mirror of https://github.com/fail2ban/fail2ban
Fixed typos
parent
a6cf3246d0
commit
a2b29b4875
6
DEVELOP
6
DEVELOP
|
@ -92,7 +92,7 @@ Documentation
|
||||||
-------------
|
-------------
|
||||||
|
|
||||||
Ensure this documentation is up to date after changes. Also ensure that the man
|
Ensure this documentation is up to date after changes. Also ensure that the man
|
||||||
pages still are accurage. Ensure that there is sufficient documentation for
|
pages still are accurate. Ensure that there is sufficient documentation for
|
||||||
your new features to be used.
|
your new features to be used.
|
||||||
|
|
||||||
Bugs
|
Bugs
|
||||||
|
@ -107,7 +107,7 @@ Use the following tags in your commit messages:
|
||||||
|
|
||||||
'ENH:' for enhancements
|
'ENH:' for enhancements
|
||||||
'BF:' for bug fixes
|
'BF:' for bug fixes
|
||||||
'DOC:' for documenation fixes
|
'DOC:' for documentation fixes
|
||||||
|
|
||||||
Adding Actions
|
Adding Actions
|
||||||
--------------
|
--------------
|
||||||
|
@ -265,4 +265,4 @@ python -c 'import common.protocol; common.protocol.printWiki()'
|
||||||
|
|
||||||
email users and development list of release
|
email users and development list of release
|
||||||
|
|
||||||
TODO notifing distributors etc.
|
TODO notifying distributors etc.
|
||||||
|
|
|
@ -116,7 +116,7 @@ actionunban = if [ -f <tmpfile>.first ]; then
|
||||||
port = ???
|
port = ???
|
||||||
|
|
||||||
# Option: userid
|
# Option: userid
|
||||||
# Notes.: Your DSheild user ID. Should be provided either in the jail config or
|
# Notes.: Your DShield user ID. Should be provided either in the jail config or
|
||||||
# in a .local file.
|
# in a .local file.
|
||||||
# Register at https://secure.dshield.org/register.html
|
# Register at https://secure.dshield.org/register.html
|
||||||
# Values: [ NUM ] Default: 0
|
# Values: [ NUM ] Default: 0
|
||||||
|
|
|
@ -53,7 +53,7 @@ actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the chain
|
# Default name of the chain
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -53,7 +53,7 @@ actionunban = ipset --test fail2ban-<name> <ip> && ipset --del fail2ban-<name> <
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the ipset
|
# Default name of the ipset
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -53,7 +53,7 @@ actionunban = ipset del fail2ban-<name> <ip> -exist
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the ipset
|
# Default name of the ipset
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -61,7 +61,7 @@ actionunban = iptables -D fail2ban-<name> -s <ip> -j fail2ban-<name>-log
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the chain
|
# Default name of the chain
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -51,7 +51,7 @@ actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the chain
|
# Default name of the chain
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -53,7 +53,7 @@ actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the chain
|
# Default name of the chain
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -11,7 +11,7 @@
|
||||||
# Notes.: command executed once at the start of Fail2Ban.
|
# Notes.: command executed once at the start of Fail2Ban.
|
||||||
# Values: CMD
|
# Values: CMD
|
||||||
#
|
#
|
||||||
# Changing iptables rules requires root priviledges. If fail2ban is
|
# Changing iptables rules requires root privileges. If fail2ban is
|
||||||
# configured to run as root, firewall setup can be performed by
|
# configured to run as root, firewall setup can be performed by
|
||||||
# fail2ban automatically. However, if fail2ban is configured to run as
|
# fail2ban automatically. However, if fail2ban is configured to run as
|
||||||
# a normal user, the configuration must be done by some other means
|
# a normal user, the configuration must be done by some other means
|
||||||
|
@ -65,7 +65,7 @@ actionunban = echo -<ip> > /proc/net/xt_recent/fail2ban-<name>
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the chain
|
# Default name of the chain
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -51,7 +51,7 @@ actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the chain
|
# Default name of the chain
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -62,7 +62,7 @@ actionunban =
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the chain
|
# Default name of the chain
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -59,7 +59,7 @@ actionunban =
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the chain
|
# Default name of the chain
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -57,7 +57,7 @@ actionunban =
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the chain
|
# Default name of the chain
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -83,7 +83,7 @@ actionunban =
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the chain
|
# Default name of the chain
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -73,7 +73,7 @@ actionunban =
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the chain
|
# Default name of the chain
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -71,7 +71,7 @@ actionunban =
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the chain
|
# Default name of the chain
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -69,7 +69,7 @@ actionunban =
|
||||||
|
|
||||||
[Init]
|
[Init]
|
||||||
|
|
||||||
# Defaut name of the chain
|
# Default name of the chain
|
||||||
#
|
#
|
||||||
name = default
|
name = default
|
||||||
|
|
||||||
|
|
|
@ -16,7 +16,7 @@ badbots = atSpider/1\.0|autoemailspider|China Local Browse 2\.6|ContentSmartz|Da
