From 1e2ddec48592ff7ff7abe2ce4cef742deec2853c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Jun 2007 21:29:18 +0000
Subject: [PATCH 02/26] - Fixed vulnerability in sshd.conf. Thanks to Daniel B.
 Cid

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@587 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                 | 6 +++++-
 config/filter.d/sshd.conf | 9 +++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 94a7b411..67f301bc 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,9 +4,13 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.8.0)                           2007/05/03
+Fail2Ban (version 0.8.1)                           2007/??/??
 =============================================================
 
+ver. 0.8.1 (2007/??/??) - stable
+----------
+- Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
+
 ver. 0.8.0 (2007/05/03) - stable
 ----------
 - Fixed RedHat init script. Thanks to Jonathan Underwood
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index fa1d88ad..39416f43 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -14,10 +14,11 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = Authentication failure for .* from <HOST>
-            Failed [-/\w]+ for .* from <HOST>
-            ROOT LOGIN REFUSED .* FROM <HOST>
-            [iI](?:llegal|nvalid) user .* from <HOST>
+failregex = Authentication failure for .* from <HOST>$
+            Failed [-/\w]+ for .* from <HOST>$
+            ROOT LOGIN REFUSED .* FROM <HOST>$
+            [iI](?:llegal|nvalid) user .* from <HOST>$
+            User .* from <HOST> not allowed because not listed in AllowUsers$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 6d129491f7db5f3ac2688be35e96ea913932a241 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Jun 2007 21:43:25 +0000
Subject: [PATCH 03/26] - Expand <HOST> in ignoreregex. Thanks to Yaroslav
 Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@589 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 server/failregex.py | 4 +---
 server/regex.py     | 3 +++
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/server/failregex.py b/server/failregex.py
index 275380b9..9889ca67 100644
--- a/server/failregex.py
+++ b/server/failregex.py
@@ -40,9 +40,7 @@ class FailRegex(Regex):
 	# avoid construction of invalid object.
 	# @param value the regular expression
 	
-	def __init__(self, value):
-		# Replace "<HOST>" with default regular expression for host.
-		regex = value.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>\S+)")
+	def __init__(self, regex):
 		# Initializes the parent.
 		Regex.__init__(self, regex)
 		# Check for group "host"
diff --git a/server/regex.py b/server/regex.py
index d3d6eee4..22fb6797 100644
--- a/server/regex.py
+++ b/server/regex.py
@@ -42,6 +42,9 @@ class Regex:
 	
 	def __init__(self, regex):
 		self._matchCache = None
+		# Perform shortcuts expansions.
+		# Replace "<HOST>" with default regular expression for host.
+		regex = regex.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>\S+)")
 		if regex.lstrip() == '':
 			raise RegexException("Cannot add empty regex")
 		try:

From ad010a667e5686ef55508fcf584ca8caa71124fd Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Jun 2007 21:43:44 +0000
Subject: [PATCH 04/26] - Expand <HOST> in ignoreregex. Thanks to Yaroslav
 Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@590 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG b/CHANGELOG
index 67f301bc..823ab2d6 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -10,6 +10,7 @@ Fail2Ban (version 0.8.1)                           2007/??/??
 ver. 0.8.1 (2007/??/??) - stable
 ----------
 - Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
+- Expand <HOST> in ignoreregex. Thanks to Yaroslav Halchenko
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------

From e2334db7a6ab60cb017135c5263b6de823431e60 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Jun 2007 21:57:10 +0000
Subject: [PATCH 05/26] - Improved regular expressions. Thanks to Yaroslav
 Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@592 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                      | 1 +
 config/filter.d/pure-ftpd.conf | 2 +-
 config/filter.d/sshd-ddos.conf | 2 +-
 config/filter.d/vsftpd.conf    | 2 +-
 config/filter.d/wuftpd.conf    | 4 ++--
 5 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 823ab2d6..65d5ceb2 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -11,6 +11,7 @@ ver. 0.8.1 (2007/??/??) - stable
 ----------
 - Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
 - Expand <HOST> in ignoreregex. Thanks to Yaroslav Halchenko
+- Improved regular expressions. Thanks to Yaroslav Halchenko
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/config/filter.d/pure-ftpd.conf b/config/filter.d/pure-ftpd.conf
index 31557468..1933d6e0 100644
--- a/config/filter.d/pure-ftpd.conf
+++ b/config/filter.d/pure-ftpd.conf
@@ -19,7 +19,7 @@ __errmsg = (?:Authentication failed for user|Erreur d'authentification pour l'ut
 #         (?:::f{4,6}:)?(?P<host>\S+)
 # Values: TEXT
 #
-failregex = pure-ftpd: (.+?@<HOST>) \[WARNING\] %(__errmsg)s \[.+\]$
+failregex = pure-ftpd(?:\[\d+\])?: (.+?@<HOST>) \[WARNING\] %(__errmsg)s \[.+\]$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/sshd-ddos.conf b/config/filter.d/sshd-ddos.conf
index 2a907e88..9720ab4a 100644
--- a/config/filter.d/sshd-ddos.conf
+++ b/config/filter.d/sshd-ddos.conf
@@ -14,7 +14,7 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = sshd\[\S*\]: Did not receive identification string from <HOST>
+failregex = sshd(?:\[\d+\])?: Did not receive identification string from <HOST>$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index 34e3da92..3c4bb11b 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -14,7 +14,7 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values: TEXT
 #
-failregex = vsftpd: .* authentication failure; .* rhost=<HOST>$
+failregex = vsftpd(?:\[\d+\])?: .* authentication failure; .* rhost=<HOST>$
             \[.+\] FAIL LOGIN: Client "<HOST>"$
 
 # Option:  ignoreregex
diff --git a/config/filter.d/wuftpd.conf b/config/filter.d/wuftpd.conf
index e7981e1e..2d08022d 100644
--- a/config/filter.d/wuftpd.conf
+++ b/config/filter.d/wuftpd.conf
@@ -2,7 +2,7 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision:  $
+# $Revision$
 #
 
 [Definition]
@@ -11,4 +11,4 @@
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT
 #
-failregex = wu-ftpd\[\d+\]:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>
+failregex = wu-ftpd(?:\[\d+\])?:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>$

From 32d1132416f103f072826d24ed5ef269db20abdd Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 25 Jun 2007 22:18:46 +0000
Subject: [PATCH 06/26] - Changed location

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@594 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 .pydevproject | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.pydevproject b/.pydevproject
index 07eba934..d71fe688 100644
--- a/.pydevproject
+++ b/.pydevproject
@@ -4,9 +4,9 @@
 <pydev_project>
 <pydev_property name="org.python.pydev.PYTHON_PROJECT_VERSION">python 2.4</pydev_property>
 <pydev_pathproperty name="org.python.pydev.PROJECT_SOURCE_PATH">
-<path>/fail2ban-unstable/client</path>
-<path>/fail2ban-unstable/server</path>
-<path>/fail2ban-unstable/testcases</path>
-<path>/fail2ban-unstable</path>
+<path>/fail2ban-0.8/client</path>
+<path>/fail2ban-0.8/server</path>
+<path>/fail2ban-0.8/testcases</path>
+<path>/fail2ban-0.8</path>
 </pydev_pathproperty>
 </pydev_project>

