mirror of
https://github.com/fail2ban/fail2ban.git
synced 2026-03-11 08:55:31 +00:00
made a branch for sarge-backports
This commit is contained in:
Yaroslav Halchenko
commit
fb116326ec
49 changed files with 4863 additions and 0 deletions
191
0.6.1-8/CHANGELOG
Normal file
191
0.6.1-8/CHANGELOG
Normal file
|
|
@ -0,0 +1,191 @@
|
|||
__ _ _ ___ _
|
||||
/ _|__ _(_) |_ ) |__ __ _ _ _
|
||||
| _/ _` | | |/ /| '_ \/ _` | ' \
|
||||
|_| \__,_|_|_/___|_.__/\__,_|_||_|
|
||||
|
||||
=============================================================
|
||||
Fail2Ban (version 0.6.1) 2006/03/16
|
||||
=============================================================
|
||||
|
||||
ver. 0.6.1 (2006/03/16) - stable
|
||||
----------
|
||||
- Added permanent banning. Set banTime to a negative value to
|
||||
enable this feature (-1 is perfect). Thanks to Mannone
|
||||
- Fixed locale bug. Thanks to Fernando José
|
||||
- Fixed crash when time format does not match data
|
||||
- Propagated patch from Debian to fix fail2ban search path
|
||||
addition to the path search list: now it is added first.
|
||||
Thanks to Nick Craig-Wood
|
||||
- Added SMTP authentification for mail notification. Thanks
|
||||
to Markus Hoffmann
|
||||
- Removed debug mode as it is confusing for people
|
||||
- Added parsing of timestamp in TAI64N format (#1275325).
|
||||
Thanks to Mark Edgington
|
||||
- Added patch #1382936 (Default formatted syslog logging).
|
||||
Thanks to Patrick Börjesson
|
||||
- Removed 192.168.0.0/16 from ignoreip. Attacks could also
|
||||
come from the local network.
|
||||
- Robust startup: if iptables module does not get fully
|
||||
initialized after startup of fail2ban, fail2ban will do
|
||||
"maxreinit" attempts to initialize its own firewall. It
|
||||
will sleep between attempts for "polltime" number of
|
||||
seconds (closes Debian: #334272). Thanks to Yaroslav
|
||||
Halchenko
|
||||
- Added "interpolations" in fail2ban.conf. This is provided
|
||||
by the ConfigParser module. Old configuration files still
|
||||
work. Thanks to Yaroslav Halchenko
|
||||
- Added initial support for hosts.deny and shorewall. Need
|
||||
more testing. Please test. Thanks to kojiro from Gentoo
|
||||
forum for hosts.deny support
|
||||
- Added support for vsftpd. Thanks to zugeschmiert
|
||||
|
||||
ver. 0.6.0 (2005/11/20) - stable
|
||||
----------
|
||||
- Propagated patches introduced by Debian maintainer
|
||||
(Yaroslav Halchenko):
|
||||
* Added an option to report local time (including timezone)
|
||||
or GMT in mail notification.
|
||||
|
||||
ver. 0.5.5 (2005/10/26) - beta
|
||||
----------
|
||||
- Propagated patches introduced by Debian maintainer
|
||||
(Yaroslav Halchenko):
|
||||
* Introduced fwcheck option to verify consistency of the
|
||||
chains. Implemented automatic restart of fail2ban main
|
||||
function in case check of fwban or fwunban command failed
|
||||
(closes: #329163, #331695). (Introduced patch was further
|
||||
adjusted by upstream author).
|
||||
* Added -f command line parameter for [findtime].
|
||||
* Added a cleanup of firewall rules on emergency shutdown
|
||||
when unknown exception is catched.
|
||||
* Fail2ban should not crash now if a wrong file name is
|
||||
specified in config.
