diff --git a/CHANGELOG b/CHANGELOG index fd74f7ce..10fa5ac8 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -4,9 +4,78 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ============================================================= -Fail2Ban (version 0.6.1) 2006/03/16 +Fail2Ban (version 0.7.4) 2006/11/01 ============================================================= +ver. 0.7.4 (2006/11/01) - beta +---------- +- Improved configuration files. Thanks to Yaroslav Halchenko +- Added man page for "fail2ban-regex" +- Moved ban/unban messages from "info" level to "warn" +- Added "-s" option to specify the socket path and "socket" + option in "fail2ban.conf" +- Added "backend" option in "jail.conf" +- Added more filters/actions and jail samples. Thanks to Nick + Munger, Christoph Haas +- Improved testing framework +- Fixed a bug in the return code handling of the executed + commands. Thanks to Yaroslav Halchenko +- Signal handling. There is a bug with join() and signal in + Python +- Better debugging output for "fail2ban-regex" +- Added support for more date format +- cPickle does not work with Python 2.5. Use pickle instead + (performance is not a problem in our case) + +ver. 0.7.3 (2006/09/28) - beta +---------- +- Added man pages. Thanks to Yaroslav Halchenko +- Added wildcard support for "logpath" +- Added Gamin (file and directory monitoring system) support +- (Re)added "ignoreip" option +- Added more concurrency protection +- First attempt at solving bug #1457620 (locale issue) +- Performance improvements +- (Re)added permanent banning with banTime < 0 +- Added DNS support to "ignoreip". Feature Request #1285859 + +ver. 0.7.2 (2006/09/10) - beta +---------- +- Refactoring and code cleanup +- Improved client output +- Added more get/set commands +- Added more configuration templates +- Removed "logpath" and "maxretry" from filter templates. + They must be defined in jail.conf now +- Added interactive mode. Use "-i" +- Added a date detector. "timeregex" and "timepattern" are no + more needed +- Added "fail2ban-regex". This is a tool to help finding + "failregex" +- Improved server communication. Start a new thread for each + incoming request. Fail2ban is not really thread-safe yet + +ver. 0.7.1 (2006/08/23) - alpha +---------- +- Fixed daemon mode bug +- Added Gentoo init.d script +- Fixed path bug when trying to start "fail2ban-server" +- Fixed reload command + +ver. 0.7.0 (2006/08/23) - alpha +---------- +- Almost a complete rewrite :) Fail2ban design is really + better (IMHO). There is a lot of new features +- Client/Server architecture +- Multithreading. Each jail has its own threads: one for the + log reading and another for the actions +- Execute several actions +- Split configuration files. They are more readable and easy + to use +- failregex uses group () now. This feature was already + present in the Debian package +- lots of things... + ver. 0.6.1 (2006/03/16) - stable ---------- - Added permanent banning. Set banTime to a negative value to @@ -22,7 +91,7 @@ ver. 0.6.1 (2006/03/16) - stable - Added parsing of timestamp in TAI64N format (#1275325). Thanks to Mark Edgington - Added patch #1382936 (Default formatted syslog logging). - Thanks to Patrick Börjesson + Thanks to Patrick Bďż˝rjesson - Removed 192.168.0.0/16 from ignoreip. Attacks could also come from the local network. - Robust startup: if iptables module does not get fully diff --git a/PKG-INFO b/PKG-INFO index 57b716d8..8f77b2fc 100644 --- a/PKG-INFO +++ b/PKG-INFO @@ -1,6 +1,6 @@ Metadata-Version: 1.0 Name: fail2ban -Version: 0.6.1 +Version: 0.7.4 Summary: Ban IPs that make too many password failure Home-page: http://fail2ban.sourceforge.net Author: Cyril Jaquier diff --git a/README b/README index c7878a59..61797f72 100644 --- a/README +++ b/README @@ -4,7 +4,7 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ============================================================= -Fail2Ban (version 0.6.1) 2006/03/16 +Fail2Ban (version 0.7.4) 2006/11/01 ============================================================= Fail2Ban