diff --git a/.gitignore b/.gitignore index 76a33e60..a8942050 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ htmlcov *.rej *.bak __pycache__ +.vagrant/ diff --git a/3rdparty/logwatch/fail2ban b/3rdparty/logwatch/fail2ban new file mode 100755 index 00000000..087eb529 --- /dev/null +++ b/3rdparty/logwatch/fail2ban @@ -0,0 +1,181 @@ +#!/usr/bin/perl +########################################################################## +# $Id: fail2ban 150 2013-06-18 22:19:38Z mtremaine $ +########################################################################## +# $Log: fail2ban,v $ +# Revision 1.5 2008/08/18 16:07:46 mike +# Patches from Paul Gear -mgt +# +# Revision 1.4 2008/06/30 23:07:51 kirk +# fixed copyright holders for files where I know who they should be +# +# Revision 1.3 2008/03/24 23:31:26 kirk +# added copyright/license notice to each script +# +# Revision 1.2 2006/12/15 04:53:59 bjorn +# Additional filtering, by Willi Mann. +# +# Revision 1.1 2006/05/30 19:04:26 bjorn +# Added fail2ban service, written by Yaroslav Halchenko. +# +# Written by Yaroslav Halchenko for fail2ban +# +########################################################################## + +######################################################## +## Copyright (c) 2008 Yaroslav Halchenko +## Covered under the included MIT/X-Consortium License: +## http://www.opensource.org/licenses/mit-license.php +## All modifications and contributions by other persons to +## this script are assumed to have been donated to the +## Logwatch project and thus assume the above copyright +## and licensing terms. If you want to make contributions +## under your own copyright or a different license this +## must be explicitly stated in the contribution an the +## Logwatch project reserves the right to not accept such +## contributions. If you have made significant +## contributions to this script and want to claim +## copyright please contact logwatch-devel@lists.sourceforge.net. +######################################################### + +use strict; +use Logwatch ':all'; + +my $Debug = $ENV{'LOGWATCH_DEBUG'} || 0; +my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0; +my $IgnoreHost = $ENV{'sshd_ignore_host'} || ""; +my $DebugCounter = 0; +my $ReInitializations = 0; +my @IptablesErrors = (); +my @ActionErrors = (); +my $NotValidIP = 0; # reported invalid IPs number +my @OtherList = (); + +my %ServicesBans = (); + +if ( $Debug >= 5 ) { + print STDERR "\n\nDEBUG: Inside Fail2Ban Filter \n\n"; + $DebugCounter = 1; +} + +while (defined(my $ThisLine = )) { + if ( $Debug >= 5 ) { + print STDERR "DEBUG($DebugCounter): $ThisLine"; + $DebugCounter++; + } + chomp($ThisLine); + if ( ($ThisLine =~ /..,... DEBUG: /) or + ($ThisLine =~ /..,... \S*\s*: DEBUG /) or # syntax of 0.7.? fail2ban + ($ThisLine =~ /..,... INFO: (Fail2Ban v.* is running|Exiting|Enabled sections:)/) or + ($ThisLine =~ /INFO\s+Log rotation detected for/) or + ($ThisLine =~ /INFO\s+Jail.+(?:stopped|started|uses poller)/) or + ($ThisLine =~ /INFO\s+Changed logging target to/) or + ($ThisLine =~ /INFO\s+Creating new jail/) or + ($ThisLine =~ /..,... \S+\s*: INFO\s+(Set |Socket|Exiting|Gamin|Created|Added|Using)/) or # syntax of 0.7.? fail2ban + ($ThisLine =~ /..,... WARNING: Verbose level is /) or + ($ThisLine =~ /..,... WARNING: Restoring firewall rules/) + ) + { + if ( $Debug >= 6 ) { + print STDERR "DEBUG($DebugCounter): line ignored\n"; + } + } elsif ( my ($Service,$Action,$Host) = ($ThisLine =~ m/WARNING:?\s\[?(.*?)[]:]?\s(Ban|Unban)[^\.]* (\S+)/)) { + if ( $Debug >= 6 ) { + print STDERR "DEBUG($DebugCounter): Found $Action for $Service from $Host\n"; + } + $ServicesBans{$Service}{$Host}{$Action}++; + $ServicesBans{$Service}{"(all)"}{$Action}++; + } elsif ( my ($Service,$Host,$NumFailures) = ($ThisLine =~ m/INFO: (\S+): (.