1418bcdf5b
`action.d/bsd-ipfw.conf`: fixed selection of rule-no by large list or initial `lowest_rule_num`, exit code can't be larger than 255 (gh-2836)
2020-09-29 12:35:49 +02:00
a038fd5dfe
`action.d/firewallcmd-*.conf` (multiport only): fixed port range selector, replacing `:` with `-`;
...
small optimizations on `firewallcmd-rich-rules.conf` and `firewallcmd-rich-logging.conf` simplifying both and provide a dependency (rich-logging is a derivative of rich-rules);
closes gh-2821
2020-09-03 16:41:23 +02:00
f09ba1b399
action in jail-config extended to consider space as separator now (splitWithOptions separates by space between mains words, but not in options), so defining `action = a b` would specify 2 actions `a` and `b`;
...
it is additionally more precise now (see fixed typo with closed bracket `]` instead of comma in testServerReloadTest)
2020-09-02 20:09:06 +02:00
a3a148078e
fail2ban-regex: more informative output for `datepattern` (e. g. set from filter) - pattern : description, example:
...
Use datepattern : ^%Y-%m-%d %H:%M:%S : ^Year-Month-Day 24hour:Minute:Second
2020-08-28 14:12:57 +02:00
17a6ba44b3
fail2ban-regex: speedup formatted output (bypass unneeded stats creation);
...
fail2ban-regex: extended with prefregex statistic
2020-08-28 13:52:09 +02:00
2945fe8cbd
changelog
2020-08-25 18:25:32 +02:00
295630cccf
documentation and changelog
2020-08-24 16:12:55 +02:00
7d172faa50
implements gh-2791: fail2ban-client extended to unban IP range(s) by subnet (CIDR/mask) or hostname (DNS)
2020-08-11 16:01:52 +02:00
62a6771b33
Merge remote-tracking branch 'sebres:0.10' into 0.10; closes gh-2763
...
action.d/nftables.conf (type=multiport only): fixed port range selector (replacing `:` with `-`)
2020-08-04 13:51:20 +02:00
5a0edf61c9
filter.d/sshd.conf: normalizing of user pattern in all RE's, allowing empty user (gh-2749)
2020-06-08 14:38:26 +02:00
368aa9e775
Merge pull request #2689 from benrubson/gitlab
...
New Gitlab jail
2020-05-04 19:19:13 +02:00
42aef09d69
Update ChangeLog
2020-04-27 19:38:48 +02:00
da1652d0d7
Update ChangeLog
2020-04-26 12:26:55 +02:00
6b90ca820f
filter.d/traefik-auth.conf: filter extended with parameter mode (`normal`, `ddos`, `aggressive`) to handle the match of username differently:
...
- `normal`: matches 401 with supplied username only
- `ddos`: matches 401 without supplied username only
- `aggressive`: matches 401 and any variant (with and without username)
closes gh-2693
2020-04-23 13:08:24 +02:00
affd9cef5f
filter.d/courier-smtp.conf: prefregex extended to consider port in log-message (closes gh-2697)
2020-04-21 13:32:17 +02:00
06b46e92eb
jail.conf: don't specify `action` directly in jails (use `action_` or `banaction` instead);
...
no mails-action added per default anymore (e. g. to allow that `action = %(action_mw)s` should be specified per jail or in default section in jail.local), closes gh-2357;
ensure we've unique action name per jail (also if parameter `actname` is not set but name deviates from standard name, gh-2686);
don't use %(banaction)s interpolation because it can be complex value (containing `[...]`), so would bother the action interpolation.
2020-04-15 19:00:49 +02:00
78651de7e5
Update ChangeLog
2020-04-14 12:25:18 +02:00
bc2b81133c
pyinotify backend: guarantees initial scanning of log-file by start (retarded via pending event if filter not yet active)
2020-03-13 22:07:32 +01:00
9f1c6f1617
filter stability fix: prevent race condition - no ban if filter (backend) is continuously busy if too many messages will be found in log, e. g. initial scan of large log-file or journal (gh-2660)
2020-03-13 17:34:37 +01:00
e3737bb7c0
filter stability fix: prevent race condition - no ban if filter (backend) is continuously busy if too many messages will be found in log, e. g. initial scan of large log-file or journal (gh-2660)
2020-03-13 17:20:19 +01:00
d4da9afd7f
Update ChangeLog
2020-03-06 20:29:48 +01:00
42714d0849
filter.d/common.conf: closes gh-2650, avoid substitute of default values in related `lt_*` section, `__prefix_line` should be interpolated in definition section (after the config considers all sections that can overwrite it);
...
amend to 62b1712d22#2387 , backend-related option `logtype`);
testSampleRegexsZZZ-GENERIC-EXAMPLE covering now negative case also (other daemon in prefix line)
2020-03-05 13:47:11 +01:00
15158e4474
closes gh-2647: add ban to database is moved from jail.putFailTicket to actions.__CheckBan; be sure manual ban is written to database, so can be restored by restart; reload/restart test extended
2020-03-02 18:58:59 +01:00
4766547e1f
performance optimization of `datepattern` (better search algorithm);
...
datetemplate: improved anchor detection for capturing groups `(^...)`; introduced new prefix `{UNB}` for `datepattern` to disable word boundaries in regex;
datedetector: speedup special case if only one template is defined (every match wins - no collision, no sorting, no other best match possible)
2020-02-28 14:27:21 +01:00
df885586d4
close Popen() pipes explicitly for PyPy
...
