mirror of https://github.com/fail2ban/fail2ban
[DATALAD RUNCMD] run codespell throughout fixing typo automagically
=== Do not change lines below === { "chain": [], "cmd": "codespell -w", "exit": 0, "extra_inputs": [], "inputs": [], "outputs": [], "pwd": "." } ^^^ Do not change lines above ^^^pull/3630/head
parent
81b2eb32d6
commit
8ef0d3c7a9
24
ChangeLog
24
ChangeLog
|
@ -74,7 +74,7 @@ ver. 1.0.1 (2022/09/27) - energy-equals-mass-times-the-speed-of-light-squared
|
||||||
* [stability] solves race condition with uncontrolled growth of failure list (jail with too many matches,
|
* [stability] solves race condition with uncontrolled growth of failure list (jail with too many matches,
|
||||||
that did not cause ban), behavior changed to ban ASAP, gh-2945
|
that did not cause ban), behavior changed to ban ASAP, gh-2945
|
||||||
* fixes search for the best datepattern - e. g. if line is too short, boundaries check for previously known
|
* fixes search for the best datepattern - e. g. if line is too short, boundaries check for previously known
|
||||||
unprecise pattern may fail on incomplete lines (logging break-off, no flush, etc), gh-3020
|
imprecise pattern may fail on incomplete lines (logging break-off, no flush, etc), gh-3020
|
||||||
* [stability, performance] backend `systemd`:
|
* [stability, performance] backend `systemd`:
|
||||||
- fixes error "local variable 'line' referenced before assignment", introduced in 55d7d9e2, gh-3097
|
- fixes error "local variable 'line' referenced before assignment", introduced in 55d7d9e2, gh-3097
|
||||||
- don't update database too often (every 10 ticks or ~ 10 seconds in production)
|
- don't update database too often (every 10 ticks or ~ 10 seconds in production)
|
||||||
|
@ -412,7 +412,7 @@ filter = flt[logtype=short]
|
||||||
* `filter.d/znc-adminlog.conf`: new filter for ZNC (IRC bouncer); requires the adminlog module to be loaded
|
* `filter.d/znc-adminlog.conf`: new filter for ZNC (IRC bouncer); requires the adminlog module to be loaded
|
||||||
|
|
||||||
### Enhancements
|
### Enhancements
|
||||||
* introduced new options: `dbmaxmatches` (fail2ban.conf) and `maxmatches` (jail.conf) to contol
|
* introduced new options: `dbmaxmatches` (fail2ban.conf) and `maxmatches` (jail.conf) to control
|
||||||
how many matches per ticket fail2ban can hold in memory and store in database (gh-2402, gh-2118);
|
how many matches per ticket fail2ban can hold in memory and store in database (gh-2402, gh-2118);
|
||||||
* fail2ban.conf: introduced new section `[Thread]` and option `stacksize` to configure default size
|
* fail2ban.conf: introduced new section `[Thread]` and option `stacksize` to configure default size
|
||||||
of the stack for threads running in fail2ban (gh-2356), it could be set in `fail2ban.local` to
|
of the stack for threads running in fail2ban (gh-2356), it could be set in `fail2ban.local` to
|
||||||
|
@ -522,7 +522,7 @@ ver. 0.10.3 (2018/04/04) - the-time-is-always-right-to-do-what-is-right
|
||||||
- fixed root login refused regex (optional port before preauth, gh-2080);
|
- fixed root login refused regex (optional port before preauth, gh-2080);
|
||||||
- avoid banning of legitimate users when pam_unix used in combination with other password method, so
|
- avoid banning of legitimate users when pam_unix used in combination with other password method, so
|
||||||
bypass pam_unix failures if accepted available for this user gh-2070;
|
bypass pam_unix failures if accepted available for this user gh-2070;
|
||||||
- amend to gh-1263 with better handling of multiple attempts (failures for different user-names recognized immediatelly);
|
- amend to gh-1263 with better handling of multiple attempts (failures for different user-names recognized immediately);
|
||||||
- mode `ddos` (and `aggressive`) extended to catch `Connection closed by ... [preauth]`, so in DDOS mode
|
- mode `ddos` (and `aggressive`) extended to catch `Connection closed by ... [preauth]`, so in DDOS mode
|
||||||
it counts failure on closing connection within preauth-stage (gh-2085);
|
it counts failure on closing connection within preauth-stage (gh-2085);
|
||||||
* `action.d/abuseipdb.conf`: fixed curl cypher errors and comment quote-issue (gh-2044, gh-2101);
|
* `action.d/abuseipdb.conf`: fixed curl cypher errors and comment quote-issue (gh-2044, gh-2101);
|
||||||
|
@ -852,7 +852,7 @@ ver. 0.10.0-alpha-1 (2016/07/14) - ipv6-support-etc
|
||||||
sane environment in error case of `actioncheck`.
|
sane environment in error case of `actioncheck`.
|
||||||
* Reporting via abuseipdb.com:
|
* Reporting via abuseipdb.com:
|
||||||
- Bans can now be reported to abuseipdb
|
- Bans can now be reported to abuseipdb
|
||||||
- Catagories must be set in the config
|
- Categories must be set in the config
|
||||||
- Relevant log lines included in report
|
- Relevant log lines included in report
|
||||||
|
|
||||||
### Enhancements
|
### Enhancements
|
||||||
|
@ -989,7 +989,7 @@ releases.
|
||||||
- Rewritten without end-anchor ($), because of potential vulnerability on very long URLs.
|
- Rewritten without end-anchor ($), because of potential vulnerability on very long URLs.
|
||||||
* filter.d/apache-badbots.conf - extended to recognize Jorgee Vulnerability Scanner (gh-1882)
|
* filter.d/apache-badbots.conf - extended to recognize Jorgee Vulnerability Scanner (gh-1882)
|
||||||
* filter.d/asterisk.conf
|
* filter.d/asterisk.conf
|
||||||
- fixed failregex AMI Asterisk authentification failed (see gh-1302)
|
- fixed failregex AMI Asterisk authentication failed (see gh-1302)
|
||||||
- removed invalid (vulnerable) regex blocking IPs using forign data (from header "from")
|
- removed invalid (vulnerable) regex blocking IPs using forign data (from header "from")
|
||||||
thus not the IP-address that really originates the request (see gh-1927)
|
thus not the IP-address that really originates the request (see gh-1927)
|
||||||
- fixed failregex for the SQL-injection attempts with single-quotes in connect-string (see gh-2011)
|
- fixed failregex for the SQL-injection attempts with single-quotes in connect-string (see gh-2011)
|
||||||
|
@ -1289,7 +1289,7 @@ ver. 0.9.3 (2015/08/01) - lets-all-stay-friends
|
||||||
* `filter.d/roundcube-auth.conf`
|
* `filter.d/roundcube-auth.conf`
|
||||||
- Updated regex to work with 'errors' log (1.0.5 and 1.1.1)
|
- Updated regex to work with 'errors' log (1.0.5 and 1.1.1)
|
||||||
- Added regex to work with 'userlogins' log
|
- Added regex to work with 'userlogins' log
|
||||||
* `action.d/sendmail*.conf` - use LC_ALL (superseeding LC_TIME) to override
|
* `action.d/sendmail*.conf` - use LC_ALL (superseding LC_TIME) to override
|
||||||
locale on systems with customized LC_ALL
|
locale on systems with customized LC_ALL
|
||||||
* performance fix: minimizes connection overhead, close socket only at
|
* performance fix: minimizes connection overhead, close socket only at
|
||||||
communication end (gh-1099)
|
communication end (gh-1099)
|
||||||
|
@ -1459,7 +1459,7 @@ ver. 0.9.1 (2014/10/29) - better, faster, stronger
|
||||||
* Ignored IPs are no longer banned when being restored from persistent
|
* Ignored IPs are no longer banned when being restored from persistent
|
||||||
database
|
database
|
||||||
* Manually unbanned IPs are now removed from persistent database, such they
|
* Manually unbanned IPs are now removed from persistent database, such they
|
||||||
wont be banned again when Fail2Ban is restarted
|
won't be banned again when Fail2Ban is restarted
|
||||||
* Pass "bantime" parameter to the actions in default jail's action
|
* Pass "bantime" parameter to the actions in default jail's action
|
||||||
definition(s)
|
definition(s)
|
||||||
* `filters.d/sieve.conf` - fixed typo in _daemon. Thanks Jisoo Park
|
* `filters.d/sieve.conf` - fixed typo in _daemon. Thanks Jisoo Park
|
||||||
|
@ -1750,7 +1750,7 @@ those filters were used.