From 08c2c557427617ced54d227b129e16d292f21eb8 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 5 Jul 2007 16:10:33 +0000
Subject: [PATCH 07/26] =?UTF-8?q?-=20Added=20sendmail=20actions.=20The=20a?=
 =?UTF-8?q?ction=20started=20with=20"mail"=20are=20now=20deprecated.=20Tha?=
 =?UTF-8?q?nks=20to=20Rapha=C3=ABl=20Marichez=20-=20Fixed=20a=20small=20ty?=
 =?UTF-8?q?po?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@595 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                                 |   2 +
 MANIFEST                                  |   4 +
 config/action.d/mail-buffered.conf        |   2 +-
 config/action.d/mail-whois-lines.conf     |   2 +-
 config/action.d/mail-whois.conf           |   2 +-
 config/action.d/mail.conf                 |   2 +-
 config/action.d/sendmail-buffered.conf    | 105 ++++++++++++++++++++++
 config/action.d/sendmail-whois-lines.conf |  88 ++++++++++++++++++
 config/action.d/sendmail-whois.conf       |  82 +++++++++++++++++
 config/action.d/sendmail.conf             |  80 +++++++++++++++++
 config/jail.conf                          |  20 ++---
 11 files changed, 375 insertions(+), 14 deletions(-)
 create mode 100644 config/action.d/sendmail-buffered.conf
 create mode 100644 config/action.d/sendmail-whois-lines.conf
 create mode 100644 config/action.d/sendmail-whois.conf
 create mode 100644 config/action.d/sendmail.conf

diff --git a/CHANGELOG b/CHANGELOG
index 65d5ceb2..fe76ac7c 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -12,6 +12,8 @@ ver. 0.8.1 (2007/??/??) - stable
 - Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
 - Expand <HOST> in ignoreregex. Thanks to Yaroslav Halchenko
 - Improved regular expressions. Thanks to Yaroslav Halchenko
+- Added sendmail actions. The action started with "mail" are
+  now deprecated. Thanks to Raphaël Marichez
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/MANIFEST b/MANIFEST
index 60f13e54..7de5196b 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -84,6 +84,10 @@ config/action.d/mail.conf
 config/action.d/mail-buffered.conf
 config/action.d/mail-whois.conf
 config/action.d/mail-whois-lines.conf
+config/action.d/sendmail.conf
+config/action.d/sendmail-buffered.conf
+config/action.d/sendmail-whois.conf
+config/action.d/sendmail-whois-lines.conf
 config/action.d/shorewall.conf
 config/fail2ban.conf
 man/fail2ban-client.1
diff --git a/config/action.d/mail-buffered.conf b/config/action.d/mail-buffered.conf
index 973d48ec..a39ca2b2 100644
--- a/config/action.d/mail-buffered.conf
+++ b/config/action.d/mail-buffered.conf
@@ -12,7 +12,7 @@
 # Values:  CMD
 #
 actionstart = echo -en "Hi,\n
-              The jail <name> has been started successfuly.\n
+              The jail <name> has been started successfully.\n
               Output will be buffered until <lines> lines are available.\n
               Regards,\n
               Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
diff --git a/config/action.d/mail-whois-lines.conf b/config/action.d/mail-whois-lines.conf
index c4bb9784..7e371557 100644
--- a/config/action.d/mail-whois-lines.conf
+++ b/config/action.d/mail-whois-lines.conf
@@ -12,7 +12,7 @@
 # Values:  CMD
 #
 actionstart = echo -en "Hi,\n
-              The jail <name> has been started successfuly.\n
+              The jail <name> has been started successfully.\n
               Regards,\n
               Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
 
diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf
index 044aa05b..39f7fdac 100644
--- a/config/action.d/mail-whois.conf
+++ b/config/action.d/mail-whois.conf
@@ -12,7 +12,7 @@
 # Values:  CMD
 #
 actionstart = echo -en "Hi,\n
-              The jail <name> has been started successfuly.\n
+              The jail <name> has been started successfully.\n
               Regards,\n
               Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
 
diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf
index 2757aa74..7c901894 100644
--- a/config/action.d/mail.conf
+++ b/config/action.d/mail.conf
@@ -12,7 +12,7 @@
 # Values:  CMD
 #
 actionstart = echo -en "Hi,\n
-              The jail <name> has been started successfuly.\n
+              The jail <name> has been started successfully.\n
               Regards,\n
               Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
 
diff --git a/config/action.d/sendmail-buffered.conf b/config/action.d/sendmail-buffered.conf
new file mode 100644
index 00000000..836ed384
--- /dev/null
+++ b/config/action.d/sendmail-buffered.conf
@@ -0,0 +1,105 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = echo -en "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Output will be buffered until <lines> lines are available.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = if [ -f <tmpfile> ]; then
+                 echo -en "Subject: [Fail2Ban] <name>: stopped
+                 From: Fail2Ban <<sender>>
+                 To: <dest>\n
+                 Hi,\n
+                 These hosts have been banned by Fail2Ban.\n
+                 `cat <tmpfile>`
+                 Regards,\n
+                 Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+                 rm <tmpfile>
+             fi
+             echo -en "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = echo `date`": <ip> (<failures> failures)" >> <tmpfile>
+            LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
+            if [ $LINE -eq <lines> ]; then
+                echo -en "Subject: [Fail2Ban] <name>: stopped
+                From: Fail2Ban <<sender>>
+                To: <dest>\n
+                Hi,\n
+                These hosts have been banned by Fail2Ban.\n
+                `cat <tmpfile>`
+                Regards,\n
+                Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+                rm <tmpfile>
+            fi
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+
+# Default number of lines that are buffered
+#
+lines = 5
+
+# Default temporary file
+#
+tmpfile = /tmp/fail2ban-mail.txt
+
diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf
new file mode 100644
index 00000000..68555ad2
--- /dev/null
+++ b/config/action.d/sendmail-whois-lines.conf
@@ -0,0 +1,88 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = echo -en "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = echo -en "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = echo -en "Subject: [Fail2Ban] <name>: banned <ip>
+            From: Fail2Ban <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here are more information about <ip>:\n
+            `/usr/bin/whois <ip>`\n\n
+            Lines containing IP:<ip> in <logpath>\n
+            `/bin/grep '\<<ip>\>' <logpath>`\n\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+
+# Path to the log files which contain relevant lines for the abuser IP
+#
+logpath = /dev/null
+
diff --git a/config/action.d/sendmail-whois.conf b/config/action.d/sendmail-whois.conf
new file mode 100644
index 00000000..9f72ca7d
--- /dev/null
+++ b/config/action.d/sendmail-whois.conf
@@ -0,0 +1,82 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = echo -en "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = echo -en "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = echo -en "Subject: [Fail2Ban] <name>: banned <ip>
+            From: Fail2Ban <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n\n
+            Here are more information about <ip>:\n
+            `/usr/bin/whois <ip>`\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+
diff --git a/config/action.d/sendmail.conf b/config/action.d/sendmail.conf
new file mode 100644
index 00000000..367d9119
--- /dev/null
+++ b/config/action.d/sendmail.conf
@@ -0,0 +1,80 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = echo -en "Subject: [Fail2Ban] <name>: started
+              From: Fail2Ban <<sender>>
+              To: <dest>\n
+              Hi,\n
+              The jail <name> has been started successfully.\n
+              Regards,\n
+              Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = echo -en "Subject: [Fail2Ban] <name>: stopped
+             From: Fail2Ban <<sender>>
+             To: <dest>\n
+             Hi,\n
+             The jail <name> has been stopped.\n
+             Regards,\n
+             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = echo -en "Subject: [Fail2Ban] <name>: banned <ip>
+            From: Fail2Ban <<sender>>
+            To: <dest>\n
+            Hi,\n
+            The IP <ip> has just been banned by Fail2Ban after
+            <failures> attempts against <name>.\n
+            Regards,\n
+            Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = 
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Destination/Addressee of the mail
+#
+dest = root
+
+# Sender of the mail
+#
+sender = fail2ban
+
diff --git a/config/jail.conf b/config/jail.conf
index f2854691..8dbbfd13 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -45,7 +45,7 @@ backend = auto
 enabled  = false
 filter   = sshd
 action   = iptables[name=SSH, port=ssh, protocol=tcp]
-           mail-whois[name=SSH, dest=yourmail@mail.com]
+           sendmail-whois[name=SSH, dest=you@mail.com, sender=fail2ban@mail.com]
 logpath  = /var/log/sshd.log
 maxretry = 5
 
