From 5ffc15ac68a35c75ce5229c971c318364e8f838b Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 7 Mar 2016 21:45:44 -0500 Subject: [PATCH 01/30] Changes for the 0.9.4 release --- ChangeLog | 2 +- MANIFEST | 5 +++++ README.md | 6 +++--- fail2ban/version.py | 4 ++-- 4 files changed, 11 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index 24001ea2..3f0f9cca 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,7 +6,7 @@ Fail2Ban: Changelog =================== -ver. 0.9.4 (2015/XX/XXX) - wanna-be-released +ver. 0.9.4 (2016/03/08) - for-you-ladies ----------- - Fixes: diff --git a/MANIFEST b/MANIFEST index d6bdba10..a216b888 100644 --- a/MANIFEST +++ b/MANIFEST @@ -44,6 +44,9 @@ config/action.d/mail-whois-lines.conf config/action.d/mail-whois.conf config/action.d/mail.conf config/action.d/mynetwatchman.conf +config/action.d/nftables-allports.conf +config/action.d/nftables-common.conf +config/action.d/nftables-multiport.conf config/action.d/nsupdate.conf config/action.d/nsupdate.conf config/action.d/osx-afctl.conf @@ -166,6 +169,7 @@ fail2ban/client/configreader.py fail2ban/client/configurator.py fail2ban/client/csocket.py fail2ban/client/fail2banreader.py +fail2ban/client/fail2banregex.py fail2ban/client/filterreader.py fail2ban/client/jailreader.py fail2ban/client/jailsreader.py @@ -218,6 +222,7 @@ fail2ban/tests/config/paths-osx.conf fail2ban/tests/databasetestcase.py fail2ban/tests/datedetectortestcase.py fail2ban/tests/dummyjail.py +fail2ban/tests/fail2banregextestcase.py fail2ban/tests/failmanagertestcase.py fail2ban/tests/files/action.d/action.py fail2ban/tests/files/action.d/action_checkainfo.py diff --git a/README.md b/README.md index a05b24c6..67ff45ec 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ / _|__ _(_) |_ ) |__ __ _ _ _ | _/ _` | | |/ /| '_ \/ _` | ' \ |_| \__,_|_|_/___|_.__/\__,_|_||_| - v0.9.3.dev 2015/XX/XX + v0.9.4 2015/03/08 ## Fail2Ban: ban hosts that cause multiple authentication errors @@ -39,8 +39,8 @@ Optional: To install, just do: - tar xvfj fail2ban-0.9.3.tar.bz2 - cd fail2ban-0.9.3 + tar xvfj fail2ban-0.9.4.tar.bz2 + cd fail2ban-0.9.4 python setup.py install This will install Fail2Ban into the python library directory. The executable diff --git a/fail2ban/version.py b/fail2ban/version.py index e9521725..9e4ef0f8 100644 --- a/fail2ban/version.py +++ b/fail2ban/version.py @@ -21,7 +21,7 @@ # __author__ = "Cyril Jaquier, Yaroslav Halchenko, Steven Hiscocks, Daniel Black" -__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2005-2015 Yaroslav Halchenko, 2013-2014 Steven Hiscocks, Daniel Black" +__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2005-2016 Yaroslav Halchenko, 2013-2014 Steven Hiscocks, Daniel Black" __license__ = "GPL-v2+" -version = "0.9.3.dev" +version = "0.9.4" From 0298ba2c1b0057857789f61be926bd39493a1678 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 7 Mar 2016 21:50:10 -0500 Subject: [PATCH 02/30] MANIFEST RELEASE and man pages updates --- MANIFEST | 101 ++++++++++++++++++++------------------- RELEASE | 5 ++ man/fail2ban-client.1 | 6 +-- man/fail2ban-regex.1 | 4 +- man/fail2ban-server.1 | 6 +-- man/fail2ban-testcases.1 | 4 +- 6 files changed, 68 insertions(+), 58 deletions(-) diff --git a/MANIFEST b/MANIFEST index a216b888..bf0ae4c9 100644 --- a/MANIFEST +++ b/MANIFEST @@ -1,18 +1,8 @@ -CONTRIBUTING.md -COPYING -ChangeLog -DEVELOP -FILTERS -README.Solaris -README.md -RELEASE -THANKS -TODO -Vagrantfile bin/fail2ban-client bin/fail2ban-regex bin/fail2ban-server bin/fail2ban-testcases +ChangeLog config/action.d/apf.conf config/action.d/badips.conf config/action.d/badips.py @@ -31,37 +21,36 @@ config/action.d/ipfilter.conf config/action.d/ipfw.conf config/action.d/iptables-allports.conf config/action.d/iptables-common.conf +config/action.d/iptables.conf config/action.d/iptables-ipset-proto4.conf config/action.d/iptables-ipset-proto6-allports.conf config/action.d/iptables-ipset-proto6.conf -config/action.d/iptables-multiport-log.conf config/action.d/iptables-multiport.conf +config/action.d/iptables-multiport-log.conf config/action.d/iptables-new.conf config/action.d/iptables-xt_recent-echo.conf -config/action.d/iptables.conf config/action.d/mail-buffered.conf -config/action.d/mail-whois-lines.conf -config/action.d/mail-whois.conf config/action.d/mail.conf +config/action.d/mail-whois.conf +config/action.d/mail-whois-lines.conf config/action.d/mynetwatchman.conf config/action.d/nftables-allports.conf config/action.d/nftables-common.conf config/action.d/nftables-multiport.conf config/action.d/nsupdate.conf -config/action.d/nsupdate.conf config/action.d/osx-afctl.conf config/action.d/osx-ipfw.conf config/action.d/pf.conf config/action.d/route.conf config/action.d/sendmail-buffered.conf config/action.d/sendmail-common.conf +config/action.d/sendmail.conf config/action.d/sendmail-geoip-lines.conf +config/action.d/sendmail-whois.conf config/action.d/sendmail-whois-ipjailmatches.conf config/action.d/sendmail-whois-ipmatches.conf config/action.d/sendmail-whois-lines.conf config/action.d/sendmail-whois-matches.conf -config/action.d/sendmail-whois.conf -config/action.d/sendmail.conf config/action.d/shorewall.conf config/action.d/smtp.py config/action.d/symbiosis-blacklist-allports.conf @@ -92,44 +81,43 @@ config/filter.d/dovecot.conf config/filter.d/dropbear.conf config/filter.d/ejabberd-auth.conf config/filter.d/exim-common.conf -config/filter.d/exim-spam.conf config/filter.d/exim.conf +config/filter.d/exim-spam.conf config/filter.d/freeswitch.conf config/filter.d/groupoffice.conf config/filter.d/gssftpd.conf config/filter.d/guacamole.conf +config/filter.d/haproxy-http-auth.conf config/filter.d/horde.conf config/filter.d/ignorecommands config/filter.d/ignorecommands/apache-fakegooglebot config/filter.d/kerio.conf config/filter.d/lighttpd-auth.conf config/filter.d/monit.conf +config/filter.d/murmur.conf config/filter.d/mysqld-auth.conf config/filter.d/nagios.conf config/filter.d/named-refused.conf config/filter.d/nginx-botsearch.conf config/filter.d/nginx-http-auth.conf +config/filter.d/nginx-limit-req.conf config/filter.d/nsd.conf +config/filter.d/openhab.conf config/filter.d/openwebmail.conf config/filter.d/oracleims.conf config/filter.d/pam-generic.conf -config/filter.d/pam-generic.conf -config/filter.d/pam-generic.conf config/filter.d/perdition.conf config/filter.d/php-url-fopen.conf -config/filter.d/php-url-fopen.conf -config/filter.d/php-url-fopen.conf config/filter.d/portsentry.conf +config/filter.d/postfix.conf config/filter.d/postfix-rbl.conf config/filter.d/postfix-sasl.conf -config/filter.d/postfix-sasl.conf -config/filter.d/postfix-sasl.conf -config/filter.d/postfix.conf config/filter.d/proftpd.conf config/filter.d/pure-ftpd.conf config/filter.d/qmail.conf config/filter.d/recidive.conf config/filter.d/roundcube-auth.conf +config/filter.d/screensharingd.conf config/filter.d/selinux-common.conf config/filter.d/selinux-ssh.conf config/filter.d/sendmail-auth.conf @@ -140,8 +128,8 @@ config/filter.d/sogo-auth.conf config/filter.d/solid-pop3d.conf config/filter.d/squid.conf config/filter.d/squirrelmail.conf -config/filter.d/sshd-ddos.conf config/filter.d/sshd.conf +config/filter.d/sshd-ddos.conf config/filter.d/stunnel.conf config/filter.d/suhosin.conf config/filter.d/tine20.conf @@ -155,13 +143,13 @@ config/paths-common.conf config/paths-debian.conf config/paths-fedora.conf config/paths-freebsd.conf +config/paths-opensuse.conf config/paths-osx.conf +CONTRIBUTING.md +COPYING +DEVELOP doc/run-rootless.txt fail2ban-2to3 -fail2ban-testcases-all -fail2ban-testcases-all-python3 -fail2ban/__init__.py -fail2ban/client/__init__.py fail2ban/client/actionreader.py fail2ban/client/beautifier.py fail2ban/client/configparserinc.py @@ -171,12 +159,13 @@ fail2ban/client/csocket.py fail2ban/client/fail2banreader.py fail2ban/client/fail2banregex.py fail2ban/client/filterreader.py +fail2ban/client/__init__.py fail2ban/client/jailreader.py fail2ban/client/jailsreader.py fail2ban/exceptions.py fail2ban/helpers.py +fail2ban/__init__.py fail2ban/protocol.py -fail2ban/server/__init__.py fail2ban/server/action.py fail2ban/server/actions.py fail2ban/server/asyncserver.py @@ -187,11 +176,12 @@ fail2ban/server/datetemplate.py fail2ban/server/faildata.py fail2ban/server/failmanager.py fail2ban/server/failregex.py -fail2ban/server/filter.py fail2ban/server/filtergamin.py fail2ban/server/filterpoll.py +fail2ban/server/filter.py fail2ban/server/filterpyinotify.py fail2ban/server/filtersystemd.py +fail2ban/server/__init__.py fail2ban/server/iso8601.py fail2ban/server/jail.py fail2ban/server/jails.py @@ -201,7 +191,8 @@ fail2ban/server/server.py fail2ban/server/strptime.py fail2ban/server/ticket.py fail2ban/server/transmitter.py -fail2ban/tests/__init__.py +fail2ban-testcases-all +fail2ban-testcases-all-python3 fail2ban/tests/action_d/__init__.py fail2ban/tests/action_d/test_badips.py fail2ban/tests/action_d/test_smtp.py @@ -224,32 +215,32 @@ fail2ban/tests/datedetectortestcase.py fail2ban/tests/dummyjail.py fail2ban/tests/fail2banregextestcase.py fail2ban/tests/failmanagertestcase.py -fail2ban/tests/files/action.d/action.py fail2ban/tests/files/action.d/action_checkainfo.py fail2ban/tests/files/action.d/action_errors.py fail2ban/tests/files/action.d/action_modifyainfo.py fail2ban/tests/files/action.d/action_noAction.py fail2ban/tests/files/action.d/action_nomethod.py -fail2ban/tests/files/config/apache-auth/README +fail2ban/tests/files/action.d/action.py +fail2ban/tests/files/config/apache-auth/basic/authz_owner/cant_get_me.html fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htaccess fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htpasswd -fail2ban/tests/files/config/apache-auth/basic/authz_owner/cant_get_me.html fail2ban/tests/files/config/apache-auth/basic/file/.htaccess fail2ban/tests/files/config/apache-auth/basic/file/.htpasswd -fail2ban/tests/files/config/apache-auth/digest.py -fail2ban/tests/files/config/apache-auth/digest/.htaccess -fail2ban/tests/files/config/apache-auth/digest/.htpasswd fail2ban/tests/files/config/apache-auth/digest_anon/.htaccess fail2ban/tests/files/config/apache-auth/digest_anon/.htpasswd +fail2ban/tests/files/config/apache-auth/digest/.htaccess +fail2ban/tests/files/config/apache-auth/digest/.htpasswd +fail2ban/tests/files/config/apache-auth/digest.py fail2ban/tests/files/config/apache-auth/digest_time/.htaccess fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd fail2ban/tests/files/config/apache-auth/noentry/.htaccess +fail2ban/tests/files/config/apache-auth/README fail2ban/tests/files/database_v1.db fail2ban/tests/files/filter.d/substition.conf -fail2ban/tests/files/filter.d/testcase-common.conf fail2ban/tests/files/filter.d/testcase01.conf +fail2ban/tests/files/filter.d/testcase-common.conf fail2ban/tests/files/ignorecommand.py fail2ban/tests/files/logs/3proxy fail2ban/tests/files/logs/apache-auth @@ -281,16 +272,20 @@ fail2ban/tests/files/logs/freeswitch fail2ban/tests/files/logs/groupoffice fail2ban/tests/files/logs/gssftpd fail2ban/tests/files/logs/guacamole +fail2ban/tests/files/logs/haproxy-http-auth fail2ban/tests/files/logs/horde fail2ban/tests/files/logs/kerio fail2ban/tests/files/logs/lighttpd-auth fail2ban/tests/files/logs/monit +fail2ban/tests/files/logs/murmur fail2ban/tests/files/logs/mysqld-auth fail2ban/tests/files/logs/nagios fail2ban/tests/files/logs/named-refused fail2ban/tests/files/logs/nginx-botsearch fail2ban/tests/files/logs/nginx-http-auth +fail2ban/tests/files/logs/nginx-limit-req fail2ban/tests/files/logs/nsd +fail2ban/tests/files/logs/openhab fail2ban/tests/files/logs/openwebmail fail2ban/tests/files/logs/oracleims fail2ban/tests/files/logs/pam-generic @@ -305,6 +300,7 @@ fail2ban/tests/files/logs/pure-ftpd fail2ban/tests/files/logs/qmail fail2ban/tests/files/logs/recidive fail2ban/tests/files/logs/roundcube-auth +fail2ban/tests/files/logs/screensharingd fail2ban/tests/files/logs/selinux-ssh fail2ban/tests/files/logs/sendmail-auth fail2ban/tests/files/logs/sendmail-reject @@ -324,14 +320,16 @@ fail2ban/tests/files/logs/vsftpd fail2ban/tests/files/logs/webmin-auth fail2ban/tests/files/logs/wuftpd fail2ban/tests/files/logs/xinetd-fail -fail2ban/tests/files/testcase-journal.log -fail2ban/tests/files/testcase-multiline.log -fail2ban/tests/files/testcase-usedns.log fail2ban/tests/files/testcase01.log fail2ban/tests/files/testcase02.log fail2ban/tests/files/testcase03.log fail2ban/tests/files/testcase04.log +fail2ban/tests/files/testcase-journal.log +fail2ban/tests/files/testcase-multiline.log +fail2ban/tests/files/testcase-usedns.log +fail2ban/tests/files/testcase-wrong-char.log fail2ban/tests/filtertestcase.py +fail2ban/tests/__init__.py fail2ban/tests/misctestcase.py fail2ban/tests/samplestestcase.py fail2ban/tests/servertestcase.py @@ -339,13 +337,13 @@ fail2ban/tests/sockettestcase.py fail2ban/tests/utils.py fail2ban/version.py files/bash-completion -files/cacti/README files/cacti/cacti_host_template_fail2ban.xml files/cacti/fail2ban_stats.sh +files/cacti/README files/debian-initd files/fail2ban-logrotate -files/fail2ban-tmpfiles.conf files/fail2ban.service +files/fail2ban-tmpfiles.conf files/fail2ban.upstart files/gen_badbots files/gentoo-confd @@ -354,21 +352,28 @@ files/ipmasq-ZZZzzz_fail2ban.rul files/logwatch/fail2ban files/macosx-initd files/monit/fail2ban -files/nagios/README files/nagios/check_fail2ban +files/nagios/README files/redhat-initd files/solaris-fail2ban.xml files/solaris-svc-fail2ban files/suse-initd +FILTERS kill-server +man/fail2ban.1 man/fail2ban-client.1 man/fail2ban-client.h2m man/fail2ban-regex.1 man/fail2ban-regex.h2m man/fail2ban-server.1 man/fail2ban-server.h2m -man/fail2ban.1 man/generate-man man/jail.conf.5 +README.md +README.Solaris +RELEASE setup.cfg setup.py +THANKS +TODO +Vagrantfile diff --git a/RELEASE b/RELEASE index d4a4f971..adbaf412 100644 --- a/RELEASE +++ b/RELEASE @@ -51,6 +51,11 @@ Preparation find -type f | grep -v -e '\.git' -e '/doc/' -e '\.travis' -e MANIFEST | sed -e 's,^\./,,g' | while read f; do grep -ne "^$f\$" MANIFEST >/dev/null || echo "$f" ; done + or an alternative for comparison with previous release + + git diff 0.9.4 | grep -B2 'index 0000000..' | grep -B1 'new file mode' | sed -n -e '/^diff /s,.* b/,,gp' >> MANIFEST + sort MANIFEST | uniq | sponge MANIFEST + * Run:: python setup.py sdist diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1 index 39ac8bf6..ec5db2d2 100644 --- a/man/fail2ban-client.1 +++ b/man/fail2ban-client.1 @@ -1,12 +1,12 @@ -.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.47.1. -.TH FAIL2BAN-CLIENT "1" "July 2015" "fail2ban-client v0.9.3" "User Commands" +.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.47.2. +.TH FAIL2BAN-CLIENT "1" "March 2016" "fail2ban-client v0.9.4" "User Commands" .SH NAME fail2ban-client \- configure and control the server .SH SYNOPSIS .B fail2ban-client [\fI\,OPTIONS\/\fR] \fI\,\/\fR .SH DESCRIPTION -Fail2Ban v0.9.3 reads log file that contains password failure report +Fail2Ban v0.9.4 reads log file that contains password failure report and bans the corresponding IP addresses using firewall rules. .SH OPTIONS .TP diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1 index c1ae40dc..740b461c 100644 --- a/man/fail2ban-regex.1 +++ b/man/fail2ban-regex.1 @@ -1,5 +1,5 @@ -.