From 5812abb98715dab761db940d7a5cb2cf1b4c4a61 Mon Sep 17 00:00:00 2001 From: Robert Trace Date: Fri, 18 Nov 2011 14:28:08 -0500 Subject: [PATCH 01/12] ENH: Remove obsolete code from gentoo init script. Bug gentoo#367819. Picked up from http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/files/fail2ban-0.8.4-gentoo-init.patch\?view\=markup --- files/gentoo-initd | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/files/gentoo-initd b/files/gentoo-initd index 0b0878ae..cd13b2d1 100755 --- a/files/gentoo-initd +++ b/files/gentoo-initd @@ -19,7 +19,7 @@ # # $Revision$ -opts="start stop restart reload showlog" +opts="reload showlog" FAIL2BAN="/usr/bin/fail2ban-client ${FAIL2BAN_OPTIONS}" @@ -41,14 +41,6 @@ stop() { eend $? "Failed to stop fail2ban" } -restart() { - if ! service_stopped "${SVCNAME}" ; then - svc_stop || return "$?" - sleep 1 - fi - svc_start -} - reload() { ebegin "Reloading fail2ban" ${FAIL2BAN} reload > /dev/null From 492d8e5ff889d55024a1403a4239649eb9fb46b9 Mon Sep 17 00:00:00 2001 From: Markos Chandras Date: Fri, 18 Nov 2011 14:32:37 -0500 Subject: [PATCH 02/12] BF: use hashlib instead of deprecated md5 Bugfix revision. Fixes bug 260337,283629,301139,315073,343955. Thanks to Robert Trace , Harley Peters for the patches. Picked up from http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/files/fail2ban-0.8.4-hashlib.patch\?view\=markup --- server/filter.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/server/filter.py b/server/filter.py index 38151d90..d170709e 100644 --- a/server/filter.py +++ b/server/filter.py @@ -446,7 +446,7 @@ class FileFilter(Filter): # In order to detect log rotation, the hash (MD5) of the first line of the file # is computed and compared to the previous hash of this line. -import md5 +import hashlib class FileContainer: @@ -461,7 +461,7 @@ class FileContainer: try: firstLine = handler.readline() # Computes the MD5 of the first line. - self.__hash = md5.new(firstLine).digest() + self.__hash = hashlib.md5(firstLine).digest() # Start at the beginning of file if tail mode is off. if tail: handler.seek(0, 2) @@ -481,7 +481,7 @@ class FileContainer: fcntl.fcntl(fd, fcntl.F_SETFD, fd | fcntl.FD_CLOEXEC) firstLine = self.__handler.readline() # Computes the MD5 of the first line. - myHash = md5.new(firstLine).digest() + myHash = hashlib.md5(firstLine).digest() stats = os.fstat(self.__handler.fileno()) # Compare hash and inode if self.__hash != myHash or self.__ino != stats.st_ino: From bd658fc74ba96a9c18c06d06c387e058a94c69d2 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Fri, 18 Nov 2011 14:38:24 -0500 Subject: [PATCH 03/12] ENH: stay compatible with python < 2.5 (use md5 if hashlib is N/A) --- server/filter.py | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/server/filter.py b/server/filter.py index d170709e..3545ad2b 100644 --- a/server/filter.py +++ b/server/filter.py @@ -446,7 +446,14 @@ class FileFilter(Filter): # In order to detect log rotation, the hash (MD5) of the first line of the file # is computed and compared to the previous hash of this line. -import hashlib +try: + import hashlib + md5sum = hashlib.md5 +except ImportError: + # hashlib was introduced in Python 2.5. For compatibility with those + # elderly Pythons, import from md5 + import md5 + md5sum = md5.new class FileContainer: @@ -461,7 +468,7 @@ class FileContainer: try: firstLine = handler.readline() # Computes the MD5 of the first line. - self.__hash = hashlib.md5(firstLine).digest() + self.__hash = md5sum(firstLine).digest() # Start at the beginning of file if tail mode is off. if tail: handler.seek(0, 2) @@ -481,7 +488,7 @@ class FileContainer: fcntl.fcntl(fd, fcntl.F_SETFD, fd | fcntl.FD_CLOEXEC) firstLine = self.__handler.readline() # Computes the MD5 of the first line. - myHash = hashlib.md5(firstLine).digest() + myHash = md5sum(firstLine).digest() stats = os.fstat(self.__handler.fileno()) # Compare hash and inode if self.__hash != myHash or self.__ino != stats.st_ino: From eda7efbca3e10d6f4d67c4a1a5ec4e5c2e20cc94 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Fri, 18 Nov 2011 14:47:55 -0500 Subject: [PATCH 04/12] ENH: fix of syntax for compatibility with Python 2.4 --- server/faildata.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/server/faildata.py b/server/faildata.py index 2b7959a7..ee396cdb 100644 --- a/server/faildata.py +++ b/server/faildata.py @@ -43,8 +43,11 @@ class FailData: def setRetry(self, value): self.