@@ -54,7 +54,7 @@ maxretry = 5
 enabled  = false
 filter   = proftpd
 action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
-           mail-whois[name=ProFTPD, dest=yourmail@mail.com]
+           sendmail-whois[name=ProFTPD, dest=you@mail.com]
 logpath  = /var/log/proftpd/proftpd.log
 maxretry = 6
 
@@ -66,7 +66,7 @@ enabled  = false
 filter   = sasl
 backend  = polling
 action   = iptables[name=sasl, port=smtp, protocol=tcp]
-           mail-whois[name=sasl, dest=yourmail@mail.com]
+           sendmail-whois[name=sasl, dest=you@mail.com]
 logpath  = /var/log/mail.log
 
 # Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
@@ -77,7 +77,7 @@ logpath  = /var/log/mail.log
 enabled     = false
 filter      = sshd
 action      = hostsdeny
-              mail-whois[name=SSH, dest=yourmail@mail.com]
+              sendmail-whois[name=SSH, dest=you@mail.com]
 ignoreregex = for myuser from
 logpath     = /var/log/sshd.log
 
@@ -101,7 +101,7 @@ maxretry = 6
 enabled  = false
 filter   = postfix
 action   = hostsdeny[file=/not/a/standard/path/hosts.deny]
-           mail[name=Postfix, dest=yourmail@mail.com]
+           sendmail[name=Postfix, dest=you@mail.com]
 logpath  = /var/log/postfix.log
 bantime  = 300
 
@@ -112,7 +112,7 @@ bantime  = 300
 
 enabled  = false
 filter   = vsftpd
-action   = mail-whois[name=VSFTPD, dest=yourmail@mail.com]
+action   = sendmail-whois[name=VSFTPD, dest=you@mail.com]
 logpath  = /var/log/vsftpd.log
 maxretry = 5
 bantime  = 1800
@@ -124,7 +124,7 @@ bantime  = 1800
 enabled  = false
 filter   = vsftpd
 action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
-           mail-whois[name=VSFTPD, dest=yourmail@mail.com]
+           sendmail-whois[name=VSFTPD, dest=you@mail.com]
 logpath  = /var/log/vsftpd.log
 maxretry = 5
 bantime  = 1800
@@ -137,7 +137,7 @@ bantime  = 1800
 enabled  = false
 filter   = apache-badbots
 action   = iptables-multiport[name=BadBots, port="http,https"]
-           mail-buffered[name=BadBots, lines=5, dest=yourmail@mail.com]
+           sendmail-buffered[name=BadBots, lines=5, dest=you@mail.com]
 logpath  = /var/www/*/logs/access_log
 bantime  = 172800
 maxretry = 1
@@ -149,7 +149,7 @@ maxretry = 1
 enabled  = false
 filter   = apache-noscript
 action   = shorewall
-           mail[name=Postfix, dest=yourmail@mail.com]
+           sendmail[name=Postfix, dest=you@mail.com]
 logpath  = /var/log/apache2/error_log
 
 # This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip"
@@ -162,6 +162,6 @@ logpath  = /var/log/apache2/error_log
 enabled  = false
 filter   = sshd
 action   = ipfw[localhost=192.168.0.1]
-           mail-whois[name="SSH,IPFW", dest=yourmail@mail.com]
+           sendmail-whois[name="SSH,IPFW", dest=you@mail.com]
 logpath  = /var/log/auth.log
 ignoreip = 168.192.0.1

From ada2d7234e5546dc020bba27ce10a67ecc2456fe Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 10 Jul 2007 19:54:01 +0000
Subject: [PATCH 08/26] - Added "ignoreregex" support to fail2ban-regex

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@596 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG        |   1 +
 fail2ban-regex   | 103 +++++++++++++++++++++++++++++++++++++++++++----
 server/filter.py |  23 ++++++++---
 3 files changed, 113 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index fe76ac7c..d4c19632 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -14,6 +14,7 @@ ver. 0.8.1 (2007/??/??) - stable
 - Improved regular expressions. Thanks to Yaroslav Halchenko
 - Added sendmail actions. The action started with "mail" are
   now deprecated. Thanks to Raphaël Marichez
+- Added "ignoreregex" support to fail2ban-regex
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/fail2ban-regex b/fail2ban-regex
index 28ea4b43..2f987e0c 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -68,6 +68,7 @@ class Fail2banRegex:
 	
 	def __init__(self):
 		self.__filter = Filter(None)
+		self.__ignoreregex = list()
 		self.__failregex = list()
 		# Setup logging
 		logging.getLogger("fail2ban").handlers = []
@@ -92,7 +93,7 @@ class Fail2banRegex:
 	
 	@staticmethod
 	def dispUsage():
-		print "Usage: "+sys.argv[0]+" [OPTIONS] <LOG> <REGEX>"
+		print "Usage: "+sys.argv[0]+" [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]"
 		print
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
@@ -111,6 +112,10 @@ class Fail2banRegex:
 		print "    string                  a string representing a 'failregex'"
 		print "    filename                path to a filter file (filter.d/sshd.conf)"
 		print
+		print "IgnoreRegex:"
+		print "    string                  a string representing an 'ignoreregex'"
+		print "    filename                path to a filter file (filter.d/sshd.conf)"
+		print
 		print "Report bugs to <lostcontrol@users.sourceforge.net>"
 	
 	def getCmdLineOptions(self, optList):
@@ -128,6 +133,35 @@ class Fail2banRegex:
 	def logIsFile(value):
 		return os.path.isfile(value)
 
