diff --git a/.gitignore b/.gitignore index a8942050..780ecfb5 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ htmlcov *.bak __pycache__ .vagrant/ +.idea/ diff --git a/.travis.yml b/.travis.yml index bd2d294c..bad7e16e 100644 --- a/.travis.yml +++ b/.travis.yml @@ -8,12 +8,17 @@ python: - "3.3" - "3.4" - "pypy" + - "pypy3" before_install: - - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get update -qq; fi + - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then travis_retry sudo apt-get update -qq; fi install: - - pip install pyinotify - - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get install -qq python-gamin; cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/; fi - - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then cd ..; pip install -q coveralls; cd -; fi + - travis_retry pip install pyinotify + - if [[ $TRAVIS_PYTHON_VERSION == 2* || $TRAVIS_PYTHON_VERSION == 'pypy' ]]; then travis_retry pip install dnspython; fi + - if [[ $TRAVIS_PYTHON_VERSION == 3* || $TRAVIS_PYTHON_VERSION == 'pypy3' ]]; then travis_retry pip install dnspython3; fi + - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then travis_retry sudo apt-get install -qq python-gamin; cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/; fi + - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then cd ..; travis_retry pip install -q coveralls; cd -; fi + # overcome buggy pypy + - if [[ $TRAVIS_PYTHON_VERSION == pypy ]] ; then dpkg --compare-versions $(pypy --version 2>&1 | awk '/PyPy/{print $2;}') ge 2.5.1 || { d=$PWD; cd /tmp; wget http://buildbot.pypy.org/nightly/trunk/pypy-c-jit-latest-linux64.tar.bz2; tar -xjvf pypy*bz2; cd pypy-*/bin/; export PATH=$PWD:$PATH; cd $d; } ; fi script: - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then coverage run --rcfile=.travis_coveragerc setup.py test; else python setup.py test; fi # test installation diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a668fa3d..b8783b01 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -15,3 +15,13 @@ join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-us ### You would like to contribute (new filters/actions/code/documentation)? send a [pull request](https://github.com/fail2ban/fail2ban/pulls) + +Pull requests guidelines +======================== + +- If there is an issue on github to be closed by the pull request, include + ```Closes #ISSUE``` (where ISSUE is issue's number) + +- Add a brief summary of the change to the ChangeLog file into a corresponding + section out of Fixes, New Features or Enhancements (improvements to existing + features) diff --git a/ChangeLog b/ChangeLog index 853f603e..fe22906f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,17 +3,20 @@ | _/ _` | | |/ /| '_ \/ _` | ' \ |_| \__,_|_|_/___|_.__/\__,_|_||_| -================================================================================ -Fail2Ban (version 0.9.1.dev) 2014/10/29 -================================================================================ +Fail2Ban: Changelog +=================== -ver. 0.9.2 (2014/XX/XXX) - wanna-be-released ------------ +ver. 0.9.2 (2015/04/26) - better-quick-now-than-later +---------- - Fixes: + * infinite busy loop on _escapedTags match in substituteRecursiveTags gh-907. + Thanks TonyThompson + * port[s] typo in jail.conf/nginx-http-auth gh-913. Thanks Frederik Wagner + (fnerdwq) * $ typo in jail.conf. Thanks Skibbi. Debian bug #767255 * grep'ing for IP in *mail-whois-lines.conf should now match also - at the begginning and EOL. Thanks Dean Lee + at the beginning and EOL. Thanks Dean Lee * jail.conf - php-url-fopen: separate logpath entries by newline * failregex declared direct in jail was joined to single line (specifying of @@ -21,19 +24,67 @@ ver. 0.9.2 (2014/XX/XXX) - wanna-be-released * filters.d/exim.conf - cover different settings of exim logs details. Thanks bes.internal * filter.d/postfix-sasl.conf - failregex is now case insensitive + * filters.d/postfix.conf - add 'Client host rejected error message' failregex + * fail2ban/__init__.py - add strptime thread safety hack-around + * recidive uses iptables-allports banaction by default now. + Avoids problems with iptables versions not understanding 'all' for + protocols and ports + * filter.d/dovecot.conf + - match pam_authenticate line from EL7 + - match unknown user line from EL7 + * Use use_poll=True for Python 2.7 and >=3.4 to overcome "Bad file + descriptor" msgs issue (gh-161) + * filter.d/postfix-sasl.conf - tweak failregex and add ignoreregex to ignore + system authentication issues + * fail2ban-regex reads filter file(s) completely, incl. '.local' file etc. + (gh-954) + * firewallcmd-* actions: split output into separate lines for grepping (gh-908) + * Guard unicode encode/decode issues while storing records