diff --git a/ChangeLog b/ChangeLog index a696a24f..cdbc7038 100644 --- a/ChangeLog +++ b/ChangeLog @@ -41,23 +41,27 @@ code-review and minor additions from Yaroslav Halchenko. * [..e019ab7] Multiple instances of the same action are allowed in the same jail -- use actname option to disambiguate. -ver. 0.8.9 (2013/04/XXX) - wanna-be-stable +ver. 0.8.9 (2013/05/XX) - wanna-be-stable ---------- -Although primarily a bugfix release, it incorporates many new -enhancements, few new features, but more importantly -- quite extended -tests battery with current 94% coverage. This release incorporates -more than a 100 of non-merge commits from 14 contributors (sorted by -number of commits): Yaroslav Halchenko, Daniel Black, Steven Hiscocks, -ArndRa, hamilton5, pigsyn, Erwan Ben Souiden, Michael Gebetsroither, -Orion Poplawski, Artur Penttinen, sebres, Nicolas Collignon, Pascal -Borreli, blotus: +Originally targeted as a bugfix release, it incorporated many new +enhancements, few new features, and more importantly -- quite extended +tests battery with current 94% coverage. -- Fixes: - Yaroslav Halchenko - * [6f4dad46] Documentation python-2.4 is the minimium version. - * [1eb23cf8] do not rely on scripts being under /usr -- might differ eg on - Fedora. Closes gh-112. Thanks to Camusensei for the bug report. +This release introduces over 200 of non-merge commits from 16 +contributors (sorted by number of commits): Yaroslav Halchenko, Daniel +Black, Steven Hiscocks, James Stout, Orion Poplawski, Enrico Labedzki, +ArndRa, hamilton5, pigsyn, Erwan Ben Souiden, Michael Gebetsroither, +Artur Penttinen, blotus, sebres, Nicolas Collignon, Pascal Borreli. + +Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom +Hendrikx, Yehuda Katz and other TBN heroes supporting users on +fail2ban-users mailing list and IRC. + +- Fixes: Yaroslav Halchenko + * [6f4dad46] python-2.4 is the minimal version. + * [1eb23cf8] do not rely on scripts being under /usr -- might differ e.g. + on Fedora. Closes gh-112. Thanks to Camusensei for the bug report. * [bf4d4af1] Changes for atomic writes. Thanks to Steven Hiscocks for insight. Closes gh-103. * [ab044b75] delay check for the existence of config directory until read. @@ -84,6 +88,8 @@ Borreli, blotus: gh-70. Thanks to iGeorgeX for the idea. blotus * [96eb8986] ' and " should also be escaped in action tags Closes gh-109 + Christoph Theis, Nick Hilliard, Daniel Black + * [b3bd877d,cde71080] Make syslog -v and syslog -vv formats work on FreeBSD - New features: Yaroslav Halchenko * [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile} @@ -103,9 +109,18 @@ Borreli, blotus: * [5f2d383] Add roundcube auth filter. Closes Debian bug #699442. Daniel Black * [be06b1b] Add action for iptables-ipsets. Closes gh-102. + Nick Munger, Ken Menzel, Daniel Black, Christoph Theis & Fabian Wenk + * [b6d0e8a] Add and enhance the bsd-ipfw action from + FreeBSD ports. Soulard Morgan * [f336d9f] Add filter for webmin. Closes gh-99. + Steven Hiscocks + * [..746c7d9] bash interactive shell completions for fail2ban-*'s + Nick Hilliard + * [0c5a9c5] Add pf action. - Enhancements: + Enrico Labedzki + * [24a8d07] Added new date format for ASSP SMTP Proxy. Steven Hiscocks * [3d6791f] Ensure restart of Actions after a check fails occurs consistently. Closes gh-172. @@ -128,19 +143,23 @@ Borreli, blotus: * [7cd6dab] Added help command to fail2ban-client. * [c8c7b0b,23bbc60] Better logging of log file read errors. * [3665e6d] Added code coverage to development process. - * [41b9f7b,32d10e9] More complete ssh filter rules to match openssh source. + * [41b9f7b,32d10e9,39750b8] More complete ssh filter rules to match openssh + source. Also include BSD changes. * [1d9abd1] Action files can have tags in definition that refer to other