diff --git a/ChangeLog b/ChangeLog index 0a601226..f54bd61d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,36 +6,30 @@ Fail2Ban: Changelog =================== -ver. 0.11.2-dev (20??/??/??) - development edition +ver. 0.10.6 (2020/11/23) - just-what-the-doctor-ordered ----------- -### Compatibility: -* to v.0.10: - - 0.11 is totally compatible to 0.10 (configuration- and API-related stuff), but the database - got some new tables and fields (auto-converted during the first start), so once updated to 0.11, you - have to remove the database /var/lib/fail2ban/fail2ban.sqlite3 (or its different to 0.10 schema) - if you would need to downgrade to 0.10 for some reason. -* to v.0.9: - - Filter (or `failregex`) internal capture-groups: +### Incompatibility list (v.0.10 compared to v.0.9): +* Filter (or `failregex`) internal capture-groups: - * If you've your own `failregex` or custom filters using conditional match `(?P=host)`, you should - rewrite the regex like in example below resp. using `(?:(?P=ip4)|(?P=ip6)` instead of `(?P=host)` - (or `(?:(?P=ip4)|(?P=ip6)|(?P=dns))` corresponding your `usedns` and `raw` settings). + - If you've your own `failregex` or custom filters using conditional match `(?P=host)`, you should + rewrite the regex like in example below resp. using `(?:(?P=ip4)|(?P=ip6)` instead of `(?P=host)` + (or `(?:(?P=ip4)|(?P=ip6)|(?P=dns))` corresponding your `usedns` and `raw` settings). - Of course you can always define your own capture-group (like below `_cond_ip_`) to do this. - ``` - testln="1500000000 failure from 192.0.2.1: bad host 192.0.2.1" - fail2ban-regex "$testln" "^\s*failure from (?P<_cond_ip_>): bad host (?P=_cond_ip_)$" - ``` - * New internal groups (currently reserved for internal usage): - `ip4`, `ip6`, `dns`, `fid`, `fport`, additionally `user` and another captures in lower case if - mapping from tag `` used in failregex (e. g. `user` by ``). + Of course you can always define your own capture-group (like below `_cond_ip_`) to do this. + ``` + testln="1500000000 failure from 192.0.2.1: bad host 192.0.2.1" + fail2ban-regex "$testln" "^\s*failure from (?P<_cond_ip_>): bad host (?P=_cond_ip_)$" + ``` + - New internal groups (currently reserved for internal usage): + `ip4`, `ip6`, `dns`, `fid`, `fport`, additionally `user` and another captures in lower case if + mapping from tag `` used in failregex (e. g. `user` by ``). - - v.0.10 and 0.11 use more precise date template handling, that can be theoretically incompatible to some - user configurations resp. `datepattern`. +* v.0.10 uses more precise date template handling, that can be theoretically incompatible to some + user configurations resp. `datepattern`. - - Since v0.10 fail2ban supports the matching of IPv6 addresses, but not all ban actions are - IPv6-capable now. +* Since v0.10 fail2ban supports the matching of IPv6 addresses, but not all ban actions are + IPv6-capable now. ### Fixes * [stability] prevent race condition - no ban if filter (backend) is continuously busy if @@ -61,6 +55,9 @@ ver. 0.11.2-dev (20??/??/??) - development edition * `action.d/bsd-ipfw.conf`: fixed selection of rule-no by large list or initial `lowest_rule_num` (gh-2836) * `filter.d/common.conf`: avoid substitute of default values in related `lt_*` section, `__prefix_line` should be interpolated in definition section (inside the filter-config, gh-2650) +* `filter.d/dovecot.conf`: + - add managesieve and submission support (gh-2795); + - accept messages with more verbose logging (gh-2573); * `filter.d/courier-smtp.conf`: prefregex extended to consider port in log-message (gh-2697) * `filter.d/traefik-auth.conf`: filter extended with parameter mode (`normal`, `ddos`, `aggressive`) to handle the match of username differently (gh-2693): @@ -94,36 +91,6 @@ ver. 0.11.2-dev (20??/??