in the database. + Fixes "binding parameter error (unsupported type)" (gh-973), thanks to kot + for reporting + * filter.d/sshd added regex for matching openSUSE ssh authentication failure + * filter.d/asterisk.conf: + - Dropped "Sending fake auth rejection" failregex since it incorrectly + targets the asterisk server itself + - match "hacking attempt detected" logs - New Features: + - New filters: + - postfix-rbl Thanks Lee Clemens + - apache-fakegooglebot.conf Thanks Lee Clemens + - nginx-botsearch Thanks Frantisek Sumsal + - New recursive embedded substitution feature added: + - `<HOST>` becomes `` for PREF=`IPV4`; + - `<HOST>` becomes `1.2.3.4` for PREF=`IPV4` and IPV4HOST=`1.2.3.4`; - New interpolation feature for config readers - `%(known/parameter)s`. (means last known option with name `parameter`). This interpolation makes possible to extend a stock filter or jail regexp in .local file (opposite to simply set failregex/ignoreregex that overwrites it), see gh-867. - - Monit config for fail2ban in /files/monit + - Monit config for fail2ban in files/monit/ + - New actions: + - action.d/firewallcmd-multiport and action.d/firewallcmd-allports Thanks Donald Yandt + - action.d/sendmail-geoip-lines.conf + - action.d/nsupdate to update DNSBL. Thanks Andrew St. Jean + - New status argument for fail2ban-client -- flavor: + fail2ban-client status [flavor] + - empty or "basic" works as-is + - "cymru" additionally prints (ASN, Country RIR) per banned IP + (requires dnspython or dnspython3) + - Flush log at USR1 signal - Enhancements: * Enable multiport for firewallcmd-new action. Closes gh-834 * files/debian-initd migrated from the debian branch and should be suitable for manual installations now (thanks Juan Karlo de Guzman) + * Define empty ignoreregex in filters which didn't have it to avoid + warnings (gh-934) + * action.d/{sendmail-*,xarf-login-attack}.conf - report local + timezone not UTC time/zone. Closes gh-911 + * Conditionally log Ignore IP with reason (dns, ip, command). Closes gh-916 + * Absorbed DNSUtils.cidr into addr2bin in filter.py, added unittests + * Added syslogsocket configuration to fail2ban.conf + * Note in the jail.conf for the recidive jail to increase dbpurgeage (gh-964) ver. 0.9.1 (2014/10/29) - better, faster, stronger diff --git a/MANIFEST b/MANIFEST index c6de80fd..d6bdba10 100644 --- a/MANIFEST +++ b/MANIFEST @@ -9,14 +9,155 @@ RELEASE THANKS TODO Vagrantfile +bin/fail2ban-client +bin/fail2ban-regex +bin/fail2ban-server +bin/fail2ban-testcases +config/action.d/apf.conf +config/action.d/badips.conf +config/action.d/badips.py +config/action.d/blocklist_de.conf +config/action.d/bsd-ipfw.conf +config/action.d/cloudflare.conf +config/action.d/complain.conf +config/action.d/dshield.conf +config/action.d/dummy.conf +config/action.d/firewallcmd-allports.conf +config/action.d/firewallcmd-ipset.conf +config/action.d/firewallcmd-multiport.conf +config/action.d/firewallcmd-new.conf +config/action.d/hostsdeny.conf +config/action.d/ipfilter.conf +config/action.d/ipfw.conf +config/action.d/iptables-allports.conf +config/action.d/iptables-common.conf +config/action.d/iptables-ipset-proto4.conf +config/action.d/iptables-ipset-proto6-allports.conf +config/action.d/iptables-ipset-proto6.conf +config/action.d/iptables-multiport-log.conf +config/action.d/iptables-multiport.conf +config/action.d/iptables-new.conf +config/action.d/iptables-xt_recent-echo.conf +config/action.d/iptables.conf +config/action.d/mail-buffered.conf +config/action.d/mail-whois-lines.conf +config/action.d/mail-whois.conf +config/action.d/mail.conf +config/action.d/mynetwatchman.conf +config/action.d/nsupdate.conf +config/action.d/nsupdate.conf +config/action.d/osx-afctl.conf +config/action.d/osx-ipfw.conf +config/action.d/pf.conf +config/action.d/route.conf +config/action.d/sendmail-buffered.conf +config/action.d/sendmail-common.conf +config/action.d/sendmail-geoip-lines.conf +config/action.d/sendmail-whois-ipjailmatches.conf +config/action.d/sendmail-whois-ipmatches.conf +config/action.d/sendmail-whois-lines.conf +config/action.d/sendmail-whois-matches.conf +config/action.d/sendmail-whois.conf +config/action.d/sendmail.conf +config/action.d/shorewall.conf +config/action.d/smtp.py +config/action.d/symbiosis-blacklist-allports.conf +config/action.d/ufw.conf +config/action.d/xarf-login-attack.conf +config/fail2ban.conf +config/filter.d/3proxy.conf +config/filter.d/apache-auth.conf +config/filter.d/apache-badbots.conf +config/filter.d/apache-botsearch.conf +config/filter.d/apache-common.conf +config/filter.d/apache-fakegooglebot.conf +config/filter.d/apache-modsecurity.conf +config/filter.d/apache-nohome.conf +config/filter.d/apache-noscript.conf +config/filter.d/apache-overflows.conf +config/filter.d/apache-shellshock.conf +config/filter.d/assp.conf +config/filter.d/asterisk.conf +config/filter.d/botsearch-common.conf +config/filter.d/common.conf +config/filter.d/counter-strike.conf +config/filter.d/courier-auth.conf +config/filter.d/courier-smtp.conf +config/filter.d/cyrus-imap.conf +config/filter.d/directadmin.conf +config/filter.d/dovecot.conf +config/filter.d/dropbear.conf +config/filter.d/ejabberd-auth.conf +config/filter.d/exim-common.conf +config/filter.d/exim-spam.conf +config/filter.d/exim.conf +config/filter.d/freeswitch.conf +config/filter.d/groupoffice.conf +config/filter.d/gssftpd.conf +config/filter.d/guacamole.conf +config/filter.d/horde.conf +config/filter.d/ignorecommands +config/filter.d/ignorecommands/apache-fakegooglebot +config/filter.d/kerio.conf +config/filter.d/lighttpd-auth.conf +config/filter.d/monit.conf +config/filter.d/mysqld-auth.conf +config/filter.d/nagios.conf +config/filter.d/named-refused.conf +config/filter.d/nginx-botsearch.conf +config/filter.d/nginx-http-auth.conf +config/filter.d/nsd.conf +config/filter.d/openwebmail.conf +config/filter.d/oracleims.conf +config/filter.d/pam-generic.conf +config/filter.d/pam-generic.conf +config/filter.d/pam-generic.conf +config/filter.d/perdition.conf +config/filter.d/php-url-fopen.conf +config/filter.d/php-url-fopen.conf +config/filter.d/php-url-fopen.conf +config/filter.d/portsentry.conf +config/filter.d/postfix-rbl.conf +config/filter.d/postfix-sasl.conf +config/filter.d/postfix-sasl.conf +config/filter.d/postfix-sasl.conf +config/filter.d/postfix.conf +config/filter.d/proftpd.conf +config/filter.d/pure-ftpd.conf +config/filter.d/qmail.conf +config/filter.d/recidive.conf +config/filter.d/roundcube-auth.conf +config/filter.d/selinux-common.conf +config/filter.d/selinux-ssh.conf +config/filter.d/sendmail-auth.conf +config/filter.d/sendmail-reject.conf +config/filter.d/sendmail-spam.conf +config/filter.d/sieve.conf +config/filter.d/sogo-auth.conf +config/filter.d/solid-pop3d.conf +config/filter.d/squid.conf +config/filter.d/squirrelmail.conf +config/filter.d/sshd-ddos.conf +config/filter.d/sshd.conf +config/filter.d/stunnel.conf +config/filter.d/suhosin.conf +config/filter.d/tine20.conf +config/filter.d/uwimap-auth.conf +config/filter.d/vsftpd.conf +config/filter.d/webmin-auth.conf +config/filter.d/wuftpd.conf +config/filter.d/xinetd-fail.conf +config/jail.conf +config/paths-common.conf +config/paths-debian.conf +config/paths-fedora.conf +config/paths-freebsd.conf +config/paths-osx.conf +doc/run-rootless.txt fail2ban-2to3 fail2ban-testcases-all fail2ban-testcases-all-python3 -bin/fail2ban-client -bin/fail2ban-server -bin/fail2ban-testcases -bin/fail2ban-regex -doc/run-rootless.txt +fail2ban/__init__.py fail2ban/client/__init__.py fail2ban/client/actionreader.py fail2ban/client/beautifier.py @@ -28,6 +169,9 @@ fail2ban/client/fail2banreader.py fail2ban/client/filterreader.py fail2ban/client/jailreader.py fail2ban/client/jailsreader.py +fail2ban/exceptions.py +fail2ban/helpers.py +fail2ban/protocol.py fail2ban/server/__init__.py fail2ban/server/action.py fail2ban/server/actions.py @@ -64,6 +208,8 @@ fail2ban/tests/clientreadertestcase.py fail2ban/tests/config/action.d/brokenaction.conf fail2ban/tests/config/fail2ban.conf fail2ban/tests/config/filter.d/simple.conf +fail2ban/tests/config/filter.d/test.conf +fail2ban/tests/config/filter.d/test.local fail2ban/tests/config/jail.conf fail2ban/tests/config/paths-common.conf fail2ban/tests/config/paths-debian.conf @@ -74,6 +220,7 @@ fail2ban/tests/datedetectortestcase.py fail2ban/tests/dummyjail.py fail2ban/tests/failmanagertestcase.py fail2ban/tests/files/action.d/action.py +fail2ban/tests/files/action.d/action_checkainfo.py fail2ban/tests/files/action.d/action_errors.py fail2ban/tests/files/action.d/action_modifyainfo.py fail2ban/tests/files/action.d/action_noAction.py @@ -104,6 +251,7 @@ fail2ban/tests/files/logs/apache-auth fail2ban/tests/files/logs/apache-badbots fail2ban/tests/files/logs/apache-botscripts fail2ban/tests/files/logs/apache-botsearch +fail2ban/tests/files/logs/apache-fakegooglebot fail2ban/tests/files/logs/apache-modsecurity fail2ban/tests/files/logs/apache-nohome fail2ban/tests/files/logs/apache-noscript @@ -135,6 +283,7 @@ fail2ban/tests/files/logs/monit fail2ban/tests/files/logs/mysqld-auth fail2ban/tests/files/logs/nagios fail2ban/tests/files/logs/named-refused +fail2ban/tests/files/logs/nginx-botsearch fail2ban/tests/files/logs/nginx-http-auth fail2ban/tests/files/logs/nsd fail2ban/tests/files/logs/openwebmail @@ -144,6 +293,7 @@ fail2ban/tests/files/logs/perdition fail2ban/tests/files/logs/php-url-fopen fail2ban/tests/files/logs/portsentry fail2ban/tests/files/logs/postfix +fail2ban/tests/files/logs/postfix-rbl fail2ban/tests/files/logs/postfix-sasl