From 28f5d7b980a7f256b9e8640a5eca471e658c136c Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Wed, 1 May 2013 00:15:46 +1000 Subject: [PATCH 01/10] ENH: opensuse script from opensuse: https://build.opensuse.org/package/view_file?expand=1&file=fail2ban.init&package=fail2ban&project=openSUSE%3AFactory --- files/suse-initd | 181 +++++++++++++++++++++++++---------------------- 1 file changed, 96 insertions(+), 85 deletions(-) mode change 100755 => 100644 files/suse-initd diff --git a/files/suse-initd b/files/suse-initd old mode 100755 new mode 100644 index 1dec63e2..b53fa540 --- a/files/suse-initd +++ b/files/suse-initd @@ -1,103 +1,114 @@ #!/bin/sh # -# /etc/init.d/fail2ban -# and its symbolic link -# /usr/sbin/rcfail2ban -# ### BEGIN INIT INFO # Provides: fail2ban -# Required-Start: $syslog $remote_fs sendmail -# Required-Stop: $syslog $remote_fs -# Should-Stop: $time ypbind sendmail +# Required-Start: $syslog $remote_fs $local_fs +# Should-Start: $time $network iptables +# Required-Stop: $syslog $remote_fs $local_fs +# Should-Stop: $time $network iptables # Default-Start: 3 5 # Default-Stop: 0 1 2 6 -# Description: startup Fail2Ban +# Pidfile: /var/run/fail2ban/fail2ban.pid +# Short-Description: Bans IPs with too many authentication failures +# Description: Start fail2ban to scan logfiles and ban IP addresses +# which make too many logfiles failures, and/or sent e-mails about ### END INIT INFO -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/sbin:/usr/bin:/bin -FAIL2BAN_BIN=/usr/local/bin/fail2ban-client -FAIL2BAN_SERVER=/usr/local/bin/fail2ban-server -FAIL2BAN_SOCKET=/var/run/fail2ban/fail2ban.sock -test -x $FAIL2BAN_BIN || { echo "$FAIL2BAN_BIN not installed"; - if [ "$1" = "stop" ]; then exit 0; - else exit 5; fi; } -# Check for existence of needed config file and read it -FAIL2BAN_CONFIG=/etc/fail2ban/fail2ban.conf -test -r $FAIL2BAN_CONFIG || { echo "$FAIL2BAN_CONFIG not existing"; - if [ "$1" = "stop" ]; then exit 0; - else exit 6; fi; } +# Check for missing binaries (stale symlinks should not happen) +FAIL2BAN_CLI=/usr/bin/fail2ban-client +test -x $FAIL2BAN_CLI || { echo "$FAIL2BAN_CLI not installed"; + if [ "$1" = "stop" ]; then exit 0; + else exit 5; fi; } +FAIL2BAN_SRV=/usr/bin/fail2ban-server +test -x $FAIL2BAN_SRV || { echo "$FAIL2BAN_SRV not installed"; + if [ "$1" = "stop" ]; then exit 0; + else exit 5; fi; } + +FAIL2BAN_CONFIG="/etc/sysconfig/fail2ban" +FAIL2BAN_SOCKET_DIR="/var/run/fail2ban" +FAIL2BAN_SOCKET="$FAIL2BAN_SOCKET_DIR/fail2ban.sock" +FAIL2BAN_PID="$FAIL2BAN_SOCKET_DIR/fail2ban.pid" + +if [ -e $FAIL2BAN_CONFIG ]; then + . $FAIL2BAN_CONFIG +fi . /etc/rc.status - -# Reset status of this service rc_reset case "$1" in start) - echo -n "Starting Fail2Ban " - # a cleanup workaround, since /etc/init.d/boot.local removes only. - # regular files, and not sockets - if test -e $FAIL2BAN_SOCKET; then - if ! lsof -n $FAIL2BAN_SOCKET &>/dev/null; then - rm $FAIL2BAN_SOCKET - fi - fi - /sbin/startproc $FAIL2BAN_BIN start &>/dev/null - rc_status -v - ;; - stop) - echo -n "Shutting down Fail2ban " - /sbin/startproc $FAIL2BAN_BIN -q stop - rc_status -v - ;; - try-restart|condrestart) - if test "$1" = "condrestart"; then - echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}" - fi - $0 status - if test $? = 0; then - $0 restart - else - rc_reset # Not running is not a failure. - fi - rc_status - ;; - restart) - $0 stop - echo -n "-wait a minute " - i=60 - while [ -e $FAIL2BAN_SOCKET ] && [ $i -gt 0 ]; do - sleep 1 - i=$[$i-1] - echo -n "." - done - echo "." - $0 start + echo -n "Starting fail2ban " - # Remember status and be quiet - rc_status - ;; - force-reload) - echo -n "Reload service Fail2ban " - /sbin/startproc $FAIL2BAN_BIN -q reload - rc_status -v - ;; - reload) - echo -n "Reload service Fail2ban " - /sbin/startproc $FAIL2BAN_BIN -q reload - rc_status -v - ;; + if [ ! -d $FAIL2BAN_SOCKET_DIR ]; then + mkdir -p $FAIL2BAN_SOCKET_DIR + fi + + if [ -e $FAIL2BAN_SOCKET ]; then + if ! lsof -n $FAIL2BAN_SOCKET &>/dev/null; then + rm $FAIL2BAN_SOCKET + fi + fi + $FAIL2BAN_CLI -x -q $FAIL2BAN_OPTIONS start &>/dev/null 2>&1 + + rc_status -v + ;; + stop) + echo -n "Shutting down fail2ban " + ## Stop daemon with built-in functionality 'stop' + /sbin/startproc -w $FAIL2BAN_CLI -q stop > /dev/null 2>&1 + + if [ -f $FAIL2BAN_SOCKET ] + then + echo "$FAIL2BAN_SOCKET not removed .. removing .." + rm $FAIL2BAN_SOCKET + fi + if [ -f $FAIL2BAN_PID ] + then + echo "$FAIL2BAN_PID not removed .. removing .." + rm $FAIL2BAN_PID + fi + + + rc_status -v + ;; + try-restart|condrestart) + $0 status + if test $? = 0; then + $0 restart + else + rc_reset # Not running is not a failure. + fi + rc_status + ;; + restart) + $0 stop + i=60 + while [ -e $FAIL2BAN_SOCKET ] && [ $i -gt 0 ]; do + sleep 1 + i=$[$i-1] + echo -n "." + done + $0 start + + rc_status + ;; + reload|force-reload) + echo -n "Reload service Fail2ban " + /sbin/startproc $FAIL2BAN_CLI -q reload > /dev/null 2>&1 + + rc_status -v + ;; status) - echo -n "Checking for service Fail2ban " - /sbin/checkproc $FAIL2BAN_SERVER - rc_status -v - ;; - probe) - test /etc/fail2ban/fail2ban.conf -nt /var/run/fail2ban.pid && echo reload - ;; + echo -n "Checking for service fail2ban " + /sbin/checkproc $FAIL2BAN_SRV + + rc_status -v + ;; *) - echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}" - exit 1 - ;; + echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}" + exit 1 + ;; esac -rc_exit \ No newline at end of file +rc_exit + From 13c154198fc3941e8f318c6c8d602df09d2cfbb2 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Fri, 3 May 2013 16:56:30 +1000 Subject: [PATCH 02/10] ENH: since it seems the default is to use file based logging, $syslog is in Should-{Start|Stop} like Debian https://github.com/fail2ban/fail2ban/blob/debian/debian/fail2ban.init --- files/suse-initd | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/files/suse-initd b/files/suse-initd index b53fa540..09c25687 100644 --- a/files/suse-initd +++ b/files/suse-initd @@ -2,10 +2,10 @@ # ### BEGIN INIT INFO # Provides: fail2ban -# Required-Start: $syslog $remote_fs $local_fs -# Should-Start: $time $network iptables -# Required-Stop: $syslog $remote_fs $local_fs -# Should-Stop: $time $network iptables +# Required-Start: $remote_fs $local_fs +# Should-Start: $syslog $time $network iptables +# Required-Stop: $remote_fs $local_fs +# Should-Stop: $syslog $time $network iptables # Default-Start: 3 5 # Default-Stop: 0 1 2 6 # Pidfile: /var/run/fail2ban/fail2ban.pid From 89e06bba15df7b56804134b5649564254bcc0843 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Fri, 24 May 2013 11:15:46 -0400 Subject: [PATCH 03/10] BF: blocktype must be defined within [Init] -- adding [Init] section. Close #232 --- ChangeLog | 5 ++++- config/action.d/route.conf | 2 ++ config/action.d/shorewall.conf | 2 ++ 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 6f98cc11..90a57f75 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,7 +10,10 @@ Fail2Ban (version 0.8.9.dev) 2013/??/?? ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED ----------- -- Fixes +- Fixes: + Yaroslav Halchenko + * action.d/{route,shorewall}.conf - blocktype must be defined + within [Init]. Closes gh-232 - New Features - Enhancements diff --git a/config/action.d/route.conf b/config/action.d/route.conf index bb4ec8e1..123245e5 100644 --- a/config/action.d/route.conf +++ b/config/action.d/route.conf @@ -18,6 +18,8 @@ actionban = ip route add actionunban = ip route del +[Init] + # Option: blocktype # Note: Type can be blackhole, unreachable and prohibit. Unreachable and prohibit correspond to the ICMP reject messages. # Values: STRING diff --git a/config/action.d/shorewall.conf