mirror of https://github.com/fail2ban/fail2ban
- Updated
git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@121 a942ae1a-1317-0410-a47c-b1dcaea8d6050.5
parent
3d79d9d1cb
commit
e98f8c8182
|
@ -9,8 +9,11 @@ Fail2Ban (version 0.?.?) ??/??/2005
|
||||||
|
|
||||||
ver. 0.?.? (??/??/2005) - ???
|
ver. 0.?.? (??/??/2005) - ???
|
||||||
----------
|
----------
|
||||||
|
- Remove interface option
|
||||||
|
- Added start and end commands in the configuration file.
|
||||||
|
Thanks to Yaroslav Halchenko
|
||||||
- Added firewall rules definition in the configuration file
|
- Added firewall rules definition in the configuration file
|
||||||
- Cleaned a bit fail2ban.py
|
- Cleaned fail2ban.py
|
||||||
- Added an initd script for RedHat/Fedora. Thanks to Andrey
|
- Added an initd script for RedHat/Fedora. Thanks to Andrey
|
||||||
G. Grozin
|
G. Grozin
|
||||||
|
|
||||||
|
|
29
README
29
README
|
@ -4,14 +4,14 @@
|
||||||
|_| \__,_|_|_/___|_.__/\__,_|_||_|
|
|_| \__,_|_|_/___|_.__/\__,_|_||_|
|
||||||
|
|
||||||
=============================================================
|
=============================================================
|
||||||
Fail2Ban (version 0.4.1) 06/30/2005
|
Fail2Ban (version 0.?.?) ??/??/2005
|
||||||
=============================================================
|
=============================================================
|
||||||
|
|
||||||
Fail2Ban scans log files like /var/log/pwdfail and bans IP
|
Fail2Ban scans log files like /var/log/pwdfail and bans IP
|
||||||
that makes too many password failures. It updates firewall
|
that makes too many password failures. It updates firewall
|
||||||
rules to reject the IP address. Currently iptables, ipfw and
|
rules to reject the IP address. These rules can be defined by
|
||||||
ipfwadm are supported. Fail2Ban can read multiple log files
|
the user. Fail2Ban can read multiple log files such as sshd
|
||||||
such as sshd or Apache web server ones. It needs log4py.
|
or Apache web server ones. It needs log4py.
|
||||||
|
|
||||||
This is my first Python program. Moreover, English is not my
|
This is my first Python program. Moreover, English is not my
|
||||||
mother tongue...
|
mother tongue...
|
||||||
|
@ -36,18 +36,19 @@ tries to find lines which match the failregex. Then it
|
||||||
retrieves the message time using timeregex and timepattern.
|
retrieves the message time using timeregex and timepattern.
|
||||||
It finally gets the ip and if it has already done 3 or more
|
It finally gets the ip and if it has already done 3 or more
|
||||||
password failures in the last banTime, the ip is banned for
|
password failures in the last banTime, the ip is banned for
|
||||||
banTime using a firewall rule. After banTime, the rule is
|
banTime using a firewall rule. This rule is set by the user
|
||||||
deleted. Notice that if no "plain" ip is available, Fail2Ban
|
in the configuration file. Thus, Fail2Ban can be adapted for
|
||||||
try to do DNS lookup in order to found one or several ip's to
|
lots of firewall. After banTime, the rule is deleted. Notice
|
||||||
ban.
|
that if no "plain" ip is available, Fail2Ban try to do DNS
|
||||||
|
lookup in order to found one or several ip's to ban.
|
||||||
|
|
||||||
Sections can be freely added so it is possible to monitor
|
Sections can be freely added so it is possible to monitor
|
||||||
several daemons at the same time.
|
several daemons at the same time.
|
||||||
|
|
||||||
Runs on my server and does its job rather well :-) The idea
|
Runs on my server and does its job rather well :-) The idea
|
||||||
is to make fail2ban usable with daemons and services that
|
is to make fail2ban usable with daemons and services that
|
||||||
require a login (sshd, telnetd, ...). It should also support
|
require a login (sshd, telnetd, ...) and with different
|
||||||
others firewalls than iptables.
|
firewalls.
|
||||||
|
|
||||||
|
|
||||||
Installation:
|
Installation:
|
||||||
|
@ -65,7 +66,8 @@ To install, just do:
|
||||||
This will install Fail2Ban into /usr/lib/fail2ban. The
|
This will install Fail2Ban into /usr/lib/fail2ban. The
|
||||||
fail2ban.py executable is placed into /usr/bin.
|
fail2ban.py executable is placed into /usr/bin.
|
||||||
|
|
||||||
For Gentoo users, an ebuild is available on the website.
|
Gentoo: an ebuild is available on the website.
|
||||||
|
Debian: a package is available on the website.
|
||||||
|
|
||||||
Fail2Ban should now be correctly installed. Just type:
|
Fail2Ban should now be correctly installed. Just type:
|
||||||
|
|
||||||
|
@ -93,7 +95,6 @@ options:
|
||||||
|
|
||||||
-b start fail2ban in background
|
-b start fail2ban in background
|
||||||
-d start fail2ban in debug mode
|
-d start fail2ban in debug mode
|
||||||
-e <INTF> ban IP on the INTF interface
|
|
||||||
-c <FILE> read configuration file FILE
|
-c <FILE> read configuration file FILE
|
||||||
-p <FILE> create PID lock in FILE
|
-p <FILE> create PID lock in FILE
|
||||||
-h display this help message
|
-h display this help message
|
||||||
|
@ -103,8 +104,6 @@ options:
|
||||||
-r <VALUE> allow a max of VALUE password failure
|
-r <VALUE> allow a max of VALUE password failure
|
||||||
-t <TIME> ban IP for TIME seconds
|
-t <TIME> ban IP for TIME seconds
|
||||||
-v verbose. Use twice for greater effect
|
-v verbose. Use twice for greater effect
|
||||||
-w <FIWA> select the firewall to use. Can be iptables,
|
|
||||||
ipfwadm or ipfw
|
|
||||||
|
|
||||||
Contact:
|
Contact:
|
||||||
--------
|
--------
|
||||||
|
@ -121,7 +120,7 @@ Thanks:
|
||||||
-------
|
-------
|
||||||
|
|
||||||
Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
|
Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
|
||||||
Tom Pike, Iain Lea, Andrey G. Grozin
|
Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko
|
||||||
|
|
||||||
License:
|
License:
|
||||||
--------
|
--------
|
||||||
|
|
Loading…
Reference in New Issue