mirror of https://github.com/fail2ban/fail2ban
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
150 lines
4.0 KiB
150 lines
4.0 KiB
# This file is part of Fail2Ban.
|
|
#
|
|
# Fail2Ban is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# Fail2Ban is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with Fail2Ban; if not, write to the Free Software
|
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
|
|
# Author: Cyril Jaquier
|
|
#
|
|
# $Revision: 354 $
|
|
|
|
__author__ = "Cyril Jaquier"
|
|
__version__ = "$Revision: 354 $"
|
|
__date__ = "$Date: 2006-09-13 23:31:22 +0200 (Wed, 13 Sep 2006) $"
|
|
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
|
__license__ = "GPL"
|
|
|
|
from failmanager import FailManager
|
|
from failmanager import FailManagerEmpty
|
|
from failticket import FailTicket
|
|
from datedetector import DateDetector
|
|
from filter import Filter
|
|
|
|
import time, logging, os
|
|
|
|
# Gets the instance of the logger.
|
|
logSys = logging.getLogger("fail2ban.filter")
|
|
|
|
##
|
|
# Log reader class.
|
|
#
|
|
# This class reads a log file and detects login failures or anything else
|
|
# that matches a given regular expression. This class is instanciated by
|
|
# a Jail object.
|
|
|
|
class FilterPoll(Filter):
|
|
|
|
##
|
|
# Constructor.
|
|
#
|
|
# Initialize the filter object with default values.
|
|
# @param jail the jail object
|
|
|
|
def __init__(self, jail):
|
|
Filter.__init__(self, jail)
|
|
|
|
self.file404Cnt = dict()
|
|
|
|
logSys.info("Created FilterPoll")
|
|
|
|
##
|
|
# Add a log file path
|
|
#
|
|
# @param path log file path
|
|
|
|
def addLogPath(self, path):
|
|
try:
|
|
self.logPath.index(path)
|
|
logSys.error(path + " already exists")
|
|
except ValueError:
|
|
self.logPath.append(path)
|
|
# Initialize default values
|
|
self.lastDate[path] = 0
|
|
self.lastModTime[path] = 0
|
|
self.lastPos[path] = 0
|
|
self.file404Cnt[path] = 0
|
|
logSys.info("Added logfile = %s" % path)
|
|
|
|
##
|
|
# Delete a log path
|
|
#
|
|
# @param path the log file to delete
|
|
|
|
def delLogPath(self, path):
|
|
try:
|
|
self.logPath.remove(path)
|
|
del self.lastDate[path]
|
|
del self.lastModTime[path]
|
|
del self.lastPos[path]
|
|
del self.file404Cnt[path]
|
|
logSys.info("Removed logfile = %s" % path)
|
|
except ValueError:
|
|
logSys.error(path + " is not monitored")
|
|
|
|
|
|
##
|
|
# Main loop.
|
|
#
|
|
# This function is the main loop of the thread. It checks if the
|
|
# file has been modified and looks for failures.
|
|
# @return True when the thread exits nicely
|
|
|
|
def run(self):
|
|
self.setActive(True)
|
|
while self.isActive():
|
|
if not self.isIdle:
|
|
# Get file modification
|
|
for file in self.logPath:
|
|
if self.isModified(file):
|
|
self.getFailures(file)
|
|
prevModified = True
|
|
|
|
if self.modified:
|
|
try:
|
|
ticket = self.failManager.toBan()
|
|
self.jail.putFailTicket(ticket)
|
|
except FailManagerEmpty:
|
|
self.failManager.cleanup(time.time())
|
|
self.dateDetector.sortTemplate()
|
|
prevModified = False
|
|
time.sleep(self.sleepTime)
|
|
else:
|
|
time.sleep(self.sleepTime)
|
|
logSys.debug(self.jail.getName() + ": filter terminated")
|
|
return True
|
|
|
|
##
|
|
# Checks if the log file has been modified.
|
|
#
|
|
# Checks if the log file has been modified using os.stat().
|
|
# @return True if log file has been modified
|
|
|
|
def isModified(self, filename):
|
|
try:
|
|
logStats = os.stat(filename)
|
|
self.file404Cnt[filename] = 0
|
|
if self.lastModTime[filename] == logStats.st_mtime:
|
|
return False
|
|
else:
|
|
logSys.debug(filename + " has been modified")
|
|
self.lastModTime[filename] = logStats.st_mtime
|
|
return True
|
|
except OSError:
|
|
logSys.error("Unable to get stat on " + filename)
|
|
self.file404Cnt[filename] = self.file404Cnt[filename] + 1
|
|
if self.file404Cnt[filename] > 2:
|
|
logSys.warn("Too much read error. Set the jail idle")
|
|
self.jail.setIdle(True)
|
|
self.file404Cnt[filename] = 0
|
|
return False
|