b/config/action.d/shorewall.conf index b165c701..81ac0518 100644 --- a/config/action.d/shorewall.conf +++ b/config/action.d/shorewall.conf @@ -48,6 +48,8 @@ actionban = shorewall # actionunban = shorewall allow +[Init] + # Option: blocktype # Note: This is what the action does with rules. # See man page of shorewall for options that include drop, logdrop, reject, or logreject From d2b1c73b92edf385908c270a0ca0e7418c12235d Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Fri, 24 May 2013 14:33:08 -0400 Subject: [PATCH 04/10] CFG: assure actions for all the jails --- ChangeLog | 4 +++- config/jail.conf | 8 +++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index 90a57f75..a0eda6dd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -16,7 +16,9 @@ ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED within [Init]. Closes gh-232 - New Features - Enhancements - + Yaroslav Halchenko + * jail.conf -- assure all jails have actions and remove unused + ports specifications ver. 0.8.9 (2013/05/13) - wanna-be-stable ---------- diff --git a/config/jail.conf b/config/jail.conf index ec5b32ef..d3a23920 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -239,10 +239,8 @@ logpath = /var/log/roundcube/userlogins enabled = false filter = sogo-auth -port = http, https # without proxy this would be: # port = 20000 - action = iptables[name=SOGo, port="http,https"] logpath = /var/log/sogo/sogo.log @@ -253,7 +251,7 @@ logpath = /var/log/sogo/sogo.log [php-url-fopen] enabled = false -port = http,https +action = iptables[name=php-url-open, port="http,https"] filter = php-url-fopen logpath = /var/www/*/logs/access_log maxretry = 1 @@ -268,8 +266,8 @@ maxretry = 1 [lighttpd-fastcgi] enabled = false -port = http,https filter = lighttpd-fastcgi +action = iptables[name=lighttpd-fastcgi, port="http,https"] # adapt the following two items as needed logpath = /var/log/lighttpd/error.log maxretry = 2 @@ -280,8 +278,8 @@ maxretry = 2 [lighttpd-auth] enabled = false -port = http,https filter = lighttpd-auth +action = iptables[name=lighttpd-auth, port="http,https"] # adapt the following two items as needed logpath = /var/log/lighttpd/error.log maxretry = 2 From 8a57ffd2fb40aa4c4f28b58967d3af440e854933 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Fri, 24 May 2013 14:33:48 -0400 Subject: [PATCH 05/10] TST: test all stock jails to have actions and correctly specifying blocktype --- testcases/clientreadertestcase.py | 32 +++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py index faa8dcd6..dbaa8ec2 100644 --- a/testcases/clientreadertestcase.py +++ b/testcases/clientreadertestcase.py @@ -144,10 +144,38 @@ class JailsReaderTest(unittest.TestCase): # and warn on useDNS self.assertTrue(['set', j, 'usedns', 'warn'] in comm_commands) self.assertTrue(['start', j] in comm_commands) + # last commands should be the 'start' commands self.assertEqual(comm_commands[-1][0], 'start') - # TODO: make sure that all of the jails have actions assigned, - # otherwise it makes little to no sense + + for j in jails._JailsReader__jails: + actions = j._JailReader__actions + jail_name = j.getName() + # make sure that all of the jails have actions assigned, + # otherwise it makes little to no sense + self.assertTrue(len(actions), + msg="No actions found for jail %s" % jail_name) + + # Test for presence of blocktype (in relation to gh-232) + for action in actions: + commands = action.convert() + file_ = action.getFile() + if '' in str(commands): + # Verify that it is among cInfo + self.assertTrue('blocktype' in action._ActionReader__cInfo) + # Verify that we have a call to set it up + blocktype_present = False + target_command = [ 'set', jail_name, 'setcinfo', file_, 'blocktype' ] + for command in commands: + if (len(command) > 5 and + command[:5] == target_command): + blocktype_present = True + continue + self.assertTrue( + blocktype_present, + msg="Found no %s command among %s" + % (target_command, str(commands)) ) + def testConfigurator(self): configurator = Configurator() From 244a96f9b3fb58867f073957714cf4d464cde80a Mon Sep 17 00:00:00 2001 From: Terence Namusonge Date: Sat, 25 May 2013 19:26:13 +0200 Subject: [PATCH 06/10] fixed failregex line for roundcube 0.9+ # Only works only if log driver: is set to 'syslog'. this is becoz fail2ban fails to 'read' the line due to the brackets around the date timestamp on logline when log driver is set to file --- config/filter.d/roundcube-auth.