From 5087b410542daae8d13dd93829e273df08be6ba5 Mon Sep 17 00:00:00 2001 From: blotus Date: Fri, 25 Jan 2013 13:37:22 +0100 Subject: [PATCH 01/24] Escape ' and " in matches tag --- server/action.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/action.py b/server/action.py index f2614b33..35974c70 100644 --- a/server/action.py +++ b/server/action.py @@ -243,7 +243,7 @@ class Action: return Action.executeCmd(stopCmd) def escapeTag(tag): - for c in '\\#&;`|*?~<>^()[]{}$\n': + for c in '\\#&;`|*?~<>^()[]{}$\n\'"': if c in tag: tag = tag.replace(c, '\\' + c) return tag From 3b0800459b0a21f5c2c55ccd2981198768cea18d Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Fri, 25 Jan 2013 12:56:00 -0700 Subject: [PATCH 02/24] Initial support for --no-network option for fail2ban-testcases --- fail2ban-testcases | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/fail2ban-testcases b/fail2ban-testcases index 0ee2c53c..20d3b226 100755 --- a/fail2ban-testcases +++ b/fail2ban-testcases @@ -53,6 +53,12 @@ def get_opt_parser(): help="Log level for the logger to use during running tests"), ]) + p.add_options([ + Option('-n', "--no-network", action="store_true", + dest="no_network", + help="Do not run tests that require the network"), + ]) + return p parser = get_opt_parser() @@ -90,6 +96,8 @@ else: stdout.setFormatter(logging.Formatter(' %(message)s')) logSys.addHandler(stdout) +if opts.no_network is None: + opts.no_network = False # # Let know the version @@ -129,11 +137,13 @@ tests.addTest(unittest.makeSuite(banmanagertestcase.AddFailure)) tests.addTest(unittest.makeSuite(clientreadertestcase.JailReaderTest)) # Filter -tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP)) +if not opts.no_network: + tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP)) tests.addTest(unittest.makeSuite(filtertestcase.LogFile)) tests.addTest(unittest.makeSuite(filtertestcase.LogFileMonitor)) -tests.addTest(unittest.makeSuite(filtertestcase.GetFailures)) -tests.addTest(unittest.makeSuite(filtertestcase.DNSUtilsTests)) +if not opts.no_network: + tests.addTest(unittest.makeSuite(filtertestcase.GetFailures)) + tests.addTest(unittest.makeSuite(filtertestcase.DNSUtilsTests)) tests.addTest(unittest.makeSuite(filtertestcase.JailTests)) # DateDetector From e4aedfdc00aa4b0a70d244ebc7670c51a4f946f5 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Fri, 25 Jan 2013 16:01:35 -0500 Subject: [PATCH 03/24] BF: pyinotify - use bitwise op on masks and do not try tracking newly created directories --- server/filterpyinotify.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/server/filterpyinotify.py b/server/filterpyinotify.py index fdc7256e..a2eea9d7 100644 --- a/server/filterpyinotify.py +++ b/server/filterpyinotify.py @@ -65,7 +65,11 @@ class FilterPyinotify(FileFilter): def callback(self, event): path = event.pathname - if event.mask == pyinotify.IN_CREATE: + if event.mask & pyinotify.IN_CREATE: + # skip directories altogether + if event.mask & pyinotify.IN_ISDIR: + logSys.debug("Ignoring creation of directory %s" % path) + return # check if that is a file we care about if not path in self.__watches: logSys.debug("Ignoring creation of %s we do not monitor" % path) From 9055d925f26a338232a6e017548a68ca9d9d489f Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Fri, 25 Jan 2013 14:19:10 -0700 Subject: [PATCH 04/24] Remove unneeded setting of opts.no_network --- fail2ban-testcases | 3 --- 1 file changed, 3 deletions(-) diff --git a/fail2ban-testcases b/fail2ban-testcases index 20d3b226..99fefd57 100755 --- a/fail2ban-testcases +++ b/fail2ban-testcases @@ -96,9 +96,6 @@ else: stdout.setFormatter(logging.Formatter(' %(message)s')) logSys.addHandler(stdout) -if opts.no_network is None: - opts.no_network = False - # # Let know the version # From 7fc83196b960e663f073b8e554708c1183a0c34f Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 28 Jan 2013 09:46:50 -0500 Subject: [PATCH 05/24] RF: move exceptions used by both client and server into common/exceptions.py this prevents importing of server while operating with client only --- client/beautifier.py | 14 ++++---------- common/exceptions.py | 36 ++++++++++++++++++++++++++++++++++++ server/jails.py | 17 +++-------------- 3 files changed, 43 insertions(+), 24 deletions(-) create mode 100644 common/exceptions.py diff --git a/client/beautifier.py b/client/beautifier.py index a75655e7..7e48016c 100644 --- a/client/beautifier.py +++ b/client/beautifier.py @@ -17,20 +17,14 @@ # along with Fail2Ban; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -# Author: Cyril Jaquier -# -# $Revision$ - -__author__ = "Cyril Jaquier" -__version__ = "$Revision$" -__date__ = "$Date$" -__copyright__ = "Copyright (c) 2004 Cyril Jaquier" +__author__ = "Cyril Jaquier, Yaroslav Halchenko" +__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2013- Yaroslav Halchenko" __license__ = "GPL" -from server.jails import UnknownJailException -from server.jails import DuplicateJailException import logging +from common.exceptions import UnknownJailException, DuplicateJailException + # Gets the instance of the logger. logSys = logging.getLogger("fail2ban.client.config") diff --git a/common/exceptions.py b/common/exceptions.py new file mode 100644 index 00000000..7e933544 --- /dev/null +++ b/common/exceptions.py @@ -0,0 +1,36 @@ +# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*- +# vi: set ft=python sts=4 ts=4 sw=4 noet : +"""Fail2Ban exceptions used by both client and server + +""" +# This file is part of Fail2Ban. +# +# Fail2Ban is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Fail2Ban is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Fail2Ban; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + +__author__ = "Cyril Jaquier, Yaroslav Halchenko" +__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Yaroslav Halchenko" +__license__ = "GPL" + +# +# Jails +# +class DuplicateJailException(Exception): + pass + +class UnknownJailException(Exception): + pass + + + diff --git a/server/jails.py b/server/jails.py index 3be38f70..4bf5f971 100644 --- a/server/jails.py +++ b/server/jails.py @@ -17,16 +17,11 @@ # along with Fail2Ban; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -# Author: Cyril Jaquier -# -# $Revision$ - -__author__ = "Cyril Jaquier" -__version__ = "$Revision$" -__date__ = "$Date$" -__copyright__ = "Copyright (c) 2004 Cyril Jaquier" +__author__ = "Cyril Jaquier, Yaroslav Halchenko" +__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2013- Yaroslav Halchenko" __license__ = "GPL" +from common.exceptions import DuplicateJailException, UnknownJailException from jail import Jail from threading import Lock @@ -160,9 +155,3 @@ class Jails: finally: self.__lock.release() - -class DuplicateJailException(Exception): - pass - -class UnknownJailException(Exception): - pass From 1eb23cf8afc9481ffcd2f393a291e8c9c6817608 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 28 Jan 2013 09:54:08 -0500 Subject: [PATCH 06/24] BF: do not rely on scripts being under /usr -- might differ eg on Fedora -- rely on import of common.version (Closes gh-112) This is also not ideal, since if there happens to be some systemwide common.version -- we are doomed but otherwise, we cannot keep extending comparison check to /bin, /sbin whatelse --- fail2ban-client | 9 +++++---- fail2ban-regex | 9 +++++---- fail2ban-server | 7 ++++--- 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/fail2ban-client b/fail2ban-client index 1d8eb15e..13d018e6 100755 --- a/fail2ban-client +++ b/fail2ban-client @@ -27,12 +27,13 @@ import getopt, time, shlex, socket # Inserts our own modules path first in the list # fix for bug #343821 -if os.path.abspath(__file__).startswith('/usr/'): - # makes sense to use system-wide library iff -client is also under /usr/ +try: + from common.version import version +except ImportError, e: sys.path.insert(1, "/usr/share/fail2ban") + from common.version import version -# Now we can import our modules -from common.version import version +# Now we can import the rest of modules from common.protocol import printFormatted from client.csocket import CSocket from client.configurator import Configurator diff --git a/fail2ban-regex b/fail2ban-regex index a42ed96d..f9bc72c1 100755 --- a/fail2ban-regex +++ b/fail2ban-regex @@ -26,13 +26,14 @@ import getopt, sys, time, logging, os # Inserts our own modules path first in the list # fix for bug #343821 -if os.path.abspath(__file__).startswith('/usr/'): - # makes sense to use system-wide library iff -regex is also under /usr/ - sys.path.insert(1, "/usr/share/fail2ban") +try: + from common.version import version +except ImportError, e: + sys.path.insert(1, "/usr/share/fail2ban") + from common.version import version from client.configparserinc import SafeConfigParserWithIncludes from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError -from common.version import version from server.filter import Filter from server.failregex import RegexException diff --git a/fail2ban-server b/fail2ban-server index bd86e6cd..0f3410c9 100755 --- a/fail2ban-server +++ b/fail2ban-server @@ -26,11 +26,12 @@ import getopt, sys, logging, os # Inserts our own modules path first in the list # fix for bug #343821 -if os.path.abspath(__file__).startswith('/usr/'): - # makes sense to use system-wide library iff -server is also under /usr/ +try: + from common.version import version +except ImportError, e: sys.path.insert(1, "/usr/share/fail2ban") + from common.version import version -from common.version import version from server.server import Server # Gets the instance of the logger. From ed386dfe0779067daa4f76f38a0234aeaa50292f Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Fri, 15 Mar 2013 14:37:11 -0600 Subject: [PATCH 07/24] Add systemd unit file and tmpfiles.d configuration files --- files/fail2ban-tmpfiles.conf | 1 + files/fail2ban.service | 12 ++++++++++++ 2 files changed, 13 insertions(+) create mode 100644 files/fail2ban-tmpfiles.conf create mode 100644 files/fail2ban.service diff --git a/files/fail2ban-tmpfiles.conf b/files/fail2ban-tmpfiles.conf new file mode 100644 index 00000000..3fd783f3 --- /dev/null +++ b/files/fail2ban-tmpfiles.conf @@ -0,0 +1 @@ +D /var/run/fail2ban 0755 root root - \ No newline at end of file diff --git a/files/fail2ban.service b/files/fail2ban.service new file mode 100644 index 00000000..35d7fc88 --- /dev/null +++ b/files/fail2ban.service @@ -0,0 +1,12 @@ +[Unit] +Description=Fail2ban Service + +[Service] +Type=forking +ExecStart=/usr/bin/fail2ban-client -x start +ExecStop=/usr/bin/fail2ban-client stop +ExecReload=/usr/bin/fail2ban-client reload +Restart=always + +[Install] +WantedBy=network.target From 32d10e904aef5b5981c6b6abe19bee4690d17c0c Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Wed, 17 Apr 2013 00:03:36 +1000 Subject: [PATCH 08/24] ENH: more openssh fail messages from openssh source code (CVS 20121205) --- config/filter.d/sshd.conf | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index e4339c78..07b2dd57 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -24,13 +24,16 @@ _daemon = sshd # Values: TEXT # failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from \s*$ + ^%(__prefix_line)sDid not receive identification string from $ ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from \s*$ - ^%(__prefix_line)sFailed (?:password|publickey) for .* from (?: port \d*)?(?: ssh\d*)?\s*$ + ^%(__prefix_line)sFailed \S+ for .* from (?: port \d*)?(?: ssh\d*)?\s*$ ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM \s*$ ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from \s*$ ^%(__prefix_line)sUser .+ from not allowed because not listed in AllowUsers\s*$ ^%(__prefix_line)sUser .+ from not allowed because listed in DenyUsers\s*$ + ^%(__prefix_line)sUser .+ from not allowed because not in any group\s*$ ^%(__prefix_line)srefused connect from \S+ \(\)\s*$ + ^%(__prefix_line)sUser .+ from not allowed because a group is listed in DenyGroups\s*$ ^%(__prefix_line)sUser .+ from not allowed because none of user's groups are listed in AllowGroups\s*$ # Option: ignoreregex From 6f4dad46f0c2a6505594c6c13ed298ef501decba Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Wed, 17 Apr 2013 10:07:01 -0400 Subject: [PATCH 09/24] DOC: slight tune ups to README (we are no longer compatible with python 2.3 ;) ) --- README | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-) diff --git a/README b/README index cab683f5..2016e9e1 100644 --- a/README +++ b/README @@ -13,13 +13,13 @@ rules can be defined by the user. Fail2Ban can read multiple log files such as sshd or Apache web server ones. This README is a quick introduction to Fail2ban. More documentation, FAQ, HOWTOs -are available on the project website: http://www.fail2ban.org +are available in fail2ban(1) manpage and on the website http://www.fail2ban.org Installation: ------------- Required: - >=python-2.3 (http://www.python.org) + >=python-2.4 (http://www.python.org) Optional: pyinotify: @@ -38,42 +38,43 @@ To install, just do: This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are placed into /usr/bin. -It is possible that Fail2ban is already packaged for your distribution. In this -case, you should use it. +It is possible that Fail2ban is already packaged for your distribution. In +this case, you should use it. Fail2Ban should be correctly installed now. Just type: > fail2ban-client -h -to see if everything is alright. You should always use fail2ban-client and never -call fail2ban-server directly. +to see if everything is alright. You should always use fail2ban-client and +never call fail2ban-server directly. Configuration: -------------- -You can configure Fail2Ban using the files in /etc/fail2ban. It is -possible to configure the server using commands sent to it by -fail2ban-client. The available commands are described in the -fail2ban-client(1) manpage. Also see fail2ban(1) manpage for further -references and find even more documentation on the website: -http://www.fail2ban.org +You can configure Fail2Ban using the files in /etc/fail2ban. It is possible to +configure the server using commands sent to it by fail2ban-client. The +available commands are described in the fail2ban-client(1) manpage. Also see +fail2ban(1) manpage for further references and find even more documentation on +the website: http://www.fail2ban.org Contact: -------- Website: http://www.fail2ban.org -You need some new features, you found bugs: visit -https://github.com/fail2ban/fail2ban/issues +You need some new features, you found bugs? +visit https://github.com/fail2ban/fail2ban/issues and if your issue is not yet known -- file a bug report. -If you would like to troubleshoot or discuss: join the mailing list +You would like to troubleshoot or discuss? +join the mailing list https://lists.sourceforge.net/lists/listinfo/fail2ban-users -If you just appreciate this program: send kudos to the original author -(Cyril Jaquier: ) or the mailing list +You just appreciate this program: +send kudos to the original author (Cyril Jaquier ) +or better to the mailing list https://lists.sourceforge.net/lists/listinfo/fail2ban-users - +since Fail2Ban is "community-driven" for years now. Thanks: ------- From ddebcab9aae68bb1b93d11bddb63c8c54bec4186 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Wed, 17 Apr 2013 09:27:06 -0600 Subject: [PATCH 10/24] Add After, PIDFile, and change WantedBy to multi-user.target in fail2ban.server --- files/fail2ban.service | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/files/fail2ban.service b/files/fail2ban.service index 35d7fc88..9c44042b 100644 --- a/files/fail2ban.service +++ b/files/fail2ban.service @@ -1,12 +1,14 @@ [Unit] Description=Fail2ban Service +After=syslog.target network.target [Service] Type=forking ExecStart=/usr/bin/fail2ban-client -x start ExecStop=/usr/bin/fail2ban-client stop ExecReload=/usr/bin/fail2ban-client reload +PIDFile=/var/run/fail2ban/fail2ban.pid Restart=always [Install] -WantedBy=network.target +WantedBy=multi-user.target From 76c08cebe9944a297327e30928abdd10e332733d Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Wed, 17 Apr 2013 11:54:45 -0400 Subject: [PATCH 11/24] DOC: a plugin to thanks for the community support --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 12678936..c571d772 100644 --- a/ChangeLog +++ b/ChangeLog @@ -20,6 +20,10 @@ Nicolas Collignon, Pascal Borreli, blotus: - New features: - Enhancements: +Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom +Hendrikx and other TBN heroes supporting users on fail2ban-users +mailing list and IRC. + ver. 0.8.8 (2012/12/06) - stable ---------- - Fixes: From 41b9f7b6ac4a60d411c58fd5f1305d7539fb104a Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 18 Apr 2013 04:38:03 +1000 Subject: [PATCH 12/24] BF: filter.d/sshd "Did not receive identification string" relates to an exploit so document this in sshd-ddos.conf but leave it out of authentication based blocks in sshd.conf --- config/filter.d/sshd-ddos.conf | 7 +++++++ config/filter.d/sshd.conf | 1 - 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/config/filter.d/sshd-ddos.conf b/config/filter.d/sshd-ddos.conf index 266594ba..58698ced 100644 --- a/config/filter.d/sshd-ddos.conf +++ b/config/filter.d/sshd-ddos.conf @@ -2,6 +2,13 @@ # # Author: Yaroslav Halchenko # +# The regex here also relates to a exploit: +# +# http://www.securityfocus.com/bid/17958/exploit +# The example code here shows the pushing of the exploit straight after +# reading the server version. This is where the client version string normally +# pushed. As such the server will read this unparsible information as +# "Did not receive identification string". [INCLUDES] diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index 07b2dd57..b4e645c4 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -24,7 +24,6 @@ _daemon = sshd # Values: TEXT # failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from \s*$ - ^%(__prefix_line)sDid not receive identification string from $ ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from \s*$ ^%(__prefix_line)sFailed \S+ for .* from (?: port \d*)?(?: ssh\d*)?\s*$ ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM \s*$ From 1331e15ac375426fef89928b5ea5d62a724c6380 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 18 Apr 2013 04:48:51 +1000 Subject: [PATCH 13/24] DOC: guidance for pull requests --- DEVELOP | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/DEVELOP b/DEVELOP index a31bf04a..124f4c01 100644 --- a/DEVELOP +++ b/DEVELOP @@ -21,6 +21,18 @@ would like to add to Fail2Ban, the best way to do so it to use the GitHub Pull Request feature. You can find more details on the Fail2Ban wiki (http://www.fail2ban.org/wiki/index.php/Get_Involved) +Pull Requests +============= + +When submitting pull requests on GitHub we ask you to: +* Clearly describe the problem you're solving; +* Don't introduce regressions that will make it hard for systems adminstrators + to update; +* Include test cases (see below); +* Include sample logs (if relevant); +* Include a change to the relevant section of the ChangeLog; and +* Include yourself in THANKS if not already there. + Testing ======= From d1c8b5795233d0a035a027381b68b62913ba57dd Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 18 Apr 2013 04:52:21 +1000 Subject: [PATCH 14/24] DOC: ChangeLog versions and dates for Releasing --- DEVELOP | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/DEVELOP b/DEVELOP index 124f4c01..438599a4 100644 --- a/DEVELOP +++ b/DEVELOP @@ -269,6 +269,10 @@ Releasing git shortlog -sn 0.8.8.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g' + Ensure the top of the ChangeLog has the right version and current date. + + Ensure the top entry of the ChangeLog has the right version and current date. + # Update man pages (cd man ; ./generate-man ) From 6b260ab974efd2881cdb555966bafbeb26066263 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 18 Apr 2013 04:53:17 +1000 Subject: [PATCH 15/24] DOC: version/date of release --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index c571d772..f119d310 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,7 +4,7 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ================================================================================ -Fail2Ban (version 0.8.8) 2012/12/06 +Fail2Ban (version 0.8.9) 2013/04/XX ================================================================================ ver. 0.8.9 (2013/04/XXX) - wanna-be-stable From 60fa4b5d7c5748bd3f56e0339e86c7718ece153a Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 18 Apr 2013 05:08:45 +1000 Subject: [PATCH 16/24] DOC: begining of ChangeLog --- ChangeLog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ChangeLog b/ChangeLog index f119d310..dce5ed6c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -17,7 +17,13 @@ Michael Gebetsroither, Orion Poplawski, Artur Penttinen, sebres, Nicolas Collignon, Pascal Borreli, blotus: - Fixes: + Yaroslav Halchenko + * [6f4dad46] Documentation python-2.4 is the minimium version. - New features: + Yaroslav Halchenko + * [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile} + to provide additional flexibility to system adminstrators. Thanks to + beilber for the idea. Close gh-114. - Enhancements: Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom From dc2f42b24dfc43fb660f2402601aeef21cac9b7e Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 18 Apr 2013 06:57:35 +1000 Subject: [PATCH 17/24] DOC: ChangeLog - current HEAD back to ce3ab34 --- ChangeLog | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/ChangeLog b/ChangeLog index dce5ed6c..3e366378 100644 --- a/ChangeLog +++ b/ChangeLog @@ -19,12 +19,67 @@ Nicolas Collignon, Pascal Borreli, blotus: - Fixes: Yaroslav Halchenko * [6f4dad46] Documentation python-2.4 is the minimium version. + * [1eb23cf8] do not rely on scripts being under /usr -- might differ eg on + Fedora. Closes gh-112. Thanks to Camusensei for the bug report. + * [bf4d4af1] Changes for atomic writes. Thanks to Steven Hiscocks for + insight. Closes gh-103. + * [ab044b75] delay check for the existence of config directory until read. + * [3b4084d4] fixing up for handling of TAI64N timestamps. + * [154aa38e] do not shutdown logging until all jails stop. + Orion Poplawski + * [e4aedfdc00] pyinotify - use bitwise op on masks and do not try tracking + newly created directories. + Nicolas Collignon + * [39667ff6] Avoid leaking file descriptors. Closes gh-167. + Sergey Brester + * [b6bb2f88 and d17b4153] invalid date recognition, irregular because of + sorting template list. + Steven Hiscocks + * [7a442f07] When changing log target with python2.{4,5} handle KeyError. + Closes gh-147, gh-148. + * [b6a68f51] Fix delaction on server side. Close gh-124. + Daniel Black + * [f0610c01] Allow more that a one word command when changing and Action via + the fail2ban-client. Closes gh-134. - New features: Yaroslav Halchenko * [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile} to provide additional flexibility to system adminstrators. Thanks to beilber for the idea. Close gh-114. - Enhancements: + Steven Hiscocks + * [c6bd8fc] Add Apache Tomcat date format. Close gh-176. + * [4d80fad] Add Guacmole filter. Close gh-176. + * [3d6791f] Ensure restart of Actions after a check fails occurs + consistently. Closes gh-172. + * [MANY] Improvements to test cases, travis, and code coverage (coveralls). + * [b36835f] Add get cinfo to fail2ban-client. Close gh-124. + * [ce3ab34] Added ability to specify PID file. + Orion Poplawski + * [ddebcab] Enhance fail2ban.service defination dependancies and Pidfile. + Closes gh-142. + Artur Penttinen + * [29d0df5] Add mysqld filter. Closes gh-152. + Erwan Ben Souiden + * [d7d5228] add nagios integration documentation and script to ensure + fail2ban is running. Closes gh-166. + ArndRaphael Brandes + * [bba3fd8] Add Sogo filter. Closes gh-117 + Yaroslav Halchenko + * [MANY] Lots of improvements to log messages and test cases. + * [91d5736] Postfix filter improvements - empty helo, from and rcpt to. + Closes gh-126. Bug report by Michael Heuberger. + * [40c5a2d] adding more of diagnostic messages into -client while starting + the daemon. + Daniel Black + * [3aeb1a9] Add jail.conf manual page. close gh-143. + * [7cd6dab] Added help command to fail2ban-client. close gh-134. + * [c8c7b0b,23bbc60] Better logging of log file read errors. close gh-134. + * [3665e6d] Added code coverage to development process. + Pascal Borreli + * [a2b29b4] Fixed lots of typos in config files and documentation. + Michael Gebetsriother + * [f9b78ba] Add action route to block at routing level. Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom Hendrikx and other TBN heroes supporting users on fail2ban-users From 3e0e0482aef1451c9a991ac1879900333c4e8d4e Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 18 Apr 2013 07:07:05 +1000 Subject: [PATCH 18/24] DOC: post release ChangeLog entry --- DEVELOP | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/DEVELOP b/DEVELOP index 438599a4..03edebbc 100644 --- a/DEVELOP +++ b/DEVELOP @@ -296,3 +296,13 @@ Releasing # Email users and development list of release TODO notifying distributors etc. + +Post Release: + +Add the following to the top of the ChangeLog + +ver. 0.8.9 (2013/XX/XXX) - wanna-be-stable +- Fixes +- New Features +- Enhancements + From 0a57b6183606d5904109cf8a7009d668acd73e44 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 18 Apr 2013 07:09:07 +1000 Subject: [PATCH 19/24] DOC: developers please rebase and use a single commit --- DEVELOP | 1 + 1 file changed, 1 insertion(+) diff --git a/DEVELOP b/DEVELOP index 03edebbc..3e8e430a 100644 --- a/DEVELOP +++ b/DEVELOP @@ -28,6 +28,7 @@ When submitting pull requests on GitHub we ask you to: * Clearly describe the problem you're solving; * Don't introduce regressions that will make it hard for systems adminstrators to update; +* If adding a major feature rebase your changes on master and get to a single commit; * Include test cases (see below); * Include sample logs (if relevant); * Include a change to the relevant section of the ChangeLog; and From d4b5e8ec30600d4966e8bfbfb4368b873a403974 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 18 Apr 2013 08:45:20 +1000 Subject: [PATCH 20/24] DOC: credit man page edits --- ChangeLog | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 3e366378..23f46aef 100644 --- a/ChangeLog +++ b/ChangeLog @@ -66,13 +66,14 @@ Nicolas Collignon, Pascal Borreli, blotus: ArndRaphael Brandes * [bba3fd8] Add Sogo filter. Closes gh-117 Yaroslav Halchenko - * [MANY] Lots of improvements to log messages and test cases. + * [MANY] Lots of improvements to log messages, man pages and test cases. * [91d5736] Postfix filter improvements - empty helo, from and rcpt to. Closes gh-126. Bug report by Michael Heuberger. * [40c5a2d] adding more of diagnostic messages into -client while starting the daemon. Daniel Black * [3aeb1a9] Add jail.conf manual page. close gh-143. + * [MANY] man page edits. * [7cd6dab] Added help command to fail2ban-client. close gh-134. * [c8c7b0b,23bbc60] Better logging of log file read errors. close gh-134. * [3665e6d] Added code coverage to development process. From ed123ea403f735fceeddbc6973958a55d4fec49e Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 18 Apr 2013 11:34:44 +1000 Subject: [PATCH 21/24] DOC: tomcat and Guacmole are next release --- ChangeLog | 2 -- 1 file changed, 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 23f46aef..fbdf2d48 100644 --- a/ChangeLog +++ b/ChangeLog @@ -48,8 +48,6 @@ Nicolas Collignon, Pascal Borreli, blotus: beilber for the idea. Close gh-114. - Enhancements: Steven Hiscocks - * [c6bd8fc] Add Apache Tomcat date format. Close gh-176. - * [4d80fad] Add Guacmole filter. Close gh-176. * [3d6791f] Ensure restart of Actions after a check fails occurs consistently. Closes gh-172. * [MANY] Improvements to test cases, travis, and code coverage (coveralls). From 5413f9b3a18eccc120c547e2f3027205e1463567 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 18 Apr 2013 11:36:37 +1000 Subject: [PATCH 22/24] DOC: move new actions and filters to New Features in ChangeLog --- ChangeLog | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/ChangeLog b/ChangeLog index fbdf2d48..25b1ad20 100644 --- a/ChangeLog +++ b/ChangeLog @@ -46,6 +46,15 @@ Nicolas Collignon, Pascal Borreli, blotus: * [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile} to provide additional flexibility to system adminstrators. Thanks to beilber for the idea. Close gh-114. + Erwan Ben Souiden + * [d7d5228] add nagios integration documentation and script to ensure + fail2ban is running. Closes gh-166. + Artur Penttinen + * [29d0df5] Add mysqld filter. Closes gh-152. + ArndRaphael Brandes + * [bba3fd8] Add Sogo filter. Closes gh-117 + Michael Gebetsriother + * [f9b78ba] Add action route to block at routing level. - Enhancements: Steven Hiscocks * [3d6791f] Ensure restart of Actions after a check fails occurs @@ -56,13 +65,6 @@ Nicolas Collignon, Pascal Borreli, blotus: Orion Poplawski * [ddebcab] Enhance fail2ban.service defination dependancies and Pidfile. Closes gh-142. - Artur Penttinen - * [29d0df5] Add mysqld filter. Closes gh-152. - Erwan Ben Souiden - * [d7d5228] add nagios integration documentation and script to ensure - fail2ban is running. Closes gh-166. - ArndRaphael Brandes - * [bba3fd8] Add Sogo filter. Closes gh-117 Yaroslav Halchenko * [MANY] Lots of improvements to log messages, man pages and test cases. * [91d5736] Postfix filter improvements - empty helo, from and rcpt to. @@ -77,8 +79,6 @@ Nicolas Collignon, Pascal Borreli, blotus: * [3665e6d] Added code coverage to development process. Pascal Borreli * [a2b29b4] Fixed lots of typos in config files and documentation. - Michael Gebetsriother - * [f9b78ba] Add action route to block at routing level. Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom Hendrikx and other TBN heroes supporting users on fail2ban-users From e5e01187175dafac23d61da640cd2e7639820505 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 18 Apr 2013 12:13:26 +1000 Subject: [PATCH 23/24] DOC: more ChangeLog entries all the way back to 0.8.8 --- ChangeLog | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/ChangeLog b/ChangeLog index 25b1ad20..eb7e2cfd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -41,11 +41,14 @@ Nicolas Collignon, Pascal Borreli, blotus: Daniel Black * [f0610c01] Allow more that a one word command when changing and Action via the fail2ban-client. Closes gh-134. + blotus + * [96eb8986] ' and " should also be escaped in action tags Closes gh-109 - New features: Yaroslav