fail2ban/tests/files/logs/proftpd fail2ban/tests/files/logs/pure-ftpd @@ -182,170 +332,38 @@ fail2ban/tests/samplestestcase.py fail2ban/tests/servertestcase.py fail2ban/tests/sockettestcase.py fail2ban/tests/utils.py -setup.py -setup.cfg -fail2ban/__init__.py -fail2ban/exceptions.py -fail2ban/helpers.py fail2ban/version.py -fail2ban/protocol.py -kill-server -config/action.d/apf.conf -config/action.d/badips.conf -config/action.d/badips.py -config/action.d/blocklist_de.conf -config/action.d/bsd-ipfw.conf -config/action.d/cloudflare.conf -config/action.d/complain.conf -config/action.d/dshield.conf -config/action.d/dummy.conf -config/action.d/firewallcmd-ipset.conf -config/action.d/firewallcmd-new.conf -config/action.d/hostsdeny.conf -config/action.d/ipfilter.conf -config/action.d/ipfw.conf -config/action.d/iptables-allports.conf -config/action.d/iptables-common.conf -config/action.d/iptables-ipset-proto4.conf -config/action.d/iptables-ipset-proto6-allports.conf -config/action.d/iptables-ipset-proto6.conf -config/action.d/iptables-multiport-log.conf -config/action.d/iptables-multiport.conf -config/action.d/iptables-new.conf -config/action.d/iptables-xt_recent-echo.conf -config/action.d/iptables.conf -config/action.d/mail-buffered.conf -config/action.d/mail-whois-lines.conf -config/action.d/mail-whois.conf -config/action.d/mail.conf -config/action.d/mynetwatchman.conf -config/action.d/osx-afctl.conf -config/action.d/osx-ipfw.conf -config/action.d/pf.conf -config/action.d/route.conf -config/action.d/sendmail-buffered.conf -config/action.d/sendmail-common.conf -config/action.d/sendmail-whois-ipjailmatches.conf -config/action.d/sendmail-whois-ipmatches.conf -config/action.d/sendmail-whois-lines.conf -config/action.d/sendmail-whois-matches.conf -config/action.d/sendmail-whois.conf -config/action.d/sendmail.conf -config/action.d/shorewall.conf -config/action.d/smtp.py -config/action.d/symbiosis-blacklist-allports.conf -config/action.d/ufw.conf -config/action.d/xarf-login-attack.conf -config/fail2ban.conf -config/filter.d/3proxy.conf -config/filter.d/apache-auth.conf -config/filter.d/apache-badbots.conf -config/filter.d/apache-botsearch.conf -config/filter.d/apache-common.conf -config/filter.d/apache-modsecurity.conf -config/filter.d/apache-nohome.conf -config/filter.d/apache-noscript.conf -config/filter.d/apache-overflows.conf -config/filter.d/apache-shellshock.conf -config/filter.d/assp.conf -config/filter.d/asterisk.conf -config/filter.d/common.conf -config/filter.d/counter-strike.conf -config/filter.d/courier-auth.conf -config/filter.d/courier-smtp.conf -config/filter.d/cyrus-imap.conf -config/filter.d/directadmin.conf -config/filter.d/dovecot.conf -config/filter.d/dropbear.conf -config/filter.d/ejabberd-auth.conf -config/filter.d/exim-common.conf -config/filter.d/exim-spam.conf -config/filter.d/exim.conf -config/filter.d/freeswitch.conf -config/filter.d/groupoffice.conf -config/filter.d/gssftpd.conf -config/filter.d/guacamole.conf -config/filter.d/horde.conf -config/filter.d/kerio.conf -config/filter.d/lighttpd-auth.conf -config/filter.d/monit.conf -config/filter.d/mysqld-auth.conf -config/filter.d/nagios.conf -config/filter.d/named-refused.conf -config/filter.d/nginx-http-auth.conf -config/filter.d/nsd.conf -config/filter.d/openwebmail.conf -config/filter.d/oracleims.conf -config/filter.d/pam-generic.conf -config/filter.d/pam-generic.conf -config/filter.d/pam-generic.conf -config/filter.d/perdition.conf -config/filter.d/php-url-fopen.conf -config/filter.d/php-url-fopen.conf -config/filter.d/php-url-fopen.conf -config/filter.d/portsentry.conf -config/filter.d/postfix-sasl.conf -config/filter.d/postfix-sasl.conf -config/filter.d/postfix-sasl.conf -config/filter.d/postfix.conf -config/filter.d/proftpd.conf -config/filter.d/pure-ftpd.conf -config/filter.d/qmail.conf -config/filter.d/recidive.conf -config/filter.d/roundcube-auth.conf -config/filter.d/selinux-common.conf -config/filter.d/selinux-ssh.conf -config/filter.d/sendmail-auth.conf -config/filter.d/sendmail-reject.conf -config/filter.d/sendmail-spam.conf -config/filter.d/sieve.conf -config/filter.d/sogo-auth.conf -config/filter.d/solid-pop3d.conf -config/filter.d/squid.conf -config/filter.d/squirrelmail.conf -config/filter.d/sshd-ddos.conf -config/filter.d/sshd.conf -config/filter.d/stunnel.conf -config/filter.d/suhosin.conf -config/filter.d/tine20.conf -config/filter.d/uwimap-auth.conf -config/filter.d/vsftpd.conf -config/filter.d/webmin-auth.conf -config/filter.d/wuftpd.conf -config/filter.d/xinetd-fail.conf -config/jail.conf -config/paths-common.conf -config/paths-debian.conf -config/paths-fedora.conf -config/paths-freebsd.conf -config/paths-osx.conf -man/fail2ban-client.1 -man/fail2ban.1 -man/jail.conf.5 -man/fail2ban-client.h2m -man/fail2ban-server.1 -man/fail2ban-server.h2m -man/fail2ban-regex.1 -man/fail2ban-regex.h2m -man/generate-man +files/bash-completion +files/cacti/README +files/cacti/cacti_host_template_fail2ban.xml +files/cacti/fail2ban_stats.sh files/debian-initd -files/gentoo-initd +files/fail2ban-logrotate +files/fail2ban-tmpfiles.conf +files/fail2ban.service +files/fail2ban.upstart +files/gen_badbots files/gentoo-confd -files/redhat-initd +files/gentoo-initd +files/ipmasq-ZZZzzz_fail2ban.rul +files/logwatch/fail2ban files/macosx-initd +files/monit/fail2ban +files/nagios/README +files/nagios/check_fail2ban +files/redhat-initd files/solaris-fail2ban.xml files/solaris-svc-fail2ban files/suse-initd -files/fail2ban-logrotate -files/fail2ban.upstart -files/logwatch/fail2ban -files/cacti/fail2ban_stats.sh -files/cacti/cacti_host_template_fail2ban.xml -files/cacti/README -files/nagios/check_fail2ban -files/nagios/README -files/bash-completion -files/fail2ban-tmpfiles.conf -files/fail2ban.service -files/ipmasq-ZZZzzz_fail2ban.rul -files/gen_badbots +kill-server +man/fail2ban-client.1 +man/fail2ban-client.h2m +man/fail2ban-regex.1 +man/fail2ban-regex.h2m +man/fail2ban-server.1 +man/fail2ban-server.h2m +man/fail2ban.1 +man/generate-man +man/jail.conf.5 +setup.cfg +setup.py diff --git a/MANIFEST.in b/MANIFEST.in index 9473d3a6..22696a20 100644 --- a/MANIFEST.in +++ b/MANIFEST.in @@ -2,3 +2,4 @@ include ChangeLog COPYING DEVELOP FILTERS README.* THANKS TODO CONTRIBUTING* Vag graft doc graft files recursive-include config *.conf *.py +recursive-include config/filter.d/ignorecommands * diff --git a/README.md b/README.md index 8210837e..d45c58d9 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ / _|__ _(_) |_ ) |__ __ _ _ _ | _/ _` | | |/ /| '_ \/ _` | ' \ |_| \__,_|_|_/___|_.__/\__,_|_||_| - v0.9.1.dev 2014/??/?? + v0.9.2 2015/04/26 ## Fail2Ban: ban hosts that cause multiple authentication errors @@ -33,11 +33,12 @@ Optional: - Linux >= 2.6.13 - [gamin >= 0.0.21](http://www.gnome.org/~veillard/gamin) - [systemd >= 204](http://www.freedesktop.org/wiki/Software/systemd) +- [dnspython](http://www.dnspython.org/) To install, just do: - tar xvfj fail2ban-0.9.1.tar.bz2 - cd fail2ban-0.9.1 + tar xvfj fail2ban-0.9.2.tar.bz2 + cd fail2ban-0.9.2 python setup.py install This will install Fail2Ban into the python library directory. The executable diff --git a/RELEASE b/RELEASE index db425a45..c008b1c6 100644 --- a/RELEASE +++ b/RELEASE @@ -72,7 +72,7 @@ Preparation * Ensure the tests work from the tarball:: - cd /tmp/fail2ban-0.9.2/ && export PYTHONPATH=`pwd` && bin/fail2ban-testcases + cd /tmp/fail2ban-0.9.2/ && bin/fail2ban-testcases * Add/finalize the corresponding entry in the ChangeLog diff --git a/THANKS b/THANKS index 61e99466..5482b21d 100644 --- a/THANKS +++ b/THANKS @@ -13,6 +13,7 @@ ag4ve (Shawn) Alasdair D. Campbell Amir Caspi Amy +Andrew St. Jean Andrey G. Grozin Andy Fragen Arturo 'Buanzo' Busleiman @@ -33,11 +34,13 @@ Daniel B. Daniel Black David Nutter Derek Atkins +Donald Yandt Eric Gerbier Enrico Labedzki Eugene Hopkinson (SlowRiot) ftoppi François Boulogne +Frantisek Sumsal Frédéric Georgiy Mernov Guilhem Lettron @@ -82,6 +85,7 @@ Michael Hanselmann Mika (mkl) Nick Munger onorua +Orion Poplawski Paul Marrapese Paul Traina Noel Butler diff --git a/bin/fail2ban-regex b/bin/fail2ban-regex index 5644dd37..b337ab5d 100755 --- a/bin/fail2ban-regex +++ b/bin/fail2ban-regex @@ -220,6 +220,7 @@ class Fail2banRegex(object): self._datepattern_set = False self._journalmatch = None + self.share_config=dict() self._filter = Filter(None) self._ignoreregex = list() self._failregex = list() @@ -260,38 +261,47 @@ class Fail2banRegex(object): def readRegex(self, value, regextype): assert(regextype in ('fail', 'ignore')) regex = regextype + 'regex' - if os.path.isfile(value): - print "Use %11s file : %s" % (regex, value) - reader = FilterReader(value, 'fail2ban-regex-jail', {}) - reader.setBaseDir(None) - - if reader.readexplicit(): - reader.getOptions(None) - readercommands = reader.convert() - regex_values = [ - RegexStat(m[3]) - for m in filter( - lambda x: x[0] == 'set' and x[2] == "add%sregex" % regextype, - readercommands)] - # Read out and set possible value of maxlines - for command in readercommands: - if command[2] == "maxlines": - maxlines = int(command[3]) - try: - self.setMaxLines(maxlines) - except ValueError: - print "ERROR: Invalid value for maxlines (%(maxlines)r) " \ - "read from %(value)s" % locals() - return False - elif command[2] == 'addjournalmatch': - journalmatch = command[3] - self.setJournalMatch(shlex.split(journalmatch)) - elif command[2] == 'datepattern': - datepattern = command[3] - self.setDatePattern(datepattern) + if os.path.isfile(value) or os.path.isfile(value + '.conf'): + if os.path.basename(os.path.dirname(value)) == 