diff --git a/ChangeLog b/ChangeLog index 27e97c4d..d2686386 100644 --- a/ChangeLog +++ b/ChangeLog @@ -29,10 +29,18 @@ ver. 0.9.2 (2014/XX/XXX) - wanna-be-released * recidive uses iptables-allports banaction by default now. Avoids problems with iptables versions not understanding 'all' for protocols and ports + * filter.d/dovecot.conf + - match pam_authenticate line from EL7 + - match unknown user line from EL7 + * Use use_poll=True for Python 2.7 to overcome "Bad file descriptor" msgs + issue (gh-161) + * filter.d/postfix-sasl.conf - tweak failregex and add ignoreregex to ignore + system authentication issues - New Features: - New filter: - postfix-rbl Thanks Lee Clemens + - apache-fakegooglebot.conf Thanks Lee Clemens - New recursive embedded substitution feature added: - `<HOST>` becomes `` for PREF=`IPV4`; - `<HOST>` becomes `1.2.3.4` for PREF=`IPV4` and IPV4HOST=`1.2.3.4`; @@ -54,6 +62,10 @@ ver. 0.9.2 (2014/XX/XXX) - wanna-be-released * Enable multiport for firewallcmd-new action. Closes gh-834 * files/debian-initd migrated from the debian branch and should be suitable for manual installations now (thanks Juan Karlo de Guzman) + * Define empty ignoreregex in filters which didn't have it to avoid + warnings (gh-934) + * action.d/{sendmail-*,xarf-login-attack}.conf - report local + timezone not UTC time/zone. Closes gh-911 ver. 0.9.1 (2014/10/29) - better, faster, stronger diff --git a/MANIFEST b/MANIFEST index c6de80fd..d6ab1156 100644 --- a/MANIFEST +++ b/MANIFEST @@ -266,6 +266,8 @@ config/filter.d/groupoffice.conf config/filter.d/gssftpd.conf config/filter.d/guacamole.conf config/filter.d/horde.conf +config/filter.d/ignorecommands +config/filter.d/ignorecommands/apache-fakegooglebot config/filter.d/kerio.conf config/filter.d/lighttpd-auth.conf config/filter.d/monit.conf diff --git a/MANIFEST.in b/MANIFEST.in index 9473d3a6..22696a20 100644 --- a/MANIFEST.in +++ b/MANIFEST.in @@ -2,3 +2,4 @@ include ChangeLog COPYING DEVELOP FILTERS README.* THANKS TODO CONTRIBUTING* Vag graft doc graft files recursive-include config *.conf *.py +recursive-include config/filter.d/ignorecommands * diff --git a/THANKS b/THANKS index 1185f6b9..28cbb929 100644 --- a/THANKS +++ b/THANKS @@ -83,6 +83,7 @@ Michael Hanselmann Mika (mkl) Nick Munger onorua +Orion Poplawski Paul Marrapese Paul Traina Noel Butler diff --git a/config/action.d/sendmail-common.conf b/config/action.d/sendmail-common.conf index 26dcb4c8..af0212bd 100644 --- a/config/action.d/sendmail-common.conf +++ b/config/action.d/sendmail-common.conf @@ -15,7 +15,7 @@ after = sendmail-common.local # Values: CMD # actionstart = printf %%b "Subject: [Fail2Ban] : started on `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n @@ -28,7 +28,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] : started on `uname -n` # Values: CMD # actionstop = printf %%b "Subject: [Fail2Ban] : stopped on `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n diff --git a/config/action.d/sendmail-whois-ipjailmatches.conf b/config/action.d/sendmail-whois-ipjailmatches.conf index 45b1f312..2de70d85 100644 --- a/config/action.d/sendmail-whois-ipjailmatches.conf +++ b/config/action.d/sendmail-whois-ipjailmatches.conf @@ -17,7 +17,7 @@ before = sendmail-common.conf # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n diff --git a/config/action.d/sendmail-whois-ipmatches.conf b/config/action.d/sendmail-whois-ipmatches.conf index 8193fb04..1390e7a3 100644 --- a/config/action.d/sendmail-whois-ipmatches.conf +++ b/config/action.d/sendmail-whois-ipmatches.conf @@ -17,7 +17,7 @@ before = sendmail-common.conf # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf index 4169e82a..135632ce 100644 --- a/config/action.d/sendmail-whois-lines.conf +++ b/config/action.d/sendmail-whois-lines.conf @@ -17,7 +17,7 @@ before = sendmail-common.conf # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n diff --git a/config/action.d/sendmail-whois-matches.conf b/config/action.d/sendmail-whois-matches.conf index ed664766..c99d5ebf 100644 --- a/config/action.d/sendmail-whois-matches.conf +++ b/config/action.d/sendmail-whois-matches.conf @@ -17,7 +17,7 @@ before = sendmail-common.conf # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n diff --git a/config/action.d/sendmail-whois.conf b/config/action.d/sendmail-whois.conf index fc601277..9403a388 100644 --- a/config/action.d/sendmail-whois.conf +++ b/config/action.d/sendmail-whois.conf @@ -17,7 +17,7 @@ before = sendmail-common.conf # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n diff --git a/config/action.d/sendmail.conf b/config/action.d/sendmail.conf index 46050e11..4b088dc8 100644 --- a/config/action.d/sendmail.conf +++ b/config/action.d/sendmail.conf @@ -17,7 +17,7 @@ before = sendmail-common.conf # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` - Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + Date: `LC_TIME=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <> To: \n Hi,\n diff --git a/config/action.d/xarf-login-attack.conf b/config/action.d/xarf-login-attack.conf index 6d6a74f0..19b3167f 100644 --- a/config/action.d/xarf-login-attack.conf +++ b/config/action.d/xarf-login-attack.conf @@ -46,7 +46,7 @@ actionban = oifs=${IFS}; IFS=.;SEP_IP=( ); set -- ${SEP_IP}; ADDRESSES=$(di REPORTID=