|
||||||
all platforms to ensure permissions are the same before and after a ban.
|
all platforms to ensure permissions are the same before and after a ban.
|
||||||
Closes gh-266. hostsdeny supports daemon_list now too.
|
Closes gh-266. hostsdeny supports daemon_list now too.
|
||||||
* `action.d/bsd-ipfw` - action option unused. Change blocktype to port unreach
|
* `action.d/bsd-ipfw` - action option unused. Change blocktype to port unreach
|
||||||
instead of deny for consistancy.
|
instead of deny for consistency.
|
||||||
* `filter.d/dovecot` - added to support different dovecot failure
|
* `filter.d/dovecot` - added to support different dovecot failure
|
||||||
"..disallowed plaintext auth". Closes Debian bug #709324
|
"..disallowed plaintext auth". Closes Debian bug #709324
|
||||||
* `filter.d/roundcube-auth` - timezone offset can be positive or negative
|
* `filter.d/roundcube-auth` - timezone offset can be positive or negative
|
||||||
|
@ -1940,7 +1940,7 @@ fail2ban-users mailing list and IRC.
|
||||||
### New Features
|
### New Features
|
||||||
- Yaroslav Halchenko
|
- Yaroslav Halchenko
|
||||||
* [9ba27353] Add support for `jail.d/{confilefile}` and `fail2ban.d/{configfile}`
|
* [9ba27353] Add support for `jail.d/{confilefile}` and `fail2ban.d/{configfile}`
|
||||||
to provide additional flexibility to system adminstrators. Thanks to
|
to provide additional flexibility to system administrators. Thanks to
|
||||||
beilber for the idea. Closes gh-114.
|
beilber for the idea. Closes gh-114.
|
||||||
* [3ce53e87] Add exim filter.
|
* [3ce53e87] Add exim filter.
|
||||||
- Erwan Ben Souiden
|
- Erwan Ben Souiden
|
||||||
|
@ -2091,7 +2091,7 @@ ver. 0.8.7 (2012/07/31) - stable
|
||||||
* [47c03a2] files/nagios - spelling/grammar fixes
|
* [47c03a2] files/nagios - spelling/grammar fixes
|
||||||
* [b083038] updated Free Software Foundation's address
|
* [b083038] updated Free Software Foundation's address
|
||||||
* [9092a63] changed TLDs to invalid domains, in accordance with RFC 2606
|
* [9092a63] changed TLDs to invalid domains, in accordance with RFC 2606
|
||||||
* [642d9af,3282f86] reformated printing of jail's name to be consistent
|
* [642d9af,3282f86] reformatted printing of jail's name to be consistent
|
||||||
with init's info messages
|
with init's info messages
|
||||||
* [3282f86] uniform use of capitalized Jail in the messages
|
* [3282f86] uniform use of capitalized Jail in the messages
|
||||||
- Leonardo Chiquitto
|
- Leonardo Chiquitto
|
||||||
|
@ -2436,7 +2436,7 @@ ver. 0.6.1 (2006/03/16) - stable
|
||||||
- Fixed crash when time format does not match data
|
- Fixed crash when time format does not match data
|
||||||
- Propagated patch from Debian to fix fail2ban search path addition to the path
|
- Propagated patch from Debian to fix fail2ban search path addition to the path
|
||||||
search list: now it is added first. Thanks to Nick Craig-Wood
|
search list: now it is added first. Thanks to Nick Craig-Wood
|
||||||
- Added SMTP authentification for mail notification. Thanks to Markus Hoffmann
|
- Added SMTP authentication for mail notification. Thanks to Markus Hoffmann
|
||||||
- Removed debug mode as it is confusing for people
|
- Removed debug mode as it is confusing for people
|
||||||
- Added parsing of timestamp in TAI64N format (#1275325). Thanks to Mark
|
- Added parsing of timestamp in TAI64N format (#1275325). Thanks to Mark
|
||||||
Edgington
|
Edgington
|
||||||
|
@ -2469,7 +2469,7 @@ ver. 0.5.5 (2005/10/26) - beta
|
||||||
further adjusted by upstream author).
|
further adjusted by upstream author).
|
||||||
* Added -f command line parameter for [findtime].
|
* Added -f command line parameter for [findtime].
|
||||||
* Added a cleanup of firewall rules on emergency shutdown when unknown
|
* Added a cleanup of firewall rules on emergency shutdown when unknown
|
||||||
exception is catched.
|
exception is caught.
|
||||||
* Fail2ban should not crash now if a wrong file name is specified in config.
|
* Fail2ban should not crash now if a wrong file name is specified in config.
|
||||||
* reordered code a bit so that log targets are setup right after background
|
* reordered code a bit so that log targets are setup right after background
|
||||||
and then only loglevel (verbose, debug) is processed, so the warning could
|
and then only loglevel (verbose, debug) is processed, so the warning could
|
||||||
|
|
|
@ -80,7 +80,7 @@ block = ip
|
||||||
# Option: blocktype
|
# Option: blocktype
|
||||||
# Notes.: How to block the traffic. Use a action from man 5 ipfw
|
# Notes.: How to block the traffic. Use a action from man 5 ipfw
|
||||||
# Common values: deny, unreach port, reset
|
# Common values: deny, unreach port, reset
|
||||||
# ACTION defination at the top of man ipfw for allowed values.
|
# ACTION definition at the top of man ipfw for allowed values.
|
||||||
# Values: STRING
|
# Values: STRING
|
||||||
#
|
#
|
||||||
blocktype = unreach port
|
blocktype = unreach port
|
||||||
|
|
|
@ -68,7 +68,7 @@ _cf_api_prms = -H "Authorization: Bearer <cftoken>" -H "Content-Type: applicatio
|
||||||
|
|
||||||
# Declare your Cloudflare Authorization Bearer Token in the [DEFAULT] section of your jail.local file.
|
# Declare your Cloudflare Authorization Bearer Token in the [DEFAULT] section of your jail.local file.
|
||||||
|
|
||||||
# The Cloudflare <ZONE_ID> of hte domain you want to manage.
|
# The Cloudflare <ZONE_ID> of the domain you want to manage.
|
||||||
#
|
#
|
||||||
# cfzone =
|
# cfzone =
|
||||||
|
|
||||||
|
|
|
@ -83,7 +83,7 @@ ipsettime = 0
|
||||||
# Values: [ NUM ] Default: 65536
|
# Values: [ NUM ] Default: 65536
|
||||||
maxelem = 65536
|
maxelem = 65536
|
||||||
|
|
||||||
# expresion to caclulate timeout from bantime, example:
|
# expression to calculate timeout from bantime, example:
|
||||||
# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
|
# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
|
||||||
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
|
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
|
||||||
|
|
||||||
|
@ -124,4 +124,4 @@ firewalld_familyopt = --option=family=inet6
|
||||||
# DEV NOTES:
|
# DEV NOTES:
|
||||||
#
|
#
|
||||||
# Author: Edgar Hoch, Daniel Black, Sergey Brester and Mihail Politaev
|
# Author: Edgar Hoch, Daniel Black, Sergey Brester and Mihail Politaev
|
||||||
# firewallcmd-new / iptables-ipset-proto6 combined for maximium goodness
|
# firewallcmd-new / iptables-ipset-proto6 combined for maximum goodness
|
||||||
|
|
|
@ -61,7 +61,7 @@ actionban = ipset --test f2b-<name> <ip> || ipset --add f2b-<name> <ip>
|
||||||
#
|
#
|
||||||
actionunban = ipset --test f2b-<name> <ip> && ipset --del f2b-<name> <ip>
|
actionunban = ipset --test f2b-<name> <ip> && ipset --del f2b-<name> <ip>
|
||||||
|
|
||||||
# Several capabilities used internaly:
|
# Several capabilities used internally:
|
||||||
|
|
||||||
rule-jump = -m set --match-set f2b-<name> src -j <blocktype>
|
rule-jump = -m set --match-set f2b-<name> src -j <blocktype>
|
||||||
|
|
||||||
|
|
|
@ -59,7 +59,7 @@ actionban = ipset -exist add <ipmset> <ip> timeout <ipsettime>
|
||||||
#
|
#
|
||||||
actionunban = ipset -exist del <ipmset> <ip>
|
actionunban = ipset -exist del <ipmset> <ip>
|
||||||
|
|
||||||
# Several capabilities used internaly:
|
# Several capabilities used internally:
|
||||||
|
|
||||||
rule-jump = -m set --match-set <ipmset> src -j <blocktype>
|
rule-jump = -m set --match-set <ipmset> src -j <blocktype>
|
||||||
|
|
||||||
|
@ -82,7 +82,7 @@ ipsettime = 0
|
||||||
# Values: [ NUM ] Default: 65536
|
# Values: [ NUM ] Default: 65536
|
||||||
maxelem = 65536
|
maxelem = 65536
|
||||||
|
|
||||||
# expresion to caclulate timeout from bantime, example:
|
# expression to calculate timeout from bantime, example:
|
||||||
# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
|
# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
|
||||||
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
|
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
|
||||||
|
|
||||||
|
|
|
@ -62,7 +62,7 @@ pre-rule =
|
||||||
|
|
||||||
rule-jump = -j <_ipt_rule_target>
|
rule-jump = -j <_ipt_rule_target>
|
||||||
|
|
||||||
# Several capabilities used internaly:
|
# Several capabilities used internally:
|
||||||
|
|
||||||
_ipt_for_proto-iter = for proto in $(echo '<protocol>' | sed 's/,/ /g'); do
|
_ipt_for_proto-iter = for proto in $(echo '<protocol>' | sed 's/,/ /g'); do
|
||||||
_ipt_for_proto-done = done
|
_ipt_for_proto-done = done
|
||||||
|
|
|
@ -47,7 +47,7 @@
|
||||||
# BadBot 256 Bad bot that is not honoring robots.txt or just flooding with too many requests, etc
|
# BadBot 256 Bad bot that is not honoring robots.txt or just flooding with too many requests, etc
|
||||||
# Compromised 512 The ip has been taken over by malware or botnet
|
# Compromised 512 The ip has been taken over by malware or botnet
|
||||||
# Phishing 1024 The ip is involved in phishing or spoofing
|
# Phishing 1024 The ip is involved in phishing or spoofing
|
||||||
# Iot 2048 The ip has targetted an iot (Internet of Things) device
|
# Iot 2048 The ip has targeted an iot (Internet of Things) device
|
||||||
# PortScan 4096 Port scan
|
# PortScan 4096 Port scan
|
||||||
# See https://ipthreat.net/bulkreportformat for more information
|
# See https://ipthreat.net/bulkreportformat for more information
|
||||||
# ```
|
# ```
|
||||||
|
|
|
@ -5,7 +5,7 @@
|
||||||
# The script will add offender IPs to a dataset on netscaler, the dataset can then be used to block the IPs at a cs/vserver or global level
|
# The script will add offender IPs to a dataset on netscaler, the dataset can then be used to block the IPs at a cs/vserver or global level
