From 81b3dbde1deab56955748277ef682523f6d862b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Viktor=20Sz=C3=A9pe?= Date: Thu, 11 Dec 2014 00:10:37 +0100 Subject: [PATCH 01/19] postfix-sasl failregex case insensitive --- config/filter.d/postfix-sasl.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/postfix-sasl.conf b/config/filter.d/postfix-sasl.conf index 35b064d3..e038b695 100644 --- a/config/filter.d/postfix-sasl.conf +++ b/config/filter.d/postfix-sasl.conf @@ -9,7 +9,7 @@ before = common.conf _daemon = postfix/(submission/)?smtp(d|s) -failregex = ^%(__prefix_line)swarning: [-._\w]+\[\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$ +failregex = ^%(__prefix_line)swarning: [-._\w]+\[\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$ ignoreregex = From 190f55b06e531f06b425505909de9c8561ae6dff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Viktor=20Sz=C3=A9pe?= Date: Thu, 11 Dec 2014 01:34:20 +0100 Subject: [PATCH 02/19] Added an item to "Fixes" --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 690b168a..c3c314af 100644 --- a/ChangeLog +++ b/ChangeLog @@ -20,6 +20,7 @@ ver. 0.9.2 (2014/XX/XXX) - wanna-be-released multiple expressions was not possible). * filters.d/exim.conf - cover different settings of exim logs details. Thanks bes.internal + * filter.d/postfix-sasl.conf - failregex is now case insensitive - New Features: - New interpolation feature for config readers - `%(known/parameter)s`. From a9b6a3754b723001b26a87a2b3b1079754b83bfc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Viktor=20Sz=C3=A9pe?= Date: Thu, 11 Dec 2014 21:01:52 +0100 Subject: [PATCH 03/19] downcase example --- fail2ban/tests/files/logs/postfix-sasl | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fail2ban/tests/files/logs/postfix-sasl b/fail2ban/tests/files/logs/postfix-sasl index 697ac424..46c1e9da 100644 --- a/fail2ban/tests/files/logs/postfix-sasl +++ b/fail2ban/tests/files/logs/postfix-sasl @@ -8,3 +8,7 @@ Mar 10 13:33:30 gandalf postfix/smtpd[3937]: warning: HOSTNAME[1.1.1.1]: SASL LO #3 Example from postfix post-debian changes to rename to add "submission" to syslog name # failJSON: { "time": "2004-09-06T00:44:56", "match": true , "host": "82.221.106.233" } Sep 6 00:44:56 trianon postfix/submission/smtpd[11538]: warning: unknown[82.221.106.233]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 + +#4 Example from postfix post-debian changes to rename to add "submission" to syslog name + downcase +# failJSON: { "time": "2004-09-06T00:44:57", "match": true , "host": "82.221.106.233" } +Sep 6 00:44:57 trianon postfix/submission/smtpd[11538]: warning: unknown[82.221.106.233]: SASL login authentication failed: UGFzc3dvcmQ6 From cc89649d04f3ec9e6613f31b9fa8769881ef5428 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sun, 21 Dec 2014 21:40:58 -0500 Subject: [PATCH 04/19] BF: adjusted for new IP of example.com Conflicts: fail2ban/tests/filtertestcase.py --- fail2ban/tests/files/testcase-usedns.log | 2 +- fail2ban/tests/filtertestcase.py | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/fail2ban/tests/files/testcase-usedns.log b/fail2ban/tests/files/testcase-usedns.log index a91fd7ac..de484127 100644 --- a/fail2ban/tests/files/testcase-usedns.log +++ b/fail2ban/tests/files/testcase-usedns.log @@ -1,2 +1,2 @@ Aug 14 11:54:59 i60p295 sshd[12365]: Failed publickey for roehl from example.com port 51332 ssh2 -Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:93.184.216.119 port 51332 ssh2 +Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:93.184.216.34 port 51332 ssh2 diff --git a/fail2ban/tests/filtertestcase.py b/fail2ban/tests/filtertestcase.py index 1fa3116e..47e88067 100644 --- a/fail2ban/tests/filtertestcase.py +++ b/fail2ban/tests/filtertestcase.py @@ -888,12 +888,12 @@ class