+	def readIgnoreRegex(self, value):
+		if os.path.isfile(value):
+			reader = SafeConfigParser()
+			try:
+				reader.read(value)
+				print "Use ignoreregex file : " + value
+				self.__ignoreregex = [RegexStat(m)
+									for m in reader.get("Definition", "ignoreregex").split('\n')]
+			except NoSectionError:
+				print "No [Definition] section in " + value
+				print
+				return False
+			except NoOptionError:
+				print "No failregex option in " + value
+				print
+				return False
+			except MissingSectionHeaderError:
+				print "No section headers in " + value
+				print
+				return False
+		else:
+			if len(value) > 53:
+				stripReg = value[0:50] + "..."
+			else:
+				stripReg = value
+			print "Use ignoreregex line : " + stripReg
+			self.__ignoreregex = [RegexStat(value)]
+		return True
+
 	def readRegex(self, value):
 		if os.path.isfile(value):
 			reader = SafeConfigParser()
@@ -157,8 +191,27 @@ class Fail2banRegex:
 			self.__failregex = [RegexStat(value)]
 		return True
 	
+	def testIgnoreRegex(self, line):
+		found = False
+		for regex in self.__ignoreregex:
+			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
+			try:
+				self.__filter.addIgnoreRegex(regex.getFailRegex())
+				try:
+					ret = self.__filter.ignoreLine(line)
+					if ret:
+						regex.inc()
+				except RegexException, e:
+					print e
+					return False
+			finally:
+				self.__filter.delIgnoreRegex(0)
+				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
+	
 	def testRegex(self, line):
 		found = False
+		for regex in self.__ignoreregex:
+			self.__filter.addIgnoreRegex(regex.getFailRegex())
 		for regex in self.__failregex:
 			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
 			try:
@@ -182,6 +235,8 @@ class Fail2banRegex:
 			finally:
 				self.__filter.delFailRegex(0)
 				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
+		for regex in self.__ignoreregex:
+					self.__filter.delIgnoreRegex(0)
 	
 	def printStats(self):
 		print
@@ -191,25 +246,51 @@ class Fail2banRegex:
 		
 		# Print title
 		cnt = 1
-		print "Failregex:"
+		print "Failregex"
+		print "|- Regular expressions:"
 		for failregex in self.__failregex:
-			print "[" + str(cnt) + "] " + failregex.getFailRegex()
+			print "|  [" + str(cnt) + "] " + failregex.getFailRegex()
 			cnt += 1
+		cnt = 1
 		
-		print
+		print "|"
 		
 		# Print stats
 		cnt = 1
 		total = 0
-		print "Number of matches:"
+		print "`- Number of matches:"
 		for failregex in self.__failregex:
 			match = failregex.getStats()
 			total += match
-			print "[" + str(cnt) + "] " + str(match) + " match(es)"
+			print "   [" + str(cnt) + "] " + str(match) + " match(es)"
 			cnt += 1
 		
 		print
 		
+		# Print title
+		cnt = 1
+		print "Ignoreregex"
+		print "|- Regular expressions:"
+		for failregex in self.__ignoreregex:
+			print "|  [" + str(cnt) + "] " + failregex.getFailRegex()
+			cnt += 1
+		cnt = 1
+		
+		print "|"
+		
+		# Print stats
+		cnt = 1
+		print "`- Number of matches:"
+		for failregex in self.__ignoreregex:
+			match = failregex.getStats()
+			print "   [" + str(cnt) + "] " + str(match) + " match(es)"
+			cnt += 1
+		
+		print
+		print "Summary"
+		print "======="
+		print
+		
 		if total == 0:
 			print "Sorry, no match"
 			print
@@ -236,7 +317,7 @@ class Fail2banRegex:
 			
 			print "Date template hits:"
 			for template in self.__filter.dateDetector.getTemplates():
-				print `template.getHits()` + " hit: " + template.getName()
+				print `template.getHits()` + " hit(s): " + template.getName()
 			
 			print
 			
@@ -260,7 +341,7 @@ if __name__ == "__main__":
 	# Process command line
 	fail2banRegex.getCmdLineOptions(optList)
 	# We need exactly 3 parameters
-	if not len(sys.argv) == 3:
+	if not len(sys.argv) in (3, 4):
 		fail2banRegex.dispUsage()
 		sys.exit(-1)
 	else:
@@ -269,6 +350,10 @@ if __name__ == "__main__":
 		print "============="
 		print
 
+		if len(sys.argv) == 4:
+			if fail2banRegex.readIgnoreRegex(sys.argv[3]) == False:
+				sys.exit(-1)
+
 		if fail2banRegex.readRegex(sys.argv[2]) == False:
 			sys.exit(-1)
 
@@ -278,6 +363,7 @@ if __name__ == "__main__":
 				print "Use log file   : " + sys.argv[1]
 				print
 				for line in hdlr:
+					fail2banRegex.testIgnoreRegex(line)
 					fail2banRegex.testRegex(line)
 			except IOError, e:
 				print e
@@ -290,6 +376,7 @@ if __name__ == "__main__":
 				stripLog = sys.argv[1]
 			print "Use single line: " + stripLog
 			print
+			fail2banRegex.testIgnoreRegex(sys.argv[1])
 			fail2banRegex.testRegex(sys.argv[1])
 		
 		if fail2banRegex.printStats():
diff --git a/server/filter.py b/server/filter.py
index 131c6d02..b567445a 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -413,6 +413,20 @@ class Filter(JailThread):
 		self.__closeLogFile()
 		return True
 
+	##
+	# Returns true if the line should be ignored.
+	#
+	# Uses ignoreregex.
+	# @param line: the line
+	# @return: a boolean
+
+	def ignoreLine(self, line):
+		for ignoreRegex in self.__ignoreRegex:
+			ignoreRegex.search(line)
+			if ignoreRegex.hasMatched():
+				return True
+		return False
+
 	##
 	# Finds the failure in a line.
 	#
@@ -423,12 +437,9 @@ class Filter(JailThread):
 	def findFailure(self, line):
 		failList = list()
 		# Checks if we must ignore this line.
-		for ignoreRegex in self.__ignoreRegex:
-			ignoreRegex.search(line)
-			if ignoreRegex.hasMatched():
-				# The ignoreregex matched. Return.
-				logSys.debug("Ignoring this line")
-				return failList
+		if self.ignoreLine(line):
+			# The ignoreregex matched. Return.
+			return failList
 		# Iterates over all the regular expressions.
 		for failRegex in self.__failRegex:
 			failRegex.search(line)

From 568264d6c72cb828f390b684f105b11cee20191d Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 10 Jul 2007 20:04:57 +0000
Subject: [PATCH 09/26] - Updated suse-initd and added it to MANIFEST. Thanks
 to Christian Rauch