|
||||
* reordered code a bit so that log targets are setup right
|
||||
after background and then only loglevel (verbose, debug)
|
||||
is processed, so the warning could be seen in the logs
|
||||
* Added a keyword <section> in parsing of the subject and
|
||||
the body of an email sent out by fail2ban (closes:
|
||||
#330311)
|
||||
|
||||
ver. 0.5.4 (2005/09/13) - beta
|
||||
----------
|
||||
- Fixed bug #1286222.
|
||||
- Propagated patches introduced by Debian maintainer
|
||||
(Yaroslav Halchenko):
|
||||
* Fixed handling of SYSLOG logging target. Now it can log
|
||||
to any SYSLOG target and facility as directed by the
|
||||
config
|
||||
* Format of SYSLOG entries fixed to look closer to standard
|
||||
* Fixed errata in config/gentoo-confd
|
||||
* Introduced findtime configuration variable to control the
|
||||
lifetime of caught "failed" log entries
|
||||
|
||||
ver. 0.5.3 (2005/09/08) - beta
|
||||
----------
|
||||
- Fixed a bug when overriding "maxfailures" or "bantime".
|
||||
Thanks to Yaroslav Halchenko
|
||||
- Added more debug output if an error occurs when sending
|
||||
mail. Thanks to Stephen Gildea
|
||||
- Renamed "maxretry" to "maxfailures" and changed default
|
||||
value to 5. Thanks to Stephen Gildea
|
||||
- Hopefully fixed bug #1256075
|
||||
- Fixed bug #1262345
|
||||
- Fixed exception handling in PIDLock
|
||||
- Removed warning when using "-V" or "-h" with no config
|
||||
file. Thanks to Yaroslav Halchenko
|
||||
- Removed "-i eth0" from config file. Thanks to Yaroslav
|
||||
Halchenko
|
||||
|
||||
ver. 0.5.2 (2005/08/06) - beta
|
||||
----------
|
||||
- Better PID lock file handling. Should close #1239562
|
||||
- Added man pages
|
||||
- Removed log4py dependency. Use logging module instead
|
||||
- "maxretry" and "bantime" can be overridden in each section
|
||||
- Fixed bug #1246278 (excessive memory usage)
|
||||
- Fixed crash on wrong option value in configuration file
|
||||
- Changed custom chains to lowercase
|
||||
|
||||
ver. 0.5.1 (2005/07/23) - beta
|
||||
----------
|
||||
- Fixed bugs #1241756, #1239557
|
||||
- Added log targets in configuration file. Removed -l option
|
||||
- Changed iptables rules in order to create a separated chain
|
||||
for each section
|
||||
- Fixed static banList in firewall.py
|
||||
- Added an initd script for Debian. Thanks to Yaroslav
|
||||
Halchenko
|
||||
- Check for obsolete files after install
|
||||
|
||||
ver. 0.5.0 (2005/07/12) - beta
|
||||
----------
|
||||
- Added support for CIDR mask in ignoreip
|
||||
- Added mail notification support
|
||||
- Fixed bug #1234699
|
||||
- Added tags replacement in rules definition. Should allow a
|
||||
clean solution for Feature Request #1229479
|
||||
- Removed "interface" and "firewall" options
|
||||
- Added start and end commands in the configuration file.
