From 75a0b1650bf2ed25f3be4aec35a1eeca9c140552 Mon Sep 17 00:00:00 2001 From: sawanoboly Date: Thu, 6 Feb 2014 18:32:01 +0900 Subject: [PATCH] apply smartos patch gist8838359-71cca2c79465296b5686d32cf02fce3b1a5dae63 --- README.smartos.md | 76 +++++++++++++++++++++++++++++++++++ config/action.d/ipfilter.conf | 8 ++-- fail2ban-client | 2 +- fail2ban-server | 2 +- files/solaris-fail2ban.xml | 10 ++--- files/solaris-svc-fail2ban | 14 +++---- setup.cfg | 2 +- setup.py | 14 +++---- 8 files changed, 102 insertions(+), 26 deletions(-) create mode 100644 README.smartos.md diff --git a/README.smartos.md b/README.smartos.md new file mode 100644 index 00000000..fe58d979 --- /dev/null +++ b/README.smartos.md @@ -0,0 +1,76 @@ +## How to Install for smartos + +### Recommend + +TCP Wrapper should be enable. + +``` +# turn on if disable. +inetadm -M tcp_wrappers=true +``` + +### Apply patch + +#### using git apply + +``` +git checkout 0.8.12 +git apply 0.8.12_smartos.patch +``` + +#### using gpatch + +``` +# gpatch -p1 < 0.8.12_smartos.patch +patching file fail2ban-client +patching file fail2ban-server +patching file files/solaris-fail2ban.xml +patching file files/solaris-svc-fail2ban +patching file setup.cfg +patching file setup.py +``` + +### Install + +``` +python setup.py install +svccfg import files/solaris-fail2ban.xml +mkdir /var/svc/method +cp files/solaris-svc-fail2ban /var/svc/method/svc-fail2ban +chmod +x /var/svc/method/svc-fail2ban +``` + +### enable service fail2ban + +``` +svcadm enable fail2ban +``` + +### Example + +ban ssh by tcpwrapper. + +``` +# cat /etc/fail2ban/jail.local + +[ssh-tcpwrapper] + +enabled = true +filter = sshd +action = hostsdeny[daemon_list=sshd] +logpath = /var/log/authlog +``` + +ban ssh by ipfilter. + +``` +# cat /etc/fail2ban/jail.local + +[ssh-ipfilter] + +enabled = true +filter = sshd +action = ipfilter +logpath = /var/log/authlog +``` + diff --git a/config/action.d/ipfilter.conf b/config/action.d/ipfilter.conf index 61420e38..091c92d7 100644 --- a/config/action.d/ipfilter.conf +++ b/config/action.d/ipfilter.conf @@ -13,14 +13,14 @@ # Values: CMD # # enable IPF if not already enabled -actionstart = /sbin/ipf -E +actionstart = /usr/sbin/ipf -E # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -# don't disable IPF with "/sbin/ipf -D", there may be other filters in use +# don't disable IPF with "/usr/sbin/ipf -D", there may be other filters in use actionstop = @@ -37,7 +37,7 @@ actioncheck = # Tags: See jail.conf(5) man page # Values: CMD # -actionban = echo block in quick from /32 | /sbin/ipf -f - +actionban = echo block in quick from /32 | /usr/sbin/ipf -f - # Option: actionunban @@ -47,7 +47,7 @@ actionban = echo block in quick from /32 | /sbin/ipf -f - # Values: CMD # # note -r option used to remove matching rule -actionunban = echo block in quick from /32 | /sbin/ipf -r -f - +actionunban = echo block in quick from /32 | /usr/sbin/ipf -r -f - [Init] diff --git a/fail2ban-client b/fail2ban-client index 0f863ab0..9b698345 100755 --- a/fail2ban-client +++ b/fail2ban-client @@ -30,7 +30,7 @@ import getopt, time, shlex, socket try: from common.version import version except ImportError, e: - sys.path.insert(1, "/usr/share/fail2ban") + sys.path.insert(1, "/usr/local/share/fail2ban") from common.version import version # Now we can import the rest of modules diff --git a/fail2ban-server b/fail2ban-server index 