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@597 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG        |   2 +
 MANIFEST         |   1 +
 files/suse-initd | 109 +++++++++++++++++++++++++----------------------
 3 files changed, 62 insertions(+), 50 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index d4c19632..85ac9a04 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -15,6 +15,8 @@ ver. 0.8.1 (2007/??/??) - stable
 - Added sendmail actions. The action started with "mail" are
   now deprecated. Thanks to Raphaël Marichez
 - Added "ignoreregex" support to fail2ban-regex
+- Updated suse-initd and added it to MANIFEST. Thanks to
+  Christian Rauch
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/MANIFEST b/MANIFEST
index 7de5196b..b4a3a698 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -102,6 +102,7 @@ files/gentoo-confd
 files/redhat-initd
 files/solaris-fail2ban.xml
 files/solaris-svc-fail2ban
+files/suse-initd
 files/cacti/fail2ban_stats.sh
 files/cacti/cacti_host_template_fail2ban.xml
 files/cacti/README
diff --git a/files/suse-initd b/files/suse-initd
index 06e481fe..bbd679aa 100755
--- a/files/suse-initd
+++ b/files/suse-initd
@@ -6,26 +6,26 @@
 #
 ### BEGIN INIT INFO
 # Provides:          fail2ban
-# Required-Start:    $syslog $remote_fs postfix
+# Required-Start:    $syslog $remote_fs sendmail
 # Required-Stop:     $syslog $remote_fs
 # Should-Stop: $time ypbind sendmail
 # Default-Start:     3 5
 # Default-Stop:      0 1 2 6
 # Description:       startup Fail2Ban
 ### END INIT INFO
-PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/sbin:/usr/bin:/bin
 FAIL2BAN_BIN=/usr/local/bin/fail2ban-client
 FAIL2BAN_SERVER=/usr/local/bin/fail2ban-server
 FAIL2BAN_SOCKET=/tmp/fail2ban.sock
-test -x $FAIL2BAN_BIN || { echo "$FAIL2BAN_BIN not installed"; 
-	if [ "$1" = "stop" ]; then exit 0;
-	else exit 5; fi; }
+test -x $FAIL2BAN_BIN || { echo "$FAIL2BAN_BIN not installed";
+        if [ "$1" = "stop" ]; then exit 0;
+        else exit 5; fi; }
 
 # Check for existence of needed config file and read it
 FAIL2BAN_CONFIG=/etc/fail2ban/fail2ban.conf
 test -r $FAIL2BAN_CONFIG || { echo "$FAIL2BAN_CONFIG not existing";
-	if [ "$1" = "stop" ]; then exit 0;
-	else exit 6; fi; }
+        if [ "$1" = "stop" ]; then exit 0;
+        else exit 6; fi; }
 
 . /etc/rc.status
 
@@ -34,54 +34,63 @@ rc_reset
 
 case "$1" in
     start)
-	echo -n "Starting Fail2Ban "
-	/sbin/startproc $FAIL2BAN_BIN -q start 2>1 > /dev/null
-	rc_status -v
-	;;
+        echo -n "Starting Fail2Ban "
+        /sbin/startproc $FAIL2BAN_BIN start &>/dev/null
+        rc_status -v
+        ;;
     stop)
-	echo -n "Shutting down Fail2ban "
-	/sbin/startproc $FAIL2BAN_BIN -q stop
-	rc_status -v
-	;;
+        echo -n "Shutting down Fail2ban "
+        /sbin/startproc $FAIL2BAN_BIN -q stop
+        rc_status -v
+        ;;
     try-restart|condrestart)
-	if test "$1" = "condrestart"; then
-		echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}"
-	fi
-	$0 status
-	if test $? = 0; then
-		$0 restart
-	else
-		rc_reset	# Not running is not a failure.
-	fi
-	rc_status
-	;;
+        if test "$1" = "condrestart"; then
+                echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}"
+        fi
+        $0 status
+        if test $? = 0; then
+                $0 restart
+        else
+                rc_reset        # Not running is not a failure.
+        fi
+        rc_status
+        ;;
     restart)
-	$0 stop
-	i=60
-	while [ -e $FAIL2BAN_SOCKET ] && [ $i -gt 60 ]
-		sleep 1
-		i=$[i-1]
-		echo -n "."
-	done
-	echo "."
-	$0 start
+        $0 stop
+        echo -n "-wait a minute "
+        i=60
+        while [ -e $FAIL2BAN_SOCKET ] && [ $i -gt 0 ]; do
+                sleep 1
+                i=$[$i-1]
+                echo -n "."
+        done
+        echo "."
+        $0 start
 
-	# Remember status and be quiet
-	rc_status
-	;;
+        # Remember status and be quiet
+        rc_status
+        ;;
     force-reload)
-	echo -n "Reload service Fail2ban "
-	/sbin/startproc $FAIL2BAN_BIN -q reload
-	rc_status -v
-	;;
+        echo -n "Reload service Fail2ban "
+        /sbin/startproc $FAIL2BAN_BIN -q reload
+        rc_status -v
+        ;;
     reload)
-	echo -n "Reload service Fail2ban "
-	/sbin/startproc $FAIL2BAN_BIN -q reload
-	rc_status -v
-	;;
+        echo -n "Reload service Fail2ban "
+        /sbin/startproc $FAIL2BAN_BIN -q reload
+        rc_status -v
+        ;;
     status)
-	echo -n "Checking for service Fail2ban "
-	/sbin/checkproc $FAIL2BAN_SERVER
-	rc_status -v
-	;;
+        echo -n "Checking for service Fail2ban "
+        /sbin/checkproc $FAIL2BAN_SERVER
+        rc_status -v
+        ;;
     probe)
+        test /etc/fail2ban/fail2ban.conf -nt /var/run/fail2ban.pid && echo reload
+        ;;
+    *)
+        echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}"
+        exit 1
+        ;;
+esac
+rc_exit
\ No newline at end of file

From f714c96d0e53ea93010fc3d0d8e9ff9a03497d36 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 10 Jul 2007 20:24:44 +0000
Subject: [PATCH 10/26] - Updated regular expressions

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@598 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                 |  1 +
 config/filter.d/sshd.conf | 11 ++++++-----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 85ac9a04..acf9f939 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -12,6 +12,7 @@ ver. 0.8.1 (2007/??/??) - stable
 - Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
 - Expand <HOST> in ignoreregex. Thanks to Yaroslav Halchenko
 - Improved regular expressions. Thanks to Yaroslav Halchenko
+  and others
 - Added sendmail actions. The action started with "mail" are
   now deprecated. Thanks to Raphaël Marichez
 - Added "ignoreregex" support to fail2ban-regex
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 39416f43..98b5ceae 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -14,11 +14,12 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = Authentication failure for .* from <HOST>$
-            Failed [-/\w]+ for .* from <HOST>$
-            ROOT LOGIN REFUSED .* FROM <HOST>$
-            [iI](?:llegal|nvalid) user .* from <HOST>$
-            User .* from <HOST> not allowed because not listed in AllowUsers$
+failregex = Authentication failure for .+ from <HOST>(?: port \d+ ssh2)?$
+            Failed [-/\w]+ for .+ from <HOST>(?: port \d+ ssh2)?$
+            ROOT LOGIN REFUSED .+ FROM <HOST>(?: port \d+ ssh2)?$
+            [iI](?:llegal|nvalid) user .+ from <HOST>(?: port \d+ ssh2)?$
+            User .+ from <HOST> not allowed because not listed in AllowUsers$
+            User .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 2816bca55bea3d0b9dd9b3275306027ebb41e393 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 11 Jul 2007 22:12:45 +0000
Subject: [PATCH 11/26] - Tightening up the pid check in redhat-initd. Thanks
 to David Nutter