Halchenko * [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile} to provide additional flexibility to system adminstrators. Thanks to beilber for the idea. Close gh-114. + * [3ce53e87] Add exim filter. Erwan Ben Souiden * [d7d5228] add nagios integration documentation and script to ensure fail2ban is running. Closes gh-166. @@ -55,6 +58,12 @@ Nicolas Collignon, Pascal Borreli, blotus: * [bba3fd8] Add Sogo filter. Closes gh-117 Michael Gebetsriother * [f9b78ba] Add action route to block at routing level. + Teodor Micu & Yaroslav Halchenko + * [5f2d383] Add roundcube auth filter. Close Debian bug #699442. + Daniel Black + * [be06b1b] Add action for iptables-ipsets. Close gh-102. + Soulard Morgan + * [f336d9f] Add filter for webmin. Close gh-99 - Enhancements: Steven Hiscocks * [3d6791f] Ensure restart of Actions after a check fails occurs @@ -79,6 +88,8 @@ Nicolas Collignon, Pascal Borreli, blotus: * [3665e6d] Added code coverage to development process. Pascal Borreli * [a2b29b4] Fixed lots of typos in config files and documentation. + hamilton5 + * [7ede1e8] Update dovecot filter config Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom Hendrikx and other TBN heroes supporting users on fail2ban-users From 274227bdfa613bafe026496e554f0167f7cacaf8 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sat, 20 Apr 2013 19:40:56 -0400 Subject: [PATCH 24/24] DOC: tune up formatting (spaces) and prelude for the changelog entry --- ChangeLog | 145 ++++++++++++++++++++++++++++-------------------------- 1 file changed, 74 insertions(+), 71 deletions(-) diff --git a/ChangeLog b/ChangeLog index eb7e2cfd..e60eb12f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,86 +10,89 @@ Fail2Ban (version 0.8.9) 2013/04/XX ver. 0.8.9 (2013/04/XXX) - wanna-be-stable ---------- -This release incorporates 144 (XXX) non-merge commits from 14 -contributors (sorted by number of commits): Yaroslav Halchenko, Daniel -Black, Steven Hiscocks, ArndRa, hamilton5, pigsyn, Erwan Ben Souiden, -Michael Gebetsroither, Orion Poplawski, Artur Penttinen, sebres, -Nicolas Collignon, Pascal Borreli, blotus: +Although primarily a bugfix release, it incorporates many new +enhancements, few new features, but more importantly -- quite extended +tests battery with current 94% coverage. This release incorporates +more than a 100 of non-merge commits from 14 contributors (sorted by +number of commits): Yaroslav Halchenko, Daniel Black, Steven Hiscocks, +ArndRa, hamilton5, pigsyn, Erwan Ben Souiden, Michael Gebetsroither, +Orion Poplawski, Artur Penttinen, sebres, Nicolas Collignon, Pascal +Borreli, blotus: - Fixes: Yaroslav Halchenko - * [6f4dad46] Documentation python-2.4 is the minimium version. - * [1eb23cf8] do not rely on scripts being under /usr -- might differ eg on - Fedora. Closes gh-112. Thanks to Camusensei for the bug report. - * [bf4d4af1] Changes for atomic writes. Thanks to Steven Hiscocks for - insight. Closes gh-103. - * [ab044b75] delay check for the existence of config directory until read. - * [3b4084d4] fixing up for handling of TAI64N timestamps. - * [154aa38e] do not shutdown logging until all jails stop. + * [6f4dad46] Documentation python-2.4 is the minimium version. + * [1eb23cf8] do not rely on scripts being under /usr -- might differ eg on + Fedora. Closes gh-112. Thanks to Camusensei for the bug report. + * [bf4d4af1] Changes for atomic writes. Thanks to Steven Hiscocks for + insight. Closes gh-103. + * [ab044b75] delay check for the existence of config directory until read. + * [3b4084d4] fixing up for handling of TAI64N timestamps. + * [154aa38e] do not shutdown logging until all jails stop. Orion Poplawski - * [e4aedfdc00] pyinotify - use bitwise op on masks and do not try tracking - newly created directories. - Nicolas Collignon - * [39667ff6] Avoid leaking file descriptors. Closes gh-167. - Sergey Brester - * [b6bb2f88 and d17b4153] invalid date recognition, irregular because of - sorting template list. + * [e4aedfdc00] pyinotify - use bitwise op on masks and do not try tracking + newly created directories. + Nicolas Collignon + * [39667ff6] Avoid leaking file descriptors. Closes gh-167. + Sergey Brester + * [b6bb2f88 and d17b4153] invalid date recognition, irregular because of + sorting template list. Steven Hiscocks - * [7a442f07] When changing log target with python2.{4,5} handle KeyError. - Closes gh-147, gh-148. - * [b6a68f51] Fix delaction on server side. Close gh-124. + * [7a442f07] When changing log target with python2.