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.47.1. -.TH FAIL2BAN-REGEX "1" "July 2015" "fail2ban-regex 0.9.3" "User Commands" +.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.47.2. +.TH FAIL2BAN-REGEX "1" "March 2016" "fail2ban-regex 0.9.4" "User Commands" .SH NAME fail2ban-regex \- test Fail2ban "failregex" option .SH SYNOPSIS diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1 index 4260e748..90ec1d80 100644 --- a/man/fail2ban-server.1 +++ b/man/fail2ban-server.1 @@ -1,12 +1,12 @@ -.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.47.1. -.TH FAIL2BAN-SERVER "1" "July 2015" "fail2ban-server v0.9.3" "User Commands" +.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.47.2. +.TH FAIL2BAN-SERVER "1" "March 2016" "fail2ban-server v0.9.4" "User Commands" .SH NAME fail2ban-server \- start the server .SH SYNOPSIS .B fail2ban-server [\fI\,OPTIONS\/\fR] .SH DESCRIPTION -Fail2Ban v0.9.3 reads log file that contains password failure report +Fail2Ban v0.9.4 reads log file that contains password failure report and bans the corresponding IP addresses using firewall rules. .PP Only use this command for debugging purpose. Start the server with diff --git a/man/fail2ban-testcases.1 b/man/fail2ban-testcases.1 index 55eedd50..dc0fee32 100644 --- a/man/fail2ban-testcases.1 +++ b/man/fail2ban-testcases.1 @@ -1,5 +1,5 @@ -.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.47.1. -.TH FAIL2BAN-TESTCASES "1" "July 2015" "fail2ban-testcases 0.9.3" "User Commands" +.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.47.2. +.TH FAIL2BAN-TESTCASES "1" "March 2016" "fail2ban-testcases 0.9.4" "User Commands" .SH NAME fail2ban-testcases \- run Fail2Ban unit-tests .SH SYNOPSIS From bb0dc17a874a296dfc86bdabf5d2e8a113b87141 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 7 Mar 2016 22:40:36 -0500 Subject: [PATCH 03/30] BF: use tests.utils.CONFIG_DIR instead of fixed one (Closes #1348) --- fail2ban/tests/fail2banregextestcase.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fail2ban/tests/fail2banregextestcase.py b/fail2ban/tests/fail2banregextestcase.py index 2fd362c7..e4af50ea 100644 --- a/fail2ban/tests/fail2banregextestcase.py +++ b/fail2ban/tests/fail2banregextestcase.py @@ -40,6 +40,7 @@ except ImportError: from ..client import fail2banregex from ..client.fail2banregex import Fail2banRegex, get_opt_parser, output from .utils import LogCaptureTestCase, logSys +from .utils import CONFIG_DIR fail2banregex.logSys = logSys @@ -48,8 +49,6 @@ def _test_output(*args): fail2banregex.output = _test_output -CONF_FILES_DIR = os.path.abspath( - os.path.join(os.path.dirname(__file__),"..", "..", "config")) TEST_FILES_DIR = os.path.join(os.path.dirname(__file__), "files") @@ -66,7 +65,7 @@ class Fail2banRegexTest(LogCaptureTestCase): FILENAME_02 = os.path.join(TEST_FILES_DIR, "testcase02.log") FILENAME_WRONGCHAR = os.path.join(TEST_FILES_DIR, "testcase-wrong-char.log") - FILTER_SSHD = os.path.join(CONF_FILES_DIR, 'filter.d', 'sshd.conf') + FILTER_SSHD = os.path.join(CONFIG_DIR, 'filter.d', 'sshd.conf') def setUp(self): """Call before every test case.""" From 634e68036e7a1dafd2cefa13a1d55b4ef72af602 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 8 Mar 2016 08:36:29 -0500 Subject: [PATCH 04/30] Get ready for further developments --- ChangeLog | 10 ++++++++++ README.md | 2 +- RELEASE | 2 +- fail2ban/version.py | 2 +- 4 files changed, 13 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3f0f9cca..1a1839a4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,6 +6,16 @@ Fail2Ban: Changelog =================== +ver. 0.9.5 (2015/XX/XXX) - wanna-be-released +----------- + +- Fixes: + +- New Features: + +- Enhancements: + + ver. 0.9.4 (2016/03/08) - for-you-ladies ----------- diff --git a/README.md b/README.md index 67ff45ec..481b7d33 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ / _|__ _(_) |_ ) |__ __ _ _ _ | _/ _` | | |/ /| '_ \/ _` | ' \ |_| \__,_|_|_/___|_.__/\__,_|_||_| - v0.9.4 2015/03/08 + v0.9.4.dev0 2016/??/?? ## Fail2Ban: ban hosts that cause multiple authentication errors diff --git a/RELEASE b/RELEASE index adbaf412..fa89fc34 100644 --- a/RELEASE +++ b/RELEASE @@ -190,7 +190,7 @@ Post Release Add the following to the top of the ChangeLog:: - ver. 0.9.5 (2015/XX/XXX) - wanna-be-released + ver. 0.9.6 (2016/XX/XXX) - wanna-be-released ----------- - Fixes: diff --git a/fail2ban/version.py b/fail2ban/version.py index 9e4ef0f8..140ca959 100644 --- a/fail2ban/version.py +++ b/fail2ban/version.py @@ -24,4 +24,4 @@ __author__ = "Cyril Jaquier, Yaroslav Halchenko, Steven Hiscocks, Daniel Black" __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2005-2016 Yaroslav Halchenko, 2013-2014 Steven Hiscocks, Daniel Black" __license__ = "GPL-v2+" -version = "0.9.4" +version = "0.9.4.dev0" From dfc65018da1b9856d8efc658ec59f366b0c4bdd5 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Wed, 9 Mar 2016 11:36:06 -0700 Subject: [PATCH 05/30] Fedora use mariadb by default, fix log path --- config/paths-fedora.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/paths-fedora.conf b/config/paths-fedora.conf index b3c978ca..e91845a1 100644 --- a/config/paths-fedora.conf +++ b/config/paths-fedora.conf @@ -34,7 +34,7 @@ apache_access_log = /var/log/httpd/*access_log exim_main_log = /var/log/exim/main.log -mysql_log = /var/lib/mysql/mysqld.log +mysql_log = /var/log/mariadb/mariadb.log roundcube_errors_log = /var/log/roundcubemail/errors From 37c9075faddbd40d4ffe202f98f4be2c9dd262a6 Mon Sep 17 00:00:00 2001 From: sebres Date: Wed, 9 Mar 2016 20:00:11 +0100 Subject: [PATCH 06/30] fixed monit filter: failregex find now both previous and new versions: - failregex of previous monit version merged as single expression; - extended failregex with new monit "access denied" version; --- config/filter.d/monit.conf | 15 +++++++++++++-- fail2ban/tests/files/logs/monit | 17 ++++++++++++++++- 2 files changed, 29 insertions(+), 3 deletions(-) diff --git a/config/filter.d/monit.conf b/config/filter.d/monit.conf index c2ef20d9..599bd363 100644 --- a/config/filter.d/monit.conf +++ b/config/filter.d/monit.conf @@ -2,9 +2,20 @@ # # +[INCLUDES] + +# Read common prefixes. If any customizations available -- read them from +# common.local +before = common.conf + [Definition] -failregex = ^\[[A-Z]+\s+\]\s*error\s*:\s*Warning:\s+Client '' supplied unknown user '\w+' accessing monit httpd$ - ^\[[A-Z]+\s+\]\s*error\s*:\s*Warning:\s+Client '' supplied wrong password for user '\w+' accessing monit httpd$ +_daemon = monit +# Regexp for previous (accessing monit httpd) and new (access denied) versions +failregex = ^\[[A-Z]+\s+\]\s*error\s*:\s*Warning:\s+Client '' supplied (?:unknown user '[^']+'|wrong password for user '[^']*') accessing monit httpd$ + ^%(__prefix_line)s\w+: access denied -- client : (?:unknown user '[^']+'|wrong password for user '[^']*'|empty password)$ + +# Ignore login with empty user (first connect, no user specified) +# ignoreregex = %(__prefix_line)s\w+: access denied -- client : (?:unknown user '') ignoreregex = diff --git a/fail2ban/tests/files/logs/monit b/fail2ban/tests/files/logs/monit index a923b6e2..57437046 100644 --- a/fail2ban/tests/files/logs/monit +++ b/fail2ban/tests/files/logs/monit @@ -1,6 +1,21 @@ +# Previous version -- # failJSON: { "time": "2005-04-16T21:05:29", "match": true , "host": "69.93.127.111" } [PDT Apr 16 21:05:29] error : Warning: Client '69.93.127.111' supplied unknown user 'foo' accessing monit httpd - # failJSON: { "time": "2005-04-16T20:59:33", "match": true , "host": "97.113.189.111" } [PDT Apr 16 20:59:33] error : Warning: Client '97.113.189.111' supplied wrong password for user 'admin' accessing monit httpd +# Current version -- corresponding "https://bitbucket.org/tildeslash/monit/src/6905335aa903d425cae732cab766bd88ea5f2d1d/src/http/processor.c?at=master&fileviewer=file-view-default#processor.c-728" +# failJSON: { "time": "2005-03-09T09:18:28", "match": false, "desc": "should be ignored: no login" } +Mar 9 09:18:28 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: missing or invalid Authorization header +# failJSON: { "time": "2005-03-09T09:18:28", "match": false, "desc": "should be ignored: no login" } +Mar 9 09:18:28 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: invalid Authorization header +# failJSON: { "time": "2005-03-09T09:18:29", "match": false, "desc": "should be ignored: connect, still no user specified" } +Mar 9 09:18:29 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: empty username +# failJSON: { "time": "2005-03-09T09:18:31", "match": false, "desc": "should be ignored: connect, still no user specified" } +Mar 9 09:18:31 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: unknown user '' +# failJSON: { "time": "2005-03-09T09:18:32", "match": true, "host": "1.2.3.4", "desc": "no password try" } +Mar 9 09:18:32 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: empty password +# failJSON: { "time": "2005-03-09T09:18:33", "match": true, "host": "1.2.3.4", "desc": "unknown user try" } +Mar 9 09:18:33 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: unknown user 'test1' +# failJSON: { "time": "2005-03-09T09:18:34", "match": true, "host": "1.2.3.4", "desc": "wrong password try" } +Mar 9 09:18:34 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: wrong password for user 'test2' From 9d13bb0c3ad0766beed7d956e87ff8c0e5674e6a Mon Sep 17 00:00:00 2001 From: sebres Date: Wed, 9 Mar 2016 20:11:14 +0100 Subject: [PATCH 07/30] ChangeLog and THANKS entries --- ChangeLog | 3 +++ THANKS | 1 + 2 files changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 1a1839a4..8ec13b48 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,9 @@ ver. 0.9.5 (2015/XX/XXX) - wanna-be-released ----------- - Fixes: + * filter.d/monit.conf + - extended failregex with new monit "access denied" version (gh-1355); + - failregex of previous monit version merged as single expression. - New Features: diff --git a/THANKS b/THANKS index 0b45c019..cfcab3ad 100644 --- a/THANKS +++ b/THANKS @@ -34,6 +34,7 @@ Daniel B. Cid Daniel B. Daniel Black David Nutter +David Reagan (jerrac) Derek Atkins Donald Yandt Eric Gerbier From f3f813a925c23951d7dbe3c86a8f5fb88b635c8c Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Wed, 9 Mar 2016 13:52:50 -0700 Subject: [PATCH 08/30] - mysqld does not log login attempts to the journal. - Add /var/log/mysqld.log to mysql_log --- config/paths-fedora.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/paths-fedora.conf b/config/paths-fedora.conf index e91845a1..d13645b1 100644 --- a/config/paths-fedora.conf +++ b/config/paths-fedora.conf @@ -35,6 +35,7 @@ apache_access_log = /var/log/httpd/*access_log exim_main_log = /var/log/exim/main.log mysql_log = /var/log/mariadb/mariadb.log + /var/log/mysqld.log roundcube_errors_log = /var/log/roundcubemail/errors @@ -48,4 +49,3 @@ pureftpd_backend = systemd wuftpd_backend = systemd postfix_backend = systemd dovecot_backend = systemd -mysql_backend = systemd From eed1a0d686ba8bb0aae7ec1546a2d4aa2415ba74 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Wed, 9 Mar 2016 23:06:59 -0500 Subject: [PATCH 09/30] BF: Include iptables-common (not removed iptables-blocktype) within firewallcmd- actions (Closes #1254) --- config/action.d/firewallcmd-allports.conf | 2 +- config/action.d/firewallcmd-multiport.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/action.d/firewallcmd-allports.conf b/config/action.d/firewallcmd-allports.conf index ec52babb..571d5ba6 100644 --- a/config/action.d/firewallcmd-allports.conf +++ b/config/action.d/firewallcmd-allports.conf @@ -6,7 +6,7 @@ [INCLUDES] -before = iptables-blocktype.conf +before = iptables-common.conf [Definition] diff --git a/config/action.d/firewallcmd-multiport.conf b/config/action.d/firewallcmd-multiport.conf index 4d806e6b..82c758fe 100644 --- a/config/action.d/firewallcmd-multiport.conf +++ b/config/action.d/firewallcmd-multiport.conf @@ -5,7 +5,7 @@ [INCLUDES] -before = iptables-blocktype.conf +before = iptables-common.conf [Definition] From bd25a43417fa4fcf8e55a991331e709f6d0fb114 Mon Sep 17 00:00:00 2001 From: Johannes Weberhofer Date: Fri, 11 Mar 2016 18:19:53 +0100 Subject: [PATCH 10/30] define journalmatch setting for pure-ftps --- config/filter.d/pure-ftpd.conf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/config/filter.d/pure-ftpd.conf b/config/filter.d/pure-ftpd.conf index be3d0ae5..034336f3 100644 --- a/config/filter.d/pure-ftpd.conf +++ b/config/filter.d/pure-ftpd.conf @@ -21,6 +21,10 @@ failregex = ^%(__prefix_line)s\(.+?@\) \[WARNING\] %(__errmsg)s\s*$ ignoreregex = +[Init] + +journalmatch = _SYSTEMD_UNIT=pure-ftpd.service + _COMM=pure-ftpd + # Author: Cyril Jaquier # Modified: Yaroslav Halchenko for pure-ftpd # Documentation thanks to Blake on http://www.fail2ban.org/wiki/index.php?title=Fail2ban:Community_Portal From bfac42eb2e970c08138380af59154c91826b8666 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 14 Mar 2016 11:10:28 -0400 Subject: [PATCH 11/30] changelog for journalmatch pure-ftpd --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 1a1839a4..7681e425 100644 --- a/ChangeLog +++ b/ChangeLog @@ -14,6 +14,7 @@ ver. 0.9.5 (2015/XX/XXX) - wanna-be-released - New Features: - Enhancements: + * journald journalmatch for pure-ftpd (gh-1362) ver. 0.9.4 (2016/03/08) - for-you-ladies From 25c2334bc89a28812b1a3dc9ce4f3a8b502aeb0f Mon Sep 17 00:00:00 2001 From: jblachly Date: Wed, 16 Mar 2016 13:52:01 -0400 Subject: [PATCH 12/30] SmartOS PAM Authentication failed (not failURE) SmartOS (and likely other Illumos platforms) enter log entries for failed sshd logins of the form: `Authentication failed for USER from HOST` The current sshd.conf regex matches `failure` -- add to this a match for `failed` to support Illumos --- config/filter.d/sshd.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index 180ac52a..58e9c977 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -18,7 +18,7 @@ before = common.conf _daemon = sshd -failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|error) for .* from ( via \S+)?\s*$ +failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failed|failure|error) for .* from ( via \S+)?\s*$ ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from \s*$ ^%(__prefix_line)sFailed \S+ for .*? from (?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ \(serial \d+\) CA )?\S+ %(__md5hex)s(, client user ".*", client host ".*")?))?\s*$ ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM \s*$ From cf2aa9c1c02631b0b6603bc4f19c4668af1989a8 Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Mon, 21 Mar 2016 05:53:23 +0000 Subject: [PATCH 13/30] Added regex for LDAP authentication failures --- config/filter.d/dovecot.conf | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf index 856c220e..136a3947 100644 --- a/config/filter.d/dovecot.conf +++ b/config/filter.d/dovecot.conf @@ -13,6 +13,7 @@ failregex = ^%(__prefix_line)s(%(__pam_auth)s(\(dovecot:auth\))?:)?\s+authentica ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=(, lip=(\d{1,3}\.){3}\d{1,3})?