- Updated

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@121 a942ae1a-1317-0410-a47c-b1dcaea8d605
0.5
Cyril Jaquier 2005-07-07 16:55:50 +00:00
parent 3d79d9d1cb
commit e98f8c8182
2 changed files with 18 additions and 16 deletions

View File

@ -9,8 +9,11 @@ Fail2Ban (version 0.?.?) ??/??/2005
ver. 0.?.? (??/??/2005) - ??? ver. 0.?.? (??/??/2005) - ???
---------- ----------
- Remove interface option
- Added start and end commands in the configuration file.
Thanks to Yaroslav Halchenko
- Added firewall rules definition in the configuration file - Added firewall rules definition in the configuration file
- Cleaned a bit fail2ban.py - Cleaned fail2ban.py
- Added an initd script for RedHat/Fedora. Thanks to Andrey - Added an initd script for RedHat/Fedora. Thanks to Andrey
G. Grozin G. Grozin

29
README
View File

@ -4,14 +4,14 @@
|_| \__,_|_|_/___|_.__/\__,_|_||_| |_| \__,_|_|_/___|_.__/\__,_|_||_|
============================================================= =============================================================
Fail2Ban (version 0.4.1) 06/30/2005 Fail2Ban (version 0.?.?) ??/??/2005
============================================================= =============================================================
Fail2Ban scans log files like /var/log/pwdfail and bans IP Fail2Ban scans log files like /var/log/pwdfail and bans IP
that makes too many password failures. It updates firewall that makes too many password failures. It updates firewall
rules to reject the IP address. Currently iptables, ipfw and rules to reject the IP address. These rules can be defined by
ipfwadm are supported. Fail2Ban can read multiple log files the user. Fail2Ban can read multiple log files such as sshd
such as sshd or Apache web server ones. It needs log4py. or Apache web server ones. It needs log4py.
This is my first Python program. Moreover, English is not my This is my first Python program. Moreover, English is not my
mother tongue... mother tongue...
@ -36,18 +36,19 @@ tries to find lines which match the failregex. Then it
retrieves the message time using timeregex and timepattern. retrieves the message time using timeregex and timepattern.
It finally gets the ip and if it has already done 3 or more It finally gets the ip and if it has already done 3 or more
password failures in the last banTime, the ip is banned for password failures in the last banTime, the ip is banned for
banTime using a firewall rule. After banTime, the rule is banTime using a firewall rule. This rule is set by the user
deleted. Notice that if no "plain" ip is available, Fail2Ban in the configuration file. Thus, Fail2Ban can be adapted for
try to do DNS lookup in order to found one or several ip's to lots of firewall. After banTime, the rule is deleted. Notice
ban. that if no "plain" ip is available, Fail2Ban try to do DNS
lookup in order to found one or several ip's to ban.
Sections can be freely added so it is possible to monitor Sections can be freely added so it is possible to monitor
several daemons at the same time. several daemons at the same time.
Runs on my server and does its job rather well :-) The idea Runs on my server and does its job rather well :-) The idea
is to make fail2ban usable with daemons and services that is to make fail2ban usable with daemons and services that
require a login (sshd, telnetd, ...). It should also support require a login (sshd, telnetd, ...) and with different
others firewalls than iptables. firewalls.
Installation: Installation:
@ -65,7 +66,8 @@ To install, just do:
This will install Fail2Ban into /usr/lib/fail2ban. The This will install Fail2Ban into /usr/lib/fail2ban. The
fail2ban.py executable is placed into /usr/bin. fail2ban.py executable is placed into /usr/bin.
For Gentoo users, an ebuild is available on the website. Gentoo: an ebuild is available on the website.
Debian: a package is available on the website.
Fail2Ban should now be correctly installed. Just type: Fail2Ban should now be correctly installed. Just type:
@ -93,7 +95,6 @@ options:
-b start fail2ban in background -b start fail2ban in background
-d start fail2ban in debug mode -d start fail2ban in debug mode
-e <INTF> ban IP on the INTF interface
-c <FILE> read configuration file FILE -c <FILE> read configuration file FILE
-p <FILE> create PID lock in FILE -p <FILE> create PID lock in FILE
-h display this help message -h display this help message
@ -103,8 +104,6 @@ options:
-r <VALUE> allow a max of VALUE password failure -r <VALUE> allow a max of VALUE password failure
-t <TIME> ban IP for TIME seconds -t <TIME> ban IP for TIME seconds
-v verbose. Use twice for greater effect -v verbose. Use twice for greater effect
-w <FIWA> select the firewall to use. Can be iptables,
ipfwadm or ipfw
Contact: Contact:
-------- --------
@ -121,7 +120,7 @@ Thanks:
------- -------
Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker, Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
Tom Pike, Iain Lea, Andrey G. Grozin Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko
License: License:
-------- --------