Lars Kneschke
47dd8fb897
ENH: filter for Tine 2.0
11 years ago
Ivo Truxa
2d8c0b26e4
Matching any Exim authentication name
...
As explained in https://github.com/grooverdan/fail2ban/pull/4 , in Exim there can be used plenty of other standard authentication names, and in fact the names can be custom. The failregex in Exim filter should catch authentication errors regardless of the name of the authentication. Hence replacing the plain|login with the general \w+
11 years ago
Daniel Black
6b0e6b9bca
ENH: add improper command pipelining postfix filter
11 years ago
Daniel Black
a443b8b4d3
BF: remove second jail definition
11 years ago
Daniel Black
cd3e94140c
MRG: complete merge
11 years ago
Daniel Black
f2e55e8499
ENH: add filter for squirrelmail. Closes gh-261
11 years ago
Daniel Black
1e8ed55a36
MRG: from 0.9
11 years ago
Tomas Pihl
b52a4441fd
Support ACL-events without AccountID. Typically happens when a registration
...
from an unknown domain is performed.
Add credits
11 years ago
Steven Hiscocks
0dd6533680
BF: Add ejabberd-auth to jail.conf
11 years ago
Steven Hiscocks
128112d51c
ENH: ejabberd filter
11 years ago
Daniel Black
8333abe420
Merge pull request #557 from grooverdan/apache-botsearch
...
ENH: Apache botsearch + BF: tag substition
11 years ago
Daniel Black
b0baab3a0e
ENH: more test cases and wider regex
11 years ago
Daniel Black
4b33f96db4
DOC: fix comment regarding apache version in apache-noscript
11 years ago
Daniel Black
8e5366a7e9
DOC: for apache-botsearch and apache-botsearch
11 years ago
Steven Hiscocks
7e8da15fc6
Merge pull request #572 from grooverdan/counterstrike
...
ENH: Counter Strike filter
11 years ago
Yaroslav Halchenko
6532a2e2f7
Merge pull request #548 from grooverdan/exim-honeypot
...
Exim honeypot
11 years ago
Daniel Black
d94efe719d
ENH: jail.conf for counter-strike
11 years ago
Daniel Black
0fb6bc7188
ENH: add filter for Counter Strike 1.6. Closes gh-347
11 years ago
Daniel Black
aabdc51e87
BF: revert separate jail for exim-honeypot as only exim-spam exists.
11 years ago
Daniel Black
9e087b508d
MRG: from 0.9
11 years ago
Daniel Black
58ebf659e4
MRG: from 0.9 to make history cleaner
11 years ago
Yaroslav Halchenko
9a8b449086
DOC: some typos, fixes from Vincent Lefevre
11 years ago
Daniel Black
9e390d6549
ENH: jail.conf for exim-honeypot
11 years ago
Daniel Black
809581ae99
ENH: jail.conf for apache-botsearch
11 years ago
Daniel Black
ed9ed6d0cb
TST/ENH: fix test case for ReadStockJailFilterComplete and add missing jails
11 years ago
Daniel Black
10fa5e3439
BF: fix jails for gssftpd and qmail
11 years ago
Daniel Black
549f64e86c
BF: remove imap2 - not an IANA and probably not used
11 years ago
Daniel Black
320861b7dc
Merge branch 'more-jails-0.9' into master_to_0.9
11 years ago
Daniel Black
76468942f9
MRG: complete merge from master
11 years ago
Daniel Black
fa6a183e94
BF: typos in jail.conf corrected
11 years ago
Daniel Black
a31c76f126
ENH: jail cleanup and fill in missing for 0.9
11 years ago
Daniel Black
755af0a51e
Merge pull request #562 from grooverdan/jail.conf-complete_and_correct
...
ENH: Jail.conf now has all filters and TST: a mechanism to test this is truee
11 years ago
Daniel Black
90fdf5fc21
ENH: jail.conf entry for groupoffice
11 years ago
Daniel Black
ab3ded2205
Merge pull request #549 from kwirk/python-actions
...