{4,5} handle KeyError. + Closes gh-147, gh-148. + * [b6a68f51] Fix delaction on server side. Closes gh-124. Daniel Black - * [f0610c01] Allow more that a one word command when changing and Action via - the fail2ban-client. Closes gh-134. + * [f0610c01] Allow more that a one word command when changing and Action via + the fail2ban-client. Closes gh-134. blotus - * [96eb8986] ' and " should also be escaped in action tags Closes gh-109 + * [96eb8986] ' and " should also be escaped in action tags Closes gh-109 - New features: Yaroslav Halchenko - * [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile} - to provide additional flexibility to system adminstrators. Thanks to - beilber for the idea. Close gh-114. - * [3ce53e87] Add exim filter. - Erwan Ben Souiden - * [d7d5228] add nagios integration documentation and script to ensure - fail2ban is running. Closes gh-166. - Artur Penttinen - * [29d0df5] Add mysqld filter. Closes gh-152. - ArndRaphael Brandes - * [bba3fd8] Add Sogo filter. Closes gh-117 - Michael Gebetsriother - * [f9b78ba] Add action route to block at routing level. - Teodor Micu & Yaroslav Halchenko - * [5f2d383] Add roundcube auth filter. Close Debian bug #699442. + * [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile} + to provide additional flexibility to system adminstrators. Thanks to + beilber for the idea. Closes gh-114. + * [3ce53e87] Add exim filter. + Erwan Ben Souiden + * [d7d5228] add nagios integration documentation and script to ensure + fail2ban is running. Closes gh-166. + Artur Penttinen + * [29d0df5] Add mysqld filter. Closes gh-152. + ArndRaphael Brandes + * [bba3fd8] Add Sogo filter. Closes gh-117. + Michael Gebetsriother + * [f9b78ba] Add action route to block at routing level. + Teodor Micu & Yaroslav Halchenko + * [5f2d383] Add roundcube auth filter. Closes Debian bug #699442. Daniel Black - * [be06b1b] Add action for iptables-ipsets. Close gh-102. - Soulard Morgan - * [f336d9f] Add filter for webmin. Close gh-99 + * [be06b1b] Add action for iptables-ipsets. Closes gh-102. + Soulard Morgan + * [f336d9f] Add filter for webmin. Closes gh-99. - Enhancements: Steven Hiscocks - * [3d6791f] Ensure restart of Actions after a check fails occurs - consistently. Closes gh-172. - * [MANY] Improvements to test cases, travis, and code coverage (coveralls). - * [b36835f] Add get cinfo to fail2ban-client. Close gh-124. - * [ce3ab34] Added ability to specify PID file. - Orion Poplawski - * [ddebcab] Enhance fail2ban.service defination dependancies and Pidfile. - Closes gh-142. + * [3d6791f] Ensure restart of Actions after a check fails occurs + consistently. Closes gh-172. + * [MANY] Improvements to test cases, travis, and code coverage (coveralls). + * [b36835f] Add get cinfo to fail2ban-client. Closes gh-124. + * [ce3ab34] Added ability to specify PID file. + Orion Poplawski + * [ddebcab] Enhance fail2ban.service definition dependencies and Pidfile. + Closes gh-142. Yaroslav Halchenko - * [MANY] Lots of improvements to log messages, man pages and test cases. - * [91d5736] Postfix filter improvements - empty helo, from and rcpt to. - Closes gh-126. Bug report by Michael Heuberger. - * [40c5a2d] adding more of diagnostic messages into -client while starting - the daemon. - Daniel Black - * [3aeb1a9] Add jail.conf manual page. close gh-143. - * [MANY] man page edits. - * [7cd6dab] Added help command to fail2ban-client. close gh-134. - * [c8c7b0b,23bbc60] Better logging of log file read errors. close gh-134. - * [3665e6d] Added code coverage to development process. - Pascal Borreli - * [a2b29b4] Fixed lots of typos in config files and documentation. - hamilton5 - * [7ede1e8] Update dovecot filter config + * [MANY] Lots of improvements to log messages, man pages and test cases. + * [91d5736] Postfix filter improvements - empty helo, from and rcpt to. + Closes gh-126. Bug report by Michael Heuberger. + * [40c5a2d] adding more of diagnostic messages into -client while starting + the daemon. + Daniel Black + * [3aeb1a9] Add jail.conf manual page. Closes gh-143. + * [MANY] man page edits. + * [7cd6dab] Added help command to fail2ban-client. + * [c8c7b0b,23bbc60] Better logging of log file read errors. + * [3665e6d] Added code coverage to development process. + Pascal Borreli + * [a2b29b4] Fixed lots of typos in config files and documentation. + hamilton5 + * [7ede1e8] Update dovecot filter config. Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom Hendrikx and other TBN heroes supporting users on fail2ban-users @@ -100,20 +103,20 @@ ver. 0.8.8 (2012/12/06) - stable - Fixes: Alan Jenkins * [8c38907] Removed 'POSSIBLE BREAK-IN ATTEMPT' from sshd filter to avoid - banning due to misconfigured DNS. Close gh-64 + banning due to misconfigured DNS. Closes gh-64 Yaroslav Halchenko * [83109bc] IMPORTANT: escape the content of (if used in custom action files) since its value could contain arbitrary symbols. Thanks for discovery go to the NBS System security team - * [0935566,5becaf8] Various python 2.4 and 2.5 compatibility fixes. Close gh-83 + * [0935566,5becaf8] Various python 2.4 and 2.5 compatibility fixes. Closes gh-83 * [b159eab] do not enable pyinotify backend if pyinotify < 0.8.3 * [37a2e59] store IP as a base, non-unicode str to avoid spurious messages - in the console. Close gh-91 + in the console. Closes gh-91 - New features: David Engeset * [2d672d1,6288ec2] 'unbanip' command for the client + avoidance of touching - the log file to take 'banip' or 'unbanip' in effect. Close gh-81, gh-86 + the log file to take 'banip' or 'unbanip' in effect. Closes gh-81, gh-86 Yaroslav Halchenko - Enhancements: * [2d66f31] replaced uninformative "Invalid command" message with warning log