tags. + * [10886e7,cec5da2,adb991a] Change actions to response with ICMP port + unreachable rather than just a drop of the packet. Pascal Borreli * [a2b29b4] Fixed lots of typos in config files and documentation. hamilton5 * [7ede1e8] Update dovecot filter config. Romain Riviere * [0ac8746] Enhance named-refused filter for views. - -Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom -Hendrikx and other TBN heroes supporting users on fail2ban-users -mailing list and IRC. + James Stout + * [..2143cdf] Solaris support enhancements: + - README.Solaris + - failregex'es tune ups (sshd.conf) + - hostsdeny: do not rely on support of '-i' in sed ver. 0.8.8 (2012/12/06) - stable ---------- diff --git a/DEVELOP b/DEVELOP index cfbc5ac7..809e4c09 100644 --- a/DEVELOP +++ b/DEVELOP @@ -269,6 +269,7 @@ Releasing * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/ * https://build.opensuse.org/package/show?package=fail2ban&project=openSUSE%3AFactory * http://sophie.zarb.org/sources/fail2ban (Mageia) + * https://trac.macports.org/browser/trunk/dports/security/fail2ban # Check distribution outstanding bugs @@ -291,6 +292,8 @@ Releasing http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/metadata.xml?view=markup * openSUSE: Stephan Kulow https://build.opensuse.org/package/users?package=fail2ban&project=openSUSE%3AFactory + * Mac Ports: @Malbrouck on github (gh-49) + https://trac.macports.org/browser/trunk/dports/security/fail2ban/Portfile # Wait for feedback from distributors diff --git a/MANIFEST b/MANIFEST index cf8e1892..a73cb0c0 100644 --- a/MANIFEST +++ b/MANIFEST @@ -58,6 +58,9 @@ fail2ban/tests/files/testcase02.log fail2ban/tests/files/testcase03.log fail2ban/tests/files/testcase04.log fail2ban/tests/files/testcase-usedns.log +fail2ban/tests/files/logs/bsd/syslog-plain.txt +fail2ban/tests/files/logs/bsd/syslog-v.txt +fail2ban/tests/files/logs/bsd/syslog-vv.txt setup.py setup.cfg fail2ban/__init__.py @@ -99,7 +102,9 @@ config/filter.d/dropbear.conf config/filter.d/lighttpd-auth.conf config/filter.d/recidive.conf config/filter.d/roundcube-auth.conf +config/action.d/bsd-ipfw.conf config/action.d/dummy.conf +config/action.d/iptables-blocktype.conf config/action.d/iptables-ipset-proto4.conf config/action.d/iptables-ipset-proto6.conf config/action.d/iptables-xt_recent-echo.conf @@ -119,6 +124,7 @@ config/action.d/mail-buffered.conf config/action.d/mail-whois.conf config/action.d/mail-whois-lines.conf config/action.d/mynetwatchman.conf +config/action.d/pf.conf config/action.d/sendmail.conf config/action.d/sendmail-buffered.conf config/action.d/sendmail-whois.conf @@ -141,8 +147,10 @@ files/macosx-initd files/solaris-fail2ban.xml files/solaris-svc-fail2ban files/suse-initd +files/fail2ban-logrotate files/cacti/fail2ban_stats.sh files/cacti/cacti_host_template_fail2ban.xml files/cacti/README files/nagios/check_fail2ban files/nagios/f2ban.txt +files/bash-completion diff --git a/README.Solaris b/README.Solaris new file mode 100644 index 00000000..49056062 --- /dev/null +++ b/README.Solaris @@ -0,0 +1,141 @@ +# vim:tw=80:ft=txt + +README FOR SOLARIS INSTALLATIONS + +By Roy Sigurd Karlsbakk + +ABOUT + +This readme is meant for those wanting to install fail2ban on Solaris 10, +OpenSolaris, OpenIndiana etc. To some degree it may as well be useful for +users of older Solaris versions and Nexenta, but don't rely on it. + +READ ME FIRST + +If I use the term Solaris, I am talking about any Solaris dialect, that is, the +official Sun/Oracle ones or derivates. If I describe an OS as +"OpenSolaris-based", it means it's either OpenSolaris, OpenIndiana or one of the +other, but /not/ the Nexenta family, since this only uses the OpenSolaris/ +IllumOS kernel and not the userland. If I say Solaris 10, I mean Solaris 10 and +perhaps, if