404a1ced..5cc5bfdd 100755 --- a/fail2ban-server +++ b/fail2ban-server @@ -29,7 +29,7 @@ import getopt, sys, logging, os try: from common.version import version except ImportError, e: - sys.path.insert(1, "/usr/share/fail2ban") + sys.path.insert(1, "/usr/local/share/fail2ban") from common.version import version from server.server import Server diff --git a/files/solaris-fail2ban.xml b/files/solaris-fail2ban.xml index c6ff0159..e279b5e6 100644 --- a/files/solaris-fail2ban.xml +++ b/files/solaris-fail2ban.xml @@ -33,7 +33,7 @@ @@ -43,21 +43,21 @@ @@ -65,7 +65,7 @@ diff --git a/files/solaris-svc-fail2ban b/files/solaris-svc-fail2ban index e397474b..716c760d 100755 --- a/files/solaris-svc-fail2ban +++ b/files/solaris-svc-fail2ban @@ -15,7 +15,7 @@ if [ -n "$2" ] && [ -f "$F2B_CONF" ]; then F2B_CONF="$2" fi -ENV="/usr/bin/env -i LANG=C PATH=/usr/local/bin:/usr/bin:/bin:/opt/sfw/bin:/usr/sfw/bin" +ENV="/usr/bin/env -i LANG=C PATH=/opt/local/bin:/usr/bin:/bin:/opt/sfw/bin:/usr/sfw/bin" # get socket/pid conf and check dir exists # sock and pid default dirs are currently the same @@ -39,24 +39,24 @@ case $1 in fi [ -f /etc/fail2ban.conf ] || touch /etc/fail2ban.conf echo "Starting fail2ban-server with $F2B_CONF" - eval $ENV /usr/local/bin/fail2ban-client start & + eval $ENV /opt/local/bin/fail2ban-client start & ;; stop) echo "Stopping fail2ban-server with $F2B_CONF" - eval $ENV /usr/local/bin/fail2ban-client stop & + eval $ENV /opt/local/bin/fail2ban-client stop & ;; reload | refresh ) echo "Reloading fail2ban-server with $F2B_CONF" - eval $ENV /usr/local/bin/fail2ban-client reload & + eval $ENV /opt/local/bin/fail2ban-client reload & ;; restart | force-reload) echo "Forcing reload of fail2ban-server with $F2B_CONF" - eval $ENV /usr/local/bin/fail2ban-client stop & + eval $ENV /opt/local/bin/fail2ban-client stop & sleep 2 - eval $ENV /usr/local/bin/fail2ban-client start & + eval $ENV /opt/local/bin/fail2ban-client start & ;; status) - /usr/local/bin/fail2ban-client status & + /opt/local/bin/fail2ban-client status & ;; *) echo "Usage: /lib/svc/method/svc-fail2ban start|stop|status|refresh|restart|reload|force-reload" >&2 diff --git a/setup.cfg b/setup.cfg index 02cd5d5d..d8b83f29 100644 --- a/setup.cfg +++ b/setup.cfg @@ -1,5 +1,5 @@ [install] -install-purelib=/usr/share/fail2ban +install-purelib=/usr/local/share/fail2ban [sdist] formats=bztar diff --git a/setup.py b/setup.py index ccead3e5..bb4d53eb 100755 --- a/setup.py +++ b/setup.py @@ -75,7 +75,7 @@ setup( ('/var/run/fail2ban', '' ), - ('/usr/share/doc/fail2ban', + ('/usr/local/share/doc/fail2ban', ['README.md', 'DEVELOP', 'doc/run-rootless.txt'] ) ] @@ -89,11 +89,11 @@ elements = { [ "fail2ban.conf" ], - "/usr/bin/": + "/usr/local/bin/": [ "fail2ban.py" ], - "/usr/lib/fail2ban/": + "/usr/local/lib/fail2ban/": [ "version.py", "protocol.py" @@ -116,11 +116,11 @@ if obsoleteFiles: print "\t" + f print -if isdir("/usr/lib/fail2ban"): +if isdir("/usr/local/lib/fail2ban"): print - print "Fail2ban is not installed under /usr/lib anymore. The new " \ - "location is under /usr/share. Please remove the directory " \ - "/usr/lib/fail2ban and everything under this directory." + print "Fail2ban is not installed under /usr/local/lib anymore. The new " \ + "location is under /usr/local/share. Please remove the directory " \ + "/usr/local/lib/fail2ban and everything under this directory." print # Update config file