* gh-yarikoptic/master:
ENH: Added login authenticator failed regexp for exim filter
DOC: Mention that logrotate configuration needs to be adjusted if logtarget is changed (Closes: #697333)
sshd filter - avoid banning on pam failures since might be too early. Close gh-106
If desired to ban on pam -- enable pam-generic filter, possibly even tuning in pam-generic.local the value for caught ttys in case of more detailed control needed
Provided example was:
Jan 18 12:47:34 host sshd[23755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.123.123.123 user=myuser
Jan 18 12:47:34 host sshd[23755]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.123.123.123 user=myuser
Jan 18 12:47:34 host sshd[23755]: Accepted password for myuser from 123.123.123.123 port 50615 ssh2
Do not trigger sshd bans on pam_unix authentication failures, this will trigger on successful logins on systems that use non-pam_unix authentication (sssd, ldap, etc.).
Before, it would first do stable sort followed with explicit reverse.
Now reverse is given as an argument to sort, and it results in actually
preserving the order in case of e.g. no sorting needed
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEABECAAYFAlDAFpkACgkQjRFFY3XAJMgAgQCg1ZQHPpU7S6EQxM4sxELuJepl
KV4AnRw/G7RX33ezTvdzAEYutKf+QJVB
=PFlG
-----END PGP SIGNATURE-----
Merge tag '0.8.8' into debian
Primarily a bugfix release 0.8.8
* tag '0.8.8': (31 commits)
Getting ready for 0.8.8 release (changelog, version boost)
BF: guarantee that IP is stored as a base, non-unicode str (Closes gh-91)
ENH: BF (forgotten import) for prev commit + removed duplicate Author, adjusted __ fields for that in fail2ban-* scripts
ENH: until we make it proper module -- adjust sys.path only if system-wide run
ENH: fail2ban-testcases-all -- pass cmdline options to fail2ban-testcases
ENH: To help with gh-87 added hints into the log on some failure return codes (e.g. 0x7f00 for this one)
ENH: trying to go native travis-ci python way to take advantage of virtualenv's with older pythons
BF: typo
BF: added a little shell script to excercise tests against all available Python versions
ENH: travis -- try to run tests against all available python versions
NF: rudimentary .travis.yml for travis-ci.org service
BF: do not enable pyinotify backend if pyinotify is too old (Closes gh-80)
DOC: forgotten --help entry for " unban "
ENH: downgrade "already banned" from WARN to INFO level (Closes gh-79)
minor: added a note on now "negative" log entries on "POSSIBLE BREAK-IN ATTEMPT"
DOC: minor "fixes" in DEVELOP
Added in while loop to process the Fail Manager after the requested banned IP was added to its queue. This solves the issue of needing to touch the log file that is being monitored to get the IP to be banned accordingly. Added in import of FailManagerEmpty exception class.
ENH: refactored previous commit to make it more Pythonic (With prev commit closes gh-86, gh-81)
Added in command option to unban and IP, just like using 'banip'. Command looks like: fail2ban-client set <jail name> unbanip <ip>
BF: in code we should use MyTime wrapper instead of time module directly
...
Otherwise it might lead to spurious characters dumped into the
terminal at few places, unless casted upon every use in the logs. To
prevent those issues in the source, store IP as a basic string if it
is a string at all
Yaroslav Halchenko