(, TLS( handshaking(: SSL_accept\(\) failed: error:[\dA-F]+:SSL routines:[TLS\d]+_GET_CLIENT_HELLO:unknown protocol)?)?(: Disconnected)?)?(, session=<\S+>)?\s*$ ^%(__prefix_line)s(Info|dovecot: auth\(default\)|auth-worker\(\d+\)): pam\(\S+,\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$ ^%(__prefix_line)s(auth|auth-worker\(\d+\)): (pam|passwd-file)\(\S+,\): unknown user\s*$ + ^%(__prefix_line)s(auth|auth-worker\(\d+\)): Info: ldap\(\S*,,\S*\): invalid credentials\s*$ ignoreregex = @@ -22,9 +23,10 @@ journalmatch = _SYSTEMD_UNIT=dovecot.service # DEV Notes: # * the first regex is essentially a copy of pam-generic.conf -# * Probably doesn't do dovecot sql/ldap backends properly +# * Probably doesn't do dovecot sql/ldap backends properly (resolved in edit 21/03/2016) # * Removed the 'no auth attempts' log lines from the matches because produces # lots of false positives on misconfigured MTAs making regexp unusable # # Author: Martin Waschbuesch # Daniel Black (rewrote with begin and end anchors) +# Martin O'Neal (added LDAP authentication failure regex) From fe1475be952c8d76527bbe4b0c1249b0e6b10bf4 Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Mon, 21 Mar 2016 05:59:59 +0000 Subject: [PATCH 14/30] Additional exim regexes to cover common attacks... --- config/filter.d/exim.conf | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf index 11fd03d1..1af15430 100644 --- a/config/filter.d/exim.conf +++ b/config/filter.d/exim.conf @@ -14,10 +14,13 @@ before = exim-common.conf [Definition] failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$ - ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$ - ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$ - ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$ - ^%(pid)s SMTP call from \S+ \[\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$ + ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$ + ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$ + ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$ + ^%(pid)s SMTP call from \S+ \[\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$ + ^%(pid)s SMTP protocol error in "AUTH LOGIN(| \S*)" H=\(\S*\) \[\]\:\d+ I=\[\S*\]\:\d+ AUTH command used when not advertised\s*$ + ^%(pid)s no MAIL in SMTP connection from (|\S* )\[\]\:\d+ I=\[\S*\]\:\d+ D=\d+s(| C=\S*)\s*$ + ^%(pid)s \S+ SMTP connection from (|\S* )(|\(\S*\))\[\]\:\d+ I=\[\S*\]\:\d+ closed by DROP in ACL\s*$ ignoreregex = @@ -30,3 +33,4 @@ ignoreregex = # # Author: Cyril Jaquier # Daniel Black (rewrote with strong regexs) +# Martin O'Neal (added additional regexs to detect authentication failures, protocol errors, and drops) From eaf6bbb08f087c01b3ce2ede8e1b3051bfff2452 Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Wed, 23 Mar 2016 11:47:31 +0000 Subject: [PATCH 15/30] add test to catch LDAP auth failures --- fail2ban/tests/files/logs/dovecot | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fail2ban/tests/files/logs/dovecot b/fail2ban/tests/files/logs/dovecot index 4c2ccc94..627b8dc8 100644 --- a/fail2ban/tests/files/logs/dovecot +++ b/fail2ban/tests/files/logs/dovecot @@ -70,3 +70,6 @@ Jun 13 21:48:06 platypus dovecot: pop3-login: Disconnected: Inactivity (no auth Jun 13 20:20:21 platypus dovecot: imap-login: Disconnected (no auth attempts): rip=180.189.168.166, lip=113.212.99.194, TLS handshaking: Disconnected # failJSON: { "time": "2005-07-02T13:49:32", "match": false , "host": "192.51.100.13" } Jul 02 13:49:32 hostname dovecot[442]: pop3-login: Disconnected (no auth attempts in 58 secs): user=<>, rip=192.51.100.13, lip=203.0.113.17, session= + +# failJSON: { "time": "2005-03-23T06:10:52", "match": true , "host": "52.37.139.121" } +Mar 23 06:10:52 auth: Info: ldap(dog,52.37.139.121,): invalid credentials From 42f43d0f8aefe840d5f590634d9559217cffdc84 Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Wed, 23 Mar 2016 11:51:12 +0000 Subject: [PATCH 16/30] added note to cover dovecot ldap regex --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 7681e425..e3e57154 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,7 @@ ver. 0.9.5 (2015/XX/XXX) - wanna-be-released - Enhancements: * journald journalmatch for pure-ftpd (gh-1362) + * Add additional regex filter for dovecot ldap authentication failures ver. 0.9.4 (2016/03/08) - for-you-ladies From 28e246b5d78f59753dcc6eacb94ef021d051e4c9 Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Wed, 23 Mar 2016 11:52:09 +0000 Subject: [PATCH 17/30] added note to cover additional exim filters --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 7681e425..48829ef0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,7 @@ ver. 0.9.5 (2015/XX/XXX) - wanna-be-released - Enhancements: * journald journalmatch for pure-ftpd (gh-1362) + * added additional regex filters for exim ver. 0.9.4 (2016/03/08) - for-you-ladies From 33ef2311e7b6d31d940bec14358109841e1bed89 Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Wed, 23 Mar 2016 11:58:03 +0000 Subject: [PATCH 18/30] added tests to cover exim regex additions --- fail2ban/tests/files/logs/exim | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fail2ban/tests/files/logs/exim b/fail2ban/tests/files/logs/exim index c015eb29..36185604 100644 --- a/fail2ban/tests/files/logs/exim +++ b/fail2ban/tests/files/logs/exim @@ -43,3 +43,16 @@ # failJSON: { "time": "2014-12-02T03:00:23", "match": true , "host": "193.254.202.35" } 2014-12-02 03:00:23 auth_plain authenticator failed for (rom182) [193.254.202.35]:41556 I=[10.0.0.1]:25: 535 Incorrect authentication data (set_id=webmaster) + +# failJSON: { "time": "2016-03-18T00:34:06", "match": true , "host": "45.32.34.167" } +2016-03-18 00:34:06 [7513] SMTP protocol error in "AUTH LOGIN" H=(ylmf-pc) [45.32.34.167]:60723 I=[172.89.0.6]:587 AUTH command used when not advertised +# failJSON: { "time": "2016-03-19T18:40:44", "match": true , "host": "92.45.204.170" } +2016-03-19 18:40:44 [26221] SMTP protocol error in "AUTH LOGIN aW5mb0BtYW5iYXQub3Jn" H=([127.0.0.1]) [92.45.204.170]:14243 I=[172.89.0.6]:587 AUTH command used when not advertised +# failJSON: { "time": "2016-03-21T06:38:05", "match": true , "host": "49.212.207.15" } +2016-03-21 06:38:05 [5718] no MAIL in SMTP connection from www3005.sakura.ne.jp [49.212.207.15]:28890 I=[172.89.0.6]:25 D=21s C=EHLO,STARTTLS +# failJSON: { "time": "2016-03-21T06:57:36", "match": true , "host": "122.165.71.116" } +2016-03-21 06:57:36 [5908] no MAIL in SMTP connection from [122.165.71.116]:2056 I=[172.89.0.6]:25 D=10s +# failJSON: { "time": "2016-03-21T04:07:49", "match": true , "host": "174.137.147.204" } +2016-03-21 04:07:49 [25874] 1ahr79-0006jK-G9 SMTP connection from (voyeur.webair.com) [174.137.147.204]:44884 I=[172.89.0.6]:25 closed by DROP in ACL +# failJSON: { "time": "2016-03-21T04:33:13", "match": true , "host": "206.214.71.53" } +2016-03-21 04:33:13 [26074] 1ahrVl-0006mY-79 SMTP connection from riveruse.com [206.214.71.53]:39865 I=[172.89.0.6]:25 closed by DROP in ACL From e9202fa0b2805833c9383b154986335df7cbca0e Mon Sep 17 00:00:00 2001 From: jblachly Date: Thu, 24 Mar 2016 00:43:15 -0400 Subject: [PATCH 19/30] Placed failure (illumos) at end of regex --- config/filter.d/sshd.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index 58e9c977..eeb1518e 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -18,7 +18,7 @@ before = common.conf _daemon = sshd -failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failed|failure|error) for .* from ( via \S+)?\s*$ +failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|error|failed) for .* from ( via \S+)?