|
||||||
# This dataset is then used to block IPs using responder policies on the netscaler.
|
# This dataset is then used to block IPs using responder policies on the netscaler.
|
||||||
#
|
#
|
||||||
# The script assumes using HTTPS with unsecure certificate to access the netscaler,
|
# The script assumes using HTTPS with insecure certificate to access the netscaler,
|
||||||
# if you have a valid certificate installed remove the -k from the curl lines, or if you want http change it accordingly (and remove the -k)
|
# if you have a valid certificate installed remove the -k from the curl lines, or if you want http change it accordingly (and remove the -k)
|
||||||
#
|
#
|
||||||
# This action depends on curl
|
# This action depends on curl
|
||||||
|
|
|
@ -44,7 +44,7 @@ match = <rule_match-<type>>
|
||||||
#
|
#
|
||||||
rule_stat = %(match)s <addr_family> saddr @<addr_set> <blocktype>
|
rule_stat = %(match)s <addr_family> saddr @<addr_set> <blocktype>
|
||||||
|
|
||||||
# optional interator over protocol's:
|
# optional iterator over protocol's:
|
||||||
_nft_for_proto-custom-iter =
|
_nft_for_proto-custom-iter =
|
||||||
_nft_for_proto-custom-done =
|
_nft_for_proto-custom-done =
|
||||||
_nft_for_proto-allports-iter =
|
_nft_for_proto-allports-iter =
|
||||||
|
|
|
@ -88,7 +88,7 @@ default-ipsettime = 0
|
||||||
# Values: [ NUM ] Default: 0 (managed by fail2ban by unban)
|
# Values: [ NUM ] Default: 0 (managed by fail2ban by unban)
|
||||||
ipsettime = 0
|
ipsettime = 0
|
||||||
|
|
||||||
# expresion to caclulate timeout from bantime, example:
|
# expression to calculate timeout from bantime, example:
|
||||||
# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
|
# banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
|
||||||
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
|
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
|
||||||
|
|
||||||
|
|
|
@ -64,7 +64,7 @@ ignoreregex =
|
||||||
# ^user .*: one-time-nonce mismatch - sending new nonce\s*$
|
# ^user .*: one-time-nonce mismatch - sending new nonce\s*$
|
||||||
# ^realm mismatch - got `(?:[^']*|.*?)' but no realm specified\s*$
|
# ^realm mismatch - got `(?:[^']*|.*?)' but no realm specified\s*$
|
||||||
#
|
#
|
||||||
# Because url/referer are foreign input, short form of regex used if long enough to idetify failure.
|
# Because url/referer are foreign input, short form of regex used if long enough to identify failure.
|
||||||
#
|
#
|
||||||
# Author: Cyril Jaquier
|
# Author: Cyril Jaquier
|
||||||
# Major edits by Daniel Black and Ben Rubson.
|
# Major edits by Daniel Black and Ben Rubson.
|
||||||
|
|
|
@ -44,7 +44,7 @@ ignoreregex =
|
||||||
honeypot = trap@example.com
|
honeypot = trap@example.com
|
||||||
|
|
||||||
# DEV Notes:
|
# DEV Notes:
|
||||||
# The %(host_info) defination contains a <HOST> match
|
# The %(host_info) definition contains a <HOST> match
|
||||||
#
|
#
|
||||||
# Author: Cyril Jaquier
|
# Author: Cyril Jaquier
|
||||||
# Daniel Black (rewrote with strong regexs)
|
# Daniel Black (rewrote with strong regexs)
|
||||||
|
|
|
@ -43,10 +43,10 @@ mode = normal
|
||||||
ignoreregex =
|
ignoreregex =
|
||||||
|
|
||||||
# DEV Notes:
|
# DEV Notes:
|
||||||
# The %(host_info) defination contains a <HOST> match
|
# The %(host_info) definition contains a <HOST> match
|
||||||
#
|
#
|
||||||
# SMTP protocol synchronization error \([^)]*\) <- This needs to be non-greedy
|
# SMTP protocol synchronization error \([^)]*\) <- This needs to be non-greedy
|
||||||
# to void capture beyond ")" to avoid a DoS Injection vulnerabilty as input= is
|
# to void capture beyond ")" to avoid a DoS Injection vulnerability as input= is
|
||||||
# user injectable data.
|
# user injectable data.
|
||||||
#
|
#
|
||||||
# Author: Cyril Jaquier
|
# Author: Cyril Jaquier
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
# Fail2Ban filter for unsuccesfull MongoDB authentication attempts
|
# Fail2Ban filter for unsuccessful MongoDB authentication attempts
|
||||||
#
|
#
|
||||||
# Logfile /var/log/mongodb/mongodb.log
|
# Logfile /var/log/mongodb/mongodb.log
|
||||||
#
|
#
|
||||||
|
@ -23,7 +23,7 @@ maxlines = 10
|
||||||
#
|
#
|
||||||
# Regarding the multiline regex:
|
# Regarding the multiline regex:
|
||||||
#
|
#
|
||||||
# There can be a nunber of non-related lines between the first and second part
|
# There can be a number of non-related lines between the first and second part
|
||||||
# of this regex maxlines of 10 is quite generious.
|
# of this regex maxlines of 10 is quite generious.
|
||||||
#
|
#
|
||||||
# Note the capture __connid, includes the connection ID, used in second part of regex.
|
# Note the capture __connid, includes the connection ID, used in second part of regex.
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
# Fail2Ban filter for unsuccesful MySQL authentication attempts
|
# Fail2Ban filter for unsuccessful MySQL authentication attempts
|
||||||
#
|
#
|
||||||
#
|
#
|
||||||
# To log wrong MySQL access attempts add to /etc/my.cnf in [mysqld]:
|
# To log wrong MySQL access attempts add to /etc/my.cnf in [mysqld]:
|
||||||
|
|
|
@ -21,7 +21,7 @@ _msg = (?:%(_anygrp)s )*acct=(?:"<F-USER>[^"]+</F-USER>"|<F-ALT_USER>\S+</F-ALT_
|
||||||
|
|
||||||
# DEV Notes:
|
# DEV Notes:
|
||||||
#
|
#
|
||||||
# Note: USER_LOGIN is ignored as this is the duplicate messsage
|
# Note: USER_LOGIN is ignored as this is the duplicate message
|
||||||
# ssh logs after 3 USER_AUTH failures.
|
# ssh logs after 3 USER_AUTH failures.
|
||||||
#
|
#
|
||||||
# Author: Daniel Black
|
# Author: Daniel Black
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
# Fail2ban filter for SOGo authentcation
|
# Fail2ban filter for SOGo authentication
|
||||||
#
|
#
|
||||||
# Log file usually in /var/log/sogo/sogo.log
|
# Log file usually in /var/log/sogo/sogo.log
|
||||||
|
|
||||||
|
|
|
@ -5,7 +5,7 @@
|
||||||
#
|
#
|
||||||
# To use 'traefik-auth' filter you have to configure your Traefik instance to write
|
# To use 'traefik-auth' filter you have to configure your Traefik instance to write
|
||||||
# the access logs as describe in https://docs.traefik.io/configuration/logs/#access-logs
|
# the access logs as describe in https://docs.traefik.io/configuration/logs/#access-logs
|
||||||
# into a log file on host and specifiy users for Basic Authentication
|
# into a log file on host and specify users for Basic Authentication
|
||||||
# https://docs.traefik.io/configuration/entrypoints/#basic-authentication
|
# https://docs.traefik.io/configuration/entrypoints/#basic-authentication
|
||||||
#
|
#
|
||||||
# Example:
|
# Example:
|
||||||
|
@ -51,7 +51,7 @@
|
||||||
|
|
||||||
[Definition]
|
[Definition]
|
||||||
|
|
||||||
# Parameter "method" can be used to specifiy request method
|
# Parameter "method" can be used to specify request method
|
||||||
req-method = \S+
|
req-method = \S+
|
||||||
# Usage example (for jail.local):
|
# Usage example (for jail.local):
|
||||||
# filter = traefik-auth[req-method="GET|POST|HEAD"]
|
# filter = traefik-auth[req-method="GET|POST|HEAD"]
|
