diff --git a/ChangeLog b/ChangeLog index b10931be..e3ed79a7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,26 +4,30 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ================================================================================ -Fail2Ban (version 0.8.9) 2013/04/XX +Fail2Ban (version 0.8.9) 2013/05/13 ================================================================================ -ver. 0.8.9 (2013/04/XX) - wanna-be-stable +ver. 0.8.9 (2013/05/13) - wanna-be-stable ---------- -Although primarily a bugfix release, it incorporates many new -enhancements, few new features, but more importantly -- quite extended -tests battery with current 94% coverage. This release incorporates -more than a 100 of non-merge commits from 14 contributors (sorted by -number of commits): Yaroslav Halchenko, Daniel Black, Steven Hiscocks, -ArndRa, hamilton5, pigsyn, Erwan Ben Souiden, Michael Gebetsroither, -Orion Poplawski, Artur Penttinen, sebres, Nicolas Collignon, Pascal -Borreli, blotus: +Originally targeted as a bugfix release, it incorporated many new +enhancements, few new features, and more importantly -- quite extended +tests battery with current 94% coverage (from 56% of 0.8.8). -- Fixes: - Yaroslav Halchenko - * [6f4dad46] Documentation python-2.4 is the minimium version. - * [1eb23cf8] do not rely on scripts being under /usr -- might differ eg on - Fedora. Closes gh-112. Thanks to Camusensei for the bug report. +This release introduces over 200 of non-merge commits from 16 +contributors (sorted by number of commits): Yaroslav Halchenko, Daniel +Black, Steven Hiscocks, James Stout, Orion Poplawski, Enrico Labedzki, +ArndRa, hamilton5, pigsyn, Erwan Ben Souiden, Michael Gebetsroither, +Artur Penttinen, blotus, sebres, Nicolas Collignon, Pascal Borreli. + +Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom +Hendrikx, Yehuda Katz and other TBN heroes supporting users on +fail2ban-users mailing list and IRC. + +- Fixes: Yaroslav Halchenko + * [6f4dad46] python-2.4 is the minimal version. + * [1eb23cf8] do not rely on scripts being under /usr -- might differ e.g. + on Fedora. Closes gh-112. Thanks to Camusensei for the bug report. * [bf4d4af1] Changes for atomic writes. Thanks to Steven Hiscocks for insight. Closes gh-103. * [ab044b75] delay check for the existence of config directory until read. @@ -50,6 +54,8 @@ Borreli, blotus: gh-70. Thanks to iGeorgeX for the idea. blotus * [96eb8986] ' and " should also be escaped in action tags Closes gh-109 + Christoph Theis, Nick Hilliard, Daniel Black + * [b3bd877d,cde71080] Make syslog -v and syslog -vv formats work on FreeBSD - New features: Yaroslav Halchenko * [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile} @@ -69,8 +75,15 @@ Borreli, blotus: * [5f2d383] Add roundcube auth filter. Closes Debian bug #699442. Daniel Black * [be06b1b] Add action for iptables-ipsets. Closes gh-102. + Nick Munger, Ken Menzel, Daniel Black, Christoph Theis & Fabian Wenk + * [b6d0e8a] Add and enhance the bsd-ipfw action from + FreeBSD ports. Soulard Morgan * [f336d9f] Add filter for webmin. Closes gh-99. + Steven Hiscocks + * [..746c7d9] bash interactive shell completions for fail2ban-*'s + Nick Hilliard + * [0c5a9c5] Add pf action. - Enhancements: Enrico Labedzki * [24a8d07] Added new date format for ASSP SMTP Proxy. @@ -90,6 +103,7 @@ Borreli, blotus: * [40c5a2d] adding more of diagnostic messages into -client while starting the daemon. * [8e63d4c] Compare against None with 'is' instead of '=='. + * [6fef85f] Strip CR and LF while analyzing the log line Daniel Black * [3aeb1a9] Add jail.conf manual page. Closes gh-143. * [MANY] man page edits. @@ -97,19 +111,22 @@ Borreli, blotus: * [c8c7b0b,23bbc60] Better logging of log file read errors. * [3665e6d] Added code coverage to development process. * [41b9f7b,32d10e9,39750b8] More complete ssh filter rules to match openssh - source. Also include BSD changes. + source. Also include BSD