GetFailures(unittest.TestCase): def testGetFailuresUseDNS(self): # We should still catch failures with usedns = no ;-) - output_yes = ('93.184.216.119', 2, 1124013539.0, + output_yes = ('93.184.216.34', 2, 1124013539.0, [u'Aug 14 11:54:59 i60p295 sshd[12365]: Failed publickey for roehl from example.com port 51332 ssh2', - u'Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:93.184.216.119 port 51332 ssh2']) + u'Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:93.184.216.34 port 51332 ssh2']) - output_no = ('93.184.216.119', 1, 1124013539.0, - [u'Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:93.184.216.119 port 51332 ssh2']) + output_no = ('93.184.216.34', 1, 1124013539.0, + [u'Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:93.184.216.34 port 51332 ssh2']) # Actually no exception would be raised -- it will be just set to 'no' #self.assertRaises(ValueError, @@ -993,9 +993,9 @@ class DNSUtilsTests(unittest.TestCase): res = DNSUtils.textToIp('www.example.com', 'no') self.assertEqual(res, []) res = DNSUtils.textToIp('www.example.com', 'warn') - self.assertEqual(res, ['93.184.216.119']) + self.assertEqual(res, ['93.184.216.34']) res = DNSUtils.textToIp('www.example.com', 'yes') - self.assertEqual(res, ['93.184.216.119']) + self.assertEqual(res, ['93.184.216.34']) def testTextToIp(self): # Test hostnames @@ -1007,7 +1007,7 @@ class DNSUtilsTests(unittest.TestCase): for s in hostnames: res = DNSUtils.textToIp(s, 'yes') if s == 'www.example.com': - self.assertEqual(res, ['93.184.216.119']) + self.assertEqual(res, ['93.184.216.34']) else: self.assertEqual(res, []) From 971c3d93feefb6f189faaa13faf93f890d40b9a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Viktor=20Sz=C3=A9pe?= Date: Wed, 24 Dec 2014 14:45:48 +0100 Subject: [PATCH 05/19] Monit config Copy it to `/etc/monit/monitrc.d/fail2ban` More info: https://github.com/szepeviktor/debian-server-tools/blob/master/monitoring/monit/monit-debian-setup.sh#L113 --- files/monit/fail2ban | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 files/monit/fail2ban diff --git a/files/monit/fail2ban b/files/monit/fail2ban new file mode 100644 index 00000000..8e6c9419 --- /dev/null +++ b/files/monit/fail2ban @@ -0,0 +1,9 @@ +check process fail2ban with pidfile /var/run/fail2ban/fail2ban.pid + group services + start program = "/etc/init.d/fail2ban force-start" + stop program = "/etc/init.d/fail2ban stop || :" + if failed unixsocket /var/run/fail2ban/fail2ban.sock then restart + if 5 restarts within 5 cycles then timeout + +check file fail2ban_log with path /var/log/fail2ban.log + if match "ERROR|WARNING" then alert From 10f68f494605fac41310ffc9a4bfc48158535013 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Viktor=20Sz=C3=A9pe?= Date: Wed, 24 Dec 2014 15:00:25 +0100 Subject: [PATCH 06/19] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 690b168a..db419c3b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -27,6 +27,7 @@ ver. 0.9.2 (2014/XX/XXX) - wanna-be-released possible to extend a stock filter or jail regexp in .local file (opposite to simply set failregex/ignoreregex that overwrites it), see gh-867. + - Monit config for fail2ban in /files/monit - Enhancements: * Enable multiport for firewallcmd-new action. Closes gh-834 From d65c4f8f5d9ef0a7748ab6ad3149514225fe78fa Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 30 Dec 2014 16:44:51 -0500 Subject: [PATCH 07/19] moved debian's initd file to files/debian-initd from debian branch --- ChangeLog | 2 + MANIFEST | 1 + files/debian-initd | 248 +++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 251 insertions(+) create mode 100755 files/debian-initd diff --git a/ChangeLog b/ChangeLog index c80dac5a..853f603e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,6 +32,8 @@ ver. 0.9.2 (2014/XX/XXX) - wanna-be-released - Enhancements: * Enable multiport for firewallcmd-new action. Closes gh-834 + * files/debian-initd migrated from the debian branch and should be + suitable for manual installations now (thanks Juan Karlo de Guzman) ver. 0.9.1 (2014/10/29) - better, faster, stronger diff --git a/MANIFEST b/MANIFEST index eeb13eef..c6de80fd 100644 --- a/MANIFEST +++ b/MANIFEST @@ -328,6 +328,7 @@ man/fail2ban-server.h2m man/fail2ban-regex.1 man/fail2ban-regex.h2m man/generate-man +files/debian-initd files/gentoo-initd files/gentoo-confd files/redhat-initd diff --git a/files/debian-initd b/files/debian-initd new file mode 100755 index 00000000..d9bb3f50 --- /dev/null +++ b/files/debian-initd @@ -0,0 +1,248 @@ +#! /bin/sh +### BEGIN INIT INFO +# Provides: fail2ban +# Required-Start: $local_fs $remote_fs +# Required-Stop: $local_fs $remote_fs +# Should-Start: $time $network $syslog iptables firehol shorewall ipmasq arno-iptables-firewall iptables-persistent ferm +# Should-Stop: $network $syslog iptables firehol shorewall ipmasq arno-iptables-firewall iptables-persistent ferm +# Default-Start: 2 3 4 5 +# Default-Stop: 0 1 6 +# Short-Description: Start/stop fail2ban +# Description: Start/stop fail2ban, a daemon scanning the log files and +# banning potential attackers. +### END INIT INFO + +# Author: Aaron Isotton +# Modified: by Yaroslav Halchenko +# reindented + minor corrections + to work on sarge without modifications +# Modified: by Glenn Aaldering +# added exit codes for status command +# Modified: by Juan Karlo de Guzman +# corrected the DAEMON's path and the SOCKFILE +# rename this file: (sudo) mv /etc/init.d/fail2ban.init /etc/init.d/fail2ban +# same with the logrotate file: (sudo) mv /etc/logrotate.d/fail2ban.logrotate /etc/logrotate.d/fail2ban +# +PATH=/usr/sbin:/usr/bin:/sbin:/bin +DESC="authentication failure monitor" +NAME=fail2ban + +# fail2ban-client is not a daemon itself but starts a daemon and +# loads its with configuration +DAEMON=/usr/local/bin/$NAME-client +SCRIPTNAME=/etc/init.d/$NAME + +# Ad-hoc way to parse out socket file name +SOCKFILE=`grep -h '^[^#]*socket *=' /etc/$NAME/$NAME.conf /etc/$NAME/$NAME.local 2>/dev/null \ + | tail -n 1 | sed -e 's/.*socket *= *//g' -e 's/ *$//g'` +[ -z "$SOCKFILE" ] && SOCKFILE='/var/run/fail2ban.sock' + +# Exit if the package is not installed +[ -x "$DAEMON" ] || exit 0 + +# Run as root by default. +FAIL2BAN_USER=root + +# Read configuration variable file if it is present +[ -r /etc/default/$NAME ] && . /etc/default/$NAME +DAEMON_ARGS="$FAIL2BAN_OPTS" + +# Load the VERBOSE setting and other rcS variables +[ -f /etc/default/rcS ] && . /etc/default/rcS + +# Predefine what can be missing from lsb source later on -- necessary to run +# on sarge. Just present it in a bit more compact way from what was shipped +log_daemon_msg () { + [ -z "$1" ] && return 1 + echo -n "$1:" + [ -z "$2" ] || echo -n " $2" +} + +# Define LSB log_* functions. +# Depend on lsb-base (>= 3.0-6) to ensure that this file is present. +# Actually has to (>=2.0-7) present in sarge. log_daemon_msg is predefined +# so we must be ok +. /lib/lsb/init-functions + +# +# Shortcut function for abnormal init script interruption +# +report_bug() +{ + echo $* + echo "Please submit a bug report to Debian BTS (reportbug fail2ban)" + exit 1 +} + +# +# Helper function to check if socket is present, which is often left after +# abnormal exit of fail2ban and needs to be removed +# +check_socket() +{ + # Return + # 0 if socket is present and readable + # 1 if socket file is not present + # 2 if socket file is present but not readable + # 3 if socket file is present but is not a socket + [ -e "$SOCKFILE" ] || return 1 + [ -r "$SOCKFILE" ] || return 2 + [ -S "$SOCKFILE" ] || return 3 + return 0 +} + +# +# Function that starts the