|
||||||
# Option: failregex
|
# Option: failregex
|
||||||
# Notes.: Regexp to catch known spambots and software alike. Please verify
|
# Notes.: Regexp to catch known spambots and software alike. Please verify
|
||||||
# that it is your intent to block IPs which were driven by
|
# that it is your intent to block IPs which were driven by
|
||||||
# abovementioned bots.
|
# above mentioned bots.
|
||||||
# Values: TEXT
|
# Values: TEXT
|
||||||
#
|
#
|
||||||
failregex = ^<HOST> -.*"(GET|POST).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
|
failregex = ^<HOST> -.*"(GET|POST).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
|
||||||
|
|
|
@ -241,7 +241,7 @@ logpath = /var/log/lighttpd/error.log
|
||||||
maxretry = 2
|
maxretry = 2
|
||||||
|
|
||||||
# Same as above for mod_auth
|
# Same as above for mod_auth
|
||||||
# It catches wrong authentifications
|
# It catches wrong authentications
|
||||||
|
|
||||||
[lighttpd-auth]
|
[lighttpd-auth]
|
||||||
|
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
Fail2ban normally requires root priviledges to insert iptables rules
|
Fail2ban normally requires root privileges to insert iptables rules
|
||||||
through calls to /sbin/iptables and also to read the logfiles.
|
through calls to /sbin/iptables and also to read the logfiles.
|
||||||
Fail2ban can run as an unpriviledged user provided that those two
|
Fail2ban can run as an unprivileged user provided that those two
|
||||||
capabilites are preserved. The idea is to run fail2ban as a normal
|
capabilities are preserved. The idea is to run fail2ban as a normal
|
||||||
user (e.g. fail2ban) who belongs to a group which is allowed to read
|
user (e.g. fail2ban) who belongs to a group which is allowed to read
|
||||||
logfiles. The user should also be allowed to write to
|
logfiles. The user should also be allowed to write to
|
||||||
/proc/net/xt_recent/fail2ban-<name> (name is specified in the iptables
|
/proc/net/xt_recent/fail2ban-<name> (name is specified in the iptables
|
||||||
|
@ -20,14 +20,14 @@ Another way to use xt_recent is by inserting the rules by writing to
|
||||||
action. Files in /proc/net/xt_recent/ are protected by normal
|
action. Files in /proc/net/xt_recent/ are protected by normal
|
||||||
filesystem rules, so can be chown'ed and chmod'ed to be writable by a
|
filesystem rules, so can be chown'ed and chmod'ed to be writable by a
|
||||||
certain user. After the necessary iptables rules are inserted (which
|
certain user. After the necessary iptables rules are inserted (which
|
||||||
requires root priviledges), blacklisting can be perfomed by an
|
requires root privileges), blacklisting can be performed by an
|
||||||
unpriviledged user.
|
unprivileged user.
|
||||||
|
|
||||||
Using fail2ban with xt_recent allows smarter filtering than normal
|
Using fail2ban with xt_recent allows smarter filtering than normal
|
||||||
iptables rules with the xt_recent module can provide.
|
iptables rules with the xt_recent module can provide.
|
||||||
|
|
||||||
The disadvantage is that fail2ban cannot perform the setup by itself,
|
The disadvantage is that fail2ban cannot perform the setup by itself,
|
||||||
which would require the priviledge to call /sbin/iptables, and it must
|
which would require the privilege to call /sbin/iptables, and it must
|
||||||
be done through other means.
|
be done through other means.
|
||||||
|
|
||||||
The primary advantage is obvious: it's generally better to run
|
The primary advantage is obvious: it's generally better to run
|
||||||
|
@ -46,7 +46,7 @@ some user and thus allow delisting IPs by helper administrators
|
||||||
without the ability to mess up other iptables rules.
|
without the ability to mess up other iptables rules.