'filter.d': + ## within filter.d folder - use standard loading algorithm to load filter completely (with .local etc.): + basedir = os.path.dirname(os.path.dirname(value)) + value = os.path.splitext(os.path.basename(value))[0] + print "Use %11s filter file : %s, basedir: %s" % (regex, value, basedir) + reader = FilterReader(value, 'fail2ban-regex-jail', {}, share_config=self.share_config, basedir=basedir) + if not reader.read(): + print "ERROR: failed to load filter %s" % value + return False else: - print "ERROR: failed to read %s" % value - return False + ## foreign file - readexplicit this file and includes if possible: + print "Use %11s file : %s" % (regex, value) + reader = FilterReader(value, 'fail2ban-regex-jail', {}, share_config=self.share_config) + reader.setBaseDir(None) + if not reader.readexplicit(): + print "ERROR: failed to read %s" % value + return False + reader.getOptions(None) + readercommands = reader.convert() + regex_values = [ + RegexStat(m[3]) + for m in filter( + lambda x: x[0] == 'set' and x[2] == "add%sregex" % regextype, + readercommands)] + # Read out and set possible value of maxlines + for command in readercommands: + if command[2] == "maxlines": + maxlines = int(command[3]) + try: + self.setMaxLines(maxlines) + except ValueError: + print "ERROR: Invalid value for maxlines (%(maxlines)r) " \ + "read from %(value)s" % locals() + return False + elif command[2] == 'addjournalmatch': + journalmatch = command[3] + self.setJournalMatch(shlex.split(journalmatch)) + elif command[2] == 'datepattern': + datepattern = command[3] + self.setDatePattern(datepattern) else: print "Use %11s line : %s" % (regex, shortstr(value)) regex_values = [RegexStat(value)] diff --git a/config/action.d/badips.py b/config/action.d/badips.py index 250b1dc3..c2a239f5 100644 --- a/config/action.d/badips.py +++ b/config/action.d/badips.py @@ -111,6 +111,8 @@ class BadIPsAction(ActionBase): ------ HTTPError Any issues with badips.com request. + ValueError + If badips.com response didn't contain necessary information """ try: response = urlopen( @@ -122,7 +124,13 @@ class BadIPsAction(ActionBase): messages['err']) raise else: - categories = json.loads(response.read().decode('utf-8'))['categories'] + response_json = json.loads(response.read().decode('utf-8')) + if not 'categories' in response_json: + err = "badips.com response lacked categories specification. Response was: %s" \ + % (response_json,) + self._logSys.error(err) + raise ValueError(err) + categories = response_json['categories'] categories_names = set( value['Name'] for value in categories) if incParents: diff --git a/config/action.d/bsd-ipfw.conf b/config/action.d/bsd-ipfw.conf index 1285361d..8b0a51aa 100644 --- a/config/action.d/bsd-ipfw.conf +++ b/config/action.d/bsd-ipfw.conf @@ -38,7 +38,7 @@ actioncheck = # Values: CMD # # requires an ipfw rule like "deny ip from table(1) to me" -actionban = ipfw table add +actionban = e=`ipfw table
add 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || { echo "$e" 1>&2; exit $x; } # Option: actionunban @@ -47,7 +47,7 @@ actionban = ipfw table
add # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = ipfw table
delete +actionunban = e=`ipfw table
delete 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || { echo "$e" 1>&2; exit $x; } [Init] # Option: table diff --git a/config/action.d/firewallcmd-allports.conf b/config/action.d/firewallcmd-allports.conf new file mode 100644 index 00000000..ec52babb --- /dev/null +++ b/config/action.d/firewallcmd-allports.conf @@ -0,0 +1,53 @@ +# Fail2Ban configuration file +# +# Author: Donald Yandt +# Because of the --remove-rules in stop this action requires firewalld-0.3.8+ + + +[INCLUDES] + +before = iptables-blocktype.conf + +[Definition] + +actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b- + firewall-cmd --direct --add-rule ipv4 filter f2b- 1000 -j RETURN + firewall-cmd --direct --add-rule ipv4 filter 0 -j f2b- + +actionstop = firewall-cmd --direct --remove-rule ipv4 filter 0 -j f2b- + firewall-cmd --direct --remove-rules ipv4 filter f2b- + firewall-cmd --direct --remove-chain ipv4 filter f2b- + + +# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-recidive$' + +actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-$' + +actionban = firewall-cmd --direct --add-rule ipv4 filter f2b- 0 -s -j + +actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b- 0 -s -j + +[Init] + +# Default name of the chain +# +name = default + +chain = INPUT_direct + +# DEV NOTES: +# +# Author: Donald Yandt +# Uses "FirewallD" instead of the "iptables daemon". +# +# +# Output: + +# actionstart: +# $ firewall-cmd --direct --add-chain ipv4 filter f2b-recidive +# success +# $ firewall-cmd --direct --add-rule ipv4 filter f2b-recidive 1000 -j