you're lucky and have some good gods on your side, it may also apply +to Solaris 9 or even 8 and hopefully in the new Solaris 11 whenever that may be +released. Quoted lines of code, settings et cetera are indented with two spaces. +This does _not_ mean you should use that indentation, especially in config files +where they can be harmful. Optional settings are prefixed with OPT: while +required settings are prefixed with REQ:. If no prefix is found, regard it as a +required setting. + +INSTALLATION ON SOLARIS + +The installation is straight forward on Solaris as well as on linux/bsd/etc. +./setup.py install installs the general packages in /usr/bin on OpenSolaris- +based distros or (at least on this box) under /usr/sfw/bin on Solaris 10. In +the files/ directory you will find the file solaris-fail2ban.xml containing the +Solaris service. To install this, run the following command as root (or with +sudo): + + svccfg import files/solaris-fail2ban.xml + +This should normally without giving an error. If you get an error, deal with it, +and please post any relevant info (or fixes?) to the fail2ban mailing list. +Next install the service handler - copy the script in and allow it to be executed: + + cp files/solaris-svc-fail2ban /lib/svc/method/svc-fail2ban + chmod +x /lib/svc/method/svc-fail2ban + +CONFIGURE SYSLOG + +For some reason, a default Solaris installation does not log ssh login attempts, +and since fail2ban works by monitoring logs, enabling this logging is rather +important for it to work. To enable this, edit /etc/syslog.conf and add a line +at the end: + + auth.info /var/adm/auth.log + +Save the file and exit, and run + + touch /var/adm/auth.log + +The Solaris system logger will _not_ create a non-existing file. Now, restart +the system logger. + + svcadm restart system-log + +Try to ssh into localhost with ssh asdf@localhost and enter an invalid password. +Make sure this is logged in the above file. When done, you may configure +fail2ban. + +FAIL2BAN CONFIGURATION + +OPT: Create /etc/fail2ban/fail2ban.local containing: + +# Fail2Ban main configuration file +# +# Comments: use '#' for comment lines and ';' for inline comments +# +# Changes: in most of the cases you should not modify this +# file, but provide customizations in fail2ban.local file, e.g.: +# +# [Definition] +# loglevel = 4 +# +[Definition] + +# Option: logtarget +# Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT. +# Only one log target can be specified. +# If you change logtarget from the default value and you are +# using logrotate -- also adjust or disable rotation in the +# corresponding configuration file +# (e.g. /etc/logrotate.d/fail2ban on Debian systems) +# Values: STDOUT STDERR SYSLOG file Default: /var/log/fail2ban.log +# +logtarget = /var/adm/fail2ban.log + + +REQ: Create /etc/fail2ban/jail.local containing: + +[ssh-tcpwrapper] + +enabled = true +filter = sshd +action = hostsdeny + sendmail-whois[name=SSH, dest=you@example.com] +ignoreregex = for myuser from +logpath = /var/adm/auth.log + +Set the sendmail dest address to something useful or drop the line to stop it spamming you. +Set 'myuser' to your username to avoid banning yourself or drop it. + +START (OR RESTART) FAIL2BAN + +Enable the fail2ban service with + + svcadm enable fail2ban + +When done, check that all services are running well + + svcs -xv + +GOTCHAS AND FIXMES + +* It seems the installation may be starting fail2ban automatically. If this is + done, fail2ban will not start, but no errors will be returned from svcs + (above). Check if it's running with 'ps -ef | grep fail2ban' and manually kill + the PID if it is. Re-enable fail2ban and try again + + svcadm disable fail2ban + svcadm enable fail2ban + +* If svcs -xv says that fail2ban failed to start or svcs