diff --git a/ChangeLog b/ChangeLog index 089522b5..5f1fc313 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,45 @@ ver. 1.0.1-dev-1 (20??/??/??) - development nightly edition the invariant check, if `actionban` or `actionunban` would not throw an error (exit code different from 0) in case of unsane environment. +### Fixes + +### New Features and Enhancements +* `actioncheck` behavior is changed now (gh-488), so invariant check as well as restore or repair + of sane environment (in case of recognized unsane state) would only occur on action errors (e. g. + if ban or unban operations are exiting with other code as 0) + + +ver. 0.11.2 (2020/11/23) - heal-the-world-with-security-tools +----------- + +### Compatibility: +* to v.0.10: + - 0.11 is totally compatible to 0.10 (configuration- and API-related stuff), but the database + got some new tables and fields (auto-converted during the first start), so once updated to 0.11, you + have to remove the database /var/lib/fail2ban/fail2ban.sqlite3 (or its different to 0.10 schema) + if you would need to downgrade to 0.10 for some reason. +* to v.0.9: + - Filter (or `failregex`) internal capture-groups: + + * If you've your own `failregex` or custom filters using conditional match `(?P=host)`, you should + rewrite the regex like in example below resp. using `(?:(?P=ip4)|(?P=ip6)` instead of `(?P=host)` + (or `(?:(?P=ip4)|(?P=ip6)|(?P=dns))` corresponding your `usedns` and `raw` settings). + + Of course you can always define your own capture-group (like below `_cond_ip_`) to do this. + ``` + testln="1500000000 failure from 192.0.2.1: bad host 192.0.2.1" + fail2ban-regex "$testln" "^\s*failure from (?P<_cond_ip_>): bad host (?P=_cond_ip_)$" + ``` + * New internal groups (currently reserved for internal usage): + `ip4`, `ip6`, `dns`, `fid`, `fport`, additionally `user` and another captures in lower case if + mapping from tag `` used in failregex (e. g. `user` by ``). + + - v.0.10 and 0.11 use more precise date template handling, that can be theoretically incompatible to some + user configurations resp. `datepattern`. + + - Since v0.10 fail2ban supports the matching of IPv6 addresses, but not all ban actions are + IPv6-capable now. + ### Fixes * [stability] prevent race condition - no ban if filter (backend) is continuously busy if too many messages will be found in log, e. g. initial scan of large log-file or journal (gh-2660) @@ -39,6 +78,9 @@ ver. 1.0.1-dev-1 (20??/??/??) - development nightly edition * `action.d/bsd-ipfw.conf`: fixed selection of rule-no by large list or initial `lowest_rule_num` (gh-2836) * `filter.d/common.conf`: avoid substitute of default values in related `lt_*` section, `__prefix_line` should be interpolated in definition section (inside the filter-config, gh-2650) +* `filter.d/dovecot.conf`: + - add managesieve and submission support (gh-2795); + - accept messages with more verbose logging (gh-2573); * `filter.d/courier-smtp.conf`: prefregex extended to consider port in log-message (gh-2697) * `filter.d/traefik-auth.conf`: filter extended with parameter mode (`normal`, `ddos`, `aggressive`) to handle the match of username differently (gh-2693): @@ -74,42 +116,11 @@ ver. 1.0.1-dev-1 (20??/??/??) - development nightly edition * fail2ban-client: extended to unban IP range(s) by subnet (CIDR/mask) or hostname (DNS), gh-2791; * extended capturing of alternate tags in filter, allowing combine of multiple groups to single tuple token with new tag prefix `` with all value of `` tags (gh-2755) -* `actioncheck` behavior is changed now (gh-488), so invariant check as well as restore or repair - of sane environment (in case of recognized unsane state) would only occur on action errors (e. g. - if ban or unban operations are exiting with other code as 0) ver. 0.11.1 (2020/01/11) - this-is-the-way ----------- -### Compatibility: -* to v.0.10: - - 0.11 is totally compatible to 0.10 (configuration- and