changes. * [1d9abd1] Action files can have tags in definition that refer to other tags. + * [10886e7,cec5da2,adb991a] Change actions to response with ICMP port + unreachable rather than just a drop of the packet. Pascal Borreli * [a2b29b4] Fixed lots of typos in config files and documentation. hamilton5 * [7ede1e8] Update dovecot filter config. Romain Riviere * [0ac8746] Enhance named-refused filter for views. - -Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom -Hendrikx and other TBN heroes supporting users on fail2ban-users -mailing list and IRC. + James Stout + * [..2143cdf] Solaris support enhancements: + - README.Solaris + - failregex'es tune ups (sshd.conf) + - hostsdeny: do not rely on support of '-i' in sed ver. 0.8.8 (2012/12/06) - stable ---------- diff --git a/MANIFEST b/MANIFEST index 5eb71080..0537abae 100644 --- a/MANIFEST +++ b/MANIFEST @@ -1,4 +1,5 @@ README.md +README.Solaris ChangeLog TODO THANKS @@ -43,6 +44,9 @@ server/datetemplate.py server/mytime.py server/failregex.py testcases/files/testcase-usedns.log +testcases/files/logs/bsd/syslog-plain.txt +testcases/files/logs/bsd/syslog-v.txt +testcases/files/logs/bsd/syslog-vv.txt testcases/banmanagertestcase.py testcases/failmanagertestcase.py testcases/clientreadertestcase.py @@ -97,7 +101,9 @@ config/filter.d/dropbear.conf config/filter.d/lighttpd-auth.conf config/filter.d/recidive.conf config/filter.d/roundcube-auth.conf +config/action.d/bsd-ipfw.conf config/action.d/dummy.conf +config/action.d/iptables-blocktype.conf config/action.d/iptables-ipset-proto4.conf config/action.d/iptables-ipset-proto6.conf config/action.d/iptables-xt_recent-echo.conf @@ -117,6 +123,7 @@ config/action.d/mail-buffered.conf config/action.d/mail-whois.conf config/action.d/mail-whois-lines.conf config/action.d/mynetwatchman.conf +config/action.d/pf.conf config/action.d/sendmail.conf config/action.d/sendmail-buffered.conf config/action.d/sendmail-whois.conf @@ -145,3 +152,4 @@ files/cacti/cacti_host_template_fail2ban.xml files/cacti/README files/nagios/check_fail2ban files/nagios/f2ban.txt +files/bash-completion diff --git a/README.Solaris b/README.Solaris index 49056062..10a5f88c 100644 --- a/README.Solaris +++ b/README.Solaris @@ -71,7 +71,7 @@ OPT: Create /etc/fail2ban/fail2ban.local containing: # Fail2Ban main configuration file # -# Comments: use '#' for comment lines and ';' for inline comments +# Comments: use '#' for comment lines and ';' (following a space) for inline comments # # Changes: in most of the cases you should not modify this # file, but provide customizations in fail2ban.local file, e.g.: diff --git a/README.md b/README.md index 04f8b349..91deaf19 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ / _|__ _(_) |_ ) |__ __ _ _ _ | _/ _` | | |/ /| '_ \/ _` | ' \ |_| \__,_|_|_/___|_.__/\__,_|_||_| - v0.8.8 2012/07/31 + v0.8.9 2013/05/13 ## Fail2Ban: ban hosts that cause multiple authentication errors @@ -30,8 +30,8 @@ Optional: To install, just do: - tar xvfj fail2ban-0.8.8.tar.bz2 - cd fail2ban-0.8.8 + tar xvfj fail2ban-0.8.9.tar.bz2 + cd fail2ban-0.8.9 python setup.py install This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are @@ -56,7 +56,7 @@ the website: http://www.fail2ban.org Code status: ------------ -* [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.png)](https://travis-ci.org/fail2ban/fail2ban) travis-ci.org (master branch) +* [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.png?branch=master)](https://travis-ci.org/fail2ban/fail2ban) travis-ci.org (master branch) * [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.png?branch=master)](https://coveralls.io/r/fail2ban/fail2ban) diff --git a/client/__init__.py b/client/__init__.py index 3de9058c..2b76f4b6 100644 --- a/client/__init__.py +++ b/client/__init__.py @@ -21,7 +21,5 @@ # __author__ = "Cyril Jaquier" -__version__ = "$Revision$" -__date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" diff --git a/client/actionreader.py b/client/actionreader.py