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/filter.d/roundcube-auth.conf b/config/filter.d/roundcube-auth.conf index 41766e31..7b153f44 100644 --- a/config/filter.d/roundcube-auth.conf +++ b/config/filter.d/roundcube-auth.conf @@ -1,6 +1,6 @@ # Fail2Ban configuration file for roundcube web server # -# Author: Teodor Micu & Yaroslav Halchenko +# Author: Teodor Micu & Yaroslav Halchenko & terence namusonge # # @@ -13,7 +13,7 @@ # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = FAILED login for .*. from \s*$ +failregex = (FAILED login|Login failed) for .* from \s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. From 098c88a67b8db83beaac6d9820e20ee109e3e6d0 Mon Sep 17 00:00:00 2001 From: Terence Namusonge Date: Sun, 26 May 2013 07:46:29 +0200 Subject: [PATCH 07/10] failregex when roundcube log driver is set to 'syslog' --- testcases/files/logs/roundcube-auth | 1 + 1 file changed, 1 insertion(+) diff --git a/testcases/files/logs/roundcube-auth b/testcases/files/logs/roundcube-auth index d16f7266..04e0faf5 100644 --- a/testcases/files/logs/roundcube-auth +++ b/testcases/files/logs/roundcube-auth @@ -1 +1,2 @@ [22-Jan-2013 22:28:21 +0200]: FAILED login for user1 from 192.0.43.10 +May 26 07:12:40 hamster roundcube: IMAP Error: Login failed for sales@example.com from 10.1.1.47 From 7a4db4b4b9cd40671f3d444a45c7382c8fc3d637 Mon Sep 17 00:00:00 2001 From: Steven Hiscocks Date: Sun, 26 May 2013 14:29:59 +0100 Subject: [PATCH 08/10] TST: Fix fail2ban.conf reader test for unreliable dictionary order --- testcases/clientreadertestcase.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py index dbaa8ec2..a8c60bf8 100644 --- a/testcases/clientreadertestcase.py +++ b/testcases/clientreadertestcase.py @@ -193,7 +193,7 @@ class JailsReaderTest(unittest.TestCase): commands = configurator.getConfigStream() # and there is logging information left to be passed into the # server - self.assertEqual(commands, + self.assertEqual(sorted(commands), [['set', 'loglevel', 3], ['set', 'logtarget', '/var/log/fail2ban.log']]) From 567cd353a14c55b66ad8a6afd18758c3d6431901 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Wed, 29 May 2013 09:41:20 -0400 Subject: [PATCH 09/10] DOC: Changelog entry fro preceeding merge from Terence --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index a0eda6dd..f68fdded 100644 --- a/ChangeLog +++ b/ChangeLog @@ -19,6 +19,8 @@ ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED Yaroslav Halchenko * jail.conf -- assure all jails have actions and remove unused ports specifications + Terence Namusonge + * config/filter.d/roundcube-auth.conf -- support roundcube 0.9+ ver. 0.8.9 (2013/05/13) - wanna-be-stable ---------- From 39d32e0352922b21c8d7ba3a95a71ea65ebe07c1 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Wed, 29 May 2013 09:56:15 -0400 Subject: [PATCH 10/10] Changelog for previous PR --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index f68fdded..69b87b06 100644 --- a/ChangeLog +++ b/ChangeLog @@ -21,6 +21,8 @@ ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED ports specifications Terence Namusonge * config/filter.d/roundcube-auth.conf -- support roundcube 0.9+ + Daniel Black + * files/suse-initd -- update to the copy from stock SUSE ver. 0.8.9 (2013/05/13) - wanna-be-stable ----------