ENH: Python actions
11 years ago
Daniel Black
50eab4df81
ENH: add filter groupoffice. Closes gh-566
11 years ago
Daniel Black
f137c7b107
BF: stunnel doesnt need datepattern as its inbuilt
11 years ago
Daniel Black
1687505995
BF: Fix datepattern
11 years ago
Steven Hiscocks
6c301ae210
Merge pull request #563 from grooverdan/gh-289-ssh
...
BF: add expression for ssh filter for code 3: SSH2_DISCONNECT_KEY_EXCHAN...
11 years ago
Daniel Black
03aba92238
ENH: add kerio filter
11 years ago
Daniel Black
1c5787174f
BF: escape . in stunnel filter
11 years ago
Daniel Black
a8e0498389
BF: add expression for ssh filter for code 3: SSH2_DISCONNECT_KEY_EXCHANGE_FAILED. closes gh-289
11 years ago
Daniel Black
a9f804e443
ENH: complete stock jail.conf to contain all filters
11 years ago
Daniel Black
6ce2ba2895
ENH: additional phpmyadmin tips from Tom on http://www.fail2ban.org/wiki/index.php?title=Fail2ban:Community_Portal . Block is now a prefix of a path
11 years ago
Daniel Black
c37ee4cc52
DOC: filter.d/vsftpd doco from wiki
11 years ago
Daniel Black
6602937ee1
DOC: filter.d./pure-ftpd doco from wiki
11 years ago
Steven Hiscocks
69a850d226
DOC: Update docstrings for smtp.py action
11 years ago
Steven Hiscocks
6e63f0ea5a
RF: Change Jails and Actions to Mapping types
11 years ago
Daniel Black
d7666c8942
DOC: bit more on how to use freeswitch
11 years ago
Daniel Black
23f0b854da
MRG: merge in freeswitch
11 years ago
Daniel Black
69b3a1cf64
BF: catchin DEBUG messages will result in duplicates
11 years ago
Daniel Black
05b159c74b
Merge pull request #464 from grooverdan/increase-jail-name-length
...
ENH: Actions to have f2b- as prefix instead of fail2ban- as per #462
11 years ago
Daniel Black
3d1a1afca4
MRG: to more recent 0.9
11 years ago
Daniel Black
5fe75436cc
DOC: DEV NOTES before author names
11 years ago
Daniel Black
477f30665a
DOC: ignoreip for internal ips on freeswitch
11 years ago
Daniel Black
36533de6bc
ENH: more filter expressions for freeswitch. Anchored existing one at end too
11 years ago
Daniel Black
d1faae3b3b
BF: port not used in jail definition for freeswitch
11 years ago
Daniel Black
938ef689de
DOC: dev notes on stunnel
11 years ago
Steven Hiscocks
80d6f74ee8
RF: Refactor actions further, include removing server proxy interface
...
This allows direct setting of action properties and calling of methods
from the fail2ban-client if so required.
11 years ago
Daniel Black
7c09a61ca5
ENH: add apache-botsearch. Closes gh-544
11 years ago
Daniel Black
b8536490ef
ENH: filter for stunnel from fail2ban wiki
11 years ago
Daniel Black
a0c2de3e4d
DOC: document incompatiblity between APF and iptables-* actions. Closes gh-510
11 years ago
Daniel Black
04d28fd2e1
ENH: add filter freeswitch - as raised on mailing list
11 years ago
Daniel Black
117d3b0466
MRG: horde filter from master
11 years ago
Daniel Black
83f3aeb308
ENH: filter for horde
11 years ago
Steven Hiscocks
98bf511443
BF: Incorrect number of arguments in smtp.py action connect log
11 years ago
Steven Hiscocks
5b2b59d752
ENH: python actions use initOpts as **kwargs
...