|
||||
Thanks to Yaroslav Halchenko
|
||||
- Added firewall rules definition in the configuration file
|
||||
- Cleaned fail2ban.py
|
||||
- Added an initd script for RedHat/Fedora. Thanks to Andrey
|
||||
G. Grozin
|
||||
|
||||
ver. 0.4.1 (2005/06/30) - stable
|
||||
----------
|
||||
- Fixed textToDNS method which generated wrong matches for
|
||||
"rhost=12-xyz...". Thanks to Tom Pike
|
||||
- fail2ban.conf modified for readability. Thanks to Iain Lea
|
||||
- Added an initd script for Gentoo
|
||||
- Changed default PID lock file location from /tmp to
|
||||
/var/run
|
||||
|
||||
ver. 0.4.0 (2005/04/24) - stable
|
||||
----------
|
||||
- Fixed textToDNS which did not recognize strings like
|
||||
"12-345-67-890.abcd.mnopqr.xyz"
|
||||
|
||||
ver. 0.3.1 (2005/03/31) - beta
|
||||
----------
|
||||
- Corrected level of messages
|
||||
- Added DNS lookup support
|
||||
- Improved parsing speed. Only parse the new log messages
|
||||
- Added a second verbose level (-vv)
|
||||
|
||||
ver. 0.3.0 (2005/02/24) - beta
|
||||
----------
|
||||
- Re-writting of parts of the code in order to handle several
|
||||
log files with different rules
|
||||
- Removed sshd.py because it is no more needed
|
||||
- Fixed a bug when exiting with IP in the ban list
|
||||
- Added PID lock file
|
||||
- Improved some parts of the code
|
||||
- Added ipfw-start-rule option (thanks to Robert Edeker)
|
||||
- Added -k option which kills a currently running Fail2Ban
|
||||
|
||||
ver. 0.1.2 (2004/11/21) - beta
|
||||
----------
|
||||
- Add ipfw and ipfwadm support. The rules are taken from
|
||||
BlockIt. Thanks to Robert Edeker
|
||||
- Add -e option which allows to set the interface. Thanks to
|
||||
Robert Edeker who reminded me this
|
||||
- Small code cleaning
|
||||
|
||||
ver. 0.1.1 (2004/10/23) - beta
|
||||
----------
|
||||
- Add SIGTERM handler in order to exit nicely when in daemon
|
||||
mode
|
||||
- Add -r option which allows to set the maximum number of
|
||||
login failures
|
||||
- Remove the Metalog class as the log file are not so syslog
|
||||
daemon specific
|
||||
- Rewrite log reader to be service centered. Sshd support
|
||||
added. Match "Failed password" and "Illegal user"
|
||||
- Add /etc/fail2ban.conf configuration support
|
||||
- Code documentation
|
||||
|
||||
|
||||
ver. 0.1.0 (2004/10/12) - alpha
|
||||
----------
|
||||
- Initial release
|
||||
15
0.6.1-8/PKG-INFO
Normal file
15
0.6.1-8/PKG-INFO
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
Metadata-Version: 1.0
|
||||
Name: fail2ban
|
||||
Version: 0.6.1
|
||||
Summary: Ban IPs that make too many password failure
|
||||
Home-page: http://fail2ban.sourceforge.net
|
||||
Author: Cyril Jaquier
|
||||
Author-email: lostcontrol@users.sourceforge.net
|
||||
License: GPL
|
||||
Description:
|
||||
Fail2Ban scans log files like /var/log/pwdfail or
|
||||
/var/log/apache/error_log and bans IP that makes
|
||||
too many password failures. It updates firewall rules
|
||||
to reject the IP address or executes user defined
|
||||
commands.
|
||||
Platform: Posix
|
||||
156
0.6.1-8/README
Normal file
156
0.6.1-8/README
Normal file
|
|
@ -0,0 +1,156 @@
|
|||
__ _ _ ___ _
|
||||
/ _|__ _(_) |_ ) |__ __ _ _ _
|
||||
| _/ _` | | |/ /| '_ \/ _` | ' \
|
||||
|_| \__,_|_|_/___|_.__/\__,_|_||_|
|
||||
|
||||
=============================================================
|
||||
Fail2Ban (version 0.6.1) 2006/03/16
|
||||
=============================================================
|
||||
|
||||
Fail2Ban scans log files like /var/log/pwdfail and bans IP
|
||||
that makes too many password failures. It updates firewall
|
||||
rules to reject the IP address. These rules can be defined by
|
||||
the user. Fail2Ban can read multiple log files such as sshd
|
||||
or Apache web server ones.
|
||||
|
||||
This is my first Python program. Moreover, English is not my
|
||||
mother tongue...