RETURN +# success +# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -j f2b-recidive +# success + diff --git a/config/action.d/firewallcmd-multiport.conf b/config/action.d/firewallcmd-multiport.conf new file mode 100644 index 00000000..4d806e6b --- /dev/null +++ b/config/action.d/firewallcmd-multiport.conf @@ -0,0 +1,63 @@ +# Fail2Ban configuration file +# +# Author: Donald Yandt +# Because of the --remove-rules in stop this action requires firewalld-0.3.8+ + +[INCLUDES] + +before = iptables-blocktype.conf + +[Definition] + +actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b- + firewall-cmd --direct --add-rule ipv4 filter f2b- 1000 -j RETURN + firewall-cmd --direct --add-rule ipv4 filter 0 -m state --state NEW -p -m multiport --dports -j f2b- + +actionstop = firewall-cmd --direct --remove-rule ipv4 filter 0 -m state --state NEW -p -m multiport --dports -j f2b- + firewall-cmd --direct --remove-rules ipv4 filter f2b- + firewall-cmd --direct --remove-chain ipv4 filter f2b- + +# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$' + +actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-$' + +actionban = firewall-cmd --direct --add-rule ipv4 filter f2b- 0 -s -j + +actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b- 0 -s -j + +[Init] + +# Default name of the chain +name = default + +chain = INPUT_direct + +# Could also use port numbers separated by a comma. +port = 1:65535 + + +# Option: protocol +# Values: [ tcp | udp | icmp | all ] + +protocol = tcp + + + +# DEV NOTES: +# +# Author: Donald Yandt +# Uses "FirewallD" instead of the "iptables daemon". +# +# +# Output: +# actionstart: +# $ firewall-cmd --direct --add-chain ipv4 filter f2b-apache-modsecurity +# success +# $ firewall-cmd --direct --add-rule ipv4 filter f2b-apache-modsecurity 1000 -j RETURN +# success +# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp -m multiport --dports 80,443 -j f2b-apache-modsecurity +# success +# actioncheck: +# $ firewall-cmd --direct --get-chains ipv4 filter f2b-apache-modsecurity | sed -e 's, ,\n,g' | grep -q '^f2b-apache-modsecurity$' +# f2b-apache-modsecurity + diff --git a/config/action.d/nsupdate.conf b/config/action.d/nsupdate.conf new file mode 100644 index 00000000..7886825c --- /dev/null +++ b/config/action.d/nsupdate.conf @@ -0,0 +1,114 @@ +# Fail2Ban configuration file +# +# Author: Andrew St. Jean +# +# Use nsupdate to perform dynamic DNS updates on a BIND zone file. +# One may want to do this to update a local RBL with banned IP addresses. +# +# Options +# +# domain DNS domain that will appear in nsupdate add and delete +# commands. +# +# ttl The time to live (TTL) in seconds of the TXT resource +# record. +# +# rdata Data portion of the TXT resource record. +# +# nsupdatecmd Full path to the nsupdate command. +# +# keyfile Full path to TSIG key file used for authentication between +# nsupdate and BIND. +# +# Create an nsupdate.local to set at least the and +# options as they don't have default values. +# +# The ban and unban commands assume nsupdate will authenticate to the BIND +# server using a TSIG key. The full path to the key file must be specified +# in the parameter. Use this command to generate your TSIG key. +# +# dnssec-keygen -a HMAC-MD5 -b 256 -n HOST +# +# Replace with some meaningful name. +# +# This command will generate two files. Specify the .private file in the +# option. Note that the .key file must also be present in the same +# directory for nsupdate to use the key. +# +# Don't forget to add the key and appropriate allow-update or update-policy +# option to your named.conf file. +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = + + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = + + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = echo | awk -F. '{print "prereq nxrrset "$4"."$3"."$2"."$1". TXT"; print "update add "$4"."$3"."$2"."$1". IN TXT \"\""; print "send"}' | -k + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = echo | awk -F. '{print "update delete "$4"."$3"."$2"."$1"."; print "send"}' | -k + +[Init] + +# Option: domain +# Notes.: DNS domain that nsupdate will update. +# Values: STRING +# +domain = + +# Option: ttl +# Notes.: time to live (TTL) in seconds of TXT resource record +# added by nsupdate. +# Values: NUM +# +ttl = 60 + +# Option: rdata +# Notes.: data portion of the TXT resource record added by nsupdate. +# Values: STRING +# +rdata = Your IP has been banned + +# Option: nsupdatecmd +# Notes.: specifies the full path to the nsupdate program that dynamically +# updates BIND zone files. +# Values: CMD +# +nsupdatecmd = /usr/bin/nsupdate + +# Option: keyfile +# Notes.: specifies the full path to the file containing the +# TSIG key for communicating with BIND. +# Values: STRING +# +keyfile = + diff --git