Adds an easy way to handle case where mandatory arguments are missed, or
not valid arguments are passed
11 years ago
Steven Hiscocks
6ef911185d
ENH: Add matches to smtp.py action
11 years ago
Daniel Black
55688395fb
DOC: doco for exim-spam
11 years ago
Daniel Black
9c7bb3b97e
ENH: exim-spam to take honeypot email address as argument. Closes #541
11 years ago
Daniel Black
391b5fc883
MRG: from master again 2014-01-01
11 years ago
Steven Hiscocks
f37c90cdba
ENH: Python based actions
...
Python actions are imported from action.d config folder, which have .py
file extension. This imports and creates an instance of the Action class
(Action can be a variable that points to a class of another name).
fail2ban.server.action.ActionBase is a base class which can be inherited
from or as a minimum has a subclass hook which is used to ensure any
imported actions implements the methods required.
All calls to the execAction are also wrapped in a try except such that
any errors won't cripple the jail.
Action is renamed CommandAction, to clearly distinguish it from other
actions.
Include is an example smtp.py python action for sending emails via smtp.
This is work in progress, as looking to add the <matches> and whois
elements, and also SSL/TLS support.
11 years ago
Daniel Black
e8710b679d
ENH: stronger regex for failregex
11 years ago
Daniel Black
856407379b
ENH: add filter openwebmail. Closes gh-543.
11 years ago
Daniel Black
ccb64e68b4
DOC: for exim-spam to say how to enable the log lines for the latest regex
11 years ago
Daniel Black
b5f5ddf123
ENH: end anchor for exim-spam
11 years ago
Daniel Black
d727ba639a
ENH: exim-spam to include spamassassin log entry. Closes gh-533
11 years ago
Daniel Black
c074773805
ENH: apache modsecurity from 0.9 branch
11 years ago
Daniel Black
be382dae4d
MRG: ufw changelog conflicts
11 years ago
Daniel Black
1f6ece2a40
Merge pull request #490 from grooverdan/firewallcmd-ipset
...
ENH: add firewallcmd-ipset
11 years ago
Daniel Black
ea2a13946e
TST: more test of filters
11 years ago
Daniel Black
c9cfdca396
ENH: add filter for apache-modsecurity
11 years ago
Daniel Black
ddac79c15c
TST: include blank ignorecommand in jail.conf to indicate default value and to raise test coverage
11 years ago
bes.internal
ebd89ec077
New ignorecommand that is added to the ignoreip list from output of an external program
...
ignorecommand update man and fix protocol help
ENH: run ignore command only after internal list has been examined. Change interface on ignorecommand to take IP as environment variable and return true if it is to be banned
ENH: ignore IP command to take tagged command
DOC: man pages for ingorecommand
TST: add test cases for ignorecommand
11 years ago
Daniel Black
382d68f0fe
DOC: perfork model for apache log format
11 years ago
Daniel Black
1b7df1181f
BF: apache-2.4 log format fix. Closes gh-516
11 years ago
Yaroslav Halchenko
7af58b9984
Merge branch 'apache-noscripts' of https://github.com/grooverdan/fail2ban
...
* 'apache-noscripts' of https://github.com/grooverdan/fail2ban :
ENH: apache-noscript now matched php-cgi scripts. Closes gh-503
Conflicts:
ChangeLog -- two new entries collided, Reformatted the merged one a bit
11 years ago
Daniel Black
a9b7d33c51
ENH: apache-noscript now matched php-cgi scripts. Closes gh-503
11 years ago
Daniel Black
a1a219189f
Merge pull request #493 from grooverdan/xarf-ipmatch
...
ENH: use ipmatches for action xarf-login-attack
11 years ago
Daniel Black
ed2f46759c
MRG: restore accidently deleted pam comment in jail.conf
11 years ago
Daniel Black
44a0981495
MRG: fix recidive filter
11 years ago
Steven Hiscocks
d22716ab63
ENH: Add nsd filter and amend DateEpoch to match date format
11 years ago
Daniel Black
7c0efc8ec8
MRG: merge so far - flushLogs not working yet
11 years ago
Daniel Black
4eedf9d4e1
ENH: use ipmatches for action xarf-login-attack
11 years ago
Daniel Black
a398c51d6c
ENH: simplify actioncheck on firewallcmd-new a little more
11 years ago
Daniel Black
772def1095
Merge pull request #491 from kwirk/ipmatches
...