says it's in maintenance mode + chcek /var/svc/log/network-fail2ban:default.log for clues. + Check permissions on /var/adm, /var/adm/auth.log /var/adm/fail2ban.log and /var/run/fail2ban + You may need to: + + sudo mkdir /var/run/fail2ban + +* Fail2ban adds lines like these to /etc/hosts.deny: + + ALL: 1.2.3.4 + + wouldn't it be better to just block sshd? diff --git a/THANKS b/THANKS index f207d71e..9545d43a 100644 --- a/THANKS +++ b/THANKS @@ -16,6 +16,7 @@ Daniel B. Cid Daniel Black David Nutter Eric Gerbier +Enrico Labedzki Guillaume Delvit Hanno 'Rince' Wagner Iain Lea diff --git a/TODO b/TODO index 61bdc093..33263d3e 100644 --- a/TODO +++ b/TODO @@ -13,6 +13,8 @@ Legend: # partially done * done +- more detailed explaination in DEVELOP for new developers (eg. howto build this HEX numbers in ChangeLog) + - Run tests though all filters/examples files - (see sshd example file) as unit test diff --git a/config/action.d/bsd-ipfw.conf b/config/action.d/bsd-ipfw.conf new file mode 100644 index 00000000..33f176e4 --- /dev/null +++ b/config/action.d/bsd-ipfw.conf @@ -0,0 +1,82 @@ +# Fail2Ban configuration file +# +# Author: Nick Munger +# Modified by: Ken Menzel +# Daniel Black (start/stop) +# Fabian Wenk (many ideas as per fail2ban users list) +# +# Ensure firewall_enable="YES" in the top of /etc/rc.conf +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = ipfw show | fgrep -q 'table()' || ( ipfw show | awk 'BEGIN { b = 1 } { if ($1 <= b) { b = $1 + 1 } else { e = b } } END { if (e) exit e
else exit b }'; num=$?; ipfw -q add $num deny from table\(
\) to me ; echo $num > "" ) + + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = [ -f ] && ( read num < ""
ipfw -q delete $num
rm "" ) + + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +# requires an ipfw rule like "deny ip from table(1) to me" +actionban = ipfw table
add + + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = ipfw table
delete + +[Init] +# Option: table +# Notes: The ipfw table to use. If a ipfw rule using this table already exists, +# this action will not create a ipfw rule to block it and the following +# options will have no effect. +# Values: NUM +table = 1 + +# Option: port +# Notes.: Specifies port to monitor. Blank indicate block all ports. +# Values: [ NUM | STRING ] +# +port = + +# Option: startstatefile +# Notes: A file to indicate that the table rule that was added. Ensure it is unique per table. +# Values: STRING +startstatefile = /var/run/fail2ban/ipfw-started-table_
+ +# Option: action +# Notes: This is the action to take for automaticly created rules. See the +# ACTION defination at the top of man ipfw for allowed values. +# "deny" and "unreach port" are probably the useful. +# Values: STRING +action = deny + +# Option: block +# Notes: This is how much to block. +# Can be "ip", "tcp", "udp" or various other options. +# Values: STRING +block = ip diff --git a/config/action.d/dshield.conf b/config/action.d/dshield.conf index 151db28f..ca68e638 100644 --- a/config/action.d/dshield.conf +++ b/config/action.d/dshield.conf @@ -25,7 +25,6 @@ # configured at DShield), and // (to # configure how often the buffer is flushed). # -# $Revision$ [Definition] diff --git a/config/action.d/dummy.conf b/config/action.d/dummy.conf index ea59881a..20507c0b 100644 --- a/config/action.d/dummy.conf +++ b/config/action.d/dummy.conf @@ -2,7 +2,6 @@ # # Author: Cyril Jaquier # -# $Revision$ # [Definition] diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf index b04f2adb..50a4545c 100644 --- a/config/action.d/hostsdeny.conf +++ b/config/action.d/hostsdeny.conf @@ -2,7 +2,6 @@ # # Author: Cyril Jaquier # -# $Revision$ # [Definition] @@ -40,7 +39,7 @@ actionban = IP= && # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = IP= && sed -i.old /ALL:\ $IP/d +actionunban = IP= && sed /ALL:\ $IP/d > .new && mv .new [Init] diff --git a/config/action.d/ipfilter.conf b/config/action.d/ipfilter.conf index d77de9bf..61420e38 100644 --- a/config/action.d/ipfilter.conf +++ b/config/action.d/ipfilter.conf @@ -37,7 +37,7 @@ actioncheck = # Tags: See jail.conf(5) man page # Values: CMD # -actionban = echo block in quick from /32 | /sbin/ipf -f - +actionban = echo block in quick from /32 | /sbin/ipf -f - # Option: actionunban @@ -47,7 +47,12 @@ actionban = echo block in quick from /32 | /sbin/ipf -f - # Values: CMD # # note -r option used to remove matching rule -actionunban = echo block in quick from /32 | /sbin/ipf -r -f - +actionunban = echo block in quick from /32 | /sbin/ipf -r -f - [Init] +# Option: Blocktype +# Notes : This is the return-icmp[return-code] mentioned in the ipf man page section 5. Keep this quoted to prevent +# Shell expansion. This should be blank (unquoted) to drop the packet. +# Values: STRING +blocktype = "return-icmp(port-unr)" diff --git a/config/action.d/ipfw.conf b/config/action.d/ipfw.conf index 62612307..09045815 100644 --- a/config/action.d/ipfw.conf +++ b/config/action.d/ipfw.conf @@ -3,7 +3,6 @@ # Author: Nick Munger # Modified by: Cyril Jaquier # -# $Revision$ # [Definition] @@ -35,7 +34,7 @@ actioncheck = # Tags: See jail.conf(5) man page # Values: CMD # -actionban = ipfw add deny tcp from to +actionban = ipfw add tcp from to # Option: actionunban @@ -59,3 +58,11 @@ port = ssh # Values: IP # localhost = 127.0.0.1 + + +# Option: blocktype +# Notes.: How to block the traffic. Use a action from man 5 ipfw +# Common values: deny, unreach port, reset +# Values: STRING +# +blocktype = unreach port diff --git a/config/action.d/iptables-allports.conf b/config/action.d/iptables-allports.conf index a02ba63d..91d40711 100644 --- a/config/action.d/iptables-allports.conf +++ b/config/action.d/iptables-allports.conf @@ -4,9 +4,13 @@ # Modified: Yaroslav O. Halchenko # made active on all ports from original iptables.conf # -# $Revision$ # +[INCLUDES] + +before = iptables-blocktype.conf + + [Definition] # Option: actionstart @@ -37,7 +41,7 @@ actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Tags: See jail.conf(5) man page # Values: CMD # -actionban = iptables -I fail2ban- 1 -s -j DROP +actionban = iptables -I fail2ban- 1 -s -j # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -45,7 +49,7 @@ actionban = iptables -I fail2ban- 1 -s -j DROP # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = iptables -D fail2ban- -s -j DROP +actionunban = iptables -D fail2ban- -s -j [Init] diff --git a/config/action.d/iptables-blocktype.conf b/config/action.d/iptables-blocktype.conf new file mode 100644 index 00000000..c505e49c --- /dev/null +++ b/config/action.d/iptables-blocktype.conf @@ -0,0 +1,22 @@ +# Fail2Ban configuration file +# +# Author: Daniel Black +# +# This is a included configuration file and includes the defination for the blocktype +# used in all iptables based actions by default. +# +# The user can override the default in iptables-blocktype.local + +[INCLUDES] + +after = iptables-blocktype.local + +[Init] + +# Option: blocktype +# Note: This is what the action does with rules. This can be any jump target +# as per the iptables man page (section 8). Common values are DROP +# REJECT, REJECT --reject-with icmp-port-unreachable +# Values: STRING +blocktype = REJECT --reject-with icmp-port-unreachable + diff --git a/config/action.d/iptables-ipset-proto4.conf b/config/action.d/iptables-ipset-proto4.conf index 4221dd8d..3ed778f9 100644 --- a/config/action.d/iptables-ipset-proto4.conf +++ b/config/action.d/iptables-ipset-proto4.conf @@ -18,6 +18,10 @@ # apt-get install ipset xtables-addons-source # module-assistant auto-install xtables-addons +[INCLUDES] + +before = iptables-blocktype.conf + [Definition] # Option: actionstart @@ -25,13 +29,13 @@ # Values: CMD # actionstart = ipset --create fail2ban- iphash - iptables -I INPUT -p -m multiport --dports -m set --match-set fail2ban- src -j DROP + iptables -I INPUT -p -m multiport --dports -m set --match-set fail2ban- src -j # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = iptables -D INPUT -p -m multiport --dports -m set --match-set fail2ban- src -j DROP +actionstop = iptables -D INPUT -p -m multiport --dports -m set --match-set fail2ban- src -j ipset --flush fail2ban- ipset --destroy fail2ban- @@ -68,4 +72,3 @@ port = ssh # Values: [ tcp | udp | icmp | all ] Default: tcp # protocol = tcp - diff --git a/config/action.d/iptables-ipset-proto6.conf b/config/action.d/iptables-ipset-proto6.conf index d90acd44..3cf9b140 100644 --- a/config/action.d/iptables-ipset-proto6.conf +++ b/config/action.d/iptables-ipset-proto6.conf @@ -18,6 +18,11 @@ # apt-get install ipset xtables-addons-source # module-assistant auto-install xtables-addons +[INCLUDES] + +before = iptables-blocktype.conf + + [Definition] # Option: actionstart @@ -74,5 +79,3 @@ protocol = tcp # Values: [ NUM ] Default: 600 bantime = 600 - - diff --git a/config/action.d/iptables-multiport-log.conf b/config/action.d/iptables-multiport-log.conf index 49958013..6084cb6c 100644 --- a/config/action.d/iptables-multiport-log.conf +++ b/config/action.d/iptables-multiport-log.conf @@ -7,9 +7,12 @@ # make "fail2ban--log" chain to log and drop # insert a jump to fail2ban- from -I if proto/port match # -# $Revision$ # +[INCLUDES] + +before = iptables-blocktype.conf + [Definition] # Option: actionstart @@ -21,7 +24,7 @@ actionstart = iptables -N fail2ban- iptables -I 1 -p -m multiport --dports -j fail2ban- iptables -N fail2ban--log iptables -I fail2ban--log -j LOG --log-prefix "$(expr fail2ban- : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2 - iptables -A fail2ban--log -j DROP + iptables -A fail2ban--log -j # Option: actionstop # Notes.: command executed once at the end of Fail2Ban diff --git a/config/action.d/iptables-multiport.conf b/config/action.d/iptables-multiport.conf index ab0ee8de..daa31148 100644 --- a/config/action.d/iptables-multiport.conf +++ b/config/action.d/iptables-multiport.conf @@ -2,9 +2,12 @@ # # Author: Cyril Jaquier # Modified by Yaroslav Halchenko for multiport banning -# $Revision$ # +[INCLUDES] + +before = iptables-blocktype.conf + [Definition] # Option: actionstart @@ -35,7 +38,7 @@ actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Tags: See jail.conf(5) man page # Values: CMD # -actionban = iptables -I fail2ban- 1 -s -j DROP +actionban = iptables -I fail2ban- 1 -s -j # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -43,7 +46,7 @@ actionban = iptables -I fail2ban- 1 -s -j DROP # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = iptables -D fail2ban- -s -j DROP +actionunban = iptables -D fail2ban- -s -j [Init] diff --git a/config/action.d/iptables-new.conf b/config/action.d/iptables-new.conf index 12f398c7..38927442 100644 --- a/config/action.d/iptables-new.conf +++ b/config/action.d/iptables-new.conf @@ -4,9 +4,13 @@ # Copied from iptables.conf and modified by Yaroslav Halchenko # to fullfill the needs of bugreporter dbts#350746. # -# $Revision$ # +[INCLUDES] + +before = iptables-blocktype.conf + + [Definition] # Option: actionstart @@ -37,7 +41,7 @@ actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Tags: See jail.conf(5) man page # Values: CMD # -actionban = iptables -I fail2ban- 1 -s -j DROP +actionban = iptables -I fail2ban- 1 -s -j # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -45,7 +49,7 @@ actionban = iptables -I fail2ban- 1 -s -j DROP # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = iptables -D fail2ban- -s -j DROP +actionunban = iptables -D fail2ban- -s -j [Init] diff --git a/config/action.d/iptables-xt_recent-echo.conf b/config/action.d/iptables-xt_recent-echo.conf index 887311be..829d4c06 100644 --- a/config/action.d/iptables-xt_recent-echo.conf +++ b/config/action.d/iptables-xt_recent-echo.conf @@ -2,9 +2,13 @@ # # Author: Zbigniew Jędrzejewski-Szmek # -# $Revision: 1 $ # +[INCLUDES] + +before = iptables-blocktype.conf + + [Definition] # Option: actionstart @@ -29,7 +33,7 @@ # own rules. The 3600 second timeout is independent and acts as a # safeguard in case the fail2ban process dies unexpectedly. The # shorter of the two timeouts actually matters. -actionstart = iptables -I INPUT -m recent --update --seconds 3600 --name fail2ban- -j DROP +actionstart = iptables -I INPUT -m recent --update --seconds 3600 --name fail2ban- -j # Option: actionstop # Notes.: command executed once at the end of Fail2Ban diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf index a3412f6b..370e4731 100644 --- a/config/action.d/iptables.conf +++ b/config/action.d/iptables.conf @@ -2,9 +2,12 @@ # # Author: Cyril Jaquier # -# $Revision$ # +[INCLUDES] + +before = iptables-blocktype.conf + [Definition] # Option: actionstart @@ -35,7 +38,7 @@ actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Tags: See jail.conf(5) man page # Values: CMD # -actionban = iptables -I fail2ban- 1 -s -j DROP +actionban = iptables -I fail2ban- 1 -s -j # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -43,7 +46,7 @@ actionban = iptables -I fail2ban- 1 -s -j DROP # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = iptables -D fail2ban- -s -j DROP +actionunban = iptables -D fail2ban- -s -j [Init] diff --git a/config/action.d/mail-buffered.conf b/config/action.d/mail-buffered.conf index 94a60e3b..7ff17cf2 100644 --- a/config/action.d/mail-buffered.conf +++ b/config/action.d/mail-buffered.conf @@ -2,7 +2,6 @@ # # Author: Cyril Jaquier # -# $Revision$ # [Definition] diff --git a/config/action.d/mail-whois-lines.conf b/config/action.d/mail-whois-lines.conf index 2120432e..d30e266d 100644 --- a/config/action.d/mail-whois-lines.conf +++ b/config/action.d/mail-whois-lines.conf @@ -2,7 +2,6 @@ # # Author: Cyril Jaquier # Modified-By: Yaroslav Halchenko to include grepping on IP over log files -# $Revision$ # [Definition] diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf index 3293c7a2..f58ae535 100644 --- a/config/action.d/mail-whois.conf +++ b/config/action.d/mail-whois.conf @@ -2,7 +2,6 @@ # # Author: Cyril Jaquier # -# $Revision$ # [Definition] diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf index f9942e10..f9a54979 100644 --- a/config/action.d/mail.conf +++ b/config/action.d/mail.conf @@ -2,7 +2,6 @@ # # Author: Cyril Jaquier # -# $Revision$ # [Definition] diff --git a/config/action.d/mynetwatchman.conf b/config/action.d/mynetwatchman.conf index 06f16db6..5245a4e3 100644 --- a/config/action.d/mynetwatchman.conf +++ b/config/action.d/mynetwatchman.conf @@ -24,7 +24,6 @@ # Another useful configuration value is , if you don't have wget # installed (an example config for curl is given below) # -# $Revision$ [Definition] diff --git a/config/action.d/pf.conf b/config/action.d/pf.conf new file mode 100644 index 00000000..d82cbb12 --- /dev/null +++ b/config/action.d/pf.conf @@ -0,0 +1,62 @@ +# Fail2Ban configuration file +# +# OpenBSD pf ban/unban +# +# Author: Nick Hilliard +# +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +# we don't enable PF automatically, as it will be enabled elsewhere +actionstart = + + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +# we don't disable PF automatically either +actionstop = + + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: IP address +# number of failures +#