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@599 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG          | 2 ++
 files/redhat-initd | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index acf9f939..1cc72723 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -18,6 +18,8 @@ ver. 0.8.1 (2007/??/??) - stable
 - Added "ignoreregex" support to fail2ban-regex
 - Updated suse-initd and added it to MANIFEST. Thanks to
   Christian Rauch
+- Tightening up the pid check in redhat-initd. Thanks to
+  David Nutter
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/files/redhat-initd b/files/redhat-initd
index 205294cf..529aef25 100755
--- a/files/redhat-initd
+++ b/files/redhat-initd
@@ -20,7 +20,7 @@ FAIL2BAN="/usr/bin/fail2ban-client"
 RETVAL=0
 
 getpid() {
-    pid=`ps -ef | grep fail2ban-|grep -v grep|awk '{print $2}'`
+    pid=`ps -eo pid,comm | grep fail2ban- | awk '{ print $1 }'`
 }
 
 start() {

From 6d7b93c826dfd1ef701a0dea9aea60fba2d59710 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 11 Jul 2007 22:13:07 +0000
Subject: [PATCH 12/26] - Updated contributors

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@600 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 README | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README b/README
index 7a4aa86f..f2c1d31e 100644
--- a/README
+++ b/README
@@ -73,7 +73,8 @@ Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
 Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
 Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
 René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch,
-Michael C. Haller, Jonathan Underwood, Hanno 'Rince' Wagner
+Michael C. Haller, Jonathan Underwood, Hanno 'Rince' Wagner,
+Daniel B. Cid, David Nutter, Raphaël Marichez
 
 License:
 --------

From 9ac663a1214287312fe314d9d5f1f3a3265b1127 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 11 Jul 2007 22:27:16 +0000
Subject: [PATCH 13/26] - Added webmin authentication filter. Thanks to
 Guillaume Delvit

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@601 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                        |  2 ++
 MANIFEST                         |  1 +
 config/filter.d/webmin-auth.conf | 28 ++++++++++++++++++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 config/filter.d/webmin-auth.conf

diff --git a/CHANGELOG b/CHANGELOG
index 1cc72723..59417a31 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -20,6 +20,8 @@ ver. 0.8.1 (2007/??/??) - stable
   Christian Rauch
 - Tightening up the pid check in redhat-initd. Thanks to
   David Nutter
+- Added webmin authentication filter. Thanks to Guillaume
+  Delvit
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/MANIFEST b/MANIFEST
index b4a3a698..b91adaa8 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -74,6 +74,7 @@ config/filter.d/sasl.conf
 config/filter.d/sshd.conf
 config/filter.d/sshd-ddos.conf
 config/filter.d/vsftpd.conf
+config/filter.d/webmin-auth.conf
 config/filter.d/wuftpd.conf
 config/action.d/hostsdeny.conf
 config/action.d/ipfw.conf
diff --git a/config/filter.d/webmin-auth.conf b/config/filter.d/webmin-auth.conf
new file mode 100644
index 00000000..ddf081ea
--- /dev/null
+++ b/config/filter.d/webmin-auth.conf
@@ -0,0 +1,28 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Rule by : Delvit Guillaume
+#
+# $Revision$
+#
+
+[Definition]
+
+# patern :      webmin[15673]: Non-existent login as toto from 86.0.6.217
+#               webmin[29544]: Invalid login as root from 86.0.6.217
+#
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+failregex = webmin.* Non-existent login as .+ from <HOST>$
+            webmin.* Invalid login as .+ from <HOST>$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 

From b239e17a7d33b550380d010e59394e163f9db7a0 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 11 Jul 2007 22:27:29 +0000
Subject: [PATCH 14/26] - Updated contributors

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@602 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 README | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README b/README
index f2c1d31e..73a0cd25 100644
--- a/README
+++ b/README
@@ -74,7 +74,8 @@ Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler,
 Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
 René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch,
 Michael C. Haller, Jonathan Underwood, Hanno 'Rince' Wagner,
-Daniel B. Cid, David Nutter, Raphaël Marichez
+Daniel B. Cid, David Nutter, Raphaël Marichez, Guillaume
+Delvit
 
 License:
 --------

From e841209f1b0bfce6233847931433f4bf17bf3a70 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 17 Jul 2007 20:41:00 +0000
Subject: [PATCH 15/26] - Added new regex for proftpd. Thanks to Vaclav Misek

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@603 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 README                       | 2 +-
 config/filter.d/proftpd.conf | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/README b/README
index 73a0cd25..8df3d779 100644
--- a/README
+++ b/README
@@ -75,7 +75,7 @@ Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand,
 René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch,
 Michael C. Haller, Jonathan Underwood, Hanno 'Rince' Wagner,
 Daniel B. Cid, David Nutter, Raphaël Marichez, Guillaume
-Delvit
+Delvit, Vaclav Misek
 
 License:
 --------
diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index 1fc31ef5..45b91c66 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -15,6 +15,7 @@
 # Values: TEXT
 #
 failregex = USER \S+: no such user found from \S* ?\[<HOST>\] to \S+\s*$
+            \(\S*\[<HOST>\]\) - USER \S+ \(Login failed\): Incorrect password.$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 711f936ed0f5a70c011257c54d6293c1816e4d80 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Sun, 5 Aug 2007 19:33:15 +0000
Subject: [PATCH 16/26] - Corrected subject

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@604 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/action.d/sendmail-buffered.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/action.d/sendmail-buffered.conf b/config/action.d/sendmail-buffered.conf
index 836ed384..621034f0 100644
--- a/config/action.d/sendmail-buffered.conf
+++ b/config/action.d/sendmail-buffered.conf
@@ -25,7 +25,7 @@ actionstart = echo -en "Subject: [Fail2Ban] <name>: started
 # Values:  CMD
 #
 actionstop = if [ -f <tmpfile> ]; then
-                 echo -en "Subject: [Fail2Ban] <name>: stopped
+                 echo -en "Subject: [Fail2Ban] <name>: summary
                  From: Fail2Ban <<sender>>
                  To: <dest>\n
                  Hi,\n
@@ -60,7 +60,7 @@ actioncheck =
 actionban = echo `date`": <ip> (<failures> failures)" >> <tmpfile>
             LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
             if [ $LINE -eq <lines> ]; then
-                echo -en "Subject: [Fail2Ban] <name>: stopped
+                echo -en "Subject: [Fail2Ban] <name>: summary
                 From: Fail2Ban <<sender>>
                 To: <dest>\n
                 Hi,\n

From 7c33b443acbb6802c9aadfee11f7a09224ee612c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 7 Aug 2007 22:11:34 +0000
Subject: [PATCH 17/26] - Removed textToDns() which is not required anymore.
 Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@605 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG        |  2 ++
 server/filter.py | 19 +++----------------
 2 files changed, 5 insertions(+), 16 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 59417a31..da66b0a1 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -22,6 +22,8 @@ ver. 0.8.1 (2007/??/??) - stable
   David Nutter
 - Added webmin authentication filter. Thanks to Guillaume
   Delvit
+- Removed textToDns() which is not required anymore. Thanks
+  to Yaroslav Halchenko
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/server/filter.py b/server/filter.py
index b567445a..04a86d79 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -503,17 +503,6 @@ class DNSUtils:
 						% dns)
 			return list()
 	