index c1a64245..8f60b55b 100644 --- a/client/actionreader.py +++ b/client/actionreader.py @@ -21,8 +21,6 @@ # __author__ = "Cyril Jaquier" -__version__ = "$Revision$" -__date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" diff --git a/client/configparserinc.py b/client/configparserinc.py index df5af1ac..f5e124a1 100644 --- a/client/configparserinc.py +++ b/client/configparserinc.py @@ -21,8 +21,6 @@ # Modified: Cyril Jaquier __author__ = 'Yaroslav Halhenko' -__revision__ = '$Revision$' -__date__ = '$Date$' __copyright__ = 'Copyright (c) 2007 Yaroslav Halchenko' __license__ = 'GPL' diff --git a/client/configreader.py b/client/configreader.py index 9fb6b3eb..3d3aff94 100644 --- a/client/configreader.py +++ b/client/configreader.py @@ -21,8 +21,6 @@ # Modified by: Yaroslav Halchenko (SafeConfigParserWithIncludes) __author__ = "Cyril Jaquier" -__version__ = "$Revision$" -__date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" diff --git a/client/configurator.py b/client/configurator.py index fc588558..d5f46305 100644 --- a/client/configurator.py +++ b/client/configurator.py @@ -21,8 +21,6 @@ # __author__ = "Cyril Jaquier" -__version__ = "$Revision$" -__date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" diff --git a/client/csocket.py b/client/csocket.py index c6f318f2..3d8362b5 100644 --- a/client/csocket.py +++ b/client/csocket.py @@ -21,8 +21,6 @@ # __author__ = "Cyril Jaquier" -__version__ = "$Revision$" -__date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" diff --git a/client/fail2banreader.py b/client/fail2banreader.py index 026076fa..ada88084 100644 --- a/client/fail2banreader.py +++ b/client/fail2banreader.py @@ -21,8 +21,6 @@ # __author__ = "Cyril Jaquier" -__version__ = "$Revision$" -__date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" diff --git a/client/filterreader.py b/client/filterreader.py index b8c47558..f75190f9 100644 --- a/client/filterreader.py +++ b/client/filterreader.py @@ -21,8 +21,6 @@ # __author__ = "Cyril Jaquier" -__version__ = "$Revision$" -__date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" diff --git a/client/jailreader.py b/client/jailreader.py index d6f678ee..f8757e26 100644 --- a/client/jailreader.py +++ b/client/jailreader.py @@ -21,8 +21,6 @@ # __author__ = "Cyril Jaquier" -__version__ = "$Revision$" -__date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" diff --git a/client/jailsreader.py b/client/jailsreader.py index f87794dd..098b525d 100644 --- a/client/jailsreader.py +++ b/client/jailsreader.py @@ -21,8 +21,6 @@ # __author__ = "Cyril Jaquier" -__version__ = "$Revision$" -__date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" diff --git a/common/__init__.py b/common/__init__.py index 3de9058c..2b76f4b6 100644 --- a/common/__init__.py +++ b/common/__init__.py @@ -21,7 +21,5 @@ # __author__ = "Cyril Jaquier" -__version__ = "$Revision$" -__date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" diff --git a/common/helpers.py b/common/helpers.py index 3c830138..c0cf052e 100644 --- a/common/helpers.py +++ b/common/helpers.py @@ -17,13 +17,7 @@ # along with Fail2Ban; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -# Author: Cyril Jaquier -# Author: Arturo 'Buanzo' Busleiman -# - -__author__ = "Cyril Jaquier" -__version__ = "$Revision$" -__date__ = "$Date$" +__author__ = "Cyril Jaquier, Arturo 'Buanzo' Busleiman" __copyright__ = "Copyright (c) 2009 Cyril Jaquier" __license__ = "GPL" @@ -35,6 +29,12 @@ def formatExceptionInfo(): excName = cla.__name__ try: excArgs = exc.