+) has (\d+) login failure\(s\). Banned./)) { + if ($Debug >= 4) { + print STDERR "DEBUG: Found host $Host trying to access $Service - failed $NumFailures times\n"; + } + push @{$ServicesBans{$Service}{$Host}{'Failures'}}, $NumFailures; + } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ ERROR:\s(.*):\s(\S+)\salready in ban list/)) { + $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++; + } elsif ( my ($Service,$Host) = ($ThisLine =~ m/WARNING\s*\[(.*)\]\s*(\S+)\s*already banned/)) { + $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++; + } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ WARNING:\s(.*):\sReBan (\S+)/)) { + $ServicesBans{$Service}{$Host}{'ReBan'}++; + } elsif ($ThisLine =~ / ERROR:?\s*(Execution of command )?\'?iptables/) { + push @IptablesErrors, "$ThisLine\n"; + } elsif ($ThisLine =~ /ERROR.*returned \d+$/) { + push @ActionErrors, "$ThisLine\n"; + } elsif (($ThisLine =~ /..,... WARNING: \#\S+ reinitialization of firewalls/) or + ($ThisLine =~ / ERROR\s*Invariant check failed. Trying to restore a sane environment/)) { + $ReInitializations++; + } elsif ($ThisLine =~ /..,... WARNING: is not a valid IP address/) { + # just ignore - this will be fixed within fail2ban and is harmless warning + } + else + { + # Report any unmatched entries... + push @OtherList, "$ThisLine\n"; + } +} + +########################################################### + + +if (keys %ServicesBans) { + printf("\nBanned services with Fail2Ban: Bans:Unbans\n"); + foreach my $service (sort {$a cmp $b} keys %ServicesBans) { + printf(" %-55s [%3d:%-3d]\n", "$service:", + $ServicesBans{$service}{'(all)'}{'Ban'}, + $ServicesBans{$service}{'(all)'}{'Unban'}); + delete $ServicesBans{$service}{'(all)'}; + my $totalSort = TotalCountOrder(%{$ServicesBans{$service}}, \&SortIP); + if ($Detail >= 5) { + foreach my $ip (sort $totalSort keys %{$ServicesBans{$service}}) { + my $name = LookupIP($ip); + printf(" %-53s %3d:%-3d\n", + $name, + $ServicesBans{$service}{$ip}{'Ban'}, + $ServicesBans{$service}{$ip}{'Unban'}); + if (($Detail >= 10) and ($ServicesBans{$service}{$ip}{'Failures'}>0)) { + print " Failed "; + foreach my $fails (@{$ServicesBans{$service}{$ip}{'Failures'}}) { + print " $fails"; + } + print " times"; + printf("\n %d Duplicate Ban attempts", $ServicesBans{$service}{$ip}{'AlreadyInTheList'}) ; + printf("\n %d ReBans due to rules reinitilizations", $ServicesBans{$service}{$ip}{'ReBan'}) ; + print "\n"; + } + } + } + } +} + + +if ($Detail>0) { + if ($#IptablesErrors > 0) { + printf("\n%d faulty iptables invocation(s)", $#IptablesErrors); + if ($Detail > 5) { + print ":\n"; + print @IptablesErrors ; + } + } + if ($#ActionErrors > 0) { + printf("\n%d error(s) returned from actions", $#ActionErrors); + if ($Detail > 5) { + print ":\n"; + print @ActionErrors ; + } + } + if ($ReInitializations > 0) { + printf("\n%d fail2ban rules reinitialization(s)", $ReInitializations); + } + if ($#OtherList >= 0) { + print "\n**Unmatched Entries**\n"; + print @OtherList; + } +} + +exit(0); + +# vi: shiftwidth=3 tabstop=3 syntax=perl et +# Local Variables: +# mode: perl +# perl-indent-level: 3 +# indent-tabs-mode: nil +# End: diff --git a/ChangeLog b/ChangeLog index 6e37335e..a1391e78 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,9 +4,22 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ================================================================================ -Fail2Ban (version 0.9.0.dev) 2014/xx/xx +Fail2Ban (version 0.9.2.dev) 2014/xx/xx ================================================================================ +ver. 0.9.2 (2014/xx/xx) - increment ban time +---------- + +- New features: + - increment ban time (+ observer) functionality introduced. + Thanks Serg G. Brester (sebres) + +- Fixes: + - purge database will be executed now (within observer). + - database functionality extended with bad ips. + - restoring currently banned ip after service restart fixed + (now < timeofban + bantime), ignore old