-	@staticmethod
-	def textToDns(text):
-		""" Search for possible DNS in an arbitrary text.
-			Thanks to Tom Pike.
-		"""
-		match = DNSUtils.DNS_CRE.match(text)
-		if match:
-			return match
-		else:
-			return None
-	
 	@staticmethod
 	def searchIP(text):
 		""" Search if an IP address if directly available and return
@@ -549,11 +538,9 @@ class DNSUtils:
 				ipList.append(plainIPStr)
 		if not ipList:
 			# Try to get IP from possible DNS
-			dns = DNSUtils.textToDns(text)
-			if not dns == None:
-				ip = DNSUtils.dnsToIp(dns.group(0))
-				for e in ip:
-					ipList.append(e)
+			ip = DNSUtils.dnsToIp(text)
+			for e in ip:
+				ipList.append(e)
 		return ipList
 	
 	@staticmethod

From 26c54c45380a5a84863e8ea64619d8842d7b5854 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:13:09 +0000
Subject: [PATCH 18/26] - Added new action iptables-allports. Thanks to
 Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@606 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                              |  2 +
 config/action.d/iptables-allports.conf | 65 ++++++++++++++++++++++++++
 2 files changed, 67 insertions(+)
 create mode 100644 config/action.d/iptables-allports.conf

diff --git a/CHANGELOG b/CHANGELOG
index da66b0a1..f69366fa 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -24,6 +24,8 @@ ver. 0.8.1 (2007/??/??) - stable
   Delvit
 - Removed textToDns() which is not required anymore. Thanks
   to Yaroslav Halchenko
+- Added new action iptables-allports. Thanks to Yaroslav
+  Halchenko
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/config/action.d/iptables-allports.conf b/config/action.d/iptables-allports.conf
new file mode 100644
index 00000000..a95065d4
--- /dev/null
+++ b/config/action.d/iptables-allports.conf
@@ -0,0 +1,65 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
+# 			made active on all ports from original iptables.conf
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I INPUT -p <protocol> -j fail2ban-<name>
+
+# Option:  actionend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -p <protocol> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L INPUT | grep -q fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+

From 040822f19f755e643ba62133b7285f0fa3db2d62 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:16:22 +0000
Subject: [PATCH 19/26] - Added "named" date format to date detector. Thanks to
 Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@607 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG              | 2 ++
 server/datedetector.py | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index f69366fa..b28f6bf3 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -26,6 +26,8 @@ ver. 0.8.1 (2007/??/??) - stable
   to Yaroslav Halchenko
 - Added new action iptables-allports. Thanks to Yaroslav
   Halchenko
+- Added "named" date format to date detector. Thanks to
+  Yaroslav Halchenko
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/server/datedetector.py b/server/datedetector.py
index 6b9986f5..1f3f5828 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -80,6 +80,12 @@ class DateDetector:
 			template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%Y-%m-%d %H:%M:%S")
 			self.__templates.append(template)
+			# named 26-Jul-2007 15:20:52.252 
+			template = DateStrptime()
+			template.setName("Day-Month-Year Hour:Minute:Second[.Millisecond]")
+			template.setRegex("\d{2}-\S{3}-\d{4} \d{2}:\d{2}:\d{2}")
+			template.setPattern("%d-%b-%Y %H:%M:%S")
+			self.__templates.append(template)
 			# TAI64N
 			template = DateTai64n()
 			template.setName("TAI64N")

From a3ace8040b87707bea427ef429d2576b00b3e636 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:21:15 +0000
Subject: [PATCH 20/26] - Added filter file for named (bind9). Thanks to
 Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@608 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                          |  2 ++
 config/filter.d/named-refused.conf | 34 ++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 config/filter.d/named-refused.conf

diff --git a/CHANGELOG b/CHANGELOG
index b28f6bf3..484fb093 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -28,6 +28,8 @@ ver. 0.8.1 (2007/??/??) - stable
   Halchenko
 - Added "named" date format to date detector. Thanks to
   Yaroslav Halchenko
+- Added filter file for named (bind9). Thanks to Yaroslav
+  Halchenko
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/config/filter.d/named-refused.conf b/config/filter.d/named-refused.conf
new file mode 100644
index 00000000..d70e8732
--- /dev/null
+++ b/config/filter.d/named-refused.conf
@@ -0,0 +1,34 @@
+# Fail2Ban configuration file for named (bind9). Trying to generalize the
+#          structure which is general to capture general patterns in log
+#          lines to cover different configurations/distributions
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision$
+#
+
+[Definition]
+
+# if you want to catch only login erros from specific daemons, use smth like
+#_named_rcodes=(?:REFUSED|SERVFAIL)
+# To catch all REFUSED queries only
+_named_rcodes=REFUSED
+_daemon=named
+
+#
+# Shortcuts for easier comprehension of the failregex
+__pid_re=(?:\[\d+\])
+__daemon_re=\(?%(_daemon)s(?:\(\S+\))?\)?:?
+__daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
+#       hostname       daemon_id         spaces
+# this can be optional (for instance if we match named native log files)
+__line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = %(__line_prefix)sunexpected RCODE \(%(_named_rcodes)s\) resolving '.*': <HOST>#\S+$
+		    %(__line_prefix)sclient <HOST>#\S+: query(?: \(cache\))? '.*' denied\s*$
+
+

From 3ef8fbe2e3509640a5d4a281a745606e91f0b81a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:29:13 +0000
Subject: [PATCH 21/26] - Modified failregex again. Thanks to Yaroslav
 Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@609 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/sshd.conf | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 98b5ceae..316af802 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -14,11 +14,11 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = Authentication failure for .+ from <HOST>(?: port \d+ ssh2)?$
-            Failed [-/\w]+ for .+ from <HOST>(?: port \d+ ssh2)?$
-            ROOT LOGIN REFUSED .+ FROM <HOST>(?: port \d+ ssh2)?$
-            [iI](?:llegal|nvalid) user .+ from <HOST>(?: port \d+ ssh2)?$
-            User .+ from <HOST> not allowed because not listed in AllowUsers$
+failregex = (?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
+            Failed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
+            ROOT LOGIN REFUSED.* FROM <HOST>\s*$
+            [iI](?:llegal|nvalid) user .* from <HOST>\s*$
+            User \S+ from <HOST> not allowed because not listed in AllowUsers$
             User .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$
 
