* master:
ENH: "is None" instead of "== None" + tune ups in headers
BF: log error only if there were missed config files that couldn't be read
DOC: missing cinfo tags are ok. Log error for self referencing definitions
DOC: s/defination/definition/g learn to spell
Changelog entry for the previous commit and some untabify
BF: pyinotify backend should also handle IN_MOVED_TO events
ENH: remove stats of config files and use results of SafeConfigParserWithIncludes.read to facilitate meaningful error messages
DOC: credits for gh-70 fix
BF: ensure dates in email are in the C locale. Thanks iGeorgeX
DOC: ChangeLog for recursive tag substition
ENH: allow recursive tag substitution in action files.
DOC: document <br> tag
DOC: ChangeLog for named-refused entry
ENH: Account for views in named filter. By Romain Riviere in gentoo bug #259458
DOC: release documentation and distributor contacts
DOC: changelog entry for enhanced ssh filter
BF: Rename mentioning of README to README.md (Fixes#187)
updated README.md to hyperlink, add travis and coversall
Moving README into a markup README.md for github's goodnesses
Conflicts:
DEVELOP
README.md
fail2ban/client/configreader.py
fail2ban/server/datedetector.py
* commit '0.8.8-212-gf6f30f1': (24 commits)
DOC: tune up formatting (spaces) and prelude for the changelog entry
DOC: more ChangeLog entries all the way back to 0.8.8
DOC: move new actions and filters to New Features in ChangeLog
DOC: tomcat and Guacmole are next release
DOC: credit man page edits
DOC: developers please rebase and use a single commit
DOC: post release ChangeLog entry
DOC: ChangeLog - current HEAD back to ce3ab34
DOC: begining of ChangeLog
DOC: version/date of release
DOC: ChangeLog versions and dates for Releasing
DOC: guidance for pull requests
BF: filter.d/sshd "Did not receive identification string" relates to an exploit so document this in sshd-ddos.conf but leave it out of authentication based blocks in sshd.conf
DOC: a plugin to thanks for the community support
Add After, PIDFile, and change WantedBy to multi-user.target in fail2ban.server
DOC: slight tune ups to README (we are no longer compatible with python 2.3 ;) )
ENH: more openssh fail messages from openssh source code (CVS 20121205)
Add systemd unit file and tmpfiles.d configuration files
BF: do not rely on scripts being under /usr -- might differ eg on Fedora -- rely on import of common.version (Closes gh-112)
RF: move exceptions used by both client and server into common/exceptions.py
...
Conflicts:
ChangeLog
README
* 'Support_for_mysql_log_example' of https://github.com/arto-p/fail2ban:
Added testcase for MySQL date format to testcases/datedetectortestcase.py and example of MySQL log file.
Added support for MySQL logfiles
Conflicts:
testcases/datedetectortestcase.py -- conflictde with other added test cases
* pr/117/head:
An example of failed logins against sogo
Update sogo-auth.conf
Update config/filter.d/sogo-auth.conf
Create sogo-auth.conf
Update config/jail.conf
Do not trigger sshd bans on pam_unix authentication failures, this will trigger on successful logins on systems that use non-pam_unix authentication (sssd, ldap, etc.).
Noticed while looking at the source (to see the point of ssh-ddos).
POSSIBLE BREAK-IN ATTEMPT - sounds scary? But keep reading
the message. It's not a login failure. It's a warning about
reverse-DNS. The login can still succeed, and if it _does_ fail,
that will be logged as normal.
<exhibit n="1">
Jul 9 05:43:00 brick sshd[18971]: Address 200.41.233.234 maps to host234.advance.com.
ar, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 9 05:43:00 brick sshd[18971]: Invalid user html from 200.41.233.234
</exhibit>
The problem (in my mind) is that some users are stuck with bad dns.
The warning won't stop them from logging in. I'm pretty sure they can't
even see it. But when they exceed a threshold number of logins -
which could be all successful logins - fail2ban will trigger.
fail2ban shouldn't adding additional checks to successful logins
- it goes against the name fail2ban :)
- the first X "POSSIBLE BREAK-IN ATTEMPT"s would be permitted anyway
- if you want to ban bad DNS, the right way is PARANOID in /etc/hosts.deny
I've checked the source of OpenSSH, and this will only affect the
reverse-DNS error. (I won't be offended if you want to check
for yourself though ;)
<exhibit n="2">
$ grep -r -h -C1 'ATTEMPT' openssh-5.5p1/
logit("reverse mapping checking getaddrinfo for %.700s "
"[%s] failed - POSSIBLE BREAK-IN ATTEMPT!", name, ntop);
return xstrdup(ntop);
--
logit("Address %.100s maps to %.600s, but this does not "
"map back to the address - POSSIBLE BREAK-IN ATTEMPT!",
ntop, name);
$
</exhibit>
* gh-magicrhesus/master:
Add the INCLUDE section to use __pid_re feature
Disable asterisk jail by default
Change jail for asterisk, add support for SIP and SIP-TLS on TCP and UDP ports
Change NOTICE by NOTICE%(__pid_re)s
Remove custom bantime
Add sample log file for asterisk
Add $ at the end of the failregex
Add asterisk support
Conflicts:
config/jail.conf -- placed asterisk jails before recidive and added blank lines after the jail headers
Based on previous work as documented in the bug by Amir and myself,
plus some enhancements and documentation added to the file itself rather
than a URL (they rot).
Yaroslav Halchenko