API-related stuff), but the database - got some new tables and fields (auto-converted during the first start), so once updated to 0.11, you - have to remove the database /var/lib/fail2ban/fail2ban.sqlite3 (or its different to 0.10 schema) - if you would need to downgrade to 0.10 for some reason. -* to v.0.9: - - Filter (or `failregex`) internal capture-groups: - - * If you've your own `failregex` or custom filters using conditional match `(?P=host)`, you should - rewrite the regex like in example below resp. using `(?:(?P=ip4)|(?P=ip6)` instead of `(?P=host)` - (or `(?:(?P=ip4)|(?P=ip6)|(?P=dns))` corresponding your `usedns` and `raw` settings). - - Of course you can always define your own capture-group (like below `_cond_ip_`) to do this. - ``` - testln="1500000000 failure from 192.0.2.1: bad host 192.0.2.1" - fail2ban-regex "$testln" "^\s*failure from (?P<_cond_ip_>): bad host (?P=_cond_ip_)$" - ``` - * New internal groups (currently reserved for internal usage): - `ip4`, `ip6`, `dns`, `fid`, `fport`, additionally `user` and another captures in lower case if - mapping from tag `` used in failregex (e. g. `user` by ``). - - - v.0.10 and 0.11 use more precise date template handling, that can be theoretically incompatible to some - user configurations resp. `datepattern`. - - - Since v0.10 fail2ban supports the matching of IPv6 addresses, but not all ban actions are - IPv6-capable now. - ### Fixes * purge database will be executed now (within observer). * restoring currently banned ip after service restart fixed diff --git a/MANIFEST b/MANIFEST index 630df5ea..703ed807 100644 --- a/MANIFEST +++ b/MANIFEST @@ -100,6 +100,8 @@ config/filter.d/exim.conf config/filter.d/exim-spam.conf config/filter.d/freeswitch.conf config/filter.d/froxlor-auth.conf +config/filter.d/gitlab.conf +config/filter.d/grafana.conf config/filter.d/groupoffice.conf config/filter.d/gssftpd.conf config/filter.d/guacamole.conf @@ -139,6 +141,7 @@ config/filter.d/sendmail-auth.conf config/filter.d/sendmail-reject.conf config/filter.d/sieve.conf config/filter.d/slapd.conf +config/filter.d/softethervpn.conf config/filter.d/sogo-auth.conf config/filter.d/solid-pop3d.conf config/filter.d/squid.conf @@ -267,6 +270,8 @@ fail2ban/tests/files/database_v1.db fail2ban/tests/files/database_v2.db fail2ban/tests/files/filter.d/substition.conf fail2ban/tests/files/filter.d/testcase01.conf +fail2ban/tests/files/filter.d/testcase02.conf +fail2ban/tests/files/filter.d/testcase02.local fail2ban/tests/files/filter.d/testcase-common.conf fail2ban/tests/files/ignorecommand.py fail2ban/tests/files/logs/3proxy @@ -301,6 +306,8 @@ fail2ban/tests/files/logs/exim fail2ban/tests/files/logs/exim-spam fail2ban/tests/files/logs/freeswitch fail2ban/tests/files/logs/froxlor-auth +fail2ban/tests/files/logs/gitlab +fail2ban/tests/files/logs/grafana fail2ban/tests/files/logs/groupoffice fail2ban/tests/files/logs/gssftpd fail2ban/tests/files/logs/guacamole @@ -338,6 +345,7 @@ fail2ban/tests/files/logs/sendmail-auth fail2ban/tests/files/logs/sendmail-reject fail2ban/tests/files/logs/sieve fail2ban/tests/files/logs/slapd +fail2ban/tests/files/logs/softethervpn fail2ban/tests/files/logs/sogo-auth fail2ban/tests/files/logs/solid-pop3d fail2ban/tests/files/logs/squid diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf index 32991cba..dd9452a9 100644 --- a/config/filter.d/apache-noscript.conf +++ b/config/filter.d/apache-noscript.conf @@ -17,9 +17,9 @@ before = apache-common.conf [Definition] -script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl) +script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl|\bcgi-bin/) -prefregex = ^%(_apache_error_client)s (?:AH0(?:01(?:28|30)|1(?:264|071)): )?(?:(?:[Ff]ile|script|[Gg]ot) ).+$ +prefregex = ^%(_apache_error_client)s (?:AH0(?:01(?:28|30)|1(?:264|071)|2811): )?(?:(?:[Ff]ile|script|[Gg]ot) ).+$ failregex = ^(?:does not exist|not found or unable to stat):