__retry = value # keep only the last matches or reset entirely - self.__matches = self.__matches[-min(len(self.__matches, value)):] \ - if value else [] + # Explicit if/else for compatibility with Python 2.4 + if value: + self.__matches = self.__matches[-min(len(self.__matches, value)):] + else: + self.__matches = [] def getRetry(self): return self.__retry From c48c2b19a0202908eb4d302ae47f3f16812a5401 Mon Sep 17 00:00:00 2001 From: Michael Lorant Date: Fri, 18 Nov 2011 14:51:03 -0500 Subject: [PATCH 05/12] BF: gentoo-initd assure /var/run dir + remove stale sock file Gentoo Bug #347477 Picked up from http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/files/gentoo-initd_create_run_dir.patch?view=markup --- files/gentoo-initd | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/files/gentoo-initd b/files/gentoo-initd index cd13b2d1..af4d8c34 100755 --- a/files/gentoo-initd +++ b/files/gentoo-initd @@ -31,6 +31,14 @@ depend() { start() { ebegin "Starting fail2ban" + if [ ! -d /var/run/fail2ban ]; then + mkdir /var/run/fail2ban || return 1 + fi + if [ -e /var/run/fail2ban/fail2ban.sock ]; then + # remove stalled sock file after system crash + # bug 347477 + rm -rf /var/run/fail2ban/fail2ban.sock || return 1 + fi ${FAIL2BAN} start &> /dev/null eend $? "Failed to start fail2ban" } From 9fa54cf23309780f3563838c9d95a24e4b9a4c38 Mon Sep 17 00:00:00 2001 From: Tom Hendrikx Date: Fri, 18 Nov 2011 22:08:41 +0100 Subject: [PATCH 06/12] Add Date: header for sendmail*.conf actions According to rfc2822, Date: headers are not optional. Added these to all sendmail action templates, format specification should conform to rfc and be portable across multiple platforms. --- config/action.d/sendmail-whois-lines.conf | 3 +++ config/action.d/sendmail-whois.conf | 3 +++ config/action.d/sendmail.conf | 3 +++ 3 files changed, 9 insertions(+) diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf index 0624d592..d1e6e40f 100644 --- a/config/action.d/sendmail-whois-lines.conf +++ b/config/action.d/sendmail-whois-lines.conf @@ -12,6 +12,7 @@ # Values: CMD # actionstart = printf %%b "Subject: [Fail2Ban] : started + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n @@ -24,6 +25,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] : started # Values: CMD # actionstop = printf %%b "Subject: [Fail2Ban] : stopped + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n @@ -46,6 +48,7 @@ actioncheck = # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n diff --git a/config/action.d/sendmail-whois.conf b/config/action.d/sendmail-whois.conf index d029005c..363c3398 100644 --- a/config/action.d/sendmail-whois.conf +++ b/config/action.d/sendmail-whois.conf @@ -12,6 +12,7 @@ # Values: CMD # actionstart = printf %%b "Subject: [Fail2Ban] : started + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n @@ -24,6 +25,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] : started # Values: CMD # actionstop = printf %%b "Subject: [Fail2Ban] : stopped + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n @@ -46,6 +48,7 @@ actioncheck = # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n diff --git a/config/action.d/sendmail.conf b/config/action.d/sendmail.conf index e705bb1e..bdc2a3b6 100644 --- a/config/action.d/sendmail.conf +++ b/config/action.d/sendmail.conf @@ -12,6 +12,7 @@ # Values: CMD # actionstart = printf %%b "Subject: [Fail2Ban] : started + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n @@ -24,6 +25,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] : started # Values: CMD # actionstop = printf %%b "Subject: [Fail2Ban] : stopped + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n @@ -46,6 +48,7 @@ actioncheck = # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned + Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"` From: Fail2Ban <> To: \n Hi,\n From fbce41562241efad77da9652bc48f0b907a6d22d Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 21 Nov 2011 19:35:14 -0500 Subject: [PATCH 07/12] ENH: added logging while stopping the jails --- server/server.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/server/server.py b/server/server.py index a5b0bf09..38ddd48b 100644 --- a/server/server.py +++ b/server/server.py @@ -126,6 +126,7 @@ class Server: self.__lock.release() def stopJail(self, name): + logSys.debug("Stopping jail %s" % name) try: self.__lock.acquire() if self.isAlive(name): @@ -135,6 +136,7 @@ class Server: self.__lock.release() def stopAllJail(self): + logSys.info("Stopping all jails") try: self.