From 3dd16eeddfc152f34093db8f5fc5ef5791084d81 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Thu, 10 Sep 2009 09:09:01 -0400 Subject: [PATCH 1/5] BF: adjusted README.Debian - multiport is default (closes: #545971) --- debian/README.Debian | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/debian/README.Debian b/debian/README.Debian index 505b9dd6..c4707972 100644 --- a/debian/README.Debian +++ b/debian/README.Debian @@ -77,21 +77,16 @@ port = ssh protocol = tcp -* Multiport banning: Comment for the wishlist #373592. +* Multiport banning: Comment for #373592, #545971 -Default iptables rules for banning use --dport statement which allows -to ban just a single port. For multiport banning you would need to use -iptables-multiport action (just override banaction in jail.local), -which is present in fail2ban shipped in Debian since 0.7.6-1. +iptables-multiport action is now default banaction (file jail.conf, to +be customized within jail.local). Therefore assure that you have built +multiport module if you use custom kernel. If you would like to ban all ports for that host, just redefine fwban/fwunban commands to don't have --dport %(port)s statement at all, or use shorewall, where actionban bans whole IP. -iptables-multiport action is not default banaction since multiport -module might not be compiled for some hand compiled kernels. - - * Blocking of NEW connections only Comment for the wishlist #350746. From bae3183f9b2dc2b3e5d2c3090db6ffedeb21a983 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Thu, 10 Sep 2009 10:35:05 -0400 Subject: [PATCH 2/5] NF: few examples for pure-ftpd --- files/logs/pure-ftpd | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 files/logs/pure-ftpd diff --git a/files/logs/pure-ftpd b/files/logs/pure-ftpd new file mode 100644 index 00000000..4b4e3455 --- /dev/null +++ b/files/logs/pure-ftpd @@ -0,0 +1,2 @@ +Jan 31 16:54:07 desktop pure-ftpd: (?@24.79.92.194) [WARNING] Authentication failed for user [Administrator] +Nov 5 18:54:02 pure-ftpd: (?@server202181210195.ixlink.net) [WARNING] Authentication failed for user [Administrator] From 472a7b31ce3d0fe9bd70a2c6e3faca31300f4409 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Thu, 10 Sep 2009 11:05:56 -0400 Subject: [PATCH 3/5] BF: use "set logtartet" instead of "reload" while logrotate. Thanks J.M.Roth (Closes: #537773) --- debian/fail2ban.logrotate | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/fail2ban.logrotate b/debian/fail2ban.logrotate index e3a9ab8a..78137684 100644 --- a/debian/fail2ban.logrotate +++ b/debian/fail2ban.logrotate @@ -7,7 +7,7 @@ delaycompress missingok postrotate - invoke-rc.d --quiet fail2ban reload >/dev/null + fail2ban-client set logtarget /var/log/fail2ban.log >/dev/null endscript create 640 root adm } From efb1f57f62e94e8cb6b0ab7bdb524fbba494a917 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Thu, 10 Sep 2009 11:22:48 -0400 Subject: [PATCH 4/5] actually boosting policy --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index 216434ae..9fee2855 100644 --- a/debian/control +++ b/debian/control @@ -8,7 +8,7 @@ XS-Python-Version: current, >= 2.4 Homepage: http://www.fail2ban.org Vcs-Browser: http://git.onerussian.com/?p=deb/fail2ban.git Vcs-git: git://git.onerussian.com/deb/fail2ban.git -Standards-Version: 3.8.2 +Standards-Version: 3.8.3 Package: fail2ban From b81cfae700e9a010002ef77da161ae109ee517c4 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Thu, 10 Sep 2009 12:02:02 -0400 Subject: [PATCH 5/5] added proftpd examples from wiki --- files/logs/proftpd | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 files/logs/proftpd diff --git a/files/logs/proftpd b/files/logs/proftpd new file mode 100644 index 00000000..def8a83e --- /dev/null +++ b/files/logs/proftpd @@ -0,0 +1,5 @@ +Jan 10 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username (Login failed): User in /etc/ftpusers +Feb 1 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username: no such user found from 123.123.123.123 [123.123.123.123] to 234.234.234.234:21 + + +