|
||||
|
||||
|
||||
More details:
|
||||
-------------
|
||||
|
||||
Fail2Ban is rather simple. I have a home server connected to
|
||||
the Internet which runs apache, samba, sshd, ... I see in my
|
||||
logs that people are trying to log into my box using "manual"
|
||||
brute force or scripts. They try 10, 20 and sometimes more
|
||||
user/password (without success anyway). In order to
|
||||
discourage these script kiddies, I wanted that sshd refuse
|
||||
login from a specific ip after 3 password failures. After
|
||||
some Google searches, I found that sshd was not able of that.
|
||||
So I search for a script or program that do it. I found
|
||||
nothing :-( So I decide to write mine and to learn Python :-)
|
||||
|
||||
For each sections defined in the configuration file, Fail2Ban
|
||||
tries to find lines which match the failregex. Then it
|
||||
retrieves the message time using timeregex and timepattern.
|
||||
It finally gets the ip and if it has already done 3 or more
|
||||
password failures in the last banTime, the ip is banned for
|
||||
banTime using a firewall rule. This rule is set by the user
|
||||
in the configuration file. Thus, Fail2Ban can be adapted for
|
||||
lots of firewall. After banTime, the rule is deleted. Notice
|
||||
that if no "plain" ip is available, Fail2Ban try to do DNS
|
||||
lookup in order to found one or several ip's to ban.
|
||||
|
||||
Sections can be freely added so it is possible to monitor
|
||||
several daemons at the same time.
|
||||
|
||||
Runs on my server and does its job rather well :-) The idea
|
||||
is to make fail2ban usable with daemons and services that
|
||||
require a login (sshd, telnetd, ...) and with different
|
||||
firewalls.
|
||||
|
||||
|
||||
Installation:
|
||||
-------------
|
||||
|
||||
Require: python-2.4 (http://www.python.org)
|
||||
|
||||
To install, just do:
|
||||
|
||||
> tar xvfj fail2ban-0.6.1.tar.bz2
|
||||
> cd fail2ban-0.6.1
|
||||
> python setup.py install
|
||||
|
||||
This will install Fail2Ban into /usr/lib/fail2ban. The
|
||||
fail2ban executable is placed into /usr/bin.
|
||||
|
||||
Gentoo: ebuilds are available on the website.
|
||||
Debian: Fail2Ban is in Debian unstable.
|
||||
RedHat: packages are available on the website.
|
||||
|
||||
Fail2Ban should now be correctly installed. Just type:
|
||||
|
||||
> fail2ban -h
|
||||
|
||||
to see if everything is alright. You can configure fail2ban
|
||||
with a config file. Different kind of configuration files are
|
||||
available:
|
||||
|
||||
iptables: copy config/fail2ban.conf.iptables to
|
||||
/etc/fail2ban.conf
|
||||
hosts.deny: copy config/fail2ban.conf.hostsdeny to
|
||||
/etc/fail2ban.conf
|
||||
shorewall: copy config/fail2ban.conf.shorewall to
|
||||
/etc/fail2ban.conf
|
||||
|
||||
Do not forget to edit fail2ban.conf to meet your needs.