daemon/service +# +do_start() +{ + # Return + # 0 if daemon has been started + # 1 if daemon was already running + # 2 if daemon could not be started + do_status && return 1 + + if [ -e "$SOCKFILE" ]; then + log_failure_msg "Socket file $SOCKFILE is present" + [ "$1" = "force-start" ] \ + && log_success_msg "Starting anyway as requested" \ + || return 2 + DAEMON_ARGS="$DAEMON_ARGS -x" + fi + + # Assure that /var/run/fail2ban exists + [ -d /var/run/fail2ban ] || mkdir -p /var/run/fail2ban + + if [ "$FAIL2BAN_USER" != "root" ]; then + # Make the socket directory, IP lists and fail2ban log + # files writable by fail2ban + chown "$FAIL2BAN_USER" /var/run/fail2ban + # Create the logfile if it doesn't exist + touch /var/log/fail2ban.log + chown "$FAIL2BAN_USER" /var/log/fail2ban.log + find /proc/net/xt_recent -name 'fail2ban-*' -exec chown "$FAIL2BAN_USER" {} \; + fi + + start-stop-daemon --start --quiet --chuid "$FAIL2BAN_USER" --exec $DAEMON -- \ + $DAEMON_ARGS start > /dev/null\ + || return 2 + + return 0 +} + + +# +# Function that checks the status of fail2ban and returns +# corresponding code +# +do_status() +{ + $DAEMON ping > /dev/null 2>&1 + return $? +} + +# +# Function that stops the daemon/service +# +do_stop() +{ + # Return + # 0 if daemon has been stopped + # 1 if daemon was already stopped + # 2 if daemon could not be stopped + # other if a failure occurred + $DAEMON status > /dev/null 2>&1 || return 1 + $DAEMON stop > /dev/null || return 2 + + # now we need actually to wait a bit since it might take time + # for server to react on client's stop request. Especially + # important for restart command on slow boxes + count=1 + while do_status && [ $count -lt 60 ]; do + sleep 1 + count=$(($count+1)) + done + [ $count -lt 60 ] || return 3 # failed to stop + + return 0 +} + +# +# Function to reload configuration +# +do_reload() { + $DAEMON reload > /dev/null && return 0 || return 1 + return 0 +} + +# yoh: +# shortcut function to don't duplicate case statements and to don't use +# bashisms (arrays). Fixes #368218 +# +log_end_msg_wrapper() +{ + if [ "$3" != "no" ]; then + [ $1 -lt $2 ] && value=0 || value=1 + log_end_msg $value + fi +} + +command="$1" +case "$command" in + start|force-start) + [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME" + do_start "$command" + log_end_msg_wrapper $? 2 "$VERBOSE" + ;; + + stop) + [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME" + do_stop + log_end_msg_wrapper $? 2 "$VERBOSE" + ;; + + restart|force-reload) + log_daemon_msg "Restarting $DESC" "$NAME" + do_stop + case "$?" in + 0|1) + do_start + log_end_msg_wrapper $? 1 "always" + ;; + *) + # Failed to stop + log_end_msg 1 + ;; + esac + ;; + + reload|force-reload) + log_daemon_msg "Reloading $DESC" "$NAME" + do_reload + log_end_msg $? + ;; + + status) + log_daemon_msg "Status of $DESC" + do_status + case $? in + 0) log_success_msg " $NAME is running" ;; + 255) + check_socket + case $? in + 1) log_failure_msg " $NAME is not running" && exit 3 ;; + 0) log_failure_msg " $NAME is not running but $SOCKFILE exists" && exit 3 ;; + 2) log_failure_msg " $SOCKFILE not readable, status of $NAME is unknown" && exit 3 ;; + 3) log_failure_msg " $SOCKFILE exists but not a socket, status of $NAME is unknown" && exit 3 ;; + *) report_bug "Unknown return code from $NAME:check_socket." && exit 4 ;; + esac + ;; + *) report_bug "Unknown $NAME status code" && exit 4 + esac + ;; + *) + echo "Usage: $SCRIPTNAME {start|force-start|stop|restart|force-reload|status}" >&2 + exit 3 + ;; +esac + +: From 6c34cf2e1e65377106d501e7389aa324108b1998 Mon Sep 17 00:00:00 2001 From: Lee Clemens Date: Tue, 30 Dec 2014 17:52:45 -0500 Subject: [PATCH 08/19] Add .idea dir to .gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index a8942050..780ecfb5 