||||||
|
|
|
@ -67,7 +67,7 @@ proftpd_backend = %(default_backend)s
|
||||||
pureftpd_log = %(syslog_ftp)s
|
pureftpd_log = %(syslog_ftp)s
|
||||||
pureftpd_backend = %(default_backend)s
|
pureftpd_backend = %(default_backend)s
|
||||||
|
|
||||||
# ftp, daemon and then local7 are tried at configure time however it is overwriteable at configure time
|
# ftp, daemon and then local7 are tried at configure time however it is overwritable at configure time
|
||||||
#
|
#
|
||||||
wuftpd_log = %(syslog_ftp)s
|
wuftpd_log = %(syslog_ftp)s
|
||||||
wuftpd_backend = %(default_backend)s
|
wuftpd_backend = %(default_backend)s
|
||||||
|
|
|
@ -98,7 +98,7 @@ class ConfigReader():
|
||||||
def read(self, name, once=True):
|
def read(self, name, once=True):
|
||||||
""" Overloads a default (not shared) read of config reader.
|
""" Overloads a default (not shared) read of config reader.
|
||||||
|
|
||||||
To prevent mutiple reads of config files with it includes, reads into
|
To prevent multiple reads of config files with it includes, reads into
|
||||||
the config reader, if it was not yet cached/shared by 'name'.
|
the config reader, if it was not yet cached/shared by 'name'.
|
||||||
"""
|
"""
|
||||||
# already shared ?
|
# already shared ?
|
||||||
|
@ -183,7 +183,7 @@ class ConfigReader():
|
||||||
class ConfigReaderUnshared(SafeConfigParserWithIncludes):
|
class ConfigReaderUnshared(SafeConfigParserWithIncludes):
|
||||||
"""Unshared config reader (previously ConfigReader).
|
"""Unshared config reader (previously ConfigReader).
|
||||||
|
|
||||||
Do not use this class (internal not shared/cached represenation).
|
Do not use this class (internal not shared/cached representation).
|
||||||
Use ConfigReader instead.
|
Use ConfigReader instead.
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|
|
@ -69,7 +69,7 @@ def debuggexURL(sample, regex, multiline=False, useDns="yes"):
|
||||||
if multiline: args['flags'] = 'm'
|
if multiline: args['flags'] = 'm'
|
||||||
return 'https://www.debuggex.com/?' + urllib.parse.urlencode(args)
|
return 'https://www.debuggex.com/?' + urllib.parse.urlencode(args)
|
||||||
|
|
||||||
def output(args): # pragma: no cover (overriden in test-cases)
|
def output(args): # pragma: no cover (overridden in test-cases)
|
||||||
print(args)
|
print(args)
|
||||||
|
|
||||||
def shortstr(s, l=53):
|
def shortstr(s, l=53):
|
||||||
|
@ -280,7 +280,7 @@ class Fail2banRegex(object):
|
||||||
self._filter.setUseDns(opts.usedns)
|
self._filter.setUseDns(opts.usedns)
|
||||||
self._filter.returnRawHost = opts.raw
|
self._filter.returnRawHost = opts.raw
|
||||||
self._filter.checkAllRegex = opts.checkAllRegex and not opts.out
|
self._filter.checkAllRegex = opts.checkAllRegex and not opts.out
|
||||||
# ignore pending (without ID/IP), added to matches if it hits later (if ID/IP can be retreved)
|
# ignore pending (without ID/IP), added to matches if it hits later (if ID/IP can be retrieved)
|
||||||
self._filter.ignorePending = bool(opts.out)
|
self._filter.ignorePending = bool(opts.out)
|
||||||
# callback to increment ignored RE's by index (during process):
|
# callback to increment ignored RE's by index (during process):
|
||||||
self._filter.onIgnoreRegex = self._onIgnoreRegex
|
self._filter.onIgnoreRegex = self._onIgnoreRegex
|
||||||
|
@ -476,7 +476,7 @@ class Fail2banRegex(object):
|
||||||
ret.append(match)
|
ret.append(match)
|
||||||
else:
|
else:
|
||||||
is_ignored = True
|
is_ignored = True
|
||||||
if self._opts.out: # (formated) output - don't need stats:
|
if self._opts.out: # (formatted) output - don't need stats:
|
||||||
return None, ret, None
|
return None, ret, None
|
||||||
# prefregex stats:
|
# prefregex stats:
|
||||||
if self._filter.prefRegex:
|
if self._filter.prefRegex:
|
||||||
|
@ -595,7 +595,7 @@ class Fail2banRegex(object):
|
||||||
continue
|
continue
|
||||||
line_datetimestripped, ret, is_ignored = self.testRegex(line)
|
line_datetimestripped, ret, is_ignored = self.testRegex(line)
|
||||||
|
|
||||||
if self._opts.out: # (formated) output:
|
if self._opts.out: # (formatted) output:
|
||||||
if len(ret) > 0 and not is_ignored: out(ret)
|
if len(ret) > 0 and not is_ignored: out(ret)
|
||||||
continue
|
continue
|
||||||
|
|
||||||
|
|
|
@ -45,7 +45,7 @@ class Fail2banServer(Fail2banCmdLine):
|
||||||
|
|
||||||
@staticmethod
|
@staticmethod
|
||||||
def startServerDirect(conf, daemon=True, setServer=None):
|
def startServerDirect(conf, daemon=True, setServer=None):
|
||||||
logSys.debug(" direct starting of server in %s, deamon: %s", os.getpid(), daemon)
|
logSys.debug(" direct starting of server in %s, daemon: %s", os.getpid(), daemon)
|
||||||
from ..server.server import Server
|
from ..server.server import Server
|
||||||
server = None
|
server = None
|
||||||
try:
|
try:
|
||||||
|
@ -120,7 +120,7 @@ class Fail2banServer(Fail2banCmdLine):
|
||||||
if frk: # pragma: no cover
|
if frk: # pragma: no cover
|
||||||
os.execv(exe, args)
|
os.execv(exe, args)
|
||||||
else:
|
else:
|
||||||
# use P_WAIT instead of P_NOWAIT (to prevent defunct-zomby process), it startet as daemon, so parent exit fast after fork):
|
# use P_WAIT instead of P_NOWAIT (to prevent defunct-zomby process), it started as daemon, so parent exit fast after fork):
|
||||||
ret = os.spawnv(os.P_WAIT, exe, args)
|
ret = os.spawnv(os.P_WAIT, exe, args)
|
||||||
if ret != 0: # pragma: no cover
|
if ret != 0: # pragma: no cover
|
||||||
raise OSError(ret, "Unknown error by executing server %r with %r" % (args[1], exe))
|
raise OSError(ret, "Unknown error by executing server %r with %r" % (args[1], exe))
|
||||||
|
|
|
@ -235,7 +235,7 @@ class JailReader(ConfigReader):
|
||||||
if e:
|
if e:
|
||||||
stream.extend([['config-error', "Jail '%s' skipped, because of wrong configuration: %s" % (self.__name, e)]])
|
stream.extend([['config-error', "Jail '%s' skipped, because of wrong configuration: %s" % (self.__name, e)]])
|
||||||
return stream
|
return stream
|
||||||
# fill jail with filter options, using filter (only not overriden in jail):
|
# fill jail with filter options, using filter (only not overridden in jail):
|
||||||
if self.__filter:
|
if self.__filter:
|
||||||
stream.extend(self.__filter.convert())
|
stream.extend(self.__filter.convert())
|
||||||
# and using options from jail:
|
# and using options from jail:
|
||||||
|
|
|
@ -670,7 +670,7 @@ class Actions(JailThread, Mapping):
|
||||||
action.consistencyCheck(_beforeRepair)
|
action.consistencyCheck(_beforeRepair)
|
||||||
continue
|
continue
|
||||||
# fallback to single unbans:
|
# fallback to single unbans:
|
||||||
logSys.debug(" Unban tickets each individualy")
|
logSys.debug(" Unban tickets each individually")
|
||||||
unbactions[name] = action
|
unbactions[name] = action
|
||||||
actions = unbactions
|
actions = unbactions
|
||||||
# flush the database also:
|
# flush the database also:
|
||||||
|
|
|
@ -104,7 +104,7 @@ class Fail2BanDb(object):
|
||||||
sqlite3.OperationalError
|
sqlite3.OperationalError
|
||||||
Error connecting/creating a SQLite3 database.