ENH: Add <ipmatches> and <ipjailmatches> tags + sendmail implementations
11 years ago
Steven Hiscocks
40007abc1d
ENH: Refactor and add database matches and failures for sendmail actions
11 years ago
Steven Hiscocks
2deb76e3f9
Merge pull request #492 from grooverdan/abusix-disclaimer
...
ENH: full abusix disclaimer in action xarf-login-attack
11 years ago
Daniel Black
1c6c011154
EHH missed trailing .
11 years ago
Daniel Black
868a4ea470
ENH: full abusix disclaimer in action xarf-login-attack
11 years ago
Daniel Black
9fe0a69852
ENH: add firewallcmd-ipset
11 years ago
Daniel Black
4ffc57e14f
ENH: simplify firewallcmd-new actioncheck and provide output samples
11 years ago
Daniel Black
ed816afbcd
ENH: add badips action
11 years ago
Daniel Black
1ff52dfe4d
DOC: document ufw a bit more. Change insertpos default to 1 to allow it to work if the user run ufw enable
11 years ago
Daniel Black
f35345ecaa
ENH: add ufw action based off Guilhem Lettron's work in lp-#701522. Closes gh-455
11 years ago
Daniel Black
13ccebe78f
BF: fix actioncheck in firewallcmd
11 years ago
Steven Hiscocks
0bcff771b8
ENH: Add <ipmatches> and <ipjailmatches> tags
...
Example use filter also added for sendmail-whois with ipmatches rather
than grepped lines
11 years ago
Steven Hiscocks
2c3dbc8046
BF: In 0.9 recidive bans come from fail2ban.server.actions
...
Also changed journalmatch to limit to WARNING priority to avoid the
recidive + DEBUG combo issue
11 years ago
Steven Hiscocks
b7d1579c9d
MRG: branch 'kwirk/database' into 0.9 - gh-480
...
Conflicts:
fail2ban/tests/utils.py
- Another test suite added in separate commit e09b700
11 years ago
Steven Hiscocks
e18af48e34
ENH: Database now optional, by setting dbfile to "None"
11 years ago
Daniel Black
9d532828fc
BF: multiple _ separated values according to http://wiki.squid-cache.org/SquidFaq/SquidLogs#Squid_result_codes . Thanks Steven
11 years ago
Daniel Black
66374913ec
ENH: add squid filter
11 years ago
Daniel Black
db4c21acde
BF/DOC: fix filename in documentation for filter.d/proftpd
11 years ago
Daniel Black
e8eab11615
DOC: proftp - turn off ReverseDNS
11 years ago
Daniel Black
f385439a41
MRG: ChangeLog merge
11 years ago
Daniel Black
36917d7517
BF: action.d/complain - match IP at beginning and end of lines
11 years ago
Steven Hiscocks
d8c7bca9b0
BF: Fix dbpurgeage default value, and change default dbfile extension
11 years ago
Steven Hiscocks
bbadef847b
ENH: Add fail2ban persistent data storage
11 years ago
Daniel Black
135c759dbb
Merge pull request #477 from kwirk/blocklist.de
...
ENH: Added blocklist.de reporting API action
11 years ago
Steven Hiscocks
630dd91dcd
BF: Add [Init] section to blocklist.de action
11 years ago
Steven Hiscocks
b3c173795e
ENH: blocklist.de action error on HTTP response code 4xx
11 years ago
Daniel Black
51f2619878
Merge pull request #473 from grooverdan/whois-missing
...
ENH: Whois missing in actions? Include output to say so
11 years ago
Daniel Black
e07ba41870
Merge pull request #463 from grooverdan/firewall-cmd-direct-new-length-too-long
...
BF: firewall-cmd-direct-new was too long. Thanks Joel.