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ htmlcov *.bak __pycache__ .vagrant/ +.idea/ From 2d7429c47cfef27f89818e665c6b7634d9f6d140 Mon Sep 17 00:00:00 2001 From: Lee Clemens Date: Tue, 30 Dec 2014 18:05:19 -0500 Subject: [PATCH 09/19] Add 'Client host rejected error message' regex Not sure if it was reworded (using Postfix 2.6) or a slightly different error, but I only have "Client host rejected: cannot find your hostname" --- ChangeLog | 1 + config/filter.d/postfix.conf | 1 + fail2ban/tests/files/logs/postfix | 3 +++ 3 files changed, 5 insertions(+) diff --git a/ChangeLog b/ChangeLog index c80dac5a..162071e3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -21,6 +21,7 @@ ver. 0.9.2 (2014/XX/XXX) - wanna-be-released * filters.d/exim.conf - cover different settings of exim logs details. Thanks bes.internal * filter.d/postfix-sasl.conf - failregex is now case insensitive + * filters.d/postfix.conf - add 'Client host rejected error message' failregex - New Features: - New interpolation feature for config readers - `%(known/parameter)s`. diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf index a7a05e47..a994d772 100644 --- a/config/filter.d/postfix.conf +++ b/config/filter.d/postfix.conf @@ -13,6 +13,7 @@ before = common.conf _daemon = postfix/(submission/)?smtp(d|s) failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 554 5\.7\.1 .*$ + ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 450 4\.7\.1 Client host rejected: cannot find your hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$ ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$ ^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[\]: 550 5\.1\.1 .*$ ^%(__prefix_line)simproper command pipelining after \S+ from [^[]*\[\]:?$ diff --git a/fail2ban/tests/files/logs/postfix b/fail2ban/tests/files/logs/postfix index ccf2f8bc..fff25bb9 100644 --- a/fail2ban/tests/files/logs/postfix +++ b/fail2ban/tests/files/logs/postfix @@ -20,3 +20,6 @@ Dec 25 02:35:54 platypus postfix/smtpd[9144]: improper command pipelining after # failJSON: { "time": "2004-12-18T02:05:46", "match": true , "host": "216.245.198.245" } Dec 18 02:05:46 platypus postfix/smtpd[16349]: improper command pipelining after NOOP from unknown[216.245.198.245] + +# failJSON: { "time": "2014-12-21T21:17:29", "match": true , "host": "93.184.216.34" } +Dec 21 21:17:29 xxx postfix/smtpd[7150]: NOQUEUE: reject: RCPT from badserver.example.com[93.184.216.34]: 450 4.7.1 Client host rejected: cannot find your hostname, [93.184.216.34]; from= to= proto=ESMTP helo= From e6ffa2e4a19dbab4782d39cb066d5d1f196ab811 Mon Sep 17 00:00:00 2001 From: Lee Clemens Date: Tue, 30 Dec 2014 18:10:19 -0500 Subject: [PATCH 10/19] Update year in postfix logs test file --- fail2ban/tests/files/logs/postfix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/tests/files/logs/postfix b/fail2ban/tests/files/logs/postfix index fff25bb9..ee8720f8 100644 --- a/fail2ban/tests/files/logs/postfix +++ b/fail2ban/tests/files/logs/postfix @@ -21,5 +21,5 @@ Dec 25 02:35:54 platypus postfix/smtpd[9144]: improper command pipelining after # failJSON: { "time": "2004-12-18T02:05:46", "match": true , "host": "216.245.198.245" } Dec 18 02:05:46 platypus postfix/smtpd[16349]: improper command pipelining after NOOP from unknown[216.245.198.245] -# failJSON: { "time": "2014-12-21T21:17:29", "match": true , "host": "93.184.216.34" } +# failJSON: { "time": "2004-12-21T21:17:29", "match": true , "host": "93.184.216.34" } Dec 21 21:17:29 xxx postfix/smtpd[7150]: NOQUEUE: reject: RCPT from badserver.example.com[93.184.216.34]: 450 4.7.1 Client host rejected: cannot find your hostname, [93.184.216.34]; from= to= proto=ESMTP helo= From c2bb3253ad3266d9e86eea549333befcd5205b95 Mon Sep 17 00:00:00 2001 From: TorontoMedia Date: Thu, 1 Jan 2015 