|
||||
|
||||
You can use the initd script available in config/. Copy
|
||||
<dist>-initd to /etc/init.d/fail2ban. Gentoo users must copy
|
||||
gentoo-confd to /etc/conf.d/fail2ban. You can start fail2ban:
|
||||
|
||||
> /etc/init.d/fail2ban start
|
||||
|
||||
Gentoo users can add it to the default runlevel:
|
||||
|
||||
> rc-update add fail2ban default
|
||||
|
||||
Configuration:
|
||||
--------------
|
||||
|
||||
You can configure fail2ban using the file /etc/fail2ban.conf
|
||||
or using command line options. Command line options override
|
||||
the value stored in fail2ban.conf. Here are the command line
|
||||
options:
|
||||
|
||||
-b start in background
|
||||
-c <FILE> read configuration file FILE
|
||||
-p <FILE> create PID lock in FILE
|
||||
-h display this help message
|
||||
-i <IP(s)> IP(s) to ignore
|
||||
-k kill a currently running instance
|
||||
-r <VALUE> allow a max of VALUE password failure [maxfailures]
|
||||
-t <TIME> ban IP for TIME seconds [bantime]
|
||||
-f <TIME> lifetime in seconds of failed entry [findtime]
|
||||
-v verbose. Use twice for greater effect
|
||||
-V print software version
|
||||
|
||||
Contact:
|
||||
--------
|
||||
|
||||
You need some new features, you found bugs or you just
|
||||
appreciate this program, you can contact me at :
|
||||
|
||||
Website: http://fail2ban.sourceforge.net
|
||||
|
||||
Cyril Jaquier: <lostcontrol@users.sourceforge.net>
|
||||
|
||||
|
||||
Thanks:
|
||||
-------
|
||||
|
||||
Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
|
||||
Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
|
||||
Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
|
||||
Edgington, Patrick Börjesson, kojiro, zugeschmiert
|
||||
|
||||
License:
|
||||
--------
|
||||
|
||||
Fail2Ban is free software; you can redistribute it
|
||||
and/or modify it under the terms of the GNU General Public
|
||||
License as published by the Free Software Foundation; either
|
||||
version 2 of the License, or (at your option) any later
|
||||
version.
|
||||
|
||||
Fail2Ban is distributed in the hope that it will be
|
||||
useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more
|
||||
details.
|
||||
|
||||
You should have received a copy of the GNU General Public
|
||||
License along with Fail2Ban; if not, write to the Free
|
||||
Software Foundation, Inc., 59 Temple Place, Suite 330,
|
||||
Boston, MA 02111-1307 USA
|
||||
95
0.6.1-8/TODO
Normal file
95
0.6.1-8/TODO
Normal file
|
|
@ -0,0 +1,95 @@
|
|||
__ _ _ ___ _
|
||||
/ _|__ _(_) |_ ) |__ __ _ _ _
|
||||
| _/ _` | | |/ /| '_ \/ _` | ' \
|
||||
|_| \__,_|_|_/___|_.__/\__,_|_||_|
|
||||
|
||||
=============================================================
|
||||
ToDo $Revision: 1.11 $
|
||||
=============================================================
|
||||
|
||||
See Feature Request Tracking System at SourceForge.net
|
||||
|
||||
- improve installation process (better prefix support)
|
||||
|
||||
- improve documentation and website for user
|
||||
|
||||
- use Doxygen
|
||||
|
||||
- use PyLint to check the code
|
||||
|
||||
- better configuration files
|
||||
|
||||
- add a check to see if the time of the log messages is
|
||||
correctly detected (valid regexp)
|
||||
|
||||
- use Gentoo Portage style for scripts.
|
||||
- banning engines script in /etc/fail2ban/scripts.d
|
||||
Example: /etc/fail2ban/scripts.d/iptables
|
||||
Will be mostly bash scripting which is more "user
|
||||
friendly".
|
||||
- split configuration files in /etc/fail2ban/services.d
|
||||
for log files
|
||||
Example: /etc/fail2ban/services.d/apache
|
||||
Mainly regular expressions.
|
||||
- template for common regex in /etc/fail2ban/templates.d
|
||||
Example: /etc/fail2ban/templates.d/date
|
||||
Mainly regular expressions.
|
||||
|
||||
- remove debug mode (root check)
|
||||
|
||||
- better return values in function
|
||||
|
||||
- use more email.Utils in mail.py
|
||||
|
||||
- add gettext support. Is this really needed for a server
|
||||
utility?
|
||||
|
||||
- send an email when fail2ban is running
|
||||
|
||||
- add multithreading. Python threading is not really
|
||||
efficient. However, fail2ban could benefit of it. We could
|
||||
use threads like this:
|
||||
- one thread which check for host to unban.