/??) - development edition whereas filter will use now as timestamp (gh-2802) * performance optimization of `datepattern` (better search algorithm in datedetector, especially for single template); * fail2ban-client: extended to unban IP range(s) by subnet (CIDR/mask) or hostname (DNS), gh-2791; -* extended capturing of alternate tags in filter, allowing combine of multiple groups to single tuple token with new tag - prefix `` with all value of `` tags (gh-2755) - - -ver. 0.11.1 (2020/01/11) - this-is-the-way ------------ - -### Fixes -* purge database will be executed now (within observer). -* restoring currently banned ip after service restart fixed - (now < timeofban + bantime), ignore old log failures (already banned) -* upgrade database: update new created table `bips` with entries from table `bans` (allows restore - current bans after upgrade from version <= 0.10) - -### New Features -* Increment ban time (+ observer) functionality introduced. -* Database functionality extended with bad ips. -* New tags (usable in actions): - - `` - ban count of this offender if known as bad (started by 1 for unknown) - - `` - current ban-time of the ticket (prolongation can be retarded up to 10 sec.) -* Introduced new action command `actionprolong` to prolong ban-time (e. g. set new timeout if expected); - Several actions (like ipset, etc.) rewritten using net logic with `actionprolong`. - Note: because ban-time is dynamic, it was removed from jail.conf as timeout argument (check jail.local). - -### Enhancements -* algorithm of restore current bans after restart changed: update the restored ban-time (and therefore - end of ban) of the ticket with ban-time of jail (as maximum), for all tickets with ban-time greater - (or persistent); not affected if ban-time of the jail is unchanged between stop/start. -* added new setup-option `--without-tests` to skip building and installing of tests files (gh-2287). -* added new command `fail2ban-client get banip ?sep-char|--with-time?` to get the banned ip addresses (gh-1916). ver. 0.10.5 (2020/01/10) - deserve-more-respect-a-jedis-weapon-must @@ -504,14 +471,9 @@ TODO: implementing of options resp. other tasks from PR #1346 - `` - failure identifier (if raw resp. failures without IP address) - `` - PTR reversed representation of IP address - `` - host name of the IP address - - `` - ban count of this offender if known as bad (started by 1 for unknown) - - `` - current ban-time of the ticket (prolongation can be retarded up to 10 sec.) - `` - interpolates to the corresponding filter group capture `...` - `` - fully-qualified name of host (the same as `$(hostname -f)`) - `` - short hostname (the same as `$(uname -n)`) -* Introduced new action command `actionprolong` to prolong ban-time (e. g. set new timeout if expected); - Several actions (like ipset, etc.) rewritten using net logic with `actionprolong`. - Note: because ban-time is dynamic, it was removed from jail.conf as timeout argument (check jail.local). * Allow to use filter options by `fail2ban-regex`, example: fail2ban-regex text.log "sshd[mode=aggressive]" * Samples test case factory extended with filter options - dict in JSON to control @@ -585,9 +547,6 @@ ver. 0.10.0-alpha-1 (2016/07/14) - ipv6-support-etc * testSocket: sporadical bug repaired - wait for server thread starts a socket (listener) * testExecuteTimeoutWithNastyChildren: sporadical bug repaired - wait for pid file inside bash, kill tree in any case (gh-1155) -* purge database will be executed now (within observer). -* restoring currently banned ip after service restart fixed - (now < timeofban + bantime), ignore old log failures (already banned) * Fixed high-load of pyinotify-backend, see https://github.com/fail2ban/fail2ban/issues/885#issuecomment-248964591 * Database: stability fix - repack cursor iterator as long as locked @@ -625,9 +584,6 @@ ver. 0.10.0-alpha-1 (2016/07/14) - ipv6-support-etc - new conditional section functionality used in config resp. includes: - [Init?family=inet4] - IPv4 qualified hosts only - [Init?family=inet6] - IPv6 qualified hosts only -* Increment ban time (+ observer) functionality introduced. - Thanks Serg G. Brester (sebres) -* Database functionality extended with bad ips. * New reload functionality (now totally without restart, unbanning/rebanning, etc.), see gh-1557 * Several commands extended and new commands introduced: diff --git a/MANIFEST b/MANIFEST index 630df5ea..50f308db 100644 --- a/MANIFEST +++ b/MANIFEST @@ -100,6 +100,8 @@ config/filter.d/exim.conf config/filter.d/exim-spam.conf config/filter.d/freeswitch.conf config/filter.d/froxlor-auth.conf +config/filter.d/gitlab.conf +config/filter.d/grafana.conf config/filter.d/groupoffice.conf config/filter.d/gssftpd.conf config/filter.d/guacamole.conf @@ -139,6 +141,7 @@ config/filter.d/sendmail-auth.conf config/filter.d/sendmail-reject.conf