diff --git a/ChangeLog b/ChangeLog index 3e117667..32e795dd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,9 +4,52 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ================================================================================ -Fail2Ban (version 0.8.5) 2011/07/28 +Fail2Ban (version 0.8.6) 2011/11/28 ================================================================================ +ver. 0.8.6 (2011/11/28) - stable +---------- +- Fixes: + Markos Chandras & Yaroslav Halchenko + * [492d8e5,bd658fc] Use hashlib (instead of deprecated md5) where available + Robert Trace & Michael Lorant + * [c48c2b1] gentoo-initd cleanup and fixes: assure /var/run + remove stale + sock file + Michael Saavedra + * [3a58d0e] Lock server's executeCmd to prevent racing among iptables calls: + see http://bugs.debian.org/554162 + Yaroslav Halchenko + * [3eb5e3b] Allow for trailing spaces in sasl logs + * [1632244] Stop server-side communication before stopping the + jails (prevents lockup if actions use fail2ban-client upon + unban): see https://github.com/fail2ban/fail2ban/issues/7 + * [5a2d518] Various changes to reincarnate unittests + Yehuda + * Wiki was cleaned from SPAM +- Enhancements: + Adam Spiers + * [3152afb] Recognise time-stamped kernel messages + Guido Bozzetto + * [713fea6] Added ipmasq rule file to restart fail2ban when iptables are + wiped out: see http://bugs.debian.org/461417 + Łukasz + * [5f23542] Matching of month names in Polish (thanks michaelberg79 + for QA) + Tom Hendrikx + * [9fa54cf] Added Date: header for sendmail*.conf actions + Yaroslav Halchenko & Tom Hendrikx + * [b52d420..22b7007] in action files now can be used + to provide matched loglines which triggered action + Yaroslav Halchenko + * [ed0bf3a] Removed duplicate entry for DataCha0s/2\.0 in badbots: + see http://bugs.debian.org/519557 + * [dad91f7] sshd.conf: allow user names to have spaces and + trailing spaces in the line + * [a9be451] removed expansions for few Date and Revision SVN keywords + * [a33135c] set/getFile for ticket.py -- found in source distribution + of 0.8.4 + * [fbce415] additional logging while stopping the jails + ver. 0.8.5 (2011/07/28) - stable ---------- - Fix: use addfailregex instead of failregex while processing per-jail diff --git a/README b/README index cb4c1cd4..4b5048ed 100644 --- a/README +++ b/README @@ -4,7 +4,7 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ================================================================================ -Fail2Ban (version 0.8.5) 2011/07/26 +Fail2Ban (version 0.8.6) 2011/11/28 ================================================================================ Fail2Ban scans log files like /var/log/pwdfail and bans IP that makes too many @@ -26,8 +26,8 @@ Optional: To install, just do: -> tar xvfj fail2ban-0.8.5.tar.bz2 -> cd fail2ban-0.8.5 +> tar xvfj fail2ban-0.8.6.tar.bz2 +> cd fail2ban-0.8.6 > python setup.py install This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are @@ -54,12 +54,18 @@ to the website: http://www.fail2ban.org Contact: -------- -You need some new features, you found bugs or you just appreciate this program, -you can contact me at: - Website: http://www.fail2ban.org -Cyril Jaquier: +You need some new features, you found bugs: visit +https://github.com/fail2ban/fail2ban/issues +and if your issue is not yet known -- file a bug report. + +If you would like to troubleshoot or discuss: join the mailing list +https://lists.sourceforge.net/lists/listinfo/fail2ban-users + +If you just appreciate this program: send kudos to the original +author: Cyril Jaquier: + Thanks: ------- diff --git a/common/version.py b/common/version.py index ed2f72db..a745be3c 100644 --- a/common/version.py +++ b/common/version.py @@ -27,4 +27,4 @@ __date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011 Yaroslav Halchenko" __license__ = "GPL" -version = "0.8.5" +version = "0.8.6" diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf index 0624d592..d1e6e40f 100644 --- a/config/action.d/sendmail-whois-lines.conf +++ b/config/action.d/sendmail-whois-lines.conf @@ -12,6 +12,7 @@ # Values: CMD # actionstart = printf %%b "Subject: [Fail2Ban] : started + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n @@ -24,6 +25,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] : started # Values: CMD # actionstop = printf %%b "Subject: [Fail2Ban] : stopped + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n @@ -46,6 +48,7 @@ actioncheck = # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n diff --git a/config/action.d/sendmail-whois.conf b/config/action.d/sendmail-whois.conf index d029005c..363c3398 100644 --- a/config/action.d/sendmail-whois.conf +++ b/config/action.d/sendmail-whois.conf @@ -12,6 +12,7 @@ # Values: CMD # actionstart = printf %%b "Subject: [Fail2Ban] : started + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n @@ -24,6 +25,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] : started # Values: CMD # actionstop = printf %%b "Subject: [Fail2Ban] : stopped + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n @@ -46,6 +48,7 @@ actioncheck = # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n diff --git a/config/action.d/sendmail.conf b/config/action.d/sendmail.conf index e705bb1e..bdc2a3b6 100644 --- a/config/action.d/sendmail.conf +++ b/config/action.d/sendmail.conf @@ -12,6 +12,7 @@ # Values: CMD # actionstart = printf %%b "Subject: [Fail2Ban] : started + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n @@ -24,6 +25,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] : started # Values: CMD # actionstop = printf %%b "Subject: [Fail2Ban] : stopped + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n @@ -46,6 +48,7 @@ actioncheck = # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n diff --git a/files/gentoo-initd b/files/gentoo-initd index 0b0878ae..af4d8c34 100755 --- a/files/gentoo-initd +++ b/files/gentoo-initd @@ -19,7 +19,7 @@ # # $Revision$ -opts="start stop restart reload showlog" +opts="reload showlog" FAIL2BAN="/usr/bin/fail2ban-client ${FAIL2BAN_OPTIONS}" @@ -31,6 +31,14 @@ depend() { start() { ebegin "Starting fail2ban" + if [ ! -d /var/run/fail2ban ]; then + mkdir /var/run/fail2ban || return 1 + fi + if [ -e /var/run/fail2ban/fail2ban.sock ]; then + # remove stalled sock file after system crash + # bug 347477 + rm -rf /var/run/fail2ban/fail2ban.sock || return 1 + fi ${FAIL2BAN} start &> /dev/null eend $? "Failed to start fail2ban" } @@ -41,14 +49,6 @@ stop() { eend $? "Failed to stop fail2ban" } -restart() { - if ! service_stopped "${SVCNAME}" ; then - svc_stop || return "$?" - sleep 1 - fi - svc_start -} - reload() { ebegin "Reloading fail2ban" ${FAIL2BAN} reload > /dev/null diff --git a/server/datedetector.py b/server/datedetector.py index 09567656..b4d0a471 100644 --- a/server/datedetector.py +++ b/server/datedetector.py @@ -99,6 +99,12 @@ class DateDetector: template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}") template.setPattern("%Y-%m-%d %H:%M:%S") self.__templates.append(template) + # custom for syslog-ng 2006.12.21 06:43:20 + template = DateStrptime() + template.setName("Year.Month.Day Hour:Minute:Second") + template.setRegex("\d{4}.\d{2}.\d{2} \d{2}:\d{2}:\d{2}") + template.setPattern("%Y.%m.%d %H:%M:%S") + self.__templates.append(template) # named 26-Jul-2007 15:20:52.252 template = DateStrptime() template.setName("Day-MONTH-Year Hour:Minute:Second[.Millisecond]") diff --git a/server/faildata.py b/server/faildata.py index 2b7959a7..ee396cdb 100644 --- a/server/faildata.py +++ b/server/faildata.py @@ -43,8 +43,11 @@ class FailData: def setRetry(self, value): self.__retry = value # keep only the last matches or reset entirely - self.__matches = self.__matches[-min(len(self.__matches, value)):] \ - if value else [] + # Explicit if/else for compatibility with Python 2.4 + if value: + self.