|
||||
- one thread per file to watch. This will allow things like
|
||||
different polling time for each file.
|
||||
<srv> is read-only (we only read log files) thus no locks
|
||||
are required. However, <meth> is read-write and must take
|
||||
care of concurrency in case of multithreading.
|
||||
|
||||
- add FAM/Gamin support. Should be quite efficient with
|
||||
threading. Take care that handle_one_event() release the
|
||||
Python lock.
|
||||
|
||||
- add a test framework. We could use unittest which is in
|
||||
Python since 2.1. It should be possible to run all tests
|
||||
automatically.
|
||||
|
||||
- add client/server using socket. Something similar to
|
||||
gdesklets. DBUS seems to be designed for desktop use.
|
||||
- fail2ban start -> start the daemon.
|
||||
- fail2ban stop -> stop the daemon.
|
||||
- fail2ban add <srv> <meth> -> add <srv> monitoring with
|
||||
<meth> ban method (iptables, hosts.deny, etc).
|
||||
- fail2ban del <srv> -> remove <srv> monitoring.
|
||||
- fail2ban status <srv> -> query current fail2ban status.
|
||||
Should return infos like a ban counter. Could be graph
|
||||
with rrdtool.
|
||||
- fail2ban pause <srv> -> suspend monitoring.
|
||||
- fail2ban resume <srv> -> resume monitoring.
|
||||
- fail2ban list -> list available services.
|
||||
- fail2ban flush <srv> -> flush the <srv> ban list.
|
||||
|
||||
- remove PID file.
|
||||
|
||||
- remove most of the command lines options if possible.
|
||||
|
||||
- add the possibility to specify wildcard in log files.
|
||||
Example: logfile = /var/log/apache2/access-*.log
|
||||
Should we start one thread per file or just one thread per
|
||||
serivce?
|
||||
|
||||
- autodetect date format in log file. Match the most popular
|
||||
format and sort them using the hit ratio. Should avoid
|
||||
user problem with regex and not have a big impact on perfs.
|
||||
|
||||
- restart automatically the daemon if an exception occurs.
|
||||
149
0.6.1-8/config/debian-initd
Normal file
149
0.6.1-8/config/debian-initd
Normal file
|
|
@ -0,0 +1,149 @@
|
|||
#! /bin/sh
|
||||
### BEGIN INIT INFO
|
||||
# Provides: fail2ban
|
||||
# Required-Start: $local_fs $remote_fs
|
||||
# Required-Stop: $local_fs $remote_fs
|
||||
# Should-Start: $time $network $syslog iptables firehol shorewall ipmasq
|
||||
# Should-Stop: $network $syslog iptables firehol shorewall ipmasq
|
||||
# Default-Start: 2 3 4 5
|
||||
# Default-Stop: 0 1 6
|
||||
# Short-Description: Start/stop fail2ban
|
||||
# Description: Start/stop fail2ban, a daemon scanning the log files and
|
||||
# banning potential attackers.
|
||||
### END INIT INFO
|
||||
|
||||
# Author: Aaron Isotton <aaron@isotton.com>
|
||||
# Modified: by Yaroslav Halchenko <debian@onerussian.com>
|
||||
# reindented + minor corrections + to work on sarge without modifications
|
||||
#
|
||||
PATH=/usr/sbin:/usr/bin:/sbin:/bin
|
||||
DESC="authentication failure monitor"
|
||||
NAME=fail2ban
|
||||
DAEMON=/usr/bin/$NAME
|
||||
PIDFILE=/var/run/$NAME.pid
|
||||
SCRIPTNAME=/etc/init.d/$NAME
|
||||
|
||||
# Exit if the package is not installed
|
||||
[ -x "$DAEMON" ] || exit 0
|
||||
|
||||
# Read configuration variable file if it is present
|
||||
[ -r /etc/default/$NAME ] && . /etc/default/$NAME
|
||||
DAEMON_ARGS="$FAIL2BAN_OPTS"
|
||||
|
||||
# Load the VERBOSE setting and other rcS variables
|
||||
[ -f /etc/default/rcS ] && . /etc/default/rcS
|
||||
|
||||
# Predefine what can be missing from lsb source later on -- necessary to run
|
||||
# on sarge. Just present it in a bit more compact way from what was shipped
|
||||
log_daemon_msg () {
|
||||
[ -z "$1" ] && return 1
|
||||
echo -n "$1:"
|
||||
[ -z "$2" ] || echo -n " $2"