config/filter.d/sieve.conf config/filter.d/slapd.conf +config/filter.d/softethervpn.conf config/filter.d/sogo-auth.conf config/filter.d/solid-pop3d.conf config/filter.d/squid.conf @@ -207,7 +210,6 @@ fail2ban/server/jail.py fail2ban/server/jails.py fail2ban/server/jailthread.py fail2ban/server/mytime.py -fail2ban/server/observer.py fail2ban/server/server.py fail2ban/server/strptime.py fail2ban/server/ticket.py @@ -264,9 +266,10 @@ fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd fail2ban/tests/files/config/apache-auth/noentry/.htaccess fail2ban/tests/files/config/apache-auth/README fail2ban/tests/files/database_v1.db -fail2ban/tests/files/database_v2.db fail2ban/tests/files/filter.d/substition.conf fail2ban/tests/files/filter.d/testcase01.conf +fail2ban/tests/files/filter.d/testcase02.conf +fail2ban/tests/files/filter.d/testcase02.local fail2ban/tests/files/filter.d/testcase-common.conf fail2ban/tests/files/ignorecommand.py fail2ban/tests/files/logs/3proxy @@ -301,6 +304,8 @@ fail2ban/tests/files/logs/exim fail2ban/tests/files/logs/exim-spam fail2ban/tests/files/logs/freeswitch fail2ban/tests/files/logs/froxlor-auth +fail2ban/tests/files/logs/gitlab +fail2ban/tests/files/logs/grafana fail2ban/tests/files/logs/groupoffice fail2ban/tests/files/logs/gssftpd fail2ban/tests/files/logs/guacamole @@ -338,6 +343,7 @@ fail2ban/tests/files/logs/sendmail-auth fail2ban/tests/files/logs/sendmail-reject fail2ban/tests/files/logs/sieve fail2ban/tests/files/logs/slapd +fail2ban/tests/files/logs/softethervpn fail2ban/tests/files/logs/sogo-auth fail2ban/tests/files/logs/solid-pop3d fail2ban/tests/files/logs/squid @@ -370,7 +376,6 @@ fail2ban/tests/files/zzz-sshd-obsolete-multiline.log fail2ban/tests/filtertestcase.py fail2ban/tests/__init__.py fail2ban/tests/misctestcase.py -fail2ban/tests/observertestcase.py fail2ban/tests/samplestestcase.py fail2ban/tests/servertestcase.py fail2ban/tests/sockettestcase.py diff --git a/README.md b/README.md index 8e9f5c3a..2b40d306 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ / _|__ _(_) |_ ) |__ __ _ _ _ | _/ _` | | |/ /| '_ \/ _` | ' \ |_| \__,_|_|_/___|_.__/\__,_|_||_| - v0.11.0.dev1 20??/??/?? + v0.10.3.dev1 20??/??/?? ## Fail2Ban: ban hosts that cause multiple authentication errors @@ -18,12 +18,11 @@ attempts, it cannot eliminate the risk presented by weak authentication. Set up services to use only two factor, or public/private authentication mechanisms if you really want to protect services. - | Since v0.10 fail2ban supports the matching of IPv6 addresses. + | Since v0.10 fail2ban supports the matching of the IPv6 addresses. ------|------ This README is a quick introduction to Fail2Ban. More documentation, FAQ, and HOWTOs -to be found on fail2ban(1) manpage, [Wiki](https://github.com/fail2ban/fail2ban/wiki), -[Developers documentation](https://fail2ban.readthedocs.io/) +to be found on fail2ban(1) manpage, [Wiki](https://github.com/fail2ban/fail2ban/wiki) and the website: https://www.fail2ban.org Installation: @@ -46,16 +45,10 @@ Optional: To install: - tar xvfj fail2ban-0.11.0.tar.bz2 - cd fail2ban-0.11.0 - sudo python setup.py install - -Alternatively, you can clone the source from GitHub to a directory of Your choice, and do the install from there. Pick the correct branch, for example, 0.11 + tar xvfj fail2ban-0.10.3.tar.bz2 + cd fail2ban-0.10.3 + python setup.py install - git clone https://github.com/fail2ban/fail2ban.git - cd fail2ban - sudo python setup.py install - This will install Fail2Ban into the python library directory. The executable scripts are placed into `/usr/bin`, and configuration in `/etc/fail2ban`. @@ -65,9 +58,6 @@ Fail2Ban should be correctly installed now. Just type: to see if everything is alright. You should always use fail2ban-client and never call fail2ban-server directly. -You can verify that you have the correct version installed with - - fail2ban-client version Please note that the system init/service script is not automatically installed. To enable fail2ban as an automatic service, simply copy the script for your @@ -89,11 +79,11 @@ fail2ban(1) and jail.conf(5) manpages for further references. Code status: ------------ -* travis-ci.org: [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=0.11)](https://travis-ci.org/fail2ban/fail2ban?branch=0.11) (0.11 