|
Error connecting/creating a SQLite3 database.
|
||||||
RuntimeError
|
RuntimeError
|
||||||
If exisiting database fails to update to new schema.
|
If existing database fails to update to new schema.
|
||||||
|
|
||||||
Attributes
|
Attributes
|
||||||
----------
|
----------
|
||||||
|
@ -494,7 +494,7 @@ class Fail2BanDb(object):
|
||||||
Parameters
|
Parameters
|
||||||
----------
|
----------
|
||||||
jail : Jail
|
jail : Jail
|
||||||
If specified, will only reutrn logs belonging to the jail.
|
If specified, will only return logs belonging to the jail.
|
||||||
|
|
||||||
Returns
|
Returns
|
||||||
-------
|
-------
|
||||||
|
|
|
@ -357,7 +357,7 @@ class DatePatternRegex(DateTemplate):
|
||||||
|
|
||||||
|
|
||||||
class DateTai64n(DateTemplate):
|
class DateTai64n(DateTemplate):
|
||||||
"""A date template which matches TAI64N formate timestamps.
|
"""A date template which matches TAI64N format timestamps.
|
||||||
|
|
||||||
Attributes
|
Attributes
|
||||||
----------
|
----------
|
||||||
|
|
|
@ -240,7 +240,7 @@ class Regex:
|
||||||
# Sets an internal cache (match object) in order to avoid searching for
|
# Sets an internal cache (match object) in order to avoid searching for
|
||||||
# the pattern again. This method must be called before calling any other
|
# the pattern again. This method must be called before calling any other
|
||||||
# method of this object.
|
# method of this object.
|
||||||
# @param a list of tupples. The tupples are ( prematch, datematch, postdatematch )
|
# @param a list of tuples. The tuples are ( prematch, datematch, postdatematch )
|
||||||
|
|
||||||
def search(self, tupleLines, orgLines=None):
|
def search(self, tupleLines, orgLines=None):
|
||||||
buf = tupleLines
|
buf = tupleLines
|
||||||
|
|
|
@ -635,7 +635,7 @@ class Filter(JailThread):
|
||||||
e = m.end(1)
|
e = m.end(1)
|
||||||
m = line[s:e]
|
m = line[s:e]
|
||||||
tupleLine = (line[:s], m, line[e:])
|
tupleLine = (line[:s], m, line[e:])
|
||||||
if m: # found and not empty - retrive date:
|
if m: # found and not empty - retrieve date:
|
||||||
date = self.dateDetector.getTime(m, timeMatch)
|
date = self.dateDetector.getTime(m, timeMatch)
|
||||||
if date is not None:
|
if date is not None:
|
||||||
# Lets get the time part
|
# Lets get the time part
|
||||||
|
@ -666,7 +666,7 @@ class Filter(JailThread):
|
||||||
if self.checkFindTime and date is not None:
|
if self.checkFindTime and date is not None:
|
||||||
# if in operation (modifications have been really found):
|
# if in operation (modifications have been really found):
|
||||||
if self.inOperation:
|
if self.inOperation:
|
||||||
# if weird date - we'd simulate now for timeing issue (too large deviation from now):
|
# if weird date - we'd simulate now for timing issue (too large deviation from now):
|
||||||
delta = int(date - MyTime.time())
|
delta = int(date - MyTime.time())
|
||||||
if abs(delta) > 60:
|
if abs(delta) > 60:
|
||||||
# log timing issue as warning once per day:
|
# log timing issue as warning once per day:
|
||||||
|
|
|
@ -344,7 +344,7 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover
|
||||||
except OSError:
|
except OSError:
|
||||||
pass
|
pass
|
||||||
if self.idle:
|
if self.idle:
|
||||||
# because journal.wait will returns immediatelly if we have records in journal,
|
# because journal.wait will returns immediately if we have records in journal,
|
||||||
# just wait a little bit here for not idle, to prevent hi-load:
|
# just wait a little bit here for not idle, to prevent hi-load:
|
||||||
if not Utils.wait_for(lambda: not self.active or not self.idle,
|
if not Utils.wait_for(lambda: not self.active or not self.idle,
|
||||||
self.sleeptime * 10, self.sleeptime
|
self.sleeptime * 10, self.sleeptime
|
||||||
|
@ -434,7 +434,7 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover
|
||||||
return ret
|
return ret
|
||||||
|
|
||||||
def _updateDBPending(self):
|
def _updateDBPending(self):
|
||||||
"""Apply pending updates (jornal position) to database.
|
"""Apply pending updates (journal position) to database.
|
||||||
"""
|
"""
|
||||||
db = self.jail.database
|
db = self.jail.database
|
||||||
while True:
|
while True:
|
||||||
|
|
|
@ -161,7 +161,7 @@ class ObserverThread(JailThread):
|
||||||
self.pulse_notify()
|
self.pulse_notify()
|
||||||
|
|
||||||
def add_wn(self, *event):
|
def add_wn(self, *event):
|
||||||
"""Add a event to queue withouth notifying thread to wake up.
|
"""Add a event to queue without notifying thread to wake up.