log failures (already banned) + ver. 0.9.1 (2014/xx/xx) - better, faster, stronger ---------- @@ -37,18 +50,38 @@ ver. 0.9.1 (2014/xx/xx) - better, faster, stronger * Correct times for non-timezone date times formats during DST Thanks Serg G. Brester (sebres) * Pass a copy of, not original, aInfo into actions to avoid side-effects + * Per-distribution paths to the exim's main log + * Ignored IPs are no longer banned when being restored from persistent + database + * Manually unbanned IPs are now removed from persistent database, such they + wont be banned again when Fail2Ban is restarted + * Pass "bantime" parameter to the actions in default jail's action + definition(s) + * filters.d/sieve.conf - fixed typo in _daemon. Thanks Jisoo Park + * cyrus-imap -- also catch also failed logins via secured (imaps/pop3s). + Regression was introduced while strengthening failregex in 0.8.11 (bd175f) + Debian bug #755173 + * postfix-sasl -- added journalmatch. Thanks Luc Maisonobe - New features: - - Added monit filter thanks Jason H Martin. + - Added + - monit filter. Thanks Jason H Martin + - directadmin filter. Thanks niorg + - fail2ban-client can fetch the running server version + - Added Cloudflare API action - Enhancements * Fail2ban-regex - add print-all-matched option. Closes gh-652 * Suppress fail2ban-client warnings for non-critical config options * Match non "Bye Bye" disconnect messages for sshd locked account regex + * courier-smtp filter: + - match lines with user names + - match lines containing "535 Authentication failed" attempts * Add tag to iptables-ipsets * Realign fail2ban log output with white space to improve readability. Does not affect SYSLOG output * Log unhandled exceptions + * cyrus-imap: catch "user not found" attempts ver. 0.9.0 (2014/03/14) - beta ---------- diff --git a/THANKS b/THANKS index 1ce0bad7..8e007667 100644 --- a/THANKS +++ b/THANKS @@ -49,6 +49,7 @@ John Thoe Jacques Lav!gnotte Ioan Indreias Jason H Martin +Jisoo Park Joel M Snyder Jonathan Kamens Jonathan Lanning @@ -62,6 +63,7 @@ kjohnsonecl kojiro Lars Kneschke Lee Clemens +leftyfb (Mike Rushton) Manuel Arostegui Ramirez Marcel Dopita Mark Edgington @@ -80,6 +82,7 @@ onorua Paul Marrapese Noel Butler Patrick Börjesson +Pressy Raphaël Marichez RealRancor René Berber @@ -88,6 +91,7 @@ Rolf Fokkens Roman Gelfand Russell Odom SATO Kentaro +Sean DuBois Sebastian Arcus Serg G. Brester (sebres) Sireyessire diff --git a/Vagrantfile b/Vagrantfile new file mode 100644 index 00000000..120ffd7f --- /dev/null +++ b/Vagrantfile @@ -0,0 +1,30 @@ +Vagrant.configure("2") do |config| + + config.vm.define "secure" do |secure| + secure.vm.box = "ubuntu/trusty64" + secure.vm.hostname = "secure.dev.fail2ban.org" + secure.vm.network "private_network", ip: "192.168.200.100" + +# secure.vm.synced_folder 'salt/roots', '/srv/salt' + +# secure.vm.provision :salt do |salt| +# salt.minion_config = 'salt/minion' +# salt.run_highstate = true +# salt.verbose = true +# end + end + + config.vm.define "attacker" do |attacker| + attacker.vm.box = "ubuntu/trusty64" + attacker.vm.hostname = "attacker.dev.fail2ban.org" + attacker.vm.network "private_network", ip: "192.168.200.150" + +# attacker.vm.synced_folder 'salt/roots', '/srv/salt' + +# attacker.vm.provision :salt do |salt| +# salt.minion_config = 'salt/minion' +# salt.run_highstate = true +# salt.verbose = true +# end + end +end diff --git a/config/action.d/cloudflare.conf b/config/action.d/cloudflare.conf new file mode 100644 index 00000000..4d5e2dc8 --- /dev/null +++ b/config/action.d/cloudflare.conf @@ -0,0 +1,55 @@ +# +# Author: Mike Rushton +# +# Referenced from from http://www.normyee.net/blog/2012/02/02/adding-cloudflare-support-to-fail2ban by NORM YEE +# +# To get your Cloudflare API key: https://www.cloudflare.com/my-account +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: IP address +# number of failures +#