branch) / [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=0.10)](https://travis-ci.org/fail2ban/fail2ban?branch=0.10) (0.10 branch) +* [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.png?branch=0.10)](https://travis-ci.org/fail2ban/fail2ban?branch=0.10) travis-ci.org (0.10 branch) / [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.png?branch=master)](https://travis-ci.org/fail2ban/fail2ban) travis-ci.org (master branch) -* coveralls.io: [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=0.11)](https://coveralls.io/github/fail2ban/fail2ban?branch=0.11) (0.11 branch) / [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=0.10)](https://coveralls.io/github/fail2ban/fail2ban?branch=0.10) / (0.10 branch) +* [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.png?branch=0.10)](https://coveralls.io/github/fail2ban/fail2ban?branch=0.10) -* codecov.io: [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=0.11)](https://codecov.io/gh/fail2ban/fail2ban/branch/0.11) (0.11 branch) / [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=0.10)](https://codecov.io/gh/fail2ban/fail2ban/branch/0.10) (0.10 branch) +* [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=0.10)](https://codecov.io/gh/fail2ban/fail2ban/branch/0.10) Contact: -------- diff --git a/THANKS b/THANKS index c363c76c..7861ceb5 100644 --- a/THANKS +++ b/THANKS @@ -111,7 +111,7 @@ Russell Odom SATO Kentaro Sean DuBois Sebastian Arcus -Serg G. Brester (sebres) +Serg G. Brester Sergey Safarov Shaun C. Sireyessire diff --git a/config/action.d/firewallcmd-ipset.conf b/config/action.d/firewallcmd-ipset.conf index c89a0243..66358f23 100644 --- a/config/action.d/firewallcmd-ipset.conf +++ b/config/action.d/firewallcmd-ipset.conf @@ -29,8 +29,6 @@ actionstop = firewall-cmd --direct --remove-rule filter 0 timeout -exist -# actionprolong = %(actionban)s - actionunban = ipset del -exist [Init] diff --git a/config/action.d/iptables-ipset-proto6-allports.conf b/config/action.d/iptables-ipset-proto6-allports.conf index 67d7947b..addb2b95 100644 --- a/config/action.d/iptables-ipset-proto6-allports.conf +++ b/config/action.d/iptables-ipset-proto6-allports.conf @@ -51,8 +51,6 @@ actionstop = -D -m set --match-set src -j timeout -exist -# actionprolong = %(actionban)s - # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the # command is executed with Fail2Ban user rights. diff --git a/config/action.d/iptables-ipset-proto6.conf b/config/action.d/iptables-ipset-proto6.conf index 87601027..7677564f 100644 --- a/config/action.d/iptables-ipset-proto6.conf +++ b/config/action.d/iptables-ipset-proto6.conf @@ -51,8 +51,6 @@ actionstop = -D -p -m multiport --dports -m # actionban = ipset add timeout -exist -# actionprolong = %(actionban)s - # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the # command is executed with Fail2Ban user rights. diff --git a/config/action.d/osx-afctl.conf b/config/action.d/osx-afctl.conf index a75e5723..a319fc6b 100644 --- a/config/action.d/osx-afctl.conf +++ b/config/action.d/osx-afctl.conf @@ -12,5 +12,5 @@ actioncheck = actionban = /usr/libexec/afctl -a -t actionunban = /usr/libexec/afctl -r -actionprolong = %(actionunban)s && %(actionban)s - +[Init] +bantime = 2880 diff --git a/config/action.d/shorewall-ipset-proto6.conf b/config/action.d/shorewall-ipset-proto6.conf index eacb53d9..75eef218 100644 --- a/config/action.d/shorewall-ipset-proto6.conf +++ b/config/action.d/shorewall-ipset-proto6.conf @@ -68,8 +68,6 @@ actionstop = ipset flush f2b- # actionban = ipset add f2b- timeout -exist -# actionprolong = %(actionban)s - # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the # command is executed with Fail2Ban user rights. diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf index 32991cba..dd9452a9 100644 --- a/config/filter.d/apache-noscript.conf +++ b/config/filter.d/apache-noscript.conf @@ -17,9 +17,9 @@ before = apache-common.conf [Definition] -script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl) +script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl|\bcgi-bin/) -prefregex = ^%(_apache_error_client)s (?:AH0(?:01(?:28|30)|1(?:264|071)): )?(?:(?:[Ff]ile|script|[Gg]ot) ).+$ +prefregex = ^%(_apache_error_client)s (?:AH0(?:01(?:28|30)|1(?:264|071)|2811): )?(?:(?:[Ff]ile|script|[Gg]ot) ).+$ failregex = ^(?:does not exist|not found or unable to stat):