|
||||||
"""
|
"""
|
||||||
## lock and add new event to queue:
|
## lock and add new event to queue:
|
||||||
with self._queue_lock:
|
with self._queue_lock:
|
||||||
|
@ -465,7 +465,7 @@ class ObserverThread(JailThread):
|
||||||
return banTime
|
return banTime
|
||||||
|
|
||||||
def banFound(self, ticket, jail, btime):
|
def banFound(self, ticket, jail, btime):
|
||||||
""" Notify observer a ban occured for ip
|
""" Notify observer a ban occurred for ip
|
||||||
|
|
||||||
Observer will check ip was known (bad) and possibly increase/prolong a ban time
|
Observer will check ip was known (bad) and possibly increase/prolong a ban time
|
||||||
Secondary we will actualize the bans and bips (bad ip) in database
|
Secondary we will actualize the bans and bips (bad ip) in database
|
||||||
|
@ -507,7 +507,7 @@ class ObserverThread(JailThread):
|
||||||
logSys.error('%s', e, exc_info=logSys.getEffectiveLevel()<=logging.DEBUG)
|
logSys.error('%s', e, exc_info=logSys.getEffectiveLevel()<=logging.DEBUG)
|
||||||
|
|
||||||
def prolongBan(self, ticket, jail):
|
def prolongBan(self, ticket, jail):
|
||||||
""" Notify observer a ban occured for ip
|
""" Notify observer a ban occurred for ip
|
||||||
|
|
||||||
Observer will check ip was known (bad) and possibly increase/prolong a ban time
|
Observer will check ip was known (bad) and possibly increase/prolong a ban time
|
||||||
Secondary we will actualize the bans and bips (bad ip) in database
|
Secondary we will actualize the bans and bips (bad ip) in database
|
||||||
|
@ -521,7 +521,7 @@ class ObserverThread(JailThread):
|
||||||
except Exception as e:
|
except Exception as e:
|
||||||
logSys.error('%s', e, exc_info=logSys.getEffectiveLevel()<=logging.DEBUG)
|
logSys.error('%s', e, exc_info=logSys.getEffectiveLevel()<=logging.DEBUG)
|
||||||
|
|
||||||
# Global observer initial created in server (could be later rewriten via singleton)
|
# Global observer initial created in server (could be later rewritten via singleton)
|
||||||
class _Observers:
|
class _Observers:
|
||||||
def __init__(self):
|
def __init__(self):
|
||||||
self.Main = None
|
self.Main = None
|
||||||
|
|
|
@ -222,7 +222,7 @@ class Server:
|
||||||
obsMain.stop()
|
obsMain.stop()
|
||||||
|
|
||||||
# Explicit close database (server can leave in a thread,
|
# Explicit close database (server can leave in a thread,
|
||||||
# so delayed GC can prevent commiting changes)
|
# so delayed GC can prevent committing changes)
|
||||||
if self.__db:
|
if self.__db:
|
||||||
self.__db.close()
|
self.__db.close()
|
||||||
self.__db = None
|
self.__db = None
|
||||||
|
|
|
@ -60,7 +60,7 @@ timeRE['H'] = r"(?P<H>[0-1]?\d|2[0-3])"
|
||||||
timeRE['M'] = r"(?P<M>[0-5]?\d)"
|
timeRE['M'] = r"(?P<M>[0-5]?\d)"
|
||||||
timeRE['S'] = r"(?P<S>[0-5]?\d|6[0-1])"
|
timeRE['S'] = r"(?P<S>[0-5]?\d|6[0-1])"
|
||||||
|
|
||||||
# Extend build-in TimeRE with some exact patterns
|
# Extend built-in TimeRE with some exact patterns
|
||||||
# exact two-digit patterns:
|
# exact two-digit patterns:
|
||||||
timeRE['Exd'] = r"(?P<d>[1-2]\d|0[1-9]|3[0-1])"
|
timeRE['Exd'] = r"(?P<d>[1-2]\d|0[1-9]|3[0-1])"
|
||||||
timeRE['Exm'] = r"(?P<m>0[1-9]|1[0-2])"
|
timeRE['Exm'] = r"(?P<m>0[1-9]|1[0-2])"
|
||||||
|
@ -307,7 +307,7 @@ def reGroupDictStrptime(found_dict, msec=False, default_tz=None):
|
||||||
day = now.day
|
day = now.day
|
||||||
assume_today = True
|
assume_today = True
|
||||||
|
|
||||||
# Actully create date
|
# Actually create date
|
||||||
date_result = datetime.datetime(
|
date_result = datetime.datetime(
|
||||||
year, month, day, hour, minute, second, fraction)
|
year, month, day, hour, minute, second, fraction)
|
||||||
# Correct timezone if not supplied in the log linge
|
# Correct timezone if not supplied in the log linge
|
||||||
|
|
|
@ -257,7 +257,7 @@ class FailTicket(Ticket):
|
||||||
as estimation from rate by previous known interval (if it exceeds the findTime)
|
as estimation from rate by previous known interval (if it exceeds the findTime)
|
||||||
"""
|
"""
|
||||||
if time > self._time:
|
if time > self._time:
|
||||||
# expand current interval and attemps count (considering maxTime):
|
# expand current interval and attempts count (considering maxTime):
|
||||||
if self._firstTime < time - maxTime:
|
if self._firstTime < time - maxTime:
|
||||||
# adjust retry calculated as estimation from rate by previous known interval:
|
# adjust retry calculated as estimation from rate by previous known interval:
|
||||||
self._retry = int(round(self._retry / float(time - self._firstTime) * maxTime))
|
self._retry = int(round(self._retry / float(time - self._firstTime) * maxTime))
|
||||||
|
|
|
@ -246,7 +246,7 @@ class CommandActionTest(LogCaptureTestCase):
|
||||||
lambda: self.__action.replaceTag("<a><b>",
|
lambda: self.__action.replaceTag("<a><b>",
|
||||||
self.__action._properties, conditional="family=inet4")
|
self.__action._properties, conditional="family=inet4")
|
||||||
)
|
)
|
||||||
# remore self-referencing in props:
|
# remote self-referencing in props:
|
||||||
delattr(self.__action, 'ac')
|
delattr(self.__action, 'ac')
|
||||||
# produce self-referencing query except:
|
# produce self-referencing query except:
|
||||||
self.assertRaisesRegex(ValueError, r"possible self referencing definitions in query",
|
self.assertRaisesRegex(ValueError, r"possible self referencing definitions in query",
|
||||||
|
@ -276,7 +276,7 @@ class CommandActionTest(LogCaptureTestCase):
|
||||||
conditional="family=inet6", cache=cache),
|
conditional="family=inet6", cache=cache),
|
||||||
"Text 890-567 text 567 '567'")
|
"Text 890-567 text 567 '567'")
|
||||||
self.assertTrue(len(cache) >= 3)
|
self.assertTrue(len(cache) >= 3)
|
||||||
# set one parameter - internal properties and cache should be reseted:
|
# set one parameter - internal properties and cache should be reset:
|
||||||
setattr(self.__action, 'xyz', "000-<abc>")
|
setattr(self.__action, 'xyz', "000-<abc>")
|
||||||
self.assertEqual(len(cache), 0)
|
self.assertEqual(len(cache), 0)
|
||||||
# test againg, should have 000 instead of 890:
|
# test againg, should have 000 instead of 890:
|
||||||
|
|
|
@ -337,7 +337,7 @@ class JailReaderTest(LogCaptureTestCase):
|
||||||
self.assertTrue(jail.getOptions())
|
self.assertTrue(jail.getOptions())
|
||||||
self.assertTrue(jail.isEnabled())
|
self.assertTrue(jail.isEnabled())
|
||||||
stream = jail.convert()
|
stream = jail.convert()
|
||||||
# check filter options are overriden with values specified directly in jail:
|
# check filter options are overridden with values specified directly in jail:
|
||||||
# prefregex:
|
# prefregex:
|
||||||
self.assertEqual([['set', 'sshd-override-flt-opts', 'prefregex', '^Test']],
|
self.assertEqual([['set', 'sshd-override-flt-opts', 'prefregex', '^Test']],
|
||||||
[o for o in stream if len(o) > 2 and o[2] == 'prefregex'])
|
[o for o in stream if len(o) > 2 and o[2] == 'prefregex'])
|
||||||
|
|
|
@ -127,7 +127,7 @@ class DatabaseTest(LogCaptureTestCase):
|
||||||
self.pruneLog("[test-repair], next phase - file-size: %d" % truncSize)
|
self.pruneLog("[test-repair], next phase - file-size: %d" % truncSize)
|
||||||
shutil.copyfile(
|
shutil.copyfile(
|
||||||
os.path.join(TEST_FILES_DIR, 'database_v1.db'), self.dbFilename)
|
os.path.join(TEST_FILES_DIR, 'database_v1.db'), self.dbFilename)
|
||||||
# produce currupt database:
|
# produce corrupt database:
|
||||||
f = os.open(self.dbFilename, os.O_RDWR)
|
f = os.open(self.dbFilename, os.O_RDWR)
|
||||||
os.ftruncate(f, truncSize)
|
os.ftruncate(f, truncSize)
|
||||||
os.close(f)
|
os.close(f)
|
||||||
|
|
|
@ -552,7 +552,7 @@ class Fail2banRegexTest(LogCaptureTestCase):
|
||||||
self.assertNotLogged('failure from == 192.0.2.4 ==')
|
self.assertNotLogged('failure from == 192.0.2.4 ==')
|
||||||
|
|
||||||
def testWrongFilterFile(self):
|
def testWrongFilterFile(self):
