retrieval of personalised content. banaction : str, optional @@ -65,7 +65,7 @@ class BadIPsAction(ActionBase): from category used for reporting. e.g. may want to report "postfix", but want to use whole "mail" category for blacklist. Default `category`. - bankey : str, optional + bankey : str, optional Key issued by badips.com to blacklist IPs reported with the associated key. updateperiod : int, optional @@ -161,7 +161,7 @@ class BadIPsAction(ActionBase): "/".join([self._badips, "get", "list", category, str(score)]), urlencode({'age': age})]) if key: - url = "&".join([url, urlencode({"key", key})]) + url = "&".join([url, urlencode({'key': key})]) response = urlopen(self._Request(url)) except HTTPError as response: messages = json.loads(response.read().decode('utf-8')) @@ -258,7 +258,7 @@ class BadIPsAction(ActionBase): self._logSys.error( "Error banning IP %s for jail '%s' with action '%s': %s", ip, self._jail.name, self.banaction, e, - exc_info=self._logSys.getEffectiveLevel<=logging.DEBUG) + exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG) else: self._bannedips.add(ip) self._logSys.info( @@ -279,7 +279,7 @@ class BadIPsAction(ActionBase): self._logSys.info( "Error unbanning IP %s for jail '%s' with action '%s': %s", ip, self._jail.name, self.banaction, e, - exc_info=self._logSys.getEffectiveLevel<=logging.DEBUG) + exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG) else: self._logSys.info( "Unbanned IP %s for jail '%s' with action '%s'", @@ -346,7 +346,7 @@ class BadIPsAction(ActionBase): try: url = "/".join([self._badips, "add", self.category, aInfo['ip']]) if self.key: - url = "?".join([url, urlencode({"key", self.key})]) + url = "?".join([url, urlencode({'key': self.key})]) response = urlopen(self._Request(url)) except HTTPError as response: messages = json.loads(response.read().decode('utf-8')) diff --git a/config/action.d/cloudflare.conf b/config/action.d/cloudflare.conf new file mode 100644 index 00000000..4d5e2dc8 --- /dev/null +++ b/config/action.d/cloudflare.conf @@ -0,0 +1,55 @@ +# +# Author: Mike Rushton +# +# Referenced from from http://www.normyee.net/blog/2012/02/02/adding-cloudflare-support-to-fail2ban by NORM YEE +# +# To get your Cloudflare API key: https://www.cloudflare.com/my-account +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: IP address +# number of failures +#