__dict__["args"] + # Assure that we always return a string, without unneeded + # 'decorations' with python <= 2.5 where args would be a tuple + if isinstance(excArgs, tuple) and len(excArgs) == 1: + excArgs = excArgs[0] + excArgs = str(excArgs) except KeyError: + # And always provide a string output excArgs = str(exc) return (excName, excArgs) diff --git a/common/protocol.py b/common/protocol.py index ccd44398..9309ce7f 100644 --- a/common/protocol.py +++ b/common/protocol.py @@ -21,8 +21,6 @@ # __author__ = "Cyril Jaquier" -__version__ = "$Revision$" -__date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" diff --git a/common/version.py b/common/version.py index df3b97c3..e6f948cd 100644 --- a/common/version.py +++ b/common/version.py @@ -18,10 +18,10 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. # Author: Cyril Jaquier -# +# __author__ = "Cyril Jaquier, Yaroslav Halchenko" -__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Yaroslav Halchenko" +__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2013 Yaroslav Halchenko" __license__ = "GPL" -version = "0.8.8" +version = "0.8.9" diff --git a/config/action.d/bsd-ipfw.conf b/config/action.d/bsd-ipfw.conf new file mode 100644 index 00000000..33f176e4 --- /dev/null +++ b/config/action.d/bsd-ipfw.conf @@ -0,0 +1,82 @@ +# Fail2Ban configuration file +# +# Author: Nick Munger +# Modified by: Ken Menzel +# Daniel Black (start/stop) +# Fabian Wenk (many ideas as per fail2ban users list) +# +# Ensure firewall_enable="YES" in the top of /etc/rc.conf +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = ipfw show | fgrep -q 'table()' || ( ipfw show | awk 'BEGIN { b = 1 } { if ($1 <= b) { b = $1 + 1 } else { e = b } } END { if (e) exit e
else exit b }'; num=$?; ipfw -q add $num deny from table\(
\) to me ; echo $num > "" ) + + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = [ -f ] && ( read num < ""
ipfw -q delete $num
rm "" ) + + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +# requires an ipfw rule like "deny ip from table(1) to me" +actionban = ipfw table
add + + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = ipfw table
delete + +[Init] +# Option: table +# Notes: The ipfw table to use. If a ipfw rule using this table already exists, +# this action will not create a ipfw rule to block it and the following +# options will have no effect. +# Values: NUM +table = 1 + +# Option: port +# Notes.: Specifies port to monitor. Blank indicate block all ports. +# Values: [ NUM | STRING ] +# +port = + +# Option: startstatefile +# Notes: A file to indicate that the table rule that was added. Ensure it is unique per table. +# Values: STRING +startstatefile = /var/run/fail2ban/ipfw-started-table_
+ +# Option: action +# Notes: This is the action to take for automaticly created rules. See the +# ACTION defination at the top of man ipfw for allowed values. +# "deny" and "unreach port" are probably the useful. +# Values: STRING +action = deny + +# Option: block +# Notes: This is how much to block. +# Can be "ip", "tcp", "udp" or various other options. +# Values: STRING +block = ip diff --git a/config/action.d/ipfilter.conf b/config/action.d/ipfilter.conf index d77de9bf..61420e38 100644 --- a/config/action.d/ipfilter.conf +++ b/config/action.d/ipfilter.conf @@ -37,7 +37,7 @@ actioncheck = # Tags: See jail.conf(5) man page # Values: CMD # -actionban = echo block in quick from /32 | /sbin/ipf -f - +actionban = echo block in quick from /32 | /sbin/ipf -f - # Option: actionunban @@ -47,7 +47,12 @@ actionban = echo block in quick from /32 | /sbin/ipf -f - # Values: CMD # # note -r option used to remove matching rule -actionunban = echo block in quick from /32 | /sbin/ipf -r -f - +actionunban = echo block in quick from /32 | /sbin/ipf -r -f - [Init] +# Option: Blocktype +# Notes : This is the return-icmp[return-code] mentioned in the ipf man page section 5. Keep this quoted to prevent +# Shell expansion. This should be blank (unquoted) to drop the packet. +# Values: STRING +blocktype = "return-icmp(port-unr)" diff --git a/config/action.d/ipfw.conf b/config/action.d/ipfw.conf index 3a56415d..09045815 100644 --- a/config/action.d/ipfw.conf +++ b/config/action.d/ipfw.conf @@ -34,7 +34,7 @@ actioncheck = # Tags: See jail.conf(5) man page # Values: CMD # -actionban = ipfw add deny tcp from to +actionban = ipfw add tcp from to # Option: actionunban @@ -58,3 +58,11 @@ port = ssh # Values: IP # localhost = 127.0.0.1 + + +# Option: blocktype +# Notes.: How to block the traffic. Use a action from man 5 ipfw +# Common values: deny, unreach port, reset +# Values: STRING +# +blocktype = unreach port diff --git a/config/action.d/iptables-allports.conf b/config/action.d/iptables-allports.conf index 50f49d82..91d40711 100644 --- a/config/action.d/iptables-allports.conf +++ b/config/action.d/iptables-allports.conf @@ -6,6 +6,11 @@ # # +[INCLUDES] + +before = iptables-blocktype.conf + + [Definition] # Option: actionstart @@ -36,7 +41,7 @@ actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Tags: See jail.conf(5) man page # Values: CMD # -actionban = iptables -I fail2ban- 1 -s -j DROP +actionban = iptables -I fail2ban- 1 -s -j # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -44,7 +49,7 @@ actionban = iptables -I fail2ban- 1 -s -j DROP # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = iptables -D fail2ban- -s -j DROP +actionunban = iptables -D fail2ban- -s -j [Init] diff --git a/config/action.d/iptables-blocktype.conf b/config/action.d/iptables-blocktype.conf new file mode 100644 index 00000000..c505e49c --- /dev/null +++ b/config/action.d/iptables-blocktype.conf @@ -0,0 +1,22 @@ +# Fail2Ban configuration file +# +# Author: Daniel Black +# +# This is a included configuration file and includes the defination for the blocktype +# used in all iptables based actions by default. +# +# The user can override the default in iptables-blocktype.local + +[INCLUDES] + +after = iptables-blocktype.local + +[Init] + +# Option: blocktype +# Note: This is what the action does with rules. This can be any jump target +# as per the iptables man page (section 8). Common values are DROP +# REJECT, REJECT --reject-with icmp-port-unreachable +# Values: STRING +blocktype = REJECT --reject-with icmp-port-unreachable + diff --git a/config/action.d/iptables-ipset-proto4.conf b/config/action.d/iptables-ipset-proto4.conf index 4221dd8d..3ed778f9 100644 --- a/config/action.d/iptables-ipset-proto4.conf +++ b/config/action.d/iptables-ipset-proto4.conf @@ -18,6 +18,10 @@ # apt-get install ipset xtables-addons-source # module-assistant auto-install xtables-addons +[INCLUDES] + +before = iptables-blocktype.conf + [Definition] # Option: actionstart @@ -25,13 +29,13 @@ # Values: CMD # actionstart = ipset --create fail2ban- iphash - iptables -I INPUT -p -m multiport --dports -m set --match-set fail2ban- src -j DROP + iptables -I INPUT -p -m multiport --dports -m set --match-set fail2ban- src -j # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = iptables -D INPUT -p -m multiport --dports -m set --match-set fail2ban- src -j DROP +actionstop = iptables -D INPUT -p -m multiport --dports -m set --match-set fail2ban- src -j ipset --flush fail2ban- ipset --destroy fail2ban- @@ -68,4 +72,3 @@ port = ssh # Values: [ tcp | udp | icmp | all ] Default: tcp # protocol = tcp - diff --git a/config/action.d/iptables-ipset-proto6.conf b/config/action.d/iptables-ipset-proto6.conf index d90acd44..3cf9b140 100644 --- a/config/action.d/iptables-ipset-proto6.conf +++ b/config/action.d/iptables-ipset-proto6.conf @@ -18,6 +18,11 @@ # apt-get install ipset xtables-addons-source # module-assistant auto-install xtables-addons +[INCLUDES] + +before = iptables-blocktype.conf + + [Definition] # Option: actionstart @@ -74,5 +79,3 @@ protocol = tcp # Values: [ NUM ] Default: 600 bantime = 600 - - diff --git a/config/action.d/iptables-multiport-log.conf b/config/action.d/iptables-multiport-log.conf index b79983fc..6084cb6c 100644 --- a/config/action.d/iptables-multiport-log.conf +++ b/config/action.d/iptables-multiport-log.conf @@ -9,6 +9,10 @@ # # +[INCLUDES] + +before = iptables-blocktype.conf + [Definition] # Option: actionstart @@ -20,7 +24,7 @@ actionstart = iptables -N fail2ban- iptables -I 1 -p -m multiport --dports -j fail2ban- iptables -N fail2ban--log iptables -I fail2ban--log -j LOG --log-prefix "$(expr