mirror of https://github.com/fail2ban/fail2ban
Merge branch 'master' into 0.9
Conflicts:
ChangeLog
Spelling correction of 0.8.13 fixed in master
config/jail.conf
Added nagios and duplicate php-url removal in master
Just nagios added, duplicate not issue in 0.9
pull/616/head
Steven Hiscocks
commit
f68d85a6ac
11
ChangeLog
11
ChangeLog
|
|
@ -80,8 +80,8 @@ configuration before relying on it.
|
|||
* Add honeypot email address to exim-spam filter as argument
|
||||
|
||||
|
||||
ver. 0.8.13 (2014/XX/XXX) - maintaince-only-from-now-on
|
||||
----------
|
||||
ver. 0.8.13 (2014/XX/XXX) - maintenance-only-from-now-on
|
||||
-----------
|
||||
|
||||
- Fixes:
|
||||
- action firewallcmd-ipset had non-working actioncheck. Removed.
|
||||
|
|
@ -89,6 +89,7 @@ ver. 0.8.13 (2014/XX/XXX) - maintaince-only-from-now-on
|
|||
- filter pureftpd - added _daemon which got removed. Added
|
||||
|
||||
- New Features:
|
||||
- filter nagios - detects unauthorized access to the nrpe daemon (Ivo Truxa)
|
||||
|
||||
- Enhancements:
|
||||
- filter pureftpd - added all translations of "Authentication failed for
|
||||
|
|
@ -103,7 +104,7 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better
|
|||
- Rename firewall-cmd-direct-new to firewallcmd-new to fit within jail name
|
||||
name length. As per gh-395
|
||||
- mysqld-syslog-iptables jailname was too long. Renamed to mysqld-syslog.
|
||||
Part of gh-447.
|
||||
Part of gh-447.
|
||||
|
||||
- Fixes:
|
||||
- allow for ",milliseconds" in the custom date format of proftpd.log
|
||||
|
|
@ -120,7 +121,7 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better
|
|||
- Fix apache-common for apache-2.4 log file format. Thanks Mark White.
|
||||
Closes gh-516
|
||||
- Asynchat changed to use push method which verifys whether all data was
|
||||
send. This ensures that all data is sent before closing the connection.
|
||||
send. This ensures that all data is sent before closing the connection.
|
||||
- Removed unnecessary reference to as yet undeclared $jail_name when checking
|
||||
a specific jail in nagios script.
|
||||
- Filter dovecot reordered session and TLS items in regex with wider scope
|
||||
|
|
@ -967,7 +968,7 @@ ver. 0.5.4 (2005/09/13) - beta
|
|||
* Fixed errata in config/gentoo-confd
|
||||
* Introduced findtime configuration variable to control the lifetime of caught
|
||||
"failed" log entries
|
||||
|
||||
|
||||
ver. 0.5.3 (2005/09/08) - beta
|
||||
----------
|
||||
- Fixed a bug when overriding "maxfailures" or "bantime". Thanks to Yaroslav
|
||||
|
|
|
|||
|
|
@ -137,7 +137,7 @@ class Fail2banClient:
|
|||
|
||||
def __processCmd(self, cmd, showRet = True):
|
||||
beautifier = Beautifier()
|
||||
ret = True
|
||||
streamRet = True
|
||||
for c in cmd:
|
||||
beautifier.setInputCmd(c)
|
||||
try:
|
||||
|
|
@ -148,10 +148,10 @@ class Fail2banClient:
|
|||
if showRet:
|
||||
print beautifier.beautify(ret[1])
|
||||
else:
|
||||
ret = False
|
||||
logSys.error("NOK: " + `ret[1].args`)
|
||||
if showRet:
|
||||
print beautifier.beautifyError(ret[1])
|
||||
streamRet = False
|
||||
except socket.error:
|
||||
if showRet:
|
||||
logSys.error("Unable to contact server. Is it running?")
|
||||
|
|
@ -160,7 +160,7 @@ class Fail2banClient:
|
|||
if showRet:
|
||||
logSys.error(e)
|
||||
return False
|
||||
return ret
|
||||
return streamRet
|
||||
|
||||
##
|
||||
# Process a command line.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,17 @@
|
|||
# Fail2Ban filter for Nagios Remote Plugin Executor (nrpe2)
|
||||
# Detecting unauthorized access to the nrpe2 daemon
|
||||
# typically logged in /var/log/messages syslog
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
# Read syslog common prefixes
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
_daemon = nrpe
|
||||
failregex = ^%(__prefix_line)sHost <HOST> is not allowed to talk to us!\s*$
|
||||
ignoreregex =
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# Author: Ivo Truxa - 2014/02/03
|
||||
|
|
@ -614,7 +614,6 @@ logpath = /var/log/mail.log
|
|||
port = smtp,465,submission
|
||||
logpath = /var/log/exim/mainlog
|
||||
|
||||
|
||||
[exim-spam]
|
||||
port = smtp,465,submission
|
||||
logpath = /var/log/exim/mainlog
|
||||
|
|
@ -827,3 +826,11 @@ tcpport = 27030,27031,27032,27033,27034,27035,27036,27037,27038,27039
|
|||
udpport = 1200,27000,27001,27002,27003,27004,27005,27006,27007,27008,27009,27010,27011,27012,27013,27014,27015
|
||||
action = %(banaction)s[name=%(__name__)s-tcp, port="%(tcpport)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
|
||||
%(banaction)s[name=%(__name__)s-udp, port="%(udpport)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
|
||||
|
||||
# consider low maxretry and a long bantime
|
||||
# nobody except your own Nagios server should ever probe nrpe
|
||||
[nagios]
|
||||
|
||||
enabled = false
|
||||
logpath = /var/log/messages ; nrpe.cfg may define a different log_facility
|
||||
maxretry = 1
|
||||
|
|
|
|||
|
|
@ -208,4 +208,8 @@ class ProcessPyinotify(pyinotify.ProcessEvent):
|
|||
|
||||
# just need default, since using mask on watch to limit events
|
||||
def process_default(self, event):
|
||||
self.__FileFilter.callback(event, origin='Default ')
|
||||
try:
|
||||
self.__FileFilter.callback(event, origin='Default ')
|
||||
except Exception as e:
|
||||
logSys.error("Error in FilterPyinotify callback: %s",
|
||||
e, exc_info=logSys.getEffectiveLevel() <= logging.DEBUG)
|
||||
|
|
|
|||
|
|
@ -0,0 +1,4 @@
|
|||
# Access of unauthorized host in /var/log/messages
|
||||
# failJSON: { "time": "2005-02-03T11:22:44", "match": true , "host": "50.97.225.132" }
|
||||
Feb 3 11:22:44 valhalla nrpe[63284]: Host 50.97.225.132 is not allowed to talk to us!
|
||||
|
||||
Loading…
Reference in New Issue