From 99344d28c8fe258de7fb72810ad5646ab62dbbc7 Mon Sep 17 00:00:00 2001 From: sebres Date: Mon, 24 Apr 2017 20:17:57 +0200 Subject: [PATCH 1/4] Introduces new tags with hostname: - `` - fully-qualified name of host (the same as `$(hostname -f)`) - `` - short hostname (the same as `$(uname -n)`) Execution of `uname -n` replaced in all mail actions with most interesting fully-qualified ``. --- config/action.d/mail-buffered.conf | 6 +++--- config/action.d/mail-whois-lines.conf | 6 +++--- config/action.d/mail-whois.conf | 6 +++--- config/action.d/mail.conf | 6 +++--- config/action.d/sendmail-buffered.conf | 8 +++---- config/action.d/sendmail-common.conf | 4 ++-- config/action.d/sendmail-geoip-lines.conf | 2 +- .../sendmail-whois-ipjailmatches.conf | 2 +- config/action.d/sendmail-whois-ipmatches.conf | 2 +- config/action.d/sendmail-whois-lines.conf | 2 +- config/action.d/sendmail-whois-matches.conf | 2 +- config/action.d/sendmail-whois.conf | 2 +- config/action.d/sendmail.conf | 2 +- config/action.d/xarf-login-attack.conf | 4 ++-- config/jail.conf | 2 +- fail2ban/server/actions.py | 4 ++++ fail2ban/server/ipdns.py | 21 +++++++++++++++++++ 17 files changed, 53 insertions(+), 28 deletions(-) diff --git a/config/action.d/mail-buffered.conf b/config/action.d/mail-buffered.conf index e74db9cc..88cd623f 100644 --- a/config/action.d/mail-buffered.conf +++ b/config/action.d/mail-buffered.conf @@ -17,7 +17,7 @@ actionstart = printf %%b "Hi,\n The jail has been started successfully.\n Output will be buffered until lines are available.\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] : started on `uname -n`" + Fail2Ban"|mail -s "[Fail2Ban] : started on " # Option: actionstop # Notes.: command executed once at the end of Fail2Ban @@ -28,13 +28,13 @@ actionstop = if [ -f ]; then These hosts have been banned by Fail2Ban.\n `cat ` Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] : Summary from `uname -n`" + Fail2Ban"|mail -s "[Fail2Ban] : Summary from " rm fi printf %%b "Hi,\n The jail has been stopped.\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] : stopped on `uname -n`" + Fail2Ban"|mail -s "[Fail2Ban] : stopped on " # Option: actioncheck # Notes.: command executed once before each actionban command diff --git a/config/action.d/mail-whois-lines.conf b/config/action.d/mail-whois-lines.conf index 7ebb8b9f..37e2d9b0 100644 --- a/config/action.d/mail-whois-lines.conf +++ b/config/action.d/mail-whois-lines.conf @@ -21,7 +21,7 @@ norestored = 1 actionstart = printf %%b "Hi,\n The jail has been started successfully.\n Regards,\n - Fail2Ban" | "[Fail2Ban] : started on `uname -n`" + Fail2Ban" | "[Fail2Ban] : started on " # Option: actionstop # Notes.: command executed once at the end of Fail2Ban @@ -30,7 +30,7 @@ actionstart = printf %%b "Hi,\n actionstop = printf %%b "Hi,\n The jail has been stopped.\n Regards,\n - Fail2Ban" | "[Fail2Ban] : stopped on `uname -n`" + Fail2Ban" | "[Fail2Ban] : stopped on " # Option: actioncheck # Notes.: command executed once before each actionban command @@ -56,7 +56,7 @@ _ban_mail_content = ( printf %%b "Hi,\n Regards,\n Fail2Ban" ) -actionban = %(_ban_mail_content)s | "[Fail2Ban] : banned from `uname -n`" +actionban = %(_ban_mail_content)s | "[Fail2Ban] : banned from " # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf index 553bfb69..1f69f4c6 100644 --- a/config/action.d/mail-whois.conf +++ b/config/action.d/mail-whois.conf @@ -20,7 +20,7 @@ norestored = 1 actionstart = printf %%b "Hi,\n The jail has been started successfully.