From e07a8cda07c8b3c3e9ab6ed304ac547fcbff986c Mon Sep 17 00:00:00 2001 From: "Serg G. Brester" Date: Fri, 27 Oct 2017 15:26:17 +0200 Subject: [PATCH 1/8] Update jail.conf Documentation of parameters for action blocklist_de, closes gh-1940 --- config/jail.conf | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/config/jail.conf b/config/jail.conf index 29ad4c96..fb76926d 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -186,10 +186,11 @@ action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"] # Report block via blocklist.de fail2ban reporting service API # -# See the IMPORTANT note in action.d/blocklist_de.conf for when to -# use this action. Create a file jail.d/blocklist_de.local containing -# [Init] -# blocklist_de_apikey = {api key from registration] +# See the IMPORTANT note in action.d/blocklist_de.conf for when to use this action. +# Specify expected parameters in file action.d/blocklist_de.local or if the interpolation +# `action_blocklist_de` used for the action, set value of `blocklist_de_apikey` +# in your `jail.local` globally (section [DEFAULT]) or per specific jail section (resp. in +# corresponding jail.d/my-jail.local file). # action_blocklist_de = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"] From 18d2761dc0738b86f4a241b8bb9a2aa4b8f6ec07 Mon Sep 17 00:00:00 2001 From: Stuart Cardall Date: Sat, 28 Oct 2017 16:14:03 +0000 Subject: [PATCH 2/8] gentoo-initd: add descriptions add descriptions to stop syslog errors for extra_started_commands when running: rc-service ipset describe Oct 28 15:13:30 xxxx daemon.warn /etc/init.d/fail2ban[26446]: ^[[1m^[[36mreload^[[m: no description Oct 28 15:13:30 xxxx daemon.warn /etc/init.d/fail2ban[26447]: ^[[1m^[[36mshowlog^[[m: no description --- files/gentoo-initd | 3 +++ 1 file changed, 3 insertions(+) diff --git a/files/gentoo-initd b/files/gentoo-initd index c4d8675c..b47e2c47 100755 --- a/files/gentoo-initd +++ b/files/gentoo-initd @@ -18,6 +18,9 @@ # Author: Sireyessire, Cyril Jaquier # +description="Daemon to ban hosts that cause multiple authentication errors" +description_reload="reload configuration" +description_showlog="show fail2ban logs" extra_started_commands="reload showlog" FAIL2BAN="/usr/bin/fail2ban-client ${FAIL2BAN_OPTIONS}" From 4a2fc8b7e85554ac819e30b48d300550a9cced10 Mon Sep 17 00:00:00 2001 From: Jeff Potter Date: Sun, 25 Jun 2017 19:05:13 -0400 Subject: [PATCH 3/8] Include imap (port 143) in courier-auth ports imap was missing from the list of ports, preventing fail2ban from blocking connections on standard IMAP port 143. --- config/jail.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/jail.conf b/config/jail.conf index 5a6c59e6..c9fb9475 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -622,7 +622,7 @@ logpath = /opt/kerio/mailserver/store/logs/security.log [courier-auth] -port = smtp,465,submission,imap3,imaps,pop3,pop3s +port = smtp,465,submission,imap,imap3,imaps,pop3,pop3s logpath = %(syslog_mail)s backend = %(syslog_backend)s From 9876dd44f93a0b012108ea1aceeccee21be03cb9 Mon Sep 17 00:00:00 2001 From: "Serg G. Brester" Date: Fri, 3 Nov 2017 13:43:33 +0100 Subject: [PATCH 4/8] replace port imap3 with imap everywhere, since imap3 is not a standard port and old rarely (if ever) used and missing on some systems (see gh-1942) --- config/jail.conf | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/config/jail.conf b/config/jail.conf index c9fb9475..41cb3529 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -622,7 +622,7 @@ logpath = /opt/kerio/mailserver/store/logs/security.log [courier-auth] -port = smtp,465,submission,imap,imap3,imaps,pop3,pop3s +port = smtp,465,submission,imap,imaps,pop3,pop3s logpath = %(syslog_mail)s backend = %(syslog_backend)s @@ -630,7 +630,7 @@ backend = %(syslog_backend)s [postfix-sasl] filter = postfix[mode=auth] -port = smtp,465,submission,imap3,imaps,pop3,pop3s +port = smtp,465,submission,imap,imaps,pop3,pop3s # You might consider monitoring /var/log/mail.warn instead if you are # running postfix since it would provide the same log lines at the # "warn" level but overall at the smaller filesize. @@ -640,27 +640,27 @@ backend = %(postfix_backend)s [perdition] -port = imap3,imaps,pop3,pop3s +port = imap,imaps,pop3,pop3s logpath = %(syslog_mail)s