11 years ago
Steven Hiscocks
a19b33cc72
ENH: blocklist.de action added fail2ban version as user agent
11 years ago
Steven Hiscocks
f742ed0e4b
DOC: when to use blocklist.de reporting
...
Taken from commit 1846056606
11 years ago
Steven Hiscocks
e810ec009d
ENH: Added blocklist.de reporting API action
11 years ago
Daniel Black
4dc51e5def
BF: put notice in email if whois program could not provide more information. Closes gh-471
11 years ago
Daniel Black
97d7f46bb7
DOC: correct grammar - s/Here are more information/Here is more information/
11 years ago
Daniel Black
8aead9ab79
BF: escape quotes when splitting addresses for xarf
11 years ago
Daniel Black
1846056606
DOC: when to use xarf messages to network owner
11 years ago
Daniel Black
8c37d2e4de
ENH: remove dependency on querycontacts
11 years ago
Daniel Black
bfd435091d
ENH: jail examples for xarf-login-attack
11 years ago
Daniel Black
dd356c3cef
BF: fixed for sendmail and tested the MTA aspects of this action
11 years ago
Daniel Black
9df5f4eec8
BF: remove debugging tee command on xarf-login-attack
11 years ago
Daniel Black
d015f7f4fc
BF/ENH: fixed so xarf-login-attack works
11 years ago
Daniel Black
0495aa098e
BF: grep matches on <ip> shouldn't include other IPs
11 years ago
Daniel Black
95845b7b65
BF: complain action could match too many IP addresses
11 years ago
Daniel Black
5cc7173fd4
ENH: add xarf email sender for login-attack type
11 years ago
Yaroslav Halchenko
3a5983ab0b
Merge branch 'bf/syslog-format' of https://github.com/yarikoptic/fail2ban
...
* 'bf/syslog-format' of https://github.com/yarikoptic/fail2ban :
Changelog entries for the last changes
ENH: added optional [PID] matching in recidive.conf
ENH: reintroducing levelnameinto syslog msgs, time stamp and indentation in non-syslog msgs
BF/ENH: include [PID] into logging msgs, remove indentation from syslog messages
Conflicts:
ChangeLog
11 years ago
Daniel Black
f7504d5b64
MRG: conflict in THANKS
11 years ago
Daniel Black
56b6bf7d25
ENH: reduce firewalld-cmd-new -> firewallcmd-new
11 years ago
Daniel Black
04438cd1a1
BF/ENH: mysql jail - rename to mysql-syslog to be consistent with 0.8.13. Add port to syslog defination. Document mysql configuration required for mysql jails
11 years ago
Daniel Black
3f4d179612
BF: smtps not an IANA port - from #447
11 years ago
Daniel Black
fe9e077acf
BF: correct spelling of port for solid-pop3 jail in jail.conf
11 years ago
Daniel Black
86a0a5962a
BF: revert to fail2ban- prefix as f2b- was intended for 0.9
11 years ago
Yaroslav Halchenko
25e967f23b
Merge branch 'mysqld-syslog-iptables-name-too-long' of https://github.com/grooverdan/fail2ban
...
* 'mysqld-syslog-iptables-name-too-long' of https://github.com/grooverdan/fail2ban :
BF: jail name mysqld-syslog-iptables too long. removed -iptables. Thanks Stefan (#447 )
Conflicts:
ChangeLog
11 years ago
Daniel Black
b9b2ddf996
BF: smtps not IANA standard. Closes #447
11 years ago
Daniel Black
cade746307
BF: jail name mysqld-syslog-iptables too long. removed -iptables. Thanks Stefan ( #447 )
11 years ago
Daniel Black
9e53892708
BF: did remove instead of move
11 years ago
Daniel Black
af4feb0c92
Actions to have f2b- as prefix instead of fail2ban- as per #462
11 years ago
Daniel Black
fb666b69ff
BF: firewall-cmd-direct-new was too long. Thanks Joel.
11 years ago