\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] : started on `uname -n`" + Fail2Ban"|mail -s "[Fail2Ban] : started on " # Option: actionstop # Notes.: command executed once at the end of Fail2Ban @@ -29,7 +29,7 @@ actionstart = printf %%b "Hi,\n actionstop = printf %%b "Hi,\n The jail has been stopped.\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] : stopped on `uname -n`" + Fail2Ban"|mail -s "[Fail2Ban] : stopped on " # Option: actioncheck # Notes.: command executed once before each actionban command @@ -49,7 +49,7 @@ actionban = printf %%b "Hi,\n Here is more information about :\n `%(_whois_command)s`\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] : banned from `uname -n`" + Fail2Ban"|mail -s "[Fail2Ban] : banned from " # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf index 4715ecc5..cfc1cf65 100644 --- a/config/action.d/mail.conf +++ b/config/action.d/mail.conf @@ -16,7 +16,7 @@ norestored = 1 actionstart = printf %%b "Hi,\n The jail has been started successfully.\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] : started on `uname -n`" + Fail2Ban"|mail -s "[Fail2Ban] : started on " # Option: actionstop # Notes.: command executed once at the end of Fail2Ban @@ -25,7 +25,7 @@ actionstart = printf %%b "Hi,\n actionstop = printf %%b "Hi,\n The jail has been stopped.\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] : stopped on `uname -n`" + Fail2Ban"|mail -s "[Fail2Ban] : stopped on " # Option: actioncheck # Notes.: command executed once before each actionban command @@ -43,7 +43,7 @@ actionban = printf %%b "Hi,\n The IP has just been banned by Fail2Ban after attempts against .\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] : banned from `uname -n`" + Fail2Ban"|mail -s "[Fail2Ban] : banned from " # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the diff --git a/config/action.d/sendmail-buffered.conf b/config/action.d/sendmail-buffered.conf index a91a6957..37bc642d 100644 --- a/config/action.d/sendmail-buffered.conf +++ b/config/action.d/sendmail-buffered.conf @@ -17,7 +17,7 @@ norestored = 1 # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = printf %%b "Subject: [Fail2Ban] : started on `uname -n` +actionstart = printf %%b "Subject: [Fail2Ban] : started on From: <> To: \n Hi,\n @@ -31,7 +31,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] : started on `uname -n` # Values: CMD # actionstop = if [ -f ]; then - printf %%b "Subject: [Fail2Ban] : summary from `uname -n` + printf %%b "Subject: [Fail2Ban] : summary from From: <> To: \n Hi,\n @@ -41,7 +41,7 @@ actionstop = if [ -f ]; then Fail2Ban" | /usr/sbin/sendmail -f rm fi - printf %%b "Subject: [Fail2Ban] : stopped on `uname -n` + printf %%b "Subject: [Fail2Ban] : stopped on From: Fail2Ban <> To: \n Hi,\n @@ -64,7 +64,7 @@ actioncheck = actionban = printf %%b "`date`: ( failures)\n" >> LINE=$( wc -l | awk '{ print $1 }' ) if [ $LINE -ge ]; then - printf %%b "Subject: [Fail2Ban] : summary from `uname -n` + printf %%b "Subject: [Fail2Ban] : summary from From: <> To: \n Hi,\n diff --git a/config/action.d/sendmail-common.conf b/config/action.d/sendmail-common.conf index 1475dedb..46eca9ca 100644 --- a/config/action.d/sendmail-common.conf +++ b/config/action.d/sendmail-common.conf @@ -14,7 +14,7 @@ after = sendmail-common.local # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = printf %%b "Subject: [Fail2Ban] : started on `uname -n` +actionstart = printf %%b "Subject: [Fail2Ban] : started on Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n @@ -27,7 +27,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] : started on `uname -n` # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = printf %%b "Subject: [Fail2Ban] : stopped on `uname -n` +actionstop = printf %%b "Subject: [Fail2Ban] : stopped on Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n diff --git a/config/action.d/sendmail-geoip-lines.conf b/config/action.d/sendmail-geoip-lines.conf index decf2c05..b7c1bf36 100644 --- a/config/action.d/sendmail-geoip-lines.conf +++ b/config/action.d/sendmail-geoip-lines.conf @@ -23,7 +23,7 @@ norestored = 1 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = ( printf %%b "Subject: [Fail2Ban] : banned from `uname -n` +actionban = ( printf %%b "Subject: [Fail2Ban] : banned from Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n diff --git a/config/action.d/sendmail-whois-ipjailmatches.conf b/config/action.d/sendmail-whois-ipjailmatches.conf index 5bcefe89..06ea3a3e 100644 --- a/config/action.d/sendmail-whois-ipjailmatches.conf +++ b/config/action.d/sendmail-whois-ipjailmatches.conf @@ -19,7 +19,7 @@ norestored = 1 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` +actionban = printf %%b "Subject: [Fail2Ban] : banned from Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n diff --git a/config/action.d/sendmail-whois-ipmatches.conf b/config/action.d/sendmail-whois-ipmatches.conf index 4a8edcb7..83bff1b4 100644 --- a/config/action.d/sendmail-whois-ipmatches.conf +++ b/config/action.d/sendmail-whois-ipmatches.conf @@ -19,7 +19,7 @@ norestored = 1 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` +actionban = printf %%b "Subject: [Fail2Ban] : banned from Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf index e3a1c974..4b947cb2 100644 --- a/config/action.d/sendmail-whois-lines.conf +++ b/config/action.d/sendmail-whois-lines.conf @@ -20,7 +20,7 @@ norestored = 1 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = ( printf %%b "Subject: [Fail2Ban] : banned from `uname -n` +actionban = ( printf %%b "Subject: [Fail2Ban] : banned from Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n diff --git a/config/action.d/sendmail-whois-matches.conf b/config/action.d/sendmail-whois-matches.conf index fc4ba061..01520135 100644 --- a/config/action.d/sendmail-whois-matches.conf +++ b/config/action.d/sendmail-whois-matches.conf @@ -19,7 +19,7 @@ norestored = 1 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` +actionban = printf %%b "Subject: [Fail2Ban] : banned from Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n diff --git a/config/action.d/sendmail-whois.conf b/config/action.d/sendmail-whois.conf index b8d99423..2fb01ed3 100644 --- a/config/action.d/sendmail-whois.conf +++ b/config/action.d/sendmail-whois.conf @@ -19,7 +19,7 @@ norestored = 1 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` +actionban = printf %%b "Subject: [Fail2Ban] : banned from Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n diff --git a/config/action.d/sendmail.conf b/config/action.d/sendmail.conf index 62c94439..cf420915 100644 --- a/config/action.d/sendmail.conf +++ b/config/action.d/sendmail.conf @@ -19,7 +19,7 @@ norestored = 1 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` +actionban = printf %%b "Subject: [Fail2Ban] : banned from Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n diff --git a/config/action.d/xarf-login-attack.conf b/config/action.d/xarf-login-attack.conf index 5274cdaf..9d441aa3 100644 --- a/config/action.d/xarf-login-attack.conf +++ b/config/action.d/xarf-login-attack.conf @@ -46,7 +46,7 @@ actionban = oifs=${IFS}; IFS=.;SEP_IP=( ); set -- ${SEP_IP}; ADDRESSES=$(di FROM= SERVICE= FAILURES= - REPORTID=