__matches = self.__matches[-min(len(self.__matches, value)):] + else: + self.__matches = [] def getRetry(self): return self.__retry diff --git a/server/filter.py b/server/filter.py index 38151d90..3545ad2b 100644 --- a/server/filter.py +++ b/server/filter.py @@ -446,7 +446,14 @@ class FileFilter(Filter): # In order to detect log rotation, the hash (MD5) of the first line of the file # is computed and compared to the previous hash of this line. -import md5 +try: + import hashlib + md5sum = hashlib.md5 +except ImportError: + # hashlib was introduced in Python 2.5. For compatibility with those + # elderly Pythons, import from md5 + import md5 + md5sum = md5.new class FileContainer: @@ -461,7 +468,7 @@ class FileContainer: try: firstLine = handler.readline() # Computes the MD5 of the first line. - self.__hash = md5.new(firstLine).digest() + self.__hash = md5sum(firstLine).digest() # Start at the beginning of file if tail mode is off. if tail: handler.seek(0, 2) @@ -481,7 +488,7 @@ class FileContainer: fcntl.fcntl(fd, fcntl.F_SETFD, fd | fcntl.FD_CLOEXEC) firstLine = self.__handler.readline() # Computes the MD5 of the first line. - myHash = md5.new(firstLine).digest() + myHash = md5sum(firstLine).digest() stats = os.fstat(self.__handler.fileno()) # Compare hash and inode if self.__hash != myHash or self.__ino != stats.st_ino: diff --git a/server/server.py b/server/server.py index a5b0bf09..0ecb0cce 100644 --- a/server/server.py +++ b/server/server.py @@ -107,9 +107,15 @@ class Server: self.__loggingLock.release() def quit(self): - self.stopAllJail() - # Stop communication + # Stop communication first because if jail's unban action + # tries to communicate via fail2ban-client we get a lockup + # among threads. So the simplest resolution is to stop all + # communications first (which should be ok anyways since we + # are exiting) + # See https://github.com/fail2ban/fail2ban/issues/7 self.__asyncServer.stop() + # Now stop all the jails + self.stopAllJail() def addJail(self, name, backend): self.__jails.add(name, backend) @@ -126,6 +132,7 @@ class Server: self.__lock.release() def stopJail(self, name): + logSys.debug("Stopping jail %s" % name) try: self.__lock.acquire() if self.isAlive(name): @@ -135,6 +142,7 @@ class Server: self.__lock.release() def stopAllJail(self): + logSys.info("Stopping all jails") try: self.__lock.acquire() for jail in self.__jails.getAll(): @@ -163,7 +171,7 @@ class Server: return self.__jails.getFilter(name).getIgnoreIP() def addLogPath(self, name, fileName): - self.__jails.getFilter(name).addLogPath(fileName, True) + self.__jails.getFilter(name).addLogPath(fileName) def delLogPath(self, name, fileName): self.__jails.getFilter(name).delLogPath(fileName) diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py index 70447b25..074bdb88 100644 --- a/testcases/datedetectortestcase.py +++ b/testcases/datedetectortestcase.py @@ -57,6 +57,26 @@ class DateDetectorTest(unittest.TestCase): self.assertEqual(self.__datedetector.getTime(log), date) self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix) + def testVariousTimes(self): + """Test detection of various common date/time formats f2b should understand + """ + date = [2005, 1, 23, 21, 59, 59, 1, 23, -1] + dateUnix = 1106513999.0 + + for sdate in ( + "Jan 23 21:59:59", + "2005.01.23 21:59:59", + "23/01/2005 21:59:59", + ): + log = sdate + "[sshd] error: PAM: Authentication failure" + # exclude + + # TODO (Yarik is confused): figure out why for above it is + # "1" as day of the week which would be Tue, although it + # was Sun + self.assertEqual(self.__datedetector.getTime(log)[:6], date[:6]) + self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix) + # def testDefaultTempate(self): # self.__datedetector.setDefaultRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}") # self.__datedetector.setDefaultPattern("%b %d %H:%M:%S")