a/config/action.d/sendmail-common.conf b/config/action.d/sendmail-common.conf index 26dcb4c8..af0212bd 100644 --- a/config/action.d/sendmail-common.conf +++ b/config/action.d/sendmail-common.conf @@ -15,7 +15,7 @@ after = sendmail-common.local # Values: CMD # actionstart = printf %%b "Subject: [Fail2Ban] : started on `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n @@ -28,7 +28,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] : started on `uname -n` # Values: CMD # actionstop = printf %%b "Subject: [Fail2Ban] : stopped on `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n diff --git a/config/action.d/sendmail-geoip-lines.conf b/config/action.d/sendmail-geoip-lines.conf new file mode 100644 index 00000000..4225a3eb --- /dev/null +++ b/config/action.d/sendmail-geoip-lines.conf @@ -0,0 +1,49 @@ +# Fail2Ban configuration file +# +# Author: Viktor Szépe +# +# + +[INCLUDES] + +before = sendmail-common.conf + +[Definition] + +# Option: actionban +# Notes.: Command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# You need to install geoiplookup and the GeoLite or GeoIP databases. +# (geoip-bin and geoip-database in Debian) +# The host command comes from bind9-host package. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` + From: <> + To: \n + Hi,\n + The IP has just been banned by Fail2Ban after + attempts against .\n\n + Here is more information about :\n + http://bgp.he.net/ip/ + http://www.projecthoneypot.org/ip_ + http://whois.domaintools.com/\n\n + Country:`geoiplookup -f /usr/share/GeoIP/GeoIP.dat "" | cut -d':' -f2-` + AS:`geoiplookup -f /usr/share/GeoIP/GeoIPASNum.dat "" | cut -d':' -f2-` + hostname: `host -t A 2>&1`\n\n + Lines containing IP: in \n + `grep -E '(^|[^0-9])([^0-9]|$)' `\n\n + Regards,\n + Fail2Ban" | /usr/sbin/sendmail -f + +[Init] + +# Default name of the chain +# +name = default + +# Path to the log files which contain relevant lines for the abuser IP +# +logpath = /dev/null diff --git a/config/action.d/sendmail-whois-ipjailmatches.conf b/config/action.d/sendmail-whois-ipjailmatches.conf index 45b1f312..9c32f41b 100644 --- a/config/action.d/sendmail-whois-ipjailmatches.conf +++ b/config/action.d/sendmail-whois-ipjailmatches.conf @@ -17,13 +17,13 @@ before = sendmail-common.conf # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n The IP has just been banned by Fail2Ban after attempts against .\n\n - Here are more information about :\n + Here is more information about :\n `/usr/bin/whois `\n\n Matches for with failures IP:\n \n\n diff --git a/config/action.d/sendmail-whois-ipmatches.conf b/config/action.d/sendmail-whois-ipmatches.conf index 8193fb04..8c07454c 100644 --- a/config/action.d/sendmail-whois-ipmatches.conf +++ b/config/action.d/sendmail-whois-ipmatches.conf @@ -17,13 +17,13 @@ before = sendmail-common.conf # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n The IP has just been banned by Fail2Ban after attempts against .\n\n - Here are more information about :\n + Here is more information about :\n `/usr/bin/whois `\n\n Matches with failures IP:\n \n\n diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf index 4169e82a..135632ce 100644 --- a/config/action.d/sendmail-whois-lines.conf +++ b/config/action.d/sendmail-whois-lines.conf @@ -17,7 +17,7 @@ before = sendmail-common.conf # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n diff --git a/config/action.d/sendmail-whois-matches.conf b/config/action.d/sendmail-whois-matches.conf index ed664766..64bac3ef 100644 --- a/config/action.d/sendmail-whois-matches.conf +++ b/config/action.d/sendmail-whois-matches.conf @@ -17,13 +17,13 @@ before = sendmail-common.conf # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n The IP has just been banned by Fail2Ban after attempts against .\n\n - Here are more information about :\n + Here is more information about :\n `/usr/bin/whois `\n\n Matches:\n \n\n diff --git a/config/action.d/sendmail-whois.conf b/config/action.d/sendmail-whois.conf index fc601277..9403a388 100644 --- a/config/action.d/sendmail-whois.conf +++ b/config/action.d/sendmail-whois.conf @@ -17,7 +17,7 @@ before = sendmail-common.conf # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n diff --git a/config/action.d/sendmail.conf b/config/action.d/sendmail.conf index 46050e11..4b088dc8 100644 --- a/config/action.d/sendmail.conf +++ b/config/action.d/sendmail.conf @@ -17,7 +17,7 @@ before = sendmail-common.conf # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n diff --git a/config/action.d/xarf-login-attack.conf b/config/action.d/xarf-login-attack.conf index 6d6a74f0..19b3167f 100644 --- a/config/action.d/xarf-login-attack.conf +++ b/config/action.d/xarf-login-attack.conf @@ -46,7 +46,7 @@ actionban = oifs=${IFS}; IFS=.;SEP_IP=( ); set -- ${SEP_IP}; ADDRESSES=$(di REPORTID=