|
||||||
|
|
||||||
The xt_recent-echo jail can be used under the root user without
|
The xt_recent-echo jail can be used under the root user without
|
||||||
further configuration. To run not as root, futher setup is necessary:
|
further configuration. To run not as root, further setup is necessary:
|
||||||
|
|
||||||
- Create user:
|
- Create user:
|
||||||
|
|
||||||
|
|
|
@ -297,7 +297,7 @@ class Fail2banClient:
|
||||||
delta = -1
|
delta = -1
|
||||||
elif pos < 2:
|
elif pos < 2:
|
||||||
delta = 1
|
delta = 1
|
||||||
# The server has 30 secondes to start.
|
# The server has 30 seconds to start.
|
||||||
if cnt >= 300:
|
if cnt >= 300:
|
||||||
if self.__conf["verbose"] > 1:
|
if self.__conf["verbose"] > 1:
|
||||||
sys.stdout.write('\n')
|
sys.stdout.write('\n')
|
||||||
|
|
|
@ -277,8 +277,8 @@ class Action:
|
||||||
# Executes a command with preliminary checks and substitutions.
|
# Executes a command with preliminary checks and substitutions.
|
||||||
#
|
#
|
||||||
# Before executing any commands, executes the "check" command first
|
# Before executing any commands, executes the "check" command first
|
||||||
# in order to check if prerequirements are met. If this check fails,
|
# in order to check if pre-requirements are met. If this check fails,
|
||||||
# it tries to restore a sane environnement before executing the real
|
# it tries to restore a sane environment before executing the real
|
||||||
# command.
|
# command.
|
||||||
# Replaces "aInfo" and "cInfo" in the query too.
|
# Replaces "aInfo" and "cInfo" in the query too.
|
||||||
#
|
#
|
||||||
|
|
|
@ -44,7 +44,7 @@ logSys = logging.getLogger("fail2ban.filter")
|
||||||
# Log reader class.
|
# Log reader class.
|
||||||
#
|
#
|
||||||
# This class reads a log file and detects login failures or anything else
|
# This class reads a log file and detects login failures or anything else
|
||||||
# that matches a given regular expression. This class is instanciated by
|
# that matches a given regular expression. This class is instantiated by
|
||||||
# a Jail object.
|
# a Jail object.
|
||||||
|
|
||||||
class Filter(JailThread):
|
class Filter(JailThread):
|
||||||
|
@ -117,7 +117,7 @@ class Filter(JailThread):
|
||||||
# Add the regular expression which matches the failure.
|
# Add the regular expression which matches the failure.
|
||||||
#
|
#
|
||||||
# The regular expression can also match any other pattern than failures
|
# The regular expression can also match any other pattern than failures
|
||||||
# and thus can be used for many purporse.
|
# and thus can be used for many purpose.
|
||||||
# @param value the regular expression
|
# @param value the regular expression
|
||||||
|
|
||||||
def addIgnoreRegex(self, value):
|
def addIgnoreRegex(self, value):
|
||||||
|
@ -414,7 +414,7 @@ class FileFilter(Filter):
|
||||||
|
|
||||||
def _addLogPath(self, path):
|
def _addLogPath(self, path):
|
||||||
# nothing to do by default
|
# nothing to do by default
|
||||||
# to be overriden by backends
|
# to be overridden by backends
|
||||||
pass
|
pass
|
||||||
|
|
||||||
|
|
||||||
|
@ -433,7 +433,7 @@ class FileFilter(Filter):
|
||||||
|
|
||||||
def _delLogPath(self, path):
|
def _delLogPath(self, path):
|
||||||
# nothing to do by default
|
# nothing to do by default
|
||||||
# to be overriden by backends
|
# to be overridden by backends
|
||||||
pass
|
pass
|
||||||
|
|
||||||
##
|
##
|
||||||
|
|
|
@ -39,7 +39,7 @@ logSys = logging.getLogger("fail2ban.filter")
|
||||||
# Log reader class.
|
# Log reader class.
|
||||||
#
|
#
|
||||||
# This class reads a log file and detects login failures or anything else
|
# This class reads a log file and detects login failures or anything else
|
||||||
# that matches a given regular expression. This class is instanciated by
|
# that matches a given regular expression. This class is instantiated by
|
||||||
# a Jail object.
|
# a Jail object.
|
||||||
|
|
||||||
class FilterPoll(FileFilter):
|
class FilterPoll(FileFilter):
|
||||||
|
|
Loading…
Reference in New Issue