diff --git a/debian/changelog b/debian/changelog index b5dc2397..9fe4bcc4 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +fail2ban (0.7.3-1) UNRELEASED; urgency=low + + * New upstream release + + -- Yaroslav Halchenko Thu, 28 Sep 2006 22:17:16 -0400 + fail2ban (0.7.1-0.2) experimental; urgency=low * New upstream release (closes: #370095,#366307) diff --git a/debian/control b/debian/control index f609bb78..4c98f8d9 100644 --- a/debian/control +++ b/debian/control @@ -3,8 +3,8 @@ Section: net Priority: optional Maintainer: Yaroslav Halchenko Uploaders: Barak Pearlmutter -Build-Depends: debhelper (>= 4.1.67), dpatch -Build-Depends-Indep: python, python-dev, help2man, python-central (>= 0.4.17) +Build-Depends: debhelper (>= 5.0.37.2), dpatch +Build-Depends-Indep: python, python-dev, help2man, python-central (>= 0.5) XS-Python-Version: current, >= 2.4 Standards-Version: 3.7.2 diff --git a/debian/jail.conf b/debian/jail.conf new file mode 100644 index 00000000..cc285a03 --- /dev/null +++ b/debian/jail.conf @@ -0,0 +1,83 @@ +# Fail2Ban configuration file. +# +# This file was composed for Debian systems from the original one +# provided now under /usr/share/doc/fail2ban/examples/jail.conf +# for additional examples. +# +# To avoid merges during upgrades do not modify this file +# and rather provide your changes in /etc/fail2ban/jail.local +# +# Author: Yaroslav O. Halchenko +# +# $Revision: 281 $ +# + +# The DEFAULT allows a global definition of the options. They can be override +# in each jail afterwards. + +[DEFAULT] + +# "ignoreip" can be an IP address, a CIDR mask or a DNS host +ignoreip = 127.0.0.1 +bantime = 600 +maxretry = 3 + +# Destination email address used solely for the interpolations in +# jail.{conf,local} configuration files. +destemail = root@localhost + +# Default action to take: ban & send an e-mail with whois report +# to the destemail +action = iptables[name=%(__name__)s, port=%(port)s] + mail-whois[name=%(__name__)s, dest=%(destemail)s] + +# +# Next jails corresponds to the standard configuration in Fail2ban 0.6. +# Please enable them by including +# +# [SECTION_NAME] +# enabled = true +# +# in /etc/fail2ban/jail.local +# +[ssh-iptables] + +enabled = true +port = ssh +filter = sshd +logpath = /var/log/auth.log +maxretry = 6 + +[apache-iptables] + +enabled = false +port = http +filter = apache-auth +logpath = /var/log/apache*/*access.log +maxretry = 6 + + +[postfix-iptables] + +enabled = false +port = smtp +filter = postfix +logpath = /var/log/postfix.log + + +[vsftpd-iptables] + +enabled = false +port = ftp +filter = vsftpd +logpath = /var/log/auth.log +maxretry = 6 + + +[couriersmtp-iptables] + +enabled = false +port = smtp +filter = couriersmtp +logpath = /var/log/mail.log + diff --git a/debian/patches/00list b/debian/patches/00list index 7c2de688..f72a6019 100644 --- a/debian/patches/00list +++ b/debian/patches/00list @@ -1,5 +1,3 @@ X00_rigid_python24 -X00_ssh_path -X00_apache_log_path -X00_default_jails X00_apache_log_failregex +10_dbts_manpages diff --git a/debian/patches/10_dbts_manpages.dpatch b/debian/patches/10_dbts_manpages.dpatch new file mode 100755 index 00000000..1cf5315d --- /dev/null +++ b/debian/patches/10_dbts_manpages.dpatch @@ -0,0 +1,33 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 10_dbts_manpages.dpatch by +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: No description. + +@DPATCH@ +diff -urNad fail2ban-0.7.3~/man/fail2ban-client.1 fail2ban-0.7.3/man/fail2ban-client.1 +--- fail2ban-0.7.3~/man/fail2ban-client.1 2006-09-28 15:34:06.000000000 -0400 ++++ fail2ban-0.7.3/man/fail2ban-client.1 2006-09-28 22:58:38.000000000 -0400 +@@ -82,7 +82,8 @@ + Written by Cyril Jaquier . + Many contributions by Yaroslav O. Halchenko . + .SH "REPORTING BUGS" +-Report bugs to ++Please report bugs via Debian bug tracking system ++http://www.debian.org/Bugs/. + .SH COPYRIGHT + Copyright \(co 2004-2006 Cyril Jaquier + .br +diff -urNad fail2ban-0.7.3~/man/fail2ban-server.1 fail2ban-0.7.3/man/fail2ban-server.1 +--- fail2ban-0.7.3~/man/fail2ban-server.1 2006-09-28 15:34:06.000000000 -0400 ++++ fail2ban-0.7.3/man/fail2ban-server.1 2006-09-28 22:59:25.000000000 -0400 +@@ -33,7 +33,8 @@ + Written by Cyril Jaquier . + Many contributions by Yaroslav O. Halchenko . + .SH "REPORTING BUGS" +-Report bugs to ++Please report bugs via Debian bug tracking system ++http://www.debian.org/Bugs/. + .SH COPYRIGHT + Copyright \(co 2004-2006 Cyril Jaquier + .br diff --git a/debian/patches/X00_ssh_path.dpatch b/debian/patches/X00_ssh_path.dpatch index d9bfbdb8..3626f33d 100755 --- a/debian/patches/X00_ssh_path.dpatch +++ b/debian/patches/X00_ssh_path.dpatch @@ -5,16 +5,24 @@ ## DP: Debian specific ssh path @DPATCH@ - -diff -x '*~' -Naur fail2ban-0.7.1/config/filter.d/sshd.conf fail2ban-0.7.1.modified/config/filter.d/sshd.conf ---- fail2ban-0.7.1/config/filter.d/sshd.conf 2006-08-06 18:12:57.000000000 -0400 -+++ fail2ban-0.7.1.modified/config/filter.d/sshd.conf 2006-09-05 10:39:21.000000000 -0400 -@@ -17,7 +17,7 @@ - # Notes.: logfile to monitor. - # Values: FILE Default: /var/log/secure - # --logpath = /var/log/secure -+logpath = /var/log/auth.log +diff -urNad fail2ban-0.7.3~/config/jail.conf fail2ban-0.7.3/config/jail.conf +--- fail2ban-0.7.3~/config/jail.conf 2006-09-27 16:30:27.000000000 -0400 ++++ fail2ban-0.7.3/config/jail.conf 2006-09-28 22:26:35.000000000 -0400 +@@ -26,7 +26,7 @@ + filter = sshd + action = iptables[name=SSH, port=ssh, protocol=tcp] + mail-whois[name=SSH, dest=yourmail@mail.com] +-logpath = /var/log/sshd.log ++logpath = /var/log/auth.log + maxretry = 5 - # Option: timeregex - # Notes.: regex to match timestamp in SSH logfile. For TAI64N format, + # This one behaves like the previous and sends a report when the jail +@@ -39,7 +39,7 @@ + action = iptables[name=SSH, port=ssh, protocol=tcp] + mail-whois[name=SSH, dest=yourmail@mail.com] + mail-report[dest=yourmail@mail.com] +-logpath = /var/log/sshd.log ++logpath = /var/log/auth.log + maxretry = 5 + + # Here we use TCP-Wrappers instead of Netfilter/Iptables. diff --git a/debian/rules b/debian/rules index bdbf0c14..c753af79 100755 --- a/debian/rules +++ b/debian/rules @@ -9,7 +9,6 @@ # Uncomment this to turn on verbose mode. #export DH_VERBOSE=1 -MANPAGE=fail2ban.8 DESTDIR=$(CURDIR)/debian/fail2ban # no parallel execution -- required for dpatch @@ -39,7 +38,7 @@ clean: clean-inits unpatch rm -f build-stamp configure-stamp # Add here commands to clean up after the build process. - rm -rf changelog.gz $(MANPAGE) build* + rm -rf changelog.gz build* dh_clean @@ -54,31 +53,31 @@ install: build copy-inits #X Evil - must be removed after Debian switches over to 2.4, now # distutils.setup will override the enterpreter line to /usr/bin/python install fail2ban-server fail2ban-client $(DESTDIR)/usr/bin + # Install Debian shipped jail file in 1 piece (instead of patching + # the shipped one since there are too many changes) + install -m 644 debian/jail.conf $(DESTDIR)/etc/fail2ban #X mkdir -p $(DESTDIR)/etc #X cp config/fail2ban.conf.iptables $(DESTDIR)/etc/fail2ban.conf -# To build manpage -$(MANPAGE): fail2ban fail2ban.h2m - help2man --include fail2ban.h2m --section=1x --no-info --output $@ ./fail2ban # # Just to comply with policy 4.8 binary-arch: # Build architecture-independent files here. -#X binary-indep: install $(MANPAGE) +#X binary-indep: install binary-indep: install dh_testdir dh_testroot dh_installchangelogs CHANGELOG dh_installdocs -#X dh_installexamples config/fail2ban.conf.* + dh_installexamples config/jail.conf # dh_install # dh_installdebconf dh_installlogrotate dh_installinit -- defaults 99 # dh_installcron # dh_installinfo -#X dh_installman fail2ban.8 man/fail2ban.conf.5 + dh_installman man/* dh_pycentral dh_python dh_link