Waiting for garbage collection to close pipes opened by Popen() can
lead to "Too many open files" errors with PyPy; close them explicitly.
2020-02-25 14:55:10 +01:00
e57e950ef5
version bump (back to dev)
2020-02-25 14:51:54 +01:00
b25d8565fc
release 0.10.5 -- Deserve more respect a jedi's weapon must. Hrrrm, Yes
2020-01-10 13:34:46 +01:00
f77398c49d
filter.d/sshd.conf: captures `Disconnected from ... [preauth]`, preauth phase only, different handling by `extra` (with supplied user only) and `ddos`/`aggressive` mode (`normal` mode is not affected, used there just as a helper with `<F-NOFAIL>` to capture IP for multiline failures without IP);
...
closes gh-2115, gh-2362.
2020-01-09 20:53:53 +01:00
d1b7e2b5fb
fail2ban-regex - several enhancements and fixes:
...
- improved usage output (don't put a long help if an error occurs);
- new option `--no-check-all` to avoid check of all regex's (first matched only);
- new option `-o`, `--out` to set token provided in output (disables check-all and outputs only expected data);
- test cases optimized and extended
2020-01-09 16:59:13 +01:00
f30b7ae244
update ChangeLog + spelling
2020-01-08 21:03:00 +01:00
e86e9b2ee9
Merge branch '0.10' into gh-927-subnet
2019-11-15 01:47:50 +01:00
27e6b0021c
ChangeLog update gh-2563
2019-11-08 13:18:57 +01:00
e5d02bc2e9
grouped tags (`<ADDR>`, `<HOST>`, `<SUBNET>`) recognize IP addresses enclosed in square brackets, closes gh-2494
2019-11-04 12:11:00 +01:00
d44607a161
part of #927 - filter enhancement to parse IP sub-nets (IP/CIDR with correct recognition of IP-family),
...
provides new replacement tags for failregex to match subnets in form of IP-addresses with CIDR mask (gh-2559):
- `<CIDR>` - helper regex to match CIDR (simple integer form of net-mask);
- `<SUBNET>` - regex to match sub-net adresses (in form of IP/CIDR, also single IP is matched, so part /CIDR is optional);
2019-11-01 16:29:17 +01:00
8b850864cf
amend to #2254 : update changelog
2019-10-18 12:00:17 +02:00
d1a73d3004
filter.d/apache-auth.conf:
...
- ignore errors from mod_evasive in `normal` mode (mode-controlled now) (gh-2548);
- extended with option `mode` - `normal` (default) and `aggressive`
close gh-2548
2019-10-18 11:26:19 +02:00
91923b5c07
don't need to match identifier exactly (@ is precise enough as prefix), not capturing group;
...
`prefregex` extended, more selective now (denied/NOTAUTH suffix moved from `failregex`, so no catch-all there anymore);
update ChangeLog
2019-07-29 13:21:00 +02:00
a395361de8
Merge pull request #2467 from sebres/logtype-option-rfc5424
...
New option `logtype` value - `rfc5424`
2019-07-24 00:02:04 +02:00
70280bfa12
Update ChangeLog
2019-07-24 00:00:24 +02:00
d3b5befe44
update changelog ( #2404 )
2019-07-22 12:50:48 +02:00
7520d250b0
Merge pull request #2444 from sebres/gh-2392
...
systemd-backend: switched default flags to SYSTEM_ONLY(4)
2019-07-11 13:25:58 +02:00
8a386103c1
Update ChangeLog
2019-06-25 15:49:07 +02:00
b288ccd6b6
new filter: znc-adminlog
2019-06-12 16:25:50 +02:00
4c81338944
update ChangeLog (gh-2390)
2019-06-12 11:28:19 +02:00
2725acb64b
amend to 809acb69e5928c0e678ad25b43e53b567cb23a3b: extended to avoid the vice versa race (too many outdated tickets to unban) - max count of outdated tickets is restricted also.
2019-06-12 00:11:26 +02:00
e5ae113215
filter.d/postfix.conf: extended with new postfix filter mode `errors` to match "too many errors" (gh-2439),
...
also included within modes `normal`, `more` (`extra` and `aggressive`), since postfix
parameter `smtpd_hard_error_limit` is default 20 (additionally consider `maxretry`)
2019-06-07 16:14:02 +02:00
3b2f75414c
filter.d/postfix.conf: extended regexp's to accept variable suffix code in status of postfix for precise messages (gh-2442)
2019-06-07 15:40:55 +02:00
8da9bfb83a
Update ChangeLog (gh-2302, rebased to 0.10)
2019-06-07 14:47:43 +02:00
3b51c005f8
update ChangeLog (multi-line parsing fix, gh-2431)
2019-05-24 16:17:06 +02:00
4d08bc4ad5
update ChangeLog
2019-05-10 16:22:25 +02:00
sebres