\s*$ ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from \s*$ ^%(__prefix_line)sFailed \S+ for .*? from (?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ \(serial \d+\) CA )?\S+ %(__md5hex)s(, client user ".*", client host ".*")?))?\s*$ ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM \s*$ From 3d239215cd2681951d9bce20f2622fa0565136d6 Mon Sep 17 00:00:00 2001 From: TorontoMedia Date: Thu, 17 Mar 2016 05:33:14 +0100 Subject: [PATCH 20/30] Two new firewalld actions with rich rules for firewalld-0.3.1+ (gh-1367) closes #1367 --- ChangeLog | 5 +- config/action.d/firewallcmd-allports.conf | 2 +- config/action.d/firewallcmd-multiport.conf | 6 +- config/action.d/firewallcmd-rich-logging.conf | 65 +++++++++++++++++++ config/action.d/firewallcmd-rich-rules.conf | 57 ++++++++++++++++ 5 files changed, 129 insertions(+), 6 deletions(-) create mode 100644 config/action.d/firewallcmd-rich-logging.conf create mode 100644 config/action.d/firewallcmd-rich-rules.conf diff --git a/ChangeLog b/ChangeLog index 80a92edb..6d8f4567 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,13 +6,14 @@ Fail2Ban: Changelog =================== -ver. 0.9.5 (2015/XX/XXX) - wanna-be-released +ver. 0.9.5 (2016/XX/XXX) - wanna-be-released ----------- - Fixes: - New Features: - + * New Actions: + - action.d/firewallcmd-rich-rules and action.d/firewallcmd-rich-logging (gh-1367) - Enhancements: * journald journalmatch for pure-ftpd (gh-1362) * Add additional regex filter for dovecot ldap authentication failures (gh-1370) diff --git a/config/action.d/firewallcmd-allports.conf b/config/action.d/firewallcmd-allports.conf index ec52babb..571d5ba6 100644 --- a/config/action.d/firewallcmd-allports.conf +++ b/config/action.d/firewallcmd-allports.conf @@ -6,7 +6,7 @@ [INCLUDES] -before = iptables-blocktype.conf +before = iptables-common.conf [Definition] diff --git a/config/action.d/firewallcmd-multiport.conf b/config/action.d/firewallcmd-multiport.conf index 4d806e6b..438d4cf7 100644 --- a/config/action.d/firewallcmd-multiport.conf +++ b/config/action.d/firewallcmd-multiport.conf @@ -5,15 +5,15 @@ [INCLUDES] -before = iptables-blocktype.conf +before = iptables-common.conf [Definition] actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b- firewall-cmd --direct --add-rule ipv4 filter f2b- 1000 -j RETURN - firewall-cmd --direct --add-rule ipv4 filter 0 -m state --state NEW -p -m multiport --dports -j f2b- + firewall-cmd --direct --add-rule ipv4 filter 0 -m conntrack --ctstate NEW -p -m multiport --dports -j f2b- -actionstop = firewall-cmd --direct --remove-rule ipv4 filter 0 -m state --state NEW -p -m multiport --dports -j f2b- +actionstop = firewall-cmd --direct --remove-rule ipv4 filter 0 -m conntrack --ctstate NEW -p -m multiport --dports -j f2b- firewall-cmd --direct --remove-rules ipv4 filter f2b- firewall-cmd --direct --remove-chain ipv4 filter f2b- diff --git a/config/action.d/firewallcmd-rich-logging.conf b/config/action.d/firewallcmd-rich-logging.conf new file mode 100644 index 00000000..1b88c2d9 --- /dev/null +++ b/config/action.d/firewallcmd-rich-logging.conf @@ -0,0 +1,65 @@ +# Fail2Ban configuration file +# +# Author: Donald Yandt +# +# Because of the rich rule commands requires firewalld-0.3.1+ +# This action uses firewalld rich-rules which gives you a cleaner iptables since it stores rules according to zones and not +# by chain. So for an example all deny rules will be listed under _deny and all log rules under _log. +# +# Also this action logs banned access attempts so you can filter that and increase ban time for offenders. +# +# If you use the --permanent rule you get a xml file in /etc/firewalld/zones/.xml that can be shared and parsed easliy +# +# Example commands to view rules: +# firewall-cmd [--zone=] --list-rich-rules +# firewall-cmd [--zone=] --list-all +# firewall-cmd [--zone=zone] --query-rich-rule='rule' + +[Definition] + +actionstart = + +actionstop = + +actioncheck = + +# you can also use zones and/or service names. +# +# zone example: +# firewall-cmd --zone= --add-rich-rule="rule family='ipv4' source address='' port port='' protocol='' log prefix='f2b-' level='' limit value='/m' " +# service name example: +# firewall-cmd --zone= --add-rich-rule="rule family='ipv4' source address='' service name='' log prefix='f2b-' level='' limit value='/m' " +# Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges seperated by a comma or space for an example: http, https, 22-60, 18 smtp + +actionban = ports=""; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='' port port='$p' protocol='' log prefix='f2b-' level='' limit value='/m' "; done + +actionunban = ports=""; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='' port port='$p' protocol='' log prefix='f2b-' level='' limit value='/m' "; done + +[Init] + +name = default + +# log levels are "emerg", "alert", "crit", "error", "warning", "notice", "info" or "debug" +level = info + +# log rate per minute +rate = 1 + +zone = public + +# use command firewall-cmd --get-services to see a list of services available +# +# Examples: +# +# amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps +# freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos +# kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s +# postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy +# telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server + +service = ssh + +# reject types: 'icmp-net-unreachable', 'icmp-host-unreachable', 'icmp-port-unreachable', 'icmp-proto-unreachable', +# 'icmp-net-prohibited', 'icmp-host-prohibited', 'icmp-admin-prohibited' or 'tcp-reset' + +blocktype = reject type='icmp-port-unreachable' diff --git a/config/action.d/firewallcmd-rich-rules.conf b/config/action.d/firewallcmd-rich-rules.conf new file mode 100644 index 00000000..4e39df54 --- /dev/null +++ b/config/action.d/firewallcmd-rich-rules.conf @@ -0,0 +1,57 @@ +# Fail2Ban configuration file +# +# Author: Donald Yandt +# +# Because of the rich rule commands requires firewalld-0.3.1+ +# This action uses firewalld rich-rules which gives you a cleaner iptables since it stores rules according to zones and not +# by chain. So for an example all deny rules will be listed under _deny. +# +# If you use the --permanent rule you get a xml file in /etc/firewalld/zones/.xml that can be shared and parsed easliy +# +# Example commands to view rules: +# firewall-cmd [--zone=] --list-rich-rules +# firewall-cmd [--zone=] --list-all +# firewall-cmd [--zone=zone] --query-rich-rule='rule' + +[Definition] + +actionstart = + +actionstop = + +actioncheck = + +#you can also use zones and/or service names. +# +# zone example: +# firewall-cmd --zone= --add-rich-rule="rule family='ipv4' source address='' port port='' protocol='' " +# service name example: +# firewall-cmd --zone= --add-rich-rule="rule family='ipv4' source address='' service name='' " +# Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges seperated by a comma or space for an example: http, https, 22-60, 18 smtp + +actionban = ports=""; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='' port port='$p' protocol='' "; done + +actionunban = ports=""; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='' port port='$p' protocol='' "; done + +[Init] + +name = default + +zone = public + +# use command firewall-cmd --get-services to see a list of services available +# +# Examples: +# +# amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps +# freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos +# kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s +# postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy +# telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server + +service = ssh + +# reject types: 'icmp-net-unreachable', 'icmp-host-unreachable', 'icmp-port-unreachable', 'icmp-proto-unreachable', +# 'icmp-net-prohibited', 'icmp-host-prohibited', 'icmp-admin-prohibited' or 'tcp-reset' + +blocktype = reject type='icmp-port-unreachable' From 9d7e860edb7f77dd29479e6c60453697030224cb Mon Sep 17 00:00:00 2001 From: sebres Date: Thu, 31 Mar 2016 11:43:14 +0200 Subject: [PATCH 21/30] possibility to increase verbosity up to heavy debug (partial ported from 716-cs) --- bin/fail2ban-client | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/bin/fail2ban-client b/bin/fail2ban-client index 7f3f5639..bc0c0be8 100755 --- a/bin/fail2ban-client +++ b/bin/fail2ban-client @@ -376,8 +376,10 @@ class Fail2banClient: logSys.setLevel(logging.WARNING) elif verbose == 2: logSys.setLevel(logging.INFO) - else: + elif verbose == 3: logSys.setLevel(logging.DEBUG) + else: + logSys.setLevel(logging.HEAVYDEBUG) # Add the default logging handler to dump to stderr logout = logging.StreamHandler(sys.stderr) # set a format which is simpler for console use From 1eb51b1bc2cfb2b0c37016cad9fe665a843eba73 Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Fri, 1 Apr 2016 18:07:01 +0100 Subject: [PATCH 22/30] Tightened up regexes to catch rDNS entries --- config/filter.d/exim.conf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf index 1af15430..4aadf15c 100644 --- a/config/filter.d/exim.conf +++ b/config/filter.d/exim.conf @@ -18,9 +18,9 @@ failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user| ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$ ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$ ^%(pid)s SMTP call from \S+ \[\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$ - ^%(pid)s SMTP protocol error in "AUTH LOGIN(| \S*)" H=\(\S*\) \[\]\:\d+ I=\[\S*\]\:\d+ AUTH command used when not advertised\s*$ - ^%(pid)s no MAIL in SMTP connection from (|\S* )\[\]\:\d+ I=\[\S*\]\:\d+ D=\d+s(| C=\S*)\s*$ - ^%(pid)s \S+ SMTP connection from (|\S* )(|\(\S*\))\[\]\:\d+ I=\[\S*\]\:\d+ closed by DROP in ACL\s*$ + ^%(pid)s SMTP protocol error in "AUTH \S*(| \S*)" H=(|\S* )(|\(\S*\) )\[\]\:\d+ I=\[\S*\]\:\d+ AUTH command used when not advertised\s*$ + ^%(pid)s no MAIL in SMTP connection from (|\S* )(|\(\S*\) )\[\]\:\d+ I=\[\S*\]\:\d+ D=\d+s(| C=\S*)\s*$ + ^%(pid)s \S+ SMTP connection from (|\S* )(|\(\S*\) )\[\]\:\d+ I=\[\S*\]\:\d+ closed by DROP in ACL\s*$ ignoreregex = From fcca1413b0800bfec091aa04c4c34d770aac8daa Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Fri, 1 Apr 2016 18:47:19 +0100 Subject: [PATCH 23/30] rDNS tests added additional tests to cover logs with rDNS --- fail2ban/tests/files/logs/exim | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fail2ban/tests/files/logs/exim b/fail2ban/tests/files/logs/exim index 36185604..a3b287d4 100644 --- a/fail2ban/tests/files/logs/exim +++ b/fail2ban/tests/files/logs/exim @@ -56,3 +56,10 @@ 2016-03-21 04:07:49 [25874] 1ahr79-0006jK-G9 SMTP connection from (voyeur.webair.com) [174.137.147.204]:44884 I=[172.89.0.6]:25 closed by DROP in ACL # failJSON: { "time": "2016-03-21T04:33:13", "match": true , "host": "206.214.71.53" } 2016-03-21 04:33:13 [26074] 1ahrVl-0006mY-79 SMTP connection from riveruse.com [206.214.71.53]:39865 I=[172.89.0.6]:25 closed by DROP in ACL + +# failJSON: { "time": "2016-04-01T11:08:39", "match": true , "host": "192.0.2.1" } +2016-04-01 11:08:39 [18643] no MAIL in SMTP connection from host.example.com (SERVER) [192.0.2.1]:1418 I=[172.89.0.6]:25 D=34s C=EHLO,AUTH +# failJSON: { "time": "2016-04-01T11:09:21", "match": true , "host": "192.0.2.1" } +2016-04-01 11:09:21 [18648] SMTP protocol error in "AUTH LOGIN" H=host.example.com (SERVER) [192.0.2.1]:4692 I=[172.89.0.6]:25 AUTH command used when not advertised +# failJSON: { "time": "2016-03-27T16:48:48", "match": true , "host": "192.0.2.1" } +2016-03-27 16:48:48 [21478] 1akDqs-0005aQ-9b SMTP connection from host.example.com (SERVER) [192.0.2.1]:47714 I=[172.89.0.6]:25 closed by DROP in ACL From 1a299409e5750b0a4ec4d3d820b278c0366fe5da Mon Sep 17 00:00:00 2001 From: Alexandre Perrin Date: Thu, 14 Apr 2016 12:10:58 +0200 Subject: [PATCH 24/30] Fix postfix/smtps/smtpd matching. --- config/filter.d/postfix-sasl.conf | 2 +- config/filter.d/postfix.conf | 2 +- fail2ban/tests/files/logs/postfix | 3 +++ fail2ban/tests/files/logs/postfix-sasl | 3 +++ 4 files changed, 8 insertions(+), 2 deletions(-) diff --git a/config/filter.d/postfix-sasl.conf b/config/filter.d/postfix-sasl.conf index 7ff995c9..470b069d 100644 --- a/config/filter.d/postfix-sasl.conf +++ b/config/filter.d/postfix-sasl.conf @@ -7,7 +7,7 @@ before = common.conf [Definition] -_daemon = postfix(-\w+)?/(submission/)?smtp(d|s) +_daemon = postfix(-\w+)?/((?:submission|smtps)/)?smtpd failregex = ^%(__prefix_line)swarning: [-._\w]+\[\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/:]*={0,2})?\s*$ diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf index 002b02b2..e162c1ff 100644 --- a/config/filter.d/postfix.conf +++ b/config/filter.d/postfix.conf @@ -10,7 +10,7 @@ before = common.conf [Definition] -_daemon = postfix(-\w+)?/(submission/)?smtp(d|s) +_daemon = postfix(-\w+)?/((?:submission|smtps)/)?smtpd failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 554 5\.7\.1 .*$ ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 450 4\.7\.1 Client host rejected: cannot find your hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$ diff --git a/fail2ban/tests/files/logs/postfix b/fail2ban/tests/files/logs/postfix index 3ec2886a..78f72287 100644 --- a/fail2ban/tests/files/logs/postfix +++ b/fail2ban/tests/files/logs/postfix @@ -32,3 +32,6 @@ Jan 31 13:55:24 xxx postfix/smtpd[3462]: NOQUEUE: reject: EHLO from s271272.stat # failJSON: { "time": "2005-01-31T13:55:24", "match": true , "host": "78.107.251.238" } Jan 31 13:55:24 xxx postfix-incoming/smtpd[3462]: NOQUEUE: reject: EHLO from s271272.static.corbina.ru[78.107.251.238]: 504 5.5.2 : Helo command rejected: need fully-qualified hostname; proto=SMTP helo= + +# failJSON: { "time": "2005-04-12T02:24:11", "match": true , "host": "62.138.2.143" } +Apr 12 02:24:11 xxx postfix/smtps/smtpd[42]: NOQUEUE: reject: EHLO from astra4139.startdedicated.de[62.138.2.143]: 504 5.5.2 : Helo command rejected: need fully-qualified hostname; proto=SMTP helo= diff --git a/fail2ban/tests/files/logs/postfix-sasl b/fail2ban/tests/files/logs/postfix-sasl index 586f9584..9fcb0f49 100644 --- a/fail2ban/tests/files/logs/postfix-sasl +++ b/fail2ban/tests/files/logs/postfix-sasl @@ -23,3 +23,6 @@ Feb 3 08:29:28 mail postfix/smtpd[21022]: warning: unknown[1.1.1.1]: SASL LOGIN # failJSON: { "time": "2005-01-29T08:11:45", "match": true , "host": "1.1.1.1" } Jan 29 08:11:45 mail postfix-incoming/smtpd[10752]: warning: unknown[1.1.1.1]: SASL LOGIN authentication failed: Password: + +# failJSON: { "time": "2005-04-12T02:24:11", "match": true , "host": "62.138.2.143" } +Apr 12 02:24:11 xxx postfix/smtps/smtpd[42]: warning: astra4139.startdedicated.de[62.138.2.143]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 From 7712310d2d9f36a3502cd4807bb40a02edfe3df7 Mon Sep 17 00:00:00 2001 From: Alexandre Perrin Date: Thu, 14 Apr 2016 13:54:58 +0200 Subject: [PATCH 25/30] Be more backward compatible on matching postfix/smtps/smtpd Support trailing smtps also and not only smtpd. suggested by @sebres --- config/filter.d/postfix-sasl.conf | 2 +- config/filter.d/postfix.