From 15ce210cd0ab5df20089abb174d7df1b95150d40 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 5 Mar 2008 23:14:22 -0500
Subject: [PATCH 1/3] BF: apache-* jails -- authentication failures are
 recorded in *error.log files, thus paths were adjusted

---
 debian/jail.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/debian/jail.conf b/debian/jail.conf
index 1169bbb0..7342cd44 100644
--- a/debian/jail.conf
+++ b/debian/jail.conf
@@ -127,7 +127,7 @@ maxretry = 6
 enabled = false
 port	= http,https
 filter	= apache-auth
-logpath = /var/log/apache*/*access.log
+logpath = /var/log/apache*/*error.log
 maxretry = 6
 
 # default action is now multiport, so apache-multiport jail was left
@@ -137,7 +137,7 @@ maxretry = 6
 enabled   = false
 port	  = http,https
 filter	  = apache-auth
-logpath   = /var/log/apache*/*access.log
+logpath   = /var/log/apache*/*error.log
 maxretry  = 6
 
 [apache-noscript]

From 5d6d07508dae8885dcc13a708c82b2677bd14b96 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 5 Mar 2008 23:18:04 -0500
Subject: [PATCH 2/3] minor: adjusted comment for named jails to come closer to
 upstream

---
 debian/jail.conf | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/debian/jail.conf b/debian/jail.conf
index 7342cd44..bb010d79 100644
--- a/debian/jail.conf
+++ b/debian/jail.conf
@@ -226,12 +226,21 @@ logpath  = /var/log/mail.log
 
 # DNS Servers
 
-# Mention: by default logging is off with bind installation.
-# Need smth like
+
+# These jails block attacks against named (bind9). By default, logging is off
+# with bind9 installation. You will need something like this:
+#
 # logging {
-#       channel security_file { file "/var/log/named/security.log" versions 3 size 30m; severity dynamic; print-time yes; };
-# 		category security { security_file; };
+#     channel security_file {
+#         file "/var/log/named/security.log" versions 3 size 30m;
+#         severity dynamic;
+#         print-time yes;
+#     };
+#     category security {
+#         security_file;
+#     };
 # }
+#
 # in your named.conf to provide proper logging
 
 # Word of Caution:

From a88fd271c41573d2cbb58f59194fe7117cbb496a Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 5 Mar 2008 23:28:57 -0500
Subject: [PATCH 3/3] 2 new jails: xinetd-fail, apache-overflows added to
 jails.conf

---
 debian/jail.conf | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/debian/jail.conf b/debian/jail.conf
index bb010d79..ce9c7eb1 100644
--- a/debian/jail.conf
+++ b/debian/jail.conf
@@ -109,6 +109,15 @@ port     = anyport
 logpath  = /var/log/auth.log
 maxretry = 6
 
+[xinetd-fail]
+
+enabled   = false
+filter    = xinetd-fail
+port      = all
+banaction = iptables-multiport-log
+logpath   = /var/log/daemon.log
+maxretry  = 2
+
 
 [ssh-ddos]
 
@@ -148,6 +157,14 @@ filter  = apache-noscript
 logpath = /var/log/apache*/*error.log
 maxretry = 6
 
+[apache-overflows]
+
+enabled = false
+port    = http,https
+filter  = apache-overflows
+logpath = /var/log/apache*/*error.log
+maxretry = 2
+
 #
 # FTP servers
 #