__lock.acquire() for jail in self.__jails.getAll(): From 16322440edf3f9bcf2a920799d4ab4cd09f57c91 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 21 Nov 2011 19:36:48 -0500 Subject: [PATCH 08/12] BF: stop all communications before stopping the jails (Close gh-7) It is necessary because otherwise if jails actions try to communicate to the server we are getting a lockup since threads are locked --- server/server.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/server/server.py b/server/server.py index 38ddd48b..12c041e5 100644 --- a/server/server.py +++ b/server/server.py @@ -107,9 +107,15 @@ class Server: self.__loggingLock.release() def quit(self): - self.stopAllJail() - # Stop communication + # Stop communication first because if jail's unban action + # tries to communicate via fail2ban-client we get a lockup + # among threads. So the simplest resolution is to stop all + # communications first (which should be ok anyways since we + # are exiting) + # See https://github.com/fail2ban/fail2ban/issues/7 self.__asyncServer.stop() + # Now stop all the jails + self.stopAllJail() def addJail(self, name, backend): self.__jails.add(name, backend) From db39c7438ae7ae3640e725fb7c87939b36a9f9ca Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 21 Nov 2011 20:01:15 -0500 Subject: [PATCH 09/12] ENH: added custom timeformat with '.' as separator. Close gh-1 Probably evening effect -- can't understand why reported days of the weeks differ and it was 1 originally at all. Left as TODO --- server/datedetector.py | 6 ++++++ testcases/datedetectortestcase.py | 20 ++++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/server/datedetector.py b/server/datedetector.py index 09567656..b4d0a471 100644 --- a/server/datedetector.py +++ b/server/datedetector.py @@ -99,6 +99,12 @@ class DateDetector: template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}") template.setPattern("%Y-%m-%d %H:%M:%S") self.__templates.append(template) + # custom for syslog-ng 2006.12.21 06:43:20 + template = DateStrptime() + template.setName("Year.Month.Day Hour:Minute:Second") + template.setRegex("\d{4}.\d{2}.\d{2} \d{2}:\d{2}:\d{2}") + template.setPattern("%Y.%m.%d %H:%M:%S") + self.__templates.append(template) # named 26-Jul-2007 15:20:52.252 template = DateStrptime() template.setName("Day-MONTH-Year Hour:Minute:Second[.Millisecond]") diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py index 70447b25..074bdb88 100644 --- a/testcases/datedetectortestcase.py +++ b/testcases/datedetectortestcase.py @@ -57,6 +57,26 @@ class DateDetectorTest(unittest.TestCase): self.assertEqual(self.__datedetector.getTime(log), date) self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix) + def testVariousTimes(self): + """Test detection of various common date/time formats f2b should understand + """ + date = [2005, 1, 23, 21, 59, 59, 1, 23, -1] + dateUnix = 1106513999.0 + + for sdate in ( + "Jan 23 21:59:59", + "2005.01.23 21:59:59", + "23/01/2005 21:59:59", + ): + log = sdate + "[sshd] error: PAM: Authentication failure" + # exclude + + # TODO (Yarik is confused): figure out why for above it is + # "1" as day of the week which would be Tue, although it + # was Sun + self.assertEqual(self.__datedetector.getTime(log)[:6], date[:6]) + self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix) + # def testDefaultTempate(self): # self.__datedetector.setDefaultRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}") # self.__datedetector.setDefaultPattern("%b %d %H:%M:%S") From 2cb14c50ac173fbe0d6e91d83f1ca95dca1e4553 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 28 Nov 2011 21:39:41 -0500 Subject: [PATCH 10/12] DOC: updated contact information to direct to github and mailing list --- README | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/README b/README index cb4c1cd4..33e9b025 100644 --- a/README +++ b/README @@ -54,12 +54,18 @@ to the website: http://www.fail2ban.org Contact: -------- -You need some new features, you found bugs or you just appreciate this program, -you can contact me at: - Website: http://www.fail2ban.org -Cyril Jaquier: +You need some new features, you found bugs: visit +https://github.com/fail2ban/fail2ban/issues +and if your issue is not yet known -- file a bug report. + +If you would like to troubleshoot or discuss: join the mailing list +https://lists.sourceforge.net/lists/listinfo/fail2ban-users + +If you just appreciate this program: send kudos to the original +author: Cyril Jaquier: + Thanks: ------- From 3e1983a8ecd9df6f06e754612f898d2501529af1 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 28 Nov 2011 22:22:16 -0500 Subject: [PATCH 11/12] Revert "ENH: server.py -- addLogPath with tail=True" This reverts commit 927a01a0763813d962f6ac90d4962c734d2954b1. Let's not change this behavior for now from previous release since it would break finding recent hits upon restart. --- server/server.