backend = %(syslog_backend)s [squirrelmail] -port = smtp,465,submission,imap2,imap3,imaps,pop3,pop3s,http,https,socks +port = smtp,465,submission,imap,imap2,imaps,pop3,pop3s,http,https,socks logpath = /var/lib/squirrelmail/prefs/squirrelmail_access_log [cyrus-imap] -port = imap3,imaps +port = imap,imaps logpath = %(syslog_mail)s backend = %(syslog_backend)s [uwimap-auth] -port = imap3,imaps +port = imap,imaps logpath = %(syslog_mail)s backend = %(syslog_backend)s From 8b26fd27780ef4a211dfa312e99e6f69bf181c16 Mon Sep 17 00:00:00 2001 From: "Serg G. Brester" Date: Fri, 3 Nov 2017 13:54:40 +0100 Subject: [PATCH 5/8] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index f8995d3d..3ddd159c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,6 +39,8 @@ ver. 0.10.2-dev-1 (2017/??/??) - development edition ports are enclosed in curly braces `{ }` in the `jail.local` etc. This may cause a double-brackets now. ### Fixes +* jail.conf: port `imap3` replace with `imap` everywhere, since imap3 is not a standard port and old rarely + (if ever) used and missing on some systems (e. g. debian stretch), see gh-1942. * action.d/pf.conf: - fixed syntax error in achnor definition (documentation, see gh-1919); - enclose ports in braces for multiport jails (see gh-1925); From 4d10c615c4ca95b1e29f3e2a394ad7922827a2f4 Mon Sep 17 00:00:00 2001 From: "Serg G. Brester" Date: Fri, 3 Nov 2017 14:05:17 +0100 Subject: [PATCH 6/8] Update ChangeLog typo --- ChangeLog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3ddd159c..c6115409 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,8 +39,8 @@ ver. 0.10.2-dev-1 (2017/??/??) - development edition ports are enclosed in curly braces `{ }` in the `jail.local` etc. This may cause a double-brackets now. ### Fixes -* jail.conf: port `imap3` replace with `imap` everywhere, since imap3 is not a standard port and old rarely - (if ever) used and missing on some systems (e. g. debian stretch), see gh-1942. +* jail.conf: port `imap3` replaced with `imap` everywhere, since imap3 is not a standard port and old rarely + (if ever) used and can missing on some systems (e. g. debian stretch), see gh-1942. * action.d/pf.conf: - fixed syntax error in achnor definition (documentation, see gh-1919); - enclose ports in braces for multiport jails (see gh-1925); From eba68a8f377795ca151d7ebd9199107a538cbb7a Mon Sep 17 00:00:00 2001 From: sebres Date: Fri, 3 Nov 2017 11:31:36 +0100 Subject: [PATCH 7/8] config/paths-common.conf: Added initial values for `syslog_authpriv`, `syslog_mail` in order to avoid errors while parsing/interpolating configuration; Note the systemd-backend does not need the logpath at all; Some defaults normalized (minimized configs, don't need to overwrite values in distribution-related path if equal). --- config/paths-common.conf | 33 ++++++++++++++++++++++++--------- config/paths-debian.conf | 11 ----------- config/paths-fedora.conf | 9 --------- config/paths-freebsd.conf | 9 --------- config/paths-opensuse.conf | 12 ------------ config/paths-osx.conf | 8 ++++---- 6 files changed, 28 insertions(+), 54 deletions(-) diff --git a/config/paths-common.conf b/config/paths-common.conf index 51323d6b..7383cafe 100644 --- a/config/paths-common.conf +++ b/config/paths-common.conf @@ -9,21 +9,36 @@ after = paths-overrides.local default_backend = %(default/backend)s +# Initial common values (to overwrite in path-.conf)... +# There is no sensible generic defaults for syslog log targets, thus +# leaving them empty here (resp. set to mostly used variant) in order +# to avoid errors while parsing/interpolating configs. +# +# Note systemd-backend does not need the logpath at all. +# +syslog_local0 = /var/log/messages + +syslog_authpriv = /var/log/auth.log +syslog_daemon = %(syslog_local0)s +syslog_ftp = %(syslog_local0)s +syslog_mail = +syslog_mail_warn = +syslog_user = %(syslog_local0)s + +# Set the default syslog backend target to default_backend +syslog_backend = %(default_backend)s + +# Default values for several jails: + sshd_log = %(syslog_authpriv)s sshd_backend = %(default_backend)s dropbear_log = %(syslog_authpriv)s dropbear_backend = %(default_backend)s -# There is no sensible generic defaults for syslog log targets, thus -# leaving them empty here so that no errors while