|
||||||
# use test log as filter file to cover eror cases...
|
# use test log as filter file to cover error cases...
|
||||||
self.assertFalse(_test_exec(
|
self.assertFalse(_test_exec(
|
||||||
FILENAME_ZZZ_GEN, FILENAME_ZZZ_GEN
|
FILENAME_ZZZ_GEN, FILENAME_ZZZ_GEN
|
||||||
))
|
))
|
||||||
|
|
|
@ -768,7 +768,7 @@ class LogFileFilterPoll(unittest.TestCase):
|
||||||
fc.setPos(0); self.filter.seekToTime(fc, time)
|
fc.setPos(0); self.filter.seekToTime(fc, time)
|
||||||
self.assertEqual(fc.getPos(), 157)
|
self.assertEqual(fc.getPos(), 157)
|
||||||
|
|
||||||
# stil one exact line:
|
# still one exact line:
|
||||||
f.write(b"%s [sshd] error: PAM: Authentication failure\n" % _tmb(time))
|
f.write(b"%s [sshd] error: PAM: Authentication failure\n" % _tmb(time))
|
||||||
f.write(b"%s [sshd] error: PAM: failure len 1\n" % _tmb(time))
|
f.write(b"%s [sshd] error: PAM: failure len 1\n" % _tmb(time))
|
||||||
f.flush()
|
f.flush()
|
||||||
|
@ -1056,7 +1056,7 @@ class CommonMonitorTestCase(unittest.TestCase):
|
||||||
return Utils.wait_for(lambda: self.filter.ticks >= last_ticks + ticks, _maxWaitTime(delay))
|
return Utils.wait_for(lambda: self.filter.ticks >= last_ticks + ticks, _maxWaitTime(delay))
|
||||||
|
|
||||||
def commonFltError(self, reason="common", exc=None):
|
def commonFltError(self, reason="common", exc=None):
|
||||||
""" Mock-up for default common error handler to find catched unhandled exceptions
|
""" Mock-up for default common error handler to find caught unhandled exceptions
|
||||||
could occur in filters
|
could occur in filters
|
||||||
"""
|
"""
|
||||||
self._commonFltError(reason, exc)
|
self._commonFltError(reason, exc)
|
||||||
|
@ -1087,7 +1087,7 @@ def get_monitor_failures_testcase(Filter_):
|
||||||
self.file = open(self.name, 'ab')
|
self.file = open(self.name, 'ab')
|
||||||
self.jail = DummyJail()
|
self.jail = DummyJail()
|
||||||
self.filter = Filter_(self.jail)
|
self.filter = Filter_(self.jail)
|
||||||
# mock-up common error to find catched unhandled exceptions:
|
# mock-up common error to find caught unhandled exceptions:
|
||||||
self._commonFltError, self.filter.commonError = self.filter.commonError, self.commonFltError
|
self._commonFltError, self.filter.commonError = self.filter.commonError, self.commonFltError
|
||||||
self.filter.addLogPath(self.name, autoSeek=False)
|
self.filter.addLogPath(self.name, autoSeek=False)
|
||||||
# speedup search using exact date pattern:
|
# speedup search using exact date pattern:
|
||||||
|
@ -1388,7 +1388,7 @@ def get_monitor_failures_journal_testcase(Filter_): # pragma: systemd no cover
|
||||||
def _initFilter(self, **kwargs):
|
def _initFilter(self, **kwargs):
|
||||||
self._getRuntimeJournal() # check journal available
|
self._getRuntimeJournal() # check journal available
|
||||||
self.filter = Filter_(self.jail, **kwargs)
|
self.filter = Filter_(self.jail, **kwargs)
|
||||||
# mock-up common error to find catched unhandled exceptions:
|
# mock-up common error to find caught unhandled exceptions:
|
||||||
self._commonFltError, self.filter.commonError = self.filter.commonError, self.commonFltError
|
self._commonFltError, self.filter.commonError = self.filter.commonError, self.commonFltError
|
||||||
self.filter.addJournalMatch([
|
self.filter.addJournalMatch([
|
||||||
"SYSLOG_IDENTIFIER=fail2ban-testcases",
|
"SYSLOG_IDENTIFIER=fail2ban-testcases",
|
||||||
|
@ -1704,7 +1704,7 @@ class GetFailures(LogCaptureTestCase):
|
||||||
self.assertSortedEqual(self.filter.getLogPaths(), [GetFailures.FILENAME_01, GetFailures.FILENAME_02])
|
self.assertSortedEqual(self.filter.getLogPaths(), [GetFailures.FILENAME_01, GetFailures.FILENAME_02])
|
||||||
|
|
||||||
def testTail(self):
|
def testTail(self):
|
||||||
# There must be no containters registered, otherwise [-1] indexing would be wrong
|
# There must be no containers registered, otherwise [-1] indexing would be wrong
|
||||||
self.assertEqual(self.filter.getLogs(), [])
|
self.assertEqual(self.filter.getLogs(), [])
|
||||||
self.filter.addLogPath(GetFailures.FILENAME_01, tail=True)
|
self.filter.addLogPath(GetFailures.FILENAME_01, tail=True)
|
||||||
self.assertEqual(self.filter.getLogs()[-1].getPos(), 1653)
|
self.assertEqual(self.filter.getLogs()[-1].getPos(), 1653)
|
||||||
|
@ -2043,7 +2043,7 @@ class DNSUtilsTests(unittest.TestCase):
|
||||||
c.set(i, 1)
|
c.set(i, 1)
|
||||||
st = time.time()
|
st = time.time()
|
||||||
self.assertTrue(Utils.wait_for(lambda: time.time() >= st + 0.0005, 1))
|
self.assertTrue(Utils.wait_for(lambda: time.time() >= st + 0.0005, 1))
|
||||||
# we have still 5 elements (or fewer if too slow test mashine):
|
# we have still 5 elements (or fewer if too slow test machine):
|
||||||
self.assertTrue(len(c) <= 5)
|
self.assertTrue(len(c) <= 5)
|
||||||
# but all that are expiered also:
|
# but all that are expiered also:
|
||||||
for i in range(10):
|
for i in range(10):
|
||||||
|
|
|
@ -205,19 +205,19 @@ class TestsUtilsTest(LogCaptureTestCase):
|
||||||
self.err = err
|
self.err = err
|
||||||
def __repr__(self):
|
def __repr__(self):
|
||||||
if self.err:
|
if self.err:
|
||||||
raise Exception('no represenation for test!')
|
raise Exception('no representation for test!')
|
||||||
else:
|
else:
|
||||||
return 'conv-error (\xf2\xf0\xe5\xf2\xe8\xe9), unterminated utf \xcf'
|
return 'conv-error (\xf2\xf0\xe5\xf2\xe8\xe9), unterminated utf \xcf'
|
||||||
test = Test()
|
test = Test()
|
||||||
logSys.log(logging.NOTICE, "test 1a: %r", test)
|
logSys.log(logging.NOTICE, "test 1a: %r", test)
|
||||||
self.assertLogged("Traceback", "no represenation for test!")
|
self.assertLogged("Traceback", "no representation for test!")
|
||||||
self.pruneLog()
|
self.pruneLog()
|
||||||
logSys.notice("test 1b: %r", test)
|
logSys.notice("test 1b: %r", test)
|
||||||
self.assertLogged("Traceback", "no represenation for test!")
|
self.assertLogged("Traceback", "no representation for test!")
|
||||||
|
|
||||||
self.pruneLog('[phase 2] test error conversion by encoding %s' % sys.getdefaultencoding())
|
self.pruneLog('[phase 2] test error conversion by encoding %s' % sys.getdefaultencoding())
|
||||||
test = Test(0)
|
test = Test(0)
|
||||||
# this may produce coversion error on ascii default encoding:
|
# this may produce conversion error on ascii default encoding:
|
||||||
#str(test)
|
#str(test)
|
||||||
logSys.log(logging.NOTICE, "test 2a: %r, %s", test, test)
|
logSys.log(logging.NOTICE, "test 2a: %r, %s", test, test)
|
||||||
self.assertLogged("test 2a", "Error by logging handler", all=False)
|
self.assertLogged("test 2a", "Error by logging handler", all=False)
|
||||||
|
|
|
@ -104,7 +104,7 @@ class BanTimeIncr(LogCaptureTestCase):
|
||||||
[1200, 2400, 4800, 9600, 19200, 38400, 43200, 43200, 43200, 43200]
|
[1200, 2400, 4800, 9600, 19200, 38400, 43200, 43200, 43200, 43200]
|
||||||
)
|
)
|
||||||
a.setBanTimeExtra('maxtime', '24h')
|
a.setBanTimeExtra('maxtime', '24h')
|
||||||
## test randomization - not possibe all 10 times we have random = 0:
|
## test randomization - not possible all 10 times we have random = 0:
|
||||||
a.setBanTimeExtra('rndtime', '5m')
|
a.setBanTimeExtra('rndtime', '5m')
|
||||||
self.assertTrue(
|
self.assertTrue(
|
||||||
False in [1200 in [a.calcBanTime(600, 1) for i in range(10)] for c in range(10)]
|
False in [1200 in [a.calcBanTime(600, 1) for i in range(10)] for c in range(10)]
|
||||||
|
@ -159,7 +159,7 @@ class BanTimeIncr(LogCaptureTestCase):
|
||||||
[1200, 2400, 4800, 9600, 19200, 38400, 43200, 43200, 43200, 43200]
|
[1200, 2400, 4800, 9600, 19200, 38400, 43200, 43200, 43200, 43200]
|
||||||
)
|
)
|
||||||
a.setBanTimeExtra('maxtime', '24h')
|
a.setBanTimeExtra('maxtime', '24h')
|
||||||
## test randomization - not possibe all 10 times we have random = 0:
|
## test randomization - not possible all 10 times we have random = 0:
|
||||||
a.setBanTimeExtra('rndtime', '5m')
|
a.setBanTimeExtra('rndtime', '5m')
|
||||||
self.assertTrue(
|
self.assertTrue(
|
||||||
False in [1200 in [int(a.calcBanTime(600, 1)) for i in range(10)] for c in range(10)]
|
False in [1200 in [int(a.calcBanTime(600, 1)) for i in range(10)] for c in range(10)]
|
||||||
|
@ -474,7 +474,7 @@ class BanTimeIncrDB(LogCaptureTestCase):
|
||||||
obs.wait_empty(5)
|
obs.wait_empty(5)
|
||||||
|
|
||||||
stime = int(MyTime.time())
|
stime = int(MyTime.time())