fail2ban- : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2 - iptables -A fail2ban--log -j DROP + iptables -A fail2ban--log -j # Option: actionstop # Notes.: command executed once at the end of Fail2Ban diff --git a/config/action.d/iptables-multiport.conf b/config/action.d/iptables-multiport.conf index f799289f..daa31148 100644 --- a/config/action.d/iptables-multiport.conf +++ b/config/action.d/iptables-multiport.conf @@ -4,6 +4,10 @@ # Modified by Yaroslav Halchenko for multiport banning # +[INCLUDES] + +before = iptables-blocktype.conf + [Definition] # Option: actionstart @@ -34,7 +38,7 @@ actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Tags: See jail.conf(5) man page # Values: CMD # -actionban = iptables -I fail2ban- 1 -s -j DROP +actionban = iptables -I fail2ban- 1 -s -j # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -42,7 +46,7 @@ actionban = iptables -I fail2ban- 1 -s -j DROP # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = iptables -D fail2ban- -s -j DROP +actionunban = iptables -D fail2ban- -s -j [Init] diff --git a/config/action.d/iptables-new.conf b/config/action.d/iptables-new.conf index f22916e1..38927442 100644 --- a/config/action.d/iptables-new.conf +++ b/config/action.d/iptables-new.conf @@ -6,6 +6,11 @@ # # +[INCLUDES] + +before = iptables-blocktype.conf + + [Definition] # Option: actionstart @@ -36,7 +41,7 @@ actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Tags: See jail.conf(5) man page # Values: CMD # -actionban = iptables -I fail2ban- 1 -s -j DROP +actionban = iptables -I fail2ban- 1 -s -j # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -44,7 +49,7 @@ actionban = iptables -I fail2ban- 1 -s -j DROP # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = iptables -D fail2ban- -s -j DROP +actionunban = iptables -D fail2ban- -s -j [Init] diff --git a/config/action.d/iptables-xt_recent-echo.conf b/config/action.d/iptables-xt_recent-echo.conf index 4fb397a2..829d4c06 100644 --- a/config/action.d/iptables-xt_recent-echo.conf +++ b/config/action.d/iptables-xt_recent-echo.conf @@ -4,6 +4,11 @@ # # +[INCLUDES] + +before = iptables-blocktype.conf + + [Definition] # Option: actionstart @@ -28,7 +33,7 @@ # own rules. The 3600 second timeout is independent and acts as a # safeguard in case the fail2ban process dies unexpectedly. The # shorter of the two timeouts actually matters. -actionstart = iptables -I INPUT -m recent --update --seconds 3600 --name fail2ban- -j DROP +actionstart = iptables -I INPUT -m recent --update --seconds 3600 --name fail2ban- -j # Option: actionstop # Notes.: command executed once at the end of Fail2Ban diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf index 662b41c0..370e4731 100644 --- a/config/action.d/iptables.conf +++ b/config/action.d/iptables.conf @@ -4,6 +4,10 @@ # # +[INCLUDES] + +before = iptables-blocktype.conf + [Definition] # Option: actionstart @@ -34,7 +38,7 @@ actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Tags: See jail.conf(5) man page # Values: CMD # -actionban = iptables -I fail2ban- 1 -s -j DROP +actionban = iptables -I fail2ban- 1 -s -j # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -42,7 +46,7 @@ actionban = iptables -I fail2ban- 1 -s -j DROP # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = iptables -D fail2ban- -s -j DROP +actionunban = iptables -D fail2ban- -s -j [Init] diff --git a/config/action.d/pf.conf b/config/action.d/pf.conf new file mode 100644 index 00000000..d82cbb12 --- /dev/null +++ b/config/action.d/pf.conf @@ -0,0 +1,62 @@ +# Fail2Ban configuration file +# +# OpenBSD pf ban/unban +# +# Author: Nick Hilliard +# +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +# we don't enable PF automatically, as it will be enabled elsewhere +actionstart = + + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +# we don't disable PF automatically either +actionstop = + + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: IP address +# number of failures +#