From 7cdb6c94bb78193dc64bf2a7da76863804b9d21a Mon Sep 17 00:00:00 2001 From: Cyril Jaquier Date: Sat, 9 Jul 2005 15:11:48 +0000 Subject: [PATCH] - Added more tags in firewall rules definition. Should help for Feature Request #1229479 git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_5@128 a942ae1a-1317-0410-a47c-b1dcaea8d605 --- config/fail2ban.conf.default | 18 +++++++++++---- fail2ban.py | 9 +++++--- firewall/firewall.py | 43 ++++++++++++++++++++++-------------- 3 files changed, 46 insertions(+), 24 deletions(-) diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default index 51d5394c..a1c0e070 100644 --- a/config/fail2ban.conf.default +++ b/config/fail2ban.conf.default @@ -99,7 +99,10 @@ fwend = # Option: fwban # Notes.: command executed when banning an IP. Take care that the # command is executed with Fail2Ban user rights. -# IP address +# Tags: IP address +# number of failures +# unix timestamp of the last failure +# unix timestamp of the ban time # Values: CMD # Default: iptables -I INPUT 1 -i eth0 -s -j DROP # @@ -108,7 +111,9 @@ fwban = iptables -I INPUT 1 -i eth0 -s -j DROP # Option: fwunban # Notes.: command executed when unbanning an IP. Take care that the # command is executed with Fail2Ban user rights. -# IP address +# Tags: IP address +# unix timestamp of the ban time +# unix timestamp of the unban time # Values: CMD # Default: iptables -D INPUT -i eth0 -s -j DROP # @@ -162,7 +167,10 @@ fwend = # Option: fwbanrule # Notes.: command executed when banning an IP. Take care that the # command is executed with Fail2Ban user rights. -# IP address +# Tags: IP address +# number of failures +# unix timestamp of the last failure +# unix timestamp of the ban time # Values: CMD # Default: iptables -I INPUT 1 -i eth0 -s -j DROP # @@ -171,7 +179,9 @@ fwban = iptables -I INPUT 1 -i eth0 -s -j DROP # Option: fwunbanrule # Notes.: command executed when unbanning an IP. Take care that the # command is executed with Fail2Ban user rights. -# IP address +# Tags: IP address +# unix timestamp of the ban time +# unix timestamp of the unban time # Values: CMD # Default: iptables -D INPUT -i eth0 -s -j DROP # diff --git a/fail2ban.py b/fail2ban.py index 0632cdc7..0f3f536e 100755 --- a/fail2ban.py +++ b/fail2ban.py @@ -321,10 +321,13 @@ def main(): if failTime < unixTime - findTime: del element[3][attempt] elif fails[attempt][0] >= conf["maxretry"]: - logSys.info(element[0] + ": " + attempt + " has " + - `element[3][attempt][0]` + + aInfo = {"ip": attempt, + "failures": element[3][attempt][0], + "failtime": failTime} + logSys.info(element[0] + ": " + aInfo["ip"] + + " has " + `aInfo["failures"]` + " login failure(s). Banned.") - element[2].addBanIP(attempt, conf["debug"]) + element[2].addBanIP(aInfo, conf["debug"]) del element[3][attempt] except KeyboardInterrupt: diff --git a/firewall/firewall.py b/firewall/firewall.py index 4d8e364d..e022f78c 100644 --- a/firewall/firewall.py +++ b/firewall/firewall.py @@ -43,23 +43,27 @@ class Firewall: self.unBanRule = unBanRule self.banTime = banTime - def addBanIP(self, ip, debug): + def addBanIP(self, aInfo, debug): """ Bans an IP. """ + ip = aInfo["ip"] if not self.inBanList(ip): - logSys.warn("Ban "+ip) - self.banList[ip] = time.time() - executeCmd(self.banIP(ip), debug) + crtTime = time.time() + logSys.warn("Ban " + ip) + self.banList[ip] = crtTime + aInfo["bantime"] = crtTime + executeCmd(self.banIP(aInfo), debug) else: logSys.error(ip+" already in ban list") - def delBanIP(self, ip, debug): + def delBanIP(self, aInfo, debug): """ Unban an IP. """ + ip = aInfo["ip"] if self.inBanList(ip): logSys.warn("Unban "+ip) del self.banList[ip] - executeCmd(self.unBanIP(ip), debug) + executeCmd(self.unBanIP(aInfo), debug) else: logSys.error(ip+" not in ban list") @@ -73,10 +77,12 @@ class Firewall: """ banListTemp = self.banList.copy() for element in banListTemp.iteritems(): - ip = element[0] btime = element[1] if btime < time.time()-self.banTime: - self.delBanIP(ip, debug) + aInfo = {"ip": element[0], + "bantime": btime, + "unbantime": time.time()} + self.delBanIP(aInfo, debug) def flushBanList(self, debug): """ Flushes the ban list and of course the firewall rules. @@ -84,26 +90,29 @@ class Firewall: """ banListTemp = self.banList.copy() for element in banListTemp.iteritems(): - ip = element[0] - self.delBanIP(ip, debug) + aInfo = {"ip": element[0], + "bantime": element[1], + "unbantime": time.time()} + self.delBanIP(aInfo, debug) - def banIP(self, ip): + def banIP(self, aInfo): """ Returns query to ban IP. """ - query = self.replaceTag(self.banRule, ip) + query = self.replaceTag(self.banRule, aInfo) return query - def unBanIP(self, ip): + def unBanIP(self, aInfo): """ Returns query to unban IP. """ - query = self.replaceTag(self.unBanRule, ip) + query = self.replaceTag(self.unBanRule, aInfo) return query - def replaceTag(self, query, ip): - """ Replace tag in query + def replaceTag(self, query, aInfo): + """ Replace tags in query """ string = query - string = string.replace("", ip) + for tag in aInfo: + string = string.replace('<'+tag+'>', `aInfo[tag]`) return string def viewBanList(self):