|
||||||
# completelly empty ?
|
# completely empty ?
|
||||||
tickets = self.db.getBans()
|
tickets = self.db.getBans()
|
||||||
self.assertEqual(tickets, [])
|
self.assertEqual(tickets, [])
|
||||||
|
|
||||||
|
@ -503,7 +503,7 @@ class BanTimeIncrDB(LogCaptureTestCase):
|
||||||
failManager.addFailure(ticket)
|
failManager.addFailure(ticket)
|
||||||
obs.add('failureFound', jail, ticket)
|
obs.add('failureFound', jail, ticket)
|
||||||
obs.wait_empty(5)
|
obs.wait_empty(5)
|
||||||
# wait until ticket transfered from failmanager into jail:
|
# wait until ticket transferred from failmanager into jail:
|
||||||
ticket2 = Utils.wait_for(jail.getFailTicket, 10)
|
ticket2 = Utils.wait_for(jail.getFailTicket, 10)
|
||||||
# check ticket and failure count:
|
# check ticket and failure count:
|
||||||
self.assertTrue(ticket2)
|
self.assertTrue(ticket2)
|
||||||
|
|
|
@ -1301,7 +1301,7 @@ class ServerConfigReaderTests(LogCaptureTestCase):
|
||||||
# for j in jails:
|
# for j in jails:
|
||||||
# print(j, jails[j])
|
# print(j, jails[j])
|
||||||
|
|
||||||
# test default stock actions sepecified in all stock jails:
|
# test default stock actions specified in all stock jails:
|
||||||
if not unittest.F2B.fast:
|
if not unittest.F2B.fast:
|
||||||
self._testExecActions(server)
|
self._testExecActions(server)
|
||||||
|
|
||||||
|
@ -1330,7 +1330,7 @@ class ServerConfigReaderTests(LogCaptureTestCase):
|
||||||
|
|
||||||
for actCfg in glob.glob(os.path.join(CONFIG_DIR, 'action.d', '*.conf')):
|
for actCfg in glob.glob(os.path.join(CONFIG_DIR, 'action.d', '*.conf')):
|
||||||
act = os.path.basename(actCfg).replace('.conf', '')
|
act = os.path.basename(actCfg).replace('.conf', '')
|
||||||
# transmit artifical jail with each action to the server:
|
# transmit artificial jail with each action to the server:
|
||||||
stream = self.getDefaultJailStream('j-'+act, act)
|
stream = self.getDefaultJailStream('j-'+act, act)
|
||||||
for cmd in stream:
|
for cmd in stream:
|
||||||
# command to server:
|
# command to server:
|
||||||
|
|
|
@ -230,7 +230,7 @@ class ClientMisc(LogCaptureTestCase):
|
||||||
def _poll(*args):
|
def _poll(*args):
|
||||||
phase['cntr'] += 1
|
phase['cntr'] += 1
|
||||||
raise Exception('test *%d*' % phase['cntr'])
|
raise Exception('test *%d*' % phase['cntr'])
|
||||||
# test errors "catched" and logged:
|
# test errors "caught" and logged:
|
||||||
loop(_active, use_poll=_poll)
|
loop(_active, use_poll=_poll)
|
||||||
self.assertLogged("test *1*", "test *10*", "test *20*", all=True)
|
self.assertLogged("test *1*", "test *10*", "test *20*", all=True)
|
||||||
self.assertLogged("Too many errors - stop logging connection errors")
|
self.assertLogged("Too many errors - stop logging connection errors")
|
||||||
|
|
|
@ -154,12 +154,12 @@ class TicketTests(unittest.TestCase):
|
||||||
self.assertEqual(
|
self.assertEqual(
|
||||||
t.getData(),
|
t.getData(),
|
||||||
{'matches': ['first', 'second'], 'failures':0, 'region': 'Hamburg', 'country': 'DE', 'city': 'Hamburg'})
|
{'matches': ['first', 'second'], 'failures':0, 'region': 'Hamburg', 'country': 'DE', 'city': 'Hamburg'})
|
||||||
# at once as dict (single argument, overwrites it completelly, no more matches/failures) :
|
# at once as dict (single argument, overwrites it completely, no more matches/failures) :
|
||||||
t.setData({'region': None, 'country': 'FR', 'city': 'Paris'},)
|
t.setData({'region': None, 'country': 'FR', 'city': 'Paris'},)
|
||||||
self.assertEqual(
|
self.assertEqual(
|
||||||
t.getData(),
|
t.getData(),
|
||||||
{'city': 'Paris', 'country': 'FR'})
|
{'city': 'Paris', 'country': 'FR'})
|
||||||
# at once as dict (overwrites it completelly, no more matches/failures) :
|
# at once as dict (overwrites it completely, no more matches/failures) :
|
||||||
t.setData({'region': 'Hamburg', 'country': 'DE', 'city': None})
|
t.setData({'region': 'Hamburg', 'country': 'DE', 'city': None})
|
||||||
self.assertEqual(
|
self.assertEqual(
|
||||||
t.getData(),
|
t.getData(),
|
||||||
|
@ -185,7 +185,7 @@ class TicketTests(unittest.TestCase):
|
||||||
self.assertEqual(
|
self.assertEqual(
|
||||||
t.getData(),
|
t.getData(),
|
||||||
{'city':'Berlin', 'region': 'Brandenburg', 'country': 'DE'})
|
{'city':'Berlin', 'region': 'Brandenburg', 'country': 'DE'})
|
||||||
# interator filter :
|
# iterator filter :
|
||||||
self.assertEqual(
|
self.assertEqual(
|
||||||
t.getData(('city', 'country')),
|
t.getData(('city', 'country')),
|
||||||
{'city':'Berlin', 'country': 'DE'})
|
{'city':'Berlin', 'country': 'DE'})
|
||||||
|
|
|
@ -267,7 +267,7 @@ def initTests(opts):
|
||||||
raise unittest.SkipTest('Skip test because of "--fast"')
|
raise unittest.SkipTest('Skip test because of "--fast"')
|
||||||
unittest.F2B.SkipIfFast = F2B_SkipIfFast
|
unittest.F2B.SkipIfFast = F2B_SkipIfFast
|
||||||
else:
|
else:
|
||||||
# smaller inertance inside test-cases (litle speedup):
|
# smaller inertance inside test-cases (little speedup):
|
||||||
Utils.DEFAULT_SLEEP_TIME = 0.025
|
Utils.DEFAULT_SLEEP_TIME = 0.025
|
||||||
Utils.DEFAULT_SLEEP_INTERVAL = 0.005
|
Utils.DEFAULT_SLEEP_INTERVAL = 0.005
|
||||||
Utils.DEFAULT_SHORT_INTERVAL = 0.0005
|
Utils.DEFAULT_SHORT_INTERVAL = 0.0005
|
||||||
|
|
|
@ -8,7 +8,7 @@
|
||||||
# DESCRIPTION (NOTES):
|
# DESCRIPTION (NOTES):
|
||||||
#
|
#
|
||||||
# Script to fetch list of agent strings from http://www.user-agents.org
|
# Script to fetch list of agent strings from http://www.user-agents.org
|
||||||
# which are known to be from mailicious bots, and create apache-badbots.conf
|
# which are known to be from malicious bots, and create apache-badbots.conf
|
||||||
# filter for fail2ban
|
# filter for fail2ban
|
||||||
#
|
#
|
||||||
# COPYRIGHT: Yaroslav Halchenko 2007-2013
|
# COPYRIGHT: Yaroslav Halchenko 2007-2013
|
||||||
|
|
Loading…
Reference in New Issue