diff --git a/.travis.yml b/.travis.yml index 4dafda11..41eeca27 100644 --- a/.travis.yml +++ b/.travis.yml @@ -12,7 +12,7 @@ before_install: install: - pip install pyinotify - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get install -qq python-gamin; cp /usr/share/pyshared/gamin.py /usr/lib/pyshared/python2.7/_gamin.so $VIRTUAL_ENV/lib/python2.7/site-packages/; fi - - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then pip install -q coveralls; fi + - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then cd ..; pip install -q coveralls; cd -; fi script: - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then coverage run --rcfile=.travis_coveragerc setup.py test; else python setup.py test; fi after_success: diff --git a/ChangeLog b/ChangeLog index 5e625c1c..701c418c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -90,6 +90,7 @@ ver. 0.8.13 (2014/XX/XXX) - maintenance-only-from-now-on - New Features: - filter nagios - detects unauthorized access to the nrpe daemon (Ivo Truxa) + - filter sendmail-{auth,reject} (jserrachinha and cepheid666 and fab23). - Enhancements: - filter pureftpd - added all translations of "Authentication failed for diff --git a/MANIFEST b/MANIFEST index 7a997382..e4643583 100644 --- a/MANIFEST +++ b/MANIFEST @@ -202,6 +202,11 @@ config/filter.d/postfix.conf config/filter.d/proftpd.conf config/filter.d/pure-ftpd.conf config/filter.d/qmail.conf +config/filter.d/pam-generic.conf +config/filter.d/php-url-fopen.conf +config/filter.d/postfix-sasl.conf +config/filter.d/sendmail-auth.conf +config/filter.d/sendmail-reject.conf config/filter.d/sieve.conf config/filter.d/solid-pop3d.conf config/filter.d/squid.conf diff --git a/THANKS b/THANKS index f252edbf..30b8f023 100644 --- a/THANKS +++ b/THANKS @@ -21,6 +21,7 @@ Bas van den Dikkenberg Beau Raines Bill Heaton Carlos Alberto Lopez Perez +cepheid666 Christian Rauch Christophe Carles Christoph Haas @@ -51,6 +52,7 @@ Jonathan Lanning Jonathan Underwood Joël Bertrand JP Espinosa +jserrachinha Justin Shore Kévin Drapel kjohnsonecl @@ -99,5 +101,6 @@ Yaroslav Halchenko Winston Smith ykimon Yehuda Katz +Zbigniew Jędrzejewski-Szmek zugeschmiert Zurd diff --git a/bin/fail2ban-client b/bin/fail2ban-client index 15fad1b0..8737c49d 100755 --- a/bin/fail2ban-client +++ b/bin/fail2ban-client @@ -325,7 +325,7 @@ class Fail2banClient: if verbose <= 0: logSys.setLevel(logging.ERROR) elif verbose == 1: - logSys.setLevel(logging.WARN) + logSys.setLevel(logging.WARNING) elif verbose == 2: logSys.setLevel(logging.INFO) else: diff --git a/bin/fail2ban-regex b/bin/fail2ban-regex index ccdb7eac..fffa8c39 100755 --- a/bin/fail2ban-regex +++ b/bin/fail2ban-regex @@ -131,7 +131,7 @@ Report bugs to https://github.com/fail2ban/fail2ban/issues "\"systemd-journal\" only"), Option('-l', "--log-level", type="choice", dest="log_level", - choices=('heavydebug', 'debug', 'info', 'warning', 'error', 'fatal'), + choices=('heavydebug', 'debug', 'info', 'notice', 'warning', 'error', 'critical'), default=None, help="Log level for the Fail2Ban logger to use"), Option("-v", "--verbose", action='store_true', @@ -476,9 +476,9 @@ if __name__ == "__main__": logSys.setLevel(getattr(logging, opts.log_level.upper())) else: # pragma: no cover # suppress the logging but it would leave unittests' progress dots - # ticking, unless like with '-l fatal' which would be silent + # ticking, unless like with '-l critical' which would be silent # unless error occurs - logSys.setLevel(getattr(logging, 'FATAL')) + logSys.setLevel(getattr(logging, 'CRITICAL')) # Add the default logging handler stdout = logging.StreamHandler(sys.stdout) diff --git a/bin/fail2ban-testcases b/bin/fail2ban-testcases index 578763d9..b3bddf1c 100755 --- a/bin/fail2ban-testcases +++ b/bin/fail2ban-testcases @@ -48,7 +48,7 @@ def get_opt_parser(): p.add_options([ Option('-l', "--log-level", type="choice", dest="log_level", - choices=('heavydebug', 'debug', 'info', 'warning', 'error', 'fatal'), + choices=('heavydebug', 'debug', 'info', 'notice', 'warning', 'error', 'critical'), default=None, help="Log level for the logger to use during running tests"), Option('-n', "--no-network", action="store_true", @@ -75,9 +75,10 @@ logSys = logging.getLogger("fail2ban") verbosity = {'heavydebug': 4, 'debug': 3, 'info': 2, + 'notice': 2, 'warning': 1, 'error': 1, - 'fatal': 0, + 'critical': 0, None: 1}[opts.log_level] if opts.log_level is not None: # pragma: no cover @@ -85,9 +86,9 @@ if opts.log_level is not None: # pragma: no cover logSys.setLevel(getattr(logging, opts.log_level.upper())) else: # pragma: no cover # suppress the logging but it would leave unittests' progress dots - # ticking, unless like with '-l fatal' which would be silent + # ticking, unless like with '-l critical' which would be silent # unless error occurs - logSys.setLevel(getattr(logging, 'FATAL')) + logSys.setLevel(getattr(logging, 'CRITICAL')) # Add the default logging handler stdout = logging.StreamHandler(sys.stdout) @@ -111,7 +112,7 @@ logSys.addHandler(stdout) # # Let know the version # -if not opts.log_level or opts.log_level != 'fatal': # pragma: no cover +if not opts.log_level or opts.log_level != 'critical': # pragma: no cover print("Fail2ban %s test suite. Python %s. Please wait..." \ % (version, str(sys.version).replace('\n', ''))) diff --git a/config/action.d/complain.conf b/config/action.d/complain.conf index 62331f19..c0175831 100644 --- a/config/action.d/complain.conf +++ b/config/action.d/complain.conf @@ -1,17 +1,16 @@ # Fail2Ban configuration file # -# Author: Russell Odom +# Author: Russell Odom , Daniel Black # Sends a complaint e-mail to addresses listed in the whois record for an # offending IP address. +# This uses the https://abusix.com/contactdb.html to lookup abuse contacts. +# +# DEPENDANCIES: +# This requires the dig command from bind-utils # # You should provide the in the jail config - lines from the log # matching the given IP address will be provided in the complaint as evidence. # -# Note that we will try to use e-mail addresses that are most likely to be abuse -# addresses (based on various keywords). If they aren't found we fall back on -# any other addresses found in the whois record, with a few exceptions. -# If no addresses are found, no e-mail is sent. -# # WARNING # ------- # @@ -55,10 +54,10 @@ actioncheck = # Tags: See jail.conf(5) man page # Values: CMD # -actionban = ADDRESSES=`whois | perl -e 'while () { next if /^changed|@(ripe|apnic)\.net/io; $m += (/abuse|trouble:|report|spam|security/io?3:0); if (/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)/io) { while (s/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)//io) { if ($m) { $a{lc($1)}=$m } else { $b{lc($1)}=$m } } $m=0 } else { $m && --$m } } if (%%a) {print join(",",keys(%%a))} else {print join(",",keys(%%b))}'` +actionban = oifs=${IFS}; IFS=.;SEP_IP=( ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs} IP= if [ ! -z "$ADDRESSES" ]; then - (printf %%b "\n"; date '+Note: Local timezone is %%z (%%Z)'; grep -E '(^|[^0-9])([^0-9]|$)' ) | "Abuse from " $ADDRESSES + (printf %%b "\n"; date '+Note: Local timezone is %%z (%%Z)'; grep -E '(^|[^0-9])([^0-9]|$)' ) | "Abuse from " ${ADDRESSES//,/\" \"} fi # Option: actionunban @@ -70,7 +69,7 @@ actionban = ADDRESSES=`whois | perl -e 'while () { next if /^changed actionunban = [Init] -message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to a whois lookup is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process. This mail was generated by Fail2Ban.)\n +message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to a abusix.com is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process.)\n\n This mail was generated by Fail2Ban.\nThe recipient address of this report was provided by the Abuse Contact DB by abusix.com. abusix.com does not maintain the content of the database. All information which we pass out, derives from the RIR databases and is processed for ease of use. If you want to change or report non working abuse contacts please contact the appropriate RIR. If you have any further question, contact abusix.com directly via email (info@abusix.com). Information about the Abuse Contact Database can be found here: https://abusix.com/global-reporting/abuse-contact-db\nabusix.com is neither responsible nor liable for the content or accuracy of this message.\n # Path to the log files which contain relevant lines for the abuser IP # diff --git a/config/action.d/iptables-xt_recent-echo.conf b/config/action.d/iptables-xt_recent-echo.conf index 4be97c44..5d309b56 100644 --- a/config/action.d/iptables-xt_recent-echo.conf +++ b/config/action.d/iptables-xt_recent-echo.conf @@ -33,13 +33,14 @@ before = iptables-blocktype.conf # own rules. The 3600 second timeout is independent and acts as a # safeguard in case the fail2ban process dies unexpectedly. The # shorter of the two timeouts actually matters. -actionstart = iptables -I INPUT -m recent --update --seconds 3600 --name f2b- -j +actionstart = if [ `id -u` -eq 0 ];then iptables -I INPUT -m recent --update --seconds 3600 --name f2b- -j ;fi # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # actionstop = echo / > /proc/net/xt_recent/f2b- + if [ `id -u` -eq 0 ];then iptables -D INPUT -m recent --update --seconds 3600 --name f2b- -j ;fi # Option: actioncheck # Notes.: command executed once before each actionban command diff --git a/config/action.d/smtp.py b/config/action.d/smtp.py index 6830d535..933e27a0 100644 --- a/config/action.d/smtp.py +++ b/config/action.d/smtp.py @@ -121,7 +121,7 @@ class SMTPAction(ActionBase): self.matches = matches self.message_values = CallingMap( - jailname = self._jail.getName(), # Doesn't change + jailname = self._jail.name, hostname = socket.gethostname, bantime = self._jail.actions.getBanTime, ) diff --git a/config/action.d/xarf-login-attack.conf b/config/action.d/xarf-login-attack.conf index c5ac5110..32c611a1 100644 --- a/config/action.d/xarf-login-attack.conf +++ b/config/action.d/xarf-login-attack.conf @@ -38,18 +38,17 @@ actionstop = actioncheck = -actionban = oifs=${IFS}; IFS=.;SEP_IP=( ); set -- ${SEP_IP} ;ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs} +actionban = oifs=${IFS}; IFS=.;SEP_IP=( ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs} IP= FROM= SERVICE= FAILURES= - MATCHES='' REPORTID=