|
||||
}
|
||||
|
||||
# Define LSB log_* functions.
|
||||
# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
|
||||
# Actually has to (>=2.0-7) present in sarge. log_daemon_msg is predefined
|
||||
# so we must be ok
|
||||
. /lib/lsb/init-functions
|
||||
|
||||
#
|
||||
# Function that starts the daemon/service
|
||||
#
|
||||
do_start()
|
||||
{
|
||||
# Return
|
||||
# 0 if daemon has been started
|
||||
# 1 if daemon was already running
|
||||
# 2 if daemon could not be started
|
||||
start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
|
||||
|| return 1
|
||||
# we need to remove pid file or fail2ban would refuse to start
|
||||
# probably check could be ommited but... better be safe
|
||||
pidofproc $NAME $PIDFILE > /dev/null
|
||||
[ $? -eq 2 ] && rm -rf $PIDFILE
|
||||
start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \
|
||||
$DAEMON_ARGS \
|
||||
|| return 2
|
||||
}
|
||||
|
||||
#
|
||||
# Function that stops the daemon/service
|
||||
#
|
||||
do_stop()
|
||||
{
|
||||
# Return
|
||||
# 0 if daemon has been stopped
|
||||
# 1 if daemon was already stopped
|
||||
# 2 if daemon could not be stopped
|
||||
# other if a failure occurred
|
||||
start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
|
||||
RETVAL="$?"
|
||||
[ "$RETVAL" = 2 ] && return 2
|
||||
start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
|
||||
[ "$?" = 2 ] && return 2
|
||||
return "$RETVAL"
|
||||
}
|
||||
|
||||
|
||||
# yoh:
|
||||
# shortcut function to don't duplicate case statements and to don't use
|
||||
# bashisms (arrays). Fixes #368218
|
||||
#
|
||||
log_end_msg_wrapper()
|
||||
{
|
||||
[ $1 -lt $2 ] && value=0 || value=1
|
||||
log_end_msg $value
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
|
||||
do_start
|
||||
[ "$VERBOSE" != no ] && log_end_msg_wrapper $? 2
|
||||
;;
|
||||
stop)
|
||||
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
|
||||
do_stop
|
||||
[ "$VERBOSE" != no ] && log_end_msg_wrapper $? 2
|
||||
;;
|
||||
restart|force-reload)
|
||||
log_daemon_msg "Restarting $DESC" "$NAME"
|
||||
do_stop
|
||||
case "$?" in
|
||||
0|1)
|
||||
do_start
|
||||
log_end_msg_wrapper $? 1
|
||||
;;
|
||||
*)
|
||||
# Failed to stop
|
||||
log_end_msg 1
|
||||
;;
|
||||
esac
|
||||
;;
|
||||
status)
|
||||
log_daemon_msg "Status of $DESC"
|
||||
pidofproc $NAME $PIDFILE > /dev/null
|
||||
status=$?