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/server.py b/server/server.py index 12c041e5..0ecb0cce 100644 --- a/server/server.py +++ b/server/server.py @@ -171,7 +171,7 @@ class Server: return self.__jails.getFilter(name).getIgnoreIP() def addLogPath(self, name, fileName): - self.__jails.getFilter(name).addLogPath(fileName, True) + self.__jails.getFilter(name).addLogPath(fileName) def delLogPath(self, name, fileName): self.__jails.getFilter(name).delLogPath(fileName) From 1efe1bc1713fdc2f71812db04bbcc7129c75928d Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 28 Nov 2011 22:24:56 -0500 Subject: [PATCH 12/12] Changelog and version changes for 0.8.6 --- ChangeLog | 45 ++++++++++++++++++++++++++++++++++++++++++++- README | 6 +++--- common/version.py | 2 +- 3 files changed, 48 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3e117667..32e795dd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,9 +4,52 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ================================================================================ -Fail2Ban (version 0.8.5) 2011/07/28 +Fail2Ban (version 0.8.6) 2011/11/28 ================================================================================ +ver. 0.8.6 (2011/11/28) - stable +---------- +- Fixes: + Markos Chandras & Yaroslav Halchenko + * [492d8e5,bd658fc] Use hashlib (instead of deprecated md5) where available + Robert Trace & Michael Lorant + * [c48c2b1] gentoo-initd cleanup and fixes: assure /var/run + remove stale + sock file + Michael Saavedra + * [3a58d0e] Lock server's executeCmd to prevent racing among iptables calls: + see http://bugs.debian.org/554162 + Yaroslav Halchenko + * [3eb5e3b] Allow for trailing spaces in sasl logs + * [1632244] Stop server-side communication before stopping the + jails (prevents lockup if actions use fail2ban-client upon + unban): see https://github.com/fail2ban/fail2ban/issues/7 + * [5a2d518] Various changes to reincarnate unittests + Yehuda + * Wiki was cleaned from SPAM +- Enhancements: + Adam Spiers + * [3152afb] Recognise time-stamped kernel messages + Guido Bozzetto + * [713fea6] Added ipmasq rule file to restart fail2ban when iptables are + wiped out: see http://bugs.debian.org/461417 + Łukasz + * [5f23542] Matching of month names in Polish (thanks michaelberg79 + for QA) + Tom Hendrikx + * [9fa54cf] Added Date: header for sendmail*.conf actions + Yaroslav Halchenko & Tom Hendrikx + * [b52d420..22b7007] in action files now can be used + to provide matched loglines which triggered action + Yaroslav Halchenko + * [ed0bf3a] Removed duplicate entry for DataCha0s/2\.0 in badbots: + see http://bugs.debian.org/519557 + * [dad91f7] sshd.conf: allow user names to have spaces and + trailing spaces in the line + * [a9be451] removed expansions for few Date and Revision SVN keywords + * [a33135c] set/getFile for ticket.py -- found in source distribution + of 0.8.4 + * [fbce415] additional logging while stopping the jails + ver. 0.8.5 (2011/07/28) - stable ---------- - Fix: use addfailregex instead of failregex while processing per-jail diff --git a/README b/README index 33e9b025..4b5048ed 100644 --- a/README +++ b/README @@ -4,7 +4,7 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ================================================================================ -Fail2Ban (version 0.8.5) 2011/07/26 +Fail2Ban (version 0.8.6) 2011/11/28 ================================================================================ Fail2Ban scans log files like /var/log/pwdfail and bans IP that makes too many @@ -26,8 +26,8 @@ Optional: To install, just do: -> tar xvfj fail2ban-0.8.5.tar.bz2 -> cd fail2ban-0.8.5 +> tar xvfj fail2ban-0.8.6.tar.bz2 +> cd fail2ban-0.8.6 > python setup.py install This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are diff --git a/common/version.py b/common/version.py index ed2f72db..a745be3c 100644 --- a/common/version.py +++ b/common/version.py @@ -27,4 +27,4 @@ __date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011 Yaroslav Halchenko" __license__ = "GPL" -version = "0.8.5" +version = "0.8.6"