From 4dba65f6854bb4085f46364e37259a12f2f1cd0d Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sat, 16 Nov 2013 22:30:31 -0500 Subject: [PATCH] debian/NEWS - information for change of default iptables action to REJECT now (Closes: #711463) --- debian/NEWS | 13 +++++++++++++ debian/changelog | 3 +++ 2 files changed, 16 insertions(+) diff --git a/debian/NEWS b/debian/NEWS index df464b23..94eb9b27 100644 --- a/debian/NEWS +++ b/debian/NEWS @@ -1,3 +1,16 @@ +fail2ban (0.8.11-1) unstable; urgency=low + + * retroactive for 0.8.9: by default iptables-* actions do not simply + DROP packets from offending IP but rather reject with + icmp-port-unreachable. If DROP behaviour is preferable, provide + config/action.d/iptables-blocktype.local with [Init] section defining + blocktype = DROP or override action definition to provide + blocktype=DROP option in jail.local + * Many failregex's were tight-up in this release which could + theoretically effect operation in comparison to previous release(s). + + -- Yaroslav Halchenko Sat, 16 Nov 2013 22:27:50 -0500 + fail2ban (0.8.4-3) unstable; urgency=low * Jail named-refused-udp is unsafe and opens possibility for easy DoS, diff --git a/debian/changelog b/debian/changelog index d41e46de..c84796f0 100644 --- a/debian/changelog +++ b/debian/changelog @@ -6,6 +6,9 @@ fail2ban (0.8.11-1) unstable; urgency=low * debian/jail.conf - dropbear jail: use dropbear filter (instead of ssh) and monitor auth.log instead of non-existing /var/log/dropbear (Closes: #620760) + * debian/NEWS + - information for change of default iptables action to REJECT now + (Closes: #711463) -- Yaroslav Halchenko Sat, 16 Nov 2013 21:34:54 -0500