05:27:18 -0500 Subject: [PATCH 11/19] Update ChangeLog --- ChangeLog | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index df52d48f..cc37ee9f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -317,7 +317,7 @@ some obscure corner of the Internet. Many thanks to our contributors for this release Daniel Black, Yaroslav Halchenko, Steven Hiscocks, Mark McKinstry, Andy Fragen, Orion Poplawski, Alexander Dietrich, JP Espinosa, Jamyn Shanley, Beau Raines, François -Boulogne and others who have helped on IRC and mailing list, logged issues +Boulogne, Donald Yandt and others who have helped on IRC and mailing list, logged issues and bug requests. - IMPORTANT incompatible changes: @@ -422,7 +422,8 @@ and bug requests. * filter.d/uwimap-auth - filter for uwimap-auth IMAP/POP server Steven Hiscocks and Daniel Black * filter.d/selinux-{common,ssh} -- add SELinux date and ssh filter - + Donald Yandt + * action.d/firewallcmd-{multiport,allports}.conf --added two new actions - Enhancements: François Boulogne and Frédéric * filter.d/lighttpd - auth regexs for lighttpd-1.4.31 From 591e44475347845e6c27cada89bb3225f075563f Mon Sep 17 00:00:00 2001 From: TorontoMedia Date: Thu, 1 Jan 2015 05:32:06 -0500 Subject: [PATCH 12/19] Create firewallcmd-allports.conf --- config/action.d/firewallcmd-allports.conf | 52 +++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 config/action.d/firewallcmd-allports.conf diff --git a/config/action.d/firewallcmd-allports.conf b/config/action.d/firewallcmd-allports.conf new file mode 100644 index 00000000..a478f25c --- /dev/null +++ b/config/action.d/firewallcmd-allports.conf @@ -0,0 +1,52 @@ +# Fail2Ban configuration file +# +# Author: Donald Yandt +# Because of the --remove-rules in stop this action requires firewalld-0.3.8+ + + +[INCLUDES] + +before = iptables-blocktype.conf + +actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b- + firewall-cmd --direct --add-rule ipv4 filter f2b- 1000 -j RETURN + firewall-cmd --direct --add-rule ipv4 filter 0 -j f2b- + +actionstop = firewall-cmd --direct --remove-rule ipv4 filter 0 -j f2b- + firewall-cmd --direct --remove-rules ipv4 filter f2b- + firewall-cmd --direct --remove-chain ipv4 filter f2b- + + +# Note: uses regular expression word boundaries '\b' +# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | grep -q '\bf2b-recidive\b' + +actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q '\bf2b-\b' + +actionban = firewall-cmd --direct --add-rule ipv4 filter f2b- 0 -s -j + +actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b- 0 -s -j + +[Init] + +# Default name of the chain +# +name = default + +chain = INPUT_direct + +# DEV NOTES: +# +# Author: Donald Yandt +# Uses "FirewallD" instead of the "iptables daemon". +# +# +# Output: + +# actionstart: +# $ firewall-cmd --direct --add-chain ipv4 filter f2b-recidive +# success +# $ firewall-cmd --direct --add-rule ipv4 filter f2b-recidive 1000 -j RETURN +# success +# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -j f2b-recidive +# success + From 50e5fd9ed71164aa545a4757cd72ded5c5aa86d4 Mon Sep 17 00:00:00 2001 From: TorontoMedia Date: Thu, 1 Jan 2015 05:32:41 -0500 Subject: [PATCH 13/19] Create firewallcmd-multiport.conf --- config/action.d/firewallcmd-multiport.conf | 61 ++++++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 config/action.d/firewallcmd-multiport.conf diff --git a/config/action.d/firewallcmd-multiport.conf b/config/action.d/firewallcmd-multiport.conf new file mode 100644 index 00000000..5f800423 --- /dev/null +++ b/config/action.d/firewallcmd-multiport.conf @@ -0,0 +1,61 @@ +# Fail2Ban configuration file +# +# Author: Donald Yandt +# Because of the --remove-rules in stop this action requires firewalld-0.3.8+ + +[INCLUDES] + +before = iptables-blocktype.conf + +[Definition] + +actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b- + firewall-cmd --direct --add-rule ipv4 filter f2b- 1000 -j RETURN + firewall-cmd --direct --add-rule ipv4 filter 0 -m state --state NEW -p -m multiport --dports -j f2b- + +actionstop = firewall-cmd --direct --remove-rule ipv4 filter 0 -m state --state NEW -p -m multiport --dports -j f2b- + firewall-cmd --direct --remove-rules ipv4 filter f2b- + firewall-cmd --direct --remove-chain ipv4 filter f2b- + +# Note: uses regular expression word boundaries '\b' +# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | grep -q '\bf2b-apache-modsecurity\b' +actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q '\bf2b-\b' + +actionban = firewall-cmd --direct --add-rule ipv4 filter f2b- 0 -s -j + +actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b- 0 -s -j + +[Init] + +# Default name of the chain +name = default + +chain = INPUT_direct + +port = 1:65535 + +# Option: protocol +# Values: [ tcp | udp | icmp | all ] + +protocol = tcp + + + +# DEV NOTES: +# +# Author: Donald Yandt +# Uses "FirewallD" instead of the "iptables daemon". +# +# +# Output: +# actionstart: +# $ firewall-cmd --direct --add-chain ipv4 filter f2b-apache-modsecurity +# success +# $ firewall-cmd --direct --add-rule ipv4 filter f2b-apache-modsecurity 1000 -j RETURN +# success +# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp -m multiport --dports 80,443 -j f2b-apache-modsecurity +# success +# actioncheck: +# $ firewall-cmd --direct --get-chains ipv4 filter f2b-apache-modsecurity | grep -q '\bf2b-apache-modsecurity\b' +# f2b-apache-modsecurity + From 1dfd9941df3fd0e278de20b6fdf2ee1aec87af8b Mon Sep 17 00:00:00 2001 From: TorontoMedia Date: Thu, 1 Jan 2015 05:33:20 -0500 Subject: [PATCH 14/19] Update THANKS --- THANKS | 1 + 1 file changed, 1 insertion(+) diff --git a/THANKS b/THANKS index 61e99466..1185f6b9 100644 --- a/THANKS +++ b/THANKS @@ -33,6 +33,7 @@ Daniel B. Daniel Black David Nutter Derek Atkins +Donald Yandt Eric Gerbier Enrico Labedzki Eugene Hopkinson (SlowRiot) From a47001ea0ea7b6f3d2a5b1aa9cef13022deb86a0 Mon Sep 17 00:00:00 2001 From: TorontoMedia Date: Thu, 1 Jan 2015 12:41:31 -0500 Subject: [PATCH 15/19] Updated ChangeLog --- ChangeLog | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index cc37ee9f..b5593554 100644 --- a/ChangeLog +++ b/ChangeLog @@ -30,6 +30,9 @@ ver. 0.9.2 (2014/XX/XXX) - wanna-be-released (opposite to simply set failregex/ignoreregex that overwrites it), see gh-867. - Monit config for fail2ban in /files/monit + - New actions: + - action.d/firewallcmd-multiport Thanks Donald Yandt + - action.d/firewallcmd-multiport Thanks Donald Yandt - Enhancements: * Enable multiport for firewallcmd-new action. Closes gh-834 @@ -422,8 +425,7 @@ and bug requests. * filter.d/uwimap-auth - filter for uwimap-auth IMAP/POP server Steven Hiscocks and Daniel Black * filter.d/selinux-{common,ssh} -- add SELinux date and ssh filter - Donald Yandt - * action.d/firewallcmd-{multiport,allports}.conf --added two new actions + - Enhancements: François Boulogne and Frédéric * filter.d/lighttpd - auth regexs for lighttpd-1.4.31 From 9f91cb2fd8bcbbfb4b8892cce527519ceb6a54c2 Mon Sep 17 00:00:00 2001 From: TorontoMedia Date: Thu, 1 Jan 2015 12:44:34 -0500 Subject: [PATCH 16/19] Created firewallcmd-allports --- config/action.d/firewallcmd-allports.conf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/config/action.d/firewallcmd-allports.conf b/config/action.d/firewallcmd-allports.conf index a478f25c..c0c378a4 100644 --- a/config/action.d/firewallcmd-allports.conf +++ b/config/action.d/firewallcmd-allports.conf @@ -17,10 +17,10 @@ actionstop = firewall-cmd --direct --remove-rule ipv4 filter 0 -j f2b- -# Note: uses regular expression word boundaries '\b' -# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | grep -q '\bf2b-recidive\b' +# Note: uses regular expression whitespaces '\s' & end of line '$' +# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | grep -q '\sf2b-recidive$' -actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q '\bf2b-\b' +actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q '\sf2b-$' actionban = firewall-cmd --direct --add-rule ipv4 filter f2b- 0 -s -j From 7eed55266b7fac7c997a06d6770491bc0aabedd2 Mon Sep 17 00:00:00 2001 From: TorontoMedia Date: Thu, 1 Jan 2015 12:46:48 -0500 Subject: [PATCH 17/19] Created firewallcmd-multiport --- config/action.d/firewallcmd-multiport.conf | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/config/action.d/firewallcmd-multiport.conf b/config/action.d/firewallcmd-multiport.conf index 5f800423..da73f9f1 100644 --- a/config/action.d/firewallcmd-multiport.conf +++ b/config/action.d/firewallcmd-multiport.conf @@ -17,9 +17,10 @@ actionstop = firewall-cmd --direct --remove-rule ipv4 filter 0 -m state firewall-cmd --direct --remove-rules ipv4 filter f2b- firewall-cmd --direct --remove-chain ipv4 filter f2b- -# Note: uses regular expression word boundaries '\b' -# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | grep -q '\bf2b-apache-modsecurity\b' -actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q '\bf2b-\b' +# Note: uses regular expression whitespaces '\s' & end of line '$' +# Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | grep -q '\sf2b-apache-modsecurity$' + +actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q '\sf2b-$' actionban = firewall-cmd --direct --add-rule ipv4 filter f2b- 0 -s -j @@ -32,8 +33,10 @@ name = default chain = INPUT_direct +# Could also use port numbers separated by a comma. port = 1:65535 + # Option: protocol # Values: [ tcp | udp | icmp | all ] @@ -56,6 +59,6 @@ protocol = tcp # $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp -m multiport --dports 80,443 -j f2b-apache-modsecurity # success # actioncheck: -# $ firewall-cmd --direct --get-chains ipv4 filter f2b-apache-modsecurity | grep -q '\bf2b-apache-modsecurity\b' +# $ firewall-cmd --direct --get-chains ipv4 filter f2b-apache-modsecurity | grep -q '\sf2b-apache-modsecurity$' # f2b-apache-modsecurity From 948eec64252ecf7169fd9d282e05a9ad247530d5 Mon Sep 17 00:00:00 2001 From: TorontoMedia Date: Thu, 1 Jan 2015 12:56:17 -0500 Subject: [PATCH 18/19] Upd --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index b5593554..d3e42ada 100644 --- a/ChangeLog +++ b/ChangeLog @@ -320,7 +320,7 @@ some obscure corner of the Internet. Many thanks to our contributors for this release Daniel Black, Yaroslav Halchenko, Steven Hiscocks, Mark McKinstry, Andy Fragen, Orion Poplawski, Alexander Dietrich, JP Espinosa, Jamyn Shanley, Beau Raines, François -Boulogne, Donald Yandt and others who have helped on IRC and mailing list, logged issues +Boulogne and others who have helped on IRC and mailing list, logged issues and bug requests. - IMPORTANT incompatible changes: From 74c3d5d96cd7e6406896e5024590f393e4c58493 Mon Sep 17 00:00:00 2001 From: TorontoMedia Date: Thu, 1 Jan 2015 13:26:11 -0500 Subject: [PATCH 19/19] Updated ChangeLog --- ChangeLog | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index d3e42ada..ba39d73e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,9 +31,8 @@ ver. 0.9.2 (2014/XX/XXX) - wanna-be-released see gh-867. - Monit config for fail2ban in /files/monit - New actions: - - action.d/firewallcmd-multiport Thanks Donald Yandt - - action.d/firewallcmd-multiport Thanks Donald Yandt - + - action.d/firewallcmd-multiport and action.d/firewallcmd-allports Thanks Donald Yandt + - Enhancements: * Enable multiport for firewallcmd-new action. Closes gh-834 * files/debian-initd migrated from the debian branch and should be