scans log files like /var/log/pwdfail and bans IP @@ -13,57 +13,26 @@ rules to reject the IP address. These rules can be defined by the user. Fail2Ban can read multiple log files such as sshd or Apache web server ones. -This is my first Python program. Moreover, English is not my -mother tongue... - - -More details: -------------- - -Fail2Ban is rather simple. I have a home server connected to -the Internet which runs apache, samba, sshd, ... I see in my -logs that people are trying to log into my box using "manual" -brute force or scripts. They try 10, 20 and sometimes more -user/password (without success anyway). In order to -discourage these script kiddies, I wanted that sshd refuse -login from a specific ip after 3 password failures. After -some Google searches, I found that sshd was not able of that. -So I search for a script or program that do it. I found -nothing :-( So I decide to write mine and to learn Python :-) - -For each sections defined in the configuration file, Fail2Ban -tries to find lines which match the failregex. Then it -retrieves the message time using timeregex and timepattern. -It finally gets the ip and if it has already done 3 or more -password failures in the last banTime, the ip is banned for -banTime using a firewall rule. This rule is set by the user -in the configuration file. Thus, Fail2Ban can be adapted for -lots of firewall. After banTime, the rule is deleted. Notice -that if no "plain" ip is available, Fail2Ban try to do DNS -lookup in order to found one or several ip's to ban. - -Sections can be freely added so it is possible to monitor -several daemons at the same time. - -Runs on my server and does its job rather well :-) The idea -is to make fail2ban usable with daemons and services that -require a login (sshd, telnetd, ...) and with different -firewalls. - +Documentation, FAQ, HOWTOs are available on the project +website: http://fail2ban.sourceforge.net Installation: ------------- -Require: python-2.4 (http://www.python.org) +Required: + >=python-2.4 (http://www.python.org) + +Optional: + >=gamin-0.0.21 (http://www.gnome.org/~veillard/gamin) To install, just do: -> tar xvfj fail2ban-0.6.1.tar.bz2 -> cd fail2ban-0.6.1 +> tar xvfj fail2ban-0.7.4.tar.bz2 +> cd fail2ban-0.7.4 > python setup.py install This will install Fail2Ban into /usr/lib/fail2ban. The -fail2ban executable is placed into /usr/bin. +executable scripts are placed into /usr/bin. Gentoo: ebuilds are available on the website. Debian: Fail2Ban is in Debian unstable. @@ -71,50 +40,46 @@ RedHat: packages are available on the website. Fail2Ban should now be correctly installed. Just type: -> fail2ban -h +> fail2ban-client -h -to see if everything is alright. You can configure fail2ban -with a config file. Different kind of configuration files are -available: - -iptables: copy config/fail2ban.conf.iptables to - /etc/fail2ban.conf -hosts.deny: copy config/fail2ban.conf.hostsdeny to - /etc/fail2ban.conf -shorewall: copy config/fail2ban.conf.shorewall to - /etc/fail2ban.conf - -Do not forget to edit fail2ban.conf to meet your needs. - -You can use the initd script available in config/. Copy --initd to /etc/init.d/fail2ban. Gentoo users must copy -gentoo-confd to /etc/conf.d/fail2ban. You can start fail2ban: - -> /etc/init.d/fail2ban start - -Gentoo users can add it to the default runlevel: - -> rc-update add fail2ban default +to see if everything is alright. Configuration: -------------- -You can configure fail2ban using the file /etc/fail2ban.conf -or using command line options. Command line options override -the value stored in fail2ban.conf. Here are the command line -options: +You can configure fail2ban using the files in /etc/fail2ban +or using command line. Here are the available command line +options (not complete yet): - -b start in background - -c read configuration file FILE - -p create PID lock in FILE - -h display this help message - -i IP(s) to ignore - -k kill a currently running instance - -r allow a max of VALUE password failure [maxfailures] - -t