parsing/interpolating configs -syslog_daemon = -syslog_ftp = -syslog_local0 = -syslog_mail_warn = -syslog_user = -# Set the default syslog backend target to default_backend -syslog_backend = %(default_backend)s +apache_error_log = /var/log/apache2/*error.log + +apache_access_log = /var/log/apache2/*access.log # from /etc/audit/auditd.conf auditd_log = /var/log/audit/audit.log diff --git a/config/paths-debian.conf b/config/paths-debian.conf index 1ca4d242..e096f972 100644 --- a/config/paths-debian.conf +++ b/config/paths-debian.conf @@ -15,23 +15,12 @@ syslog_mail = /var/log/mail.log # syslog_mail_warn = /var/log/mail.warn syslog_mail_warn = %(syslog_mail)s -syslog_authpriv = /var/log/auth.log - -# syslog_auth = /var/log/auth.log -# syslog_user = /var/log/user.log syslog_ftp = /var/log/syslog syslog_daemon = /var/log/daemon.log -syslog_local0 = /var/log/messages - - -apache_error_log = /var/log/apache2/*error.log - -apache_access_log = /var/log/apache2/*access.log - exim_main_log = /var/log/exim4/mainlog # was in debian squeezy but not in wheezy diff --git a/config/paths-fedora.conf b/config/paths-fedora.conf index d13645b1..3d637e1f 100644 --- a/config/paths-fedora.conf +++ b/config/paths-fedora.conf @@ -15,15 +15,6 @@ syslog_mail_warn = /var/log/maillog syslog_authpriv = /var/log/secure -syslog_user = /var/log/messages - -syslog_ftp = /var/log/messages - -syslog_daemon = /var/log/messages - -syslog_local0 = /var/log/messages - - apache_error_log = /var/log/httpd/*error_log apache_access_log = /var/log/httpd/*access_log diff --git a/config/paths-freebsd.conf b/config/paths-freebsd.conf index 91b23636..550ee887 100644 --- a/config/paths-freebsd.conf +++ b/config/paths-freebsd.conf @@ -15,19 +15,10 @@ syslog_mail = /var/log/maillog syslog_mail_warn = /var/log/maillog -syslog_authpriv = /var/log/auth.log - # note - is only ftp.info - if notice /var/log/messages may be needed syslog_ftp = /var/log/xferlog -syslog_daemon = /var/log/messages - -syslog_local0 = /var/log/messages - # Linux things -# we fake to avoid parse error in startups - -auditd_log = /dev/null # http://svnweb.freebsd.org/ports/head/www/apache24/files/patch-docs__conf__extra__httpd-ssl.conf.in?view=markup # http://svnweb.freebsd.org/ports/head/www/apache22/files/patch-docs__conf__extra__httpd-ssl.conf.in?view=markup diff --git a/config/paths-opensuse.conf b/config/paths-opensuse.conf index 227a5e98..f1d70ce7 100644 --- a/config/paths-opensuse.conf +++ b/config/paths-opensuse.conf @@ -9,24 +9,12 @@ after = paths-overrides.local [DEFAULT] -syslog_local0 = /var/log/messages - syslog_mail = /var/log/mail syslog_mail_warn = %(syslog_mail)s syslog_authpriv = %(syslog_local0)s -syslog_user = %(syslog_local0)s - -syslog_ftp = %(syslog_local0)s - -syslog_daemon = %(syslog_local0)s - -apache_error_log = /var/log/apache2/*error_log - -apache_access_log = /var/log/apache2/*access_log - pureftpd_log = %(syslog_local0)s exim_main_log = /var/log/exim/main.log diff --git a/config/paths-osx.conf b/config/paths-osx.conf index d1b99b38..2fffd65a 100644 --- a/config/paths-osx.conf +++ b/config/paths-osx.conf @@ -17,11 +17,11 @@ syslog_mail_warn = /var/log/mail.warn syslog_authpriv = /var/log/secure.log #syslog_auth = -#syslog_user = +syslog_user = -#syslog_ftp = +syslog_ftp = -#syslog_daemon = +syslog_daemon = -#syslog_local0 = +syslog_local0 = From ee80c524301d498f9cbf3ab359bf620f46808057 Mon Sep 17 00:00:00 2001 From: "Serg G. Brester" Date: Fri, 3 Nov 2017 13:13:41 +0100 Subject: [PATCH 8/8] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index c6115409..757774a6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -41,6 +41,8 @@ ver. 0.10.2-dev-1 (2017/??/??) - development edition ### Fixes * jail.conf: port `imap3` replaced with `imap` everywhere, since imap3 is not a standard port and old rarely (if ever) used and can missing on some systems (e. g. debian stretch), see gh-1942. +* config/paths-common.conf: added missing initial values (and small normalization in config/paths-*.conf) + in order to avoid errors while interpolating (e. g. starting with systemd-backend), see gh-1955. * action.d/pf.conf: - fixed syntax error in achnor definition (documentation, see gh-1919); - enclose ports in braces for multiport jails (see gh-1925);