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/filter.d/postfix-sasl.conf b/config/filter.d/postfix-sasl.conf index 470b069d..4a6ceaaa 100644 --- a/config/filter.d/postfix-sasl.conf +++ b/config/filter.d/postfix-sasl.conf @@ -7,7 +7,7 @@ before = common.conf [Definition] -_daemon = postfix(-\w+)?/((?:submission|smtps)/)?smtpd +_daemon = postfix(-\w+)?/(?:submission/|smtps/)?smtp[ds] failregex = ^%(__prefix_line)swarning: [-._\w]+\[\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/:]*={0,2})?\s*$ diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf index e162c1ff..3051409b 100644 --- a/config/filter.d/postfix.conf +++ b/config/filter.d/postfix.conf @@ -10,7 +10,7 @@ before = common.conf [Definition] -_daemon = postfix(-\w+)?/((?:submission|smtps)/)?smtpd +_daemon = postfix(-\w+)?/(?:submission/|smtps/)?smtp[ds] failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 554 5\.7\.1 .*$ ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 450 4\.7\.1 Client host rejected: cannot find your hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$ From e595fefc9b2f3ab0e17abcca563dd63dbba4157c Mon Sep 17 00:00:00 2001 From: sebres Date: Thu, 14 Apr 2016 14:50:17 +0200 Subject: [PATCH 26/30] change log and thanks entries --- ChangeLog | 2 ++ THANKS | 1 + 2 files changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index e51a2962..033cd9ec 100644 --- a/ChangeLog +++ b/ChangeLog @@ -13,6 +13,8 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released * filter.d/monit.conf - extended failregex with new monit "access denied" version (gh-1355); - failregex of previous monit version merged as single expression. + * filter.d/postfix.conf, filter.d/postfix-sasl.conf + - extended failregex daemon part, matching also `postfix/smtps/smtpd` now (gh-1391) - New Features: * New Actions: diff --git a/THANKS b/THANKS index cfcab3ad..64de43a4 100644 --- a/THANKS +++ b/THANKS @@ -12,6 +12,7 @@ Adrien Clerc ache ag4ve (Shawn) Alasdair D. Campbell +Alexandre Perrin (kAworu) Amir Caspi Amy Andrew St. Jean From add67227f4d7dd03ba840c3faae2d7211d4e3d39 Mon Sep 17 00:00:00 2001 From: Daniel Aleksandersen Date: Sun, 24 Apr 2016 02:20:02 +0200 Subject: [PATCH 27/30] Use HTTPS in Debuggex URLs --- fail2ban/client/fail2banregex.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/client/fail2banregex.py b/fail2ban/client/fail2banregex.py index d0cdab84..7c56a77e 100755 --- a/fail2ban/client/fail2banregex.py +++ b/fail2ban/client/fail2banregex.py @@ -61,7 +61,7 @@ def debuggexURL(sample, regex): q = urllib.urlencode({ 're': regex.replace('', '(?&.ipv4)'), 'str': sample, 'flavor': 'python' }) - return 'http://www.debuggex.com/?' + q + return 'https://www.debuggex.com/?' + q def output(args): print(args) From d889918f19964071d752c4fa5e7b0b0020699c6d Mon Sep 17 00:00:00 2001 From: jungle-boogie Date: Sun, 24 Apr 2016 21:35:18 -0700 Subject: [PATCH 28/30] update doc url direct to confluence page. no code changes. --- config/filter.d/freeswitch.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/freeswitch.conf b/config/filter.d/freeswitch.conf index ecc4a8bd..1ef5a256 100644 --- a/config/filter.d/freeswitch.conf +++ b/config/filter.d/freeswitch.conf @@ -16,7 +16,7 @@ failregex = ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ SIP auth (failure|challenge) \(( ignoreregex = # Author: Rupa SChomaker, soapee01, Daniel Black -# http://wiki.freeswitch.org/wiki/Fail2ban +# https://freeswitch.org/confluence/display/FREESWITCH/Fail2Ban # Thanks to Jim on mailing list of samples and guidance # # No need to match the following. Its a duplicate of the SIP auth regex. From 340a5a23f4a8453294de2bc5fe54690241230875 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 26 Apr 2016 09:30:36 -0400 Subject: [PATCH 29/30] BF+ENH: fixed up testing querying cymru information + assert_dict_equal helper --- fail2ban/tests/banmanagertestcase.py | 43 +++++++++++++++------------- fail2ban/tests/utils.py | 8 +++++- 2 files changed, 30 insertions(+), 21 deletions(-) diff --git a/fail2ban/tests/banmanagertestcase.py b/fail2ban/tests/banmanagertestcase.py index 09d2411e..8c58994c 100644 --- a/fail2ban/tests/banmanagertestcase.py +++ b/fail2ban/tests/banmanagertestcase.py @@ -28,7 +28,7 @@ import unittest from ..server.banmanager import BanManager from ..server.ticket import BanTicket - +from .utils import assert_dict_equal class AddFailure(unittest.TestCase): def setUp(self): @@ -74,15 +74,10 @@ class StatusExtendedCymruInfo(unittest.TestCase): def testCymruInfo(self): cymru_info = self.__banManager.getBanListExtendedCymruInfo() - if "assertDictEqual" in dir(self): - self.assertDictEqual(cymru_info, {"asn": [self.__asn], - "country": [self.__country], - "rir": [self.__rir]}) - else: - # Python 2.6 does not support assertDictEqual() - self.assertEqual(cymru_info["asn"], [self.__asn]) - self.assertEqual(cymru_info["country"], [self.__country]) - self.assertEqual(cymru_info["rir"], [self.__rir]) + assert_dict_equal(cymru_info, + {"asn": [self.__asn], + "country": [self.__country], + "rir": [self.__rir]}) def testCymruInfoASN(self): self.assertEqual( @@ -100,16 +95,24 @@ class StatusExtendedCymruInfo(unittest.TestCase): [self.__rir]) def testCymruInfoNxdomain(self): - ticket = BanTicket("10.0.0.0", 1167605999.0) self.__banManager = BanManager() + + # non-existing IP + ticket = BanTicket("0.0.0.0", 1167605999.0) self.assertTrue(self.__banManager.addBanTicket(ticket)) cymru_info = self.__banManager.getBanListExtendedCymruInfo() - if "assertDictEqual" in dir(self): - self.assertDictEqual(cymru_info, {"asn": ["nxdomain"], - "country": ["nxdomain"], - "rir": ["nxdomain"]}) - else: - # Python 2.6 does not support assertDictEqual() - self.assertEqual(cymru_info["asn"], ["nxdomain"]) - self.assertEqual(cymru_info["country"], ["nxdomain"]) - self.assertEqual(cymru_info["rir"], ["nxdomain"]) + assert_dict_equal(cymru_info, + {"asn": ["nxdomain"], + "country": ["nxdomain"], + "rir": ["nxdomain"]}) + + # even for private IPs ASNs defined + # Since it outputs for all active tickets we would get previous results + # and new ones + ticket = BanTicket("10.0.0.0", 1167606000.0) + self.assertTrue(self.__banManager.addBanTicket(ticket)) + cymru_info = self.__banManager.getBanListExtendedCymruInfo() + assert_dict_equal(cymru_info, + {"asn": ["nxdomain", "4565",], + "country": ["nxdomain", "unknown"], + "rir": ["nxdomain", "other"]}) diff --git a/fail2ban/tests/utils.py b/fail2ban/tests/utils.py index 0c29e638..8fc78683 100644 --- a/fail2ban/tests/utils.py +++ b/fail2ban/tests/utils.py @@ -312,4 +312,10 @@ else: kernel32.CloseHandle(process) return True else: - return False \ No newline at end of file + return False + +# Python 2.6 compatibility. in 2.7 assertDictEqual +def assert_dict_equal(a, b): + assert isinstance(a, dict), "Object is not dictionary: %r" % a + assert isinstance(b, dict), "Object is not dictionary: %r" % b + assert a==b, "Dictionaries differ:\n%r !=\n%r" % (a, b) From 75eb240846f91452ae7ff397dc88c69f8459a794 Mon Sep 17 00:00:00 2001 From: Daniel Aleksandersen Date: Sat, 30 Apr 2016 16:18:56 +0200 Subject: [PATCH 30/30] Assert https not http Resolves test regression from issue #1395. --- fail2ban/tests/fail2banregextestcase.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/tests/fail2banregextestcase.py b/fail2ban/tests/fail2banregextestcase.py index e4af50ea..49d6a3a6 100644 --- a/fail2ban/tests/fail2banregextestcase.py +++ b/fail2ban/tests/fail2banregextestcase.py @@ -175,6 +175,6 @@ class Fail2banRegexTest(LogCaptureTestCase): self.assertTrue(fail2banRegex.start(opts, args)) self.assertLogged('Lines: 4 lines, 0 ignored, 2 matched, 2 missed') - self.assertLogged('http://') + self.assertLogged('https://')