From 2a57a17c860399818e10e18ec62ef765a7cc28d4 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 16 Mar 2013 13:51:23 +1100 Subject: [PATCH 01/14] completed items from TODO list --- TODO | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/TODO b/TODO index 933134e9..61bdc093 100644 --- a/TODO +++ b/TODO @@ -16,9 +16,9 @@ Legend: - Run tests though all filters/examples files - (see sshd example file) as unit test -- Removed relative imports +* Removed relative imports -- Cleanup fail2ban-client and fail2ban-server. Move code to server/ and client/ +* Cleanup fail2ban-client and fail2ban-server. Move code to server/ and client/ - Add timeout to external commands (signal alarm, watchdog thread, etc) From a5928cc3cfe558f9731a32015ffbae6619a61fbb Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 16 Mar 2013 13:52:18 +1100 Subject: [PATCH 02/14] ENH: packaging information for RPM builds --- setup.cfg | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/setup.cfg b/setup.cfg index cdc25b29..53e7276a 100644 --- a/setup.cfg +++ b/setup.cfg @@ -3,3 +3,11 @@ install-purelib=/usr/share/fail2ban [sdist] formats=bztar + +[bdist_rpm] +release = 1 +packager = Yaroslav Halchenko +doc_files = DEVELOP + README + THANKS + doc/run-rootless.txt From 10d4aa16820accaedb313871dd56376142cf7f8c Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 16 Mar 2013 13:53:12 +1100 Subject: [PATCH 03/14] BF: remove non-existant files from setup.py. ENH: add documentation --- setup.py | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/setup.py b/setup.py index 37086227..784999a2 100755 --- a/setup.py +++ b/setup.py @@ -67,6 +67,9 @@ setup( ), ('/var/run/fail2ban', '' + ), + ('/usr/share/doc/fail2ban', + ['README', 'DEVELOP', 'doc/run-rootless.txt'] ) ] ) @@ -82,13 +85,7 @@ elements = { "/usr/bin/": [ "fail2ban.py" - ], - "/usr/lib/fail2ban/firewall/": - [ - "iptables.py", - "ipfwadm.py", - "ipfw.py" - ], + ], "/usr/lib/fail2ban/": [ "version.py", From c6ac9c2e353ded2d081f6cc93359188293c057f4 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 16 Mar 2013 13:53:51 +1100 Subject: [PATCH 04/14] ENH: git ignore failed patch reminants --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index 1e3b2ec4..c2e979e5 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,5 @@ dist *.pyc htmlcov .coverage +*.orig +*.rej From 3aeb1a9f4e9094b9882b7f7daddbf687161968f6 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 16 Mar 2013 13:57:42 +1100 Subject: [PATCH 05/14] ENH: jail.conf man page --- man/jail.conf.5 | 145 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 145 insertions(+) create mode 100644 man/jail.conf.5 diff --git a/man/jail.conf.5 b/man/jail.conf.5 new file mode 100644 index 00000000..7a841f7d --- /dev/null +++ b/man/jail.conf.5 @@ -0,0 +1,145 @@ +.TH JAIL.CONF.5 "fail2ban" "jail.conf(5)" +.SH NAME +jail.conf \- configuration for the fail2ban server +.SH SYNOPSIS +.B jail.conf / jail.local + +.B action.d/*.conf action.d/*.local + +.B filter.d/*.conf filter.d/*.local +.SH DESCRIPTION +Fail2ban has three configuration file types. Action files are the commands for banning and unbanning IP address, +Filter files tell fail2ban how authentication failures occur, and Jail configurations that map the two together. + +There are *.conf files that are distributed by fail2ban and *.local file that contain user overwritten files. +It is recommend that *.conf files are not changed. *.local files are where users overwrite their default settings. +For instance if you require the default [ssh-iptables-ipset] jail create a jail.local with The jail.conf file is + the configuration for the fail2ban server. Only overwride the settings you need to change and the rest come from +the default *.conf file. + +[ssh-iptables-ipset] + +enabled = true + +.SH DEFAULT +The following options are applicable to all jails. Their meaning is in the default jail.conf file. +.TP +\fBignoreip\fR +.TP +\fBbantime\fR +.TP +\fBfindtime\fR +.TP +\fBmaxretry\fR +.TP +\fBbackend\fR +.TP +\fBusedns\fR +.TP +.SH ACTION FILES +Action files specify which commands are executed to ban an IP address. They are located in /etc/fail2ban/action.d. + +Like jail.conf files if you desire local changes create a [actionname].local file in the /etc/fail2ban/action.d directory +and override the required settings. + +The action files are ini files that have two sections, \fBdefination\fR and \fBinit\fR . + +The [init] section allows for settings relevant to the action. In jail.conf/jail.local these can be overwritten for a particular jail. + +The commands are specified in the [defination] section as below.. + +The commands are executed through a system shell so shell redirection and process control is allowed. The commands should +return 0 to indicate success which will prevent fail2ban attempting to retry (up to \fBmaxretry\fR times to ban the IP again. + +The following action parameters are in the [defination] section. +.TP +\fBactionstart\fR +This is the commands that are executed when the jail starts. +.TP +\fBactionstop\fR +This is the commands that are executed when the jail stops. +.TP +\fBactioncheck\fR +This is the command that is before each other action. It checks to see if the environment is ok. +.TP +\fBactionban\fR +This is the command that bans the IP address. +.TP +\fBactionunban\fR +This is the command that unbans the IP address after \fBbantime\fR. + +Tags are in <>. All the elements of [init] are tags that are replaced in all action commands. Tags can be added by the +\fBfail2ban-client\fR using the setctag command. + +More that one command is allowed. Each command needs to be on a new line and indented with whitespace with no blank lines. The following defines +two commands to be executed. + +actionban = iptables -I fail2ban- --source -j DROP + + echo ip=, match=, time=