 # Option:  ignoreregex

From 49b2e40682e6af68b43a9e2d267d783df710691a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:31:47 +0000
Subject: [PATCH 22/26] - Fixed vsftpd filter. Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@610 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                   | 1 +
 config/filter.d/vsftpd.conf | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 484fb093..fe550610 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -30,6 +30,7 @@ ver. 0.8.1 (2007/??/??) - stable
   Yaroslav Halchenko
 - Added filter file for named (bind9). Thanks to Yaroslav
   Halchenko
+- Fixed vsftpd filter. Thanks to Yaroslav Halchenko
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index 3c4bb11b..9f955fae 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -14,8 +14,8 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values: TEXT
 #
-failregex = vsftpd(?:\[\d+\])?: .* authentication failure; .* rhost=<HOST>$
-            \[.+\] FAIL LOGIN: Client "<HOST>"$
+failregex = vsftpd(?:\[\d+\])?: .* authentication failure; .* rhost=<HOST>\s*$
+            \[.+\] FAIL LOGIN: Client "<HOST>"\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 5fd5a8112a4ec21c372574c472c2b6f334cda9b3 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:49:58 +0000
Subject: [PATCH 23/26] - Added named (bind9) example. Thanks to Yaroslav
 Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@611 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/jail.conf | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/config/jail.conf b/config/jail.conf
index 8dbbfd13..d61e7b6f 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -165,3 +165,41 @@ action   = ipfw[localhost=192.168.0.1]
            sendmail-whois[name="SSH,IPFW", dest=you@mail.com]
 logpath  = /var/log/auth.log
 ignoreip = 168.192.0.1
+
+# These jails block attacks against named (bind9). By default, logging is off
+# with bind9 installation. You will need something like this:
+#
+# logging {
+#     channel lame-servers_file {
+#         file "/var/log/named/lame-servers.log" versions 3 size 30m;
+#         severity dynamic;
+#         print-time yes;
+#     };
+#     category lame-servers {
+#         lame-servers_file;
+#     };
+# }
+#
+# in your named.conf to provide proper logging.
+# This jail blocks UDP traffic for DNS requests.
+
+[named-refused-udp]
+
+enabled  = false
+filter   = named-refused
+action   = iptables-multiport[name=Named, port="domain,953", protocol=udp]
+           sendmail-whois[name=Named, dest=you@mail.com]
+logpath  = /var/log/named/lame-servers.log
+ignoreip = 168.192.0.1
+
+# This jail blocks TCP traffic for DNS requests.
+
+[named-refused-tcp]
+
+enabled  = false
+filter   = named-refused
+action   = iptables-multiport[name=Named, port="domain,953", protocol=tcp]
+           sendmail-whois[name=Named, dest=you@mail.com]
+logpath  = /var/log/named/lame-servers.log
+ignoreip = 168.192.0.1
+

From b2a79a5e49530bac2c8f0d79afbb946e2864af52 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:52:42 +0000
Subject: [PATCH 24/26] - Added new files

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@612 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 MANIFEST | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MANIFEST b/MANIFEST
index b91adaa8..a4cc60ef 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -66,6 +66,7 @@ config/filter.d/apache-noscript.conf
 config/filter.d/courierlogin.conf
 config/filter.d/couriersmtp.conf
 config/filter.d/exim.conf
+config/filter.d/named-refused.conf
 config/filter.d/postfix.conf
 config/filter.d/proftpd.conf
 config/filter.d/pure-ftpd.conf
@@ -79,6 +80,7 @@ config/filter.d/wuftpd.conf
 config/action.d/hostsdeny.conf
 config/action.d/ipfw.conf
 config/action.d/iptables.conf
+config/action.d/iptables-allports.conf
 config/action.d/iptables-multiport.conf
 config/action.d/iptables-new.conf
 config/action.d/mail.conf

From 732c66215fb9f6475f5f76ece2aef5810d440360 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 13 Aug 2007 21:39:26 +0000
Subject: [PATCH 25/26] - Improved regular expressions

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@613 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/sshd.conf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 316af802..1a601bd6 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -15,11 +15,11 @@
 # Values:  TEXT
 #
 failregex = (?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
-            Failed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
+            Failed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?\s*$
             ROOT LOGIN REFUSED.* FROM <HOST>\s*$
             [iI](?:llegal|nvalid) user .* from <HOST>\s*$
-            User \S+ from <HOST> not allowed because not listed in AllowUsers$
-            User .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$
+            User .+ from <HOST> not allowed because not listed in AllowUsers\s*$
+            User .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From e40468dfd3533eb4cd8f196d41b62dd72cfc4d5c Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 14 Aug 2007 21:39:15 +0000
Subject: [PATCH 26/26] - Prepared for 0.8.1

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@614 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG             |  4 ++--
 README                |  6 +++---
 common/version.py     |  2 +-
 man/fail2ban-client.1 |  4 ++--
 man/fail2ban-regex.1  | 13 ++++++++++---
 man/fail2ban-server.1 |  4 ++--
 6 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index fe550610..6d05c5c8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,10 +4,10 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.8.1)                           2007/??/??
+Fail2Ban (version 0.8.1)                           2007/08/14
 =============================================================
 
-ver. 0.8.1 (2007/??/??) - stable
+ver. 0.8.1 (2007/08/14) - stable
 ----------
 - Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
 - Expand <HOST> in ignoreregex. Thanks to Yaroslav Halchenko
diff --git a/README b/README
index 8df3d779..5cece798 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.8.0)                           2007/05/03
+Fail2Ban (version 0.8.1)                           2007/08/14
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -28,8 +28,8 @@ Optional:
 
 To install, just do:
 
-> tar xvfj fail2ban-0.8.0.tar.bz2
-> cd fail2ban-0.8.0
+> tar xvfj fail2ban-0.8.1.tar.bz2
+> cd fail2ban-0.8.1
 > python setup.py install
 
 This will install Fail2Ban into /usr/share/fail2ban. The
diff --git a/common/version.py b/common/version.py
index 929c2225..aa428745 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.8.0"
+version = "0.8.1"
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 3dd4111b..719ad7f8 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,11 +1,11 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "May 2007" "fail2ban-client v0.8.0" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "August 2007" "fail2ban-client v0.8.1" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH DESCRIPTION
 [?1034hUsage: ../fail2ban\-client [OPTIONS] <COMMAND>
 .PP
-Fail2Ban v0.8.0 reads log file that contains password failure report
+Fail2Ban v0.8.1 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index a7fae822..2556162e 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-REGEX "1" "May 2007" "fail2ban-regex v0.8.0" "User Commands"
+.TH FAIL2BAN-REGEX "1" "August 2007" "fail2ban-regex v0.8.1" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
 .B fail2ban-regex
-[\fIOPTIONS\fR] \fI<LOG> <REGEX>\fR
+[\fIOPTIONS\fR] \fI<LOG> <REGEX> \fR[\fIIGNOREREGEX\fR]
 .SH DESCRIPTION
-Fail2Ban v0.8.0 reads log file that contains password failure report
+Fail2Ban v0.8.1 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 This tools can test regular expressions for "fail2ban".
@@ -31,6 +31,13 @@ a string representing a 'failregex'
 .TP
 \fBfilename\fR
 path to a filter file (filter.d/sshd.conf)
+.SS "IgnoreRegex:"
+.TP
+\fBstring\fR
+a string representing an 'ignoreregex'
+.TP
+\fBfilename\fR
+path to a filter file (filter.d/sshd.conf)
 .SH AUTHOR
 Written by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
 Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index d8ed93cd..dfa3b185 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "May 2007" "fail2ban-server v0.8.0" "User Commands"
+.TH FAIL2BAN-SERVER "1" "August 2007" "fail2ban-server v0.8.1" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.8.0 reads log file that contains password failure report
+Fail2Ban v0.8.1 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with