|
||||
case $status in
|
||||
0) log_success_msg " $NAME is running"
|
||||
exit 0
|
||||
;;
|
||||
1|2) log_failure_msg " $NAME is not running but $PIDFILE exists"
|
||||
exit 1
|
||||
;;
|
||||
3) log_warning_msg " $NAME is not running"
|
||||
exit 3
|
||||
;;
|
||||
4) log_failure_msg " $PIDFILE not readable, status of $NAME unknown"
|
||||
exit 4
|
||||
;;
|
||||
esac
|
||||
;;
|
||||
*)
|
||||
echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload|status}" >&2
|
||||
exit 3
|
||||
;;
|
||||
esac
|
||||
|
||||
:
|
||||
327
0.6.1-8/config/fail2ban.conf.hostsdeny
Normal file
327
0.6.1-8/config/fail2ban.conf.hostsdeny
Normal file
|
|
@ -0,0 +1,327 @@
|
|||
# Fail2Ban configuration file
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
#
|
||||
# 2005.06.21 modified for readability Iain Lea iain@bricbrac.de
|
||||
|
||||
[DEFAULT]
|
||||
# Option: background
|
||||
# Notes.: start fail2ban as a daemon. Output is redirect to logfile.
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
background = false
|
||||
|
||||
# Option: logtargets
|
||||
# Notes.: log targets. Space separated list of logging targets.
|
||||
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
|
||||
#
|
||||
logtargets = /var/log/fail2ban.log
|
||||
|
||||
# Option: syslog-target
|
||||
# Notes.: where to find syslog facility if logtarget SYSLOG.
|
||||
# Values: SOCKET HOST HOST:PORT Default: /dev/log
|
||||
#
|
||||
syslog-target = /dev/log
|
||||
|
||||
# Option: syslog-facility
|
||||
# Notes.: which syslog facility to use if logtarget SYSLOG.
|
||||
# Values: NUM Default: 1
|
||||
#
|
||||
syslog-facility = 1
|
||||
|
||||
# Option: pidlock
|
||||
# Notes.: path of the PID lock file (must be able to write to file).
|
||||
# Values: FILE Default: /var/run/fail2ban.pid
|
||||
#
|
||||
pidlock = /var/run/fail2ban.pid
|
||||
|
||||
# Option: maxfailures
|
||||
# Notes.: number of failures before IP gets banned.
|
||||
# Values: NUM Default: 5
|
||||
#
|
||||
maxfailures = 5
|
||||
|
||||
# Option: bantime
|
||||
# Notes.: number of seconds an IP will be banned. If set to a negative
|
||||
# value, IP will never be unbanned (permanent banning).
|
||||
# Values: NUM Default: 600
|
||||
#
|
||||
bantime = 600
|
||||
|
||||
# Option: findtime
|
||||
# Notes.: lifetime in seconds of a "failed" log entry.
|
||||
# Values: NUM Default: 600
|
||||
#
|
||||
findtime = 600
|
||||
|
||||
# Option: ignoreip
|
||||
# Notes.: space separated list of IP's to be ignored by fail2ban.
|
||||
# You can use CIDR mask in order to specify a range.
|
||||
# Example: ignoreip = 192.168.0.1/24 123.45.235.65
|
||||
# Values: IP Default:
|
||||
#
|
||||
ignoreip =
|
||||
|
||||
# Option: cmdstart
|
||||
# Notes.: command executed once at the start of Fail2Ban
|
||||
# Values: CMD Default:
|
||||
#
|
||||
cmdstart =
|
||||
|
||||
# Option: cmdend
|
||||
# Notes.: command executed once at the end of Fail2Ban.
|
||||
# Values: CMD Default:
|
||||
#
|
||||
cmdend =
|
||||
|
||||
# Option: polltime
|
||||
# Notes.: number of seconds fail2ban sleeps between iterations.
|
||||
# Values: NUM Default: 1
|
||||
#
|
||||
polltime = 1
|
||||
|
||||
# Option: reinittime
|
||||
# Notes.: minimal number of seconds between the re-initialization of
|
||||
# firewalls due to external changes in their rules (see fwcheck)
|
||||
# Values: NUM Default: 100
|
||||
#
|
||||
reinittime = 10
|
||||
|
||||
# Option: maxreinits
|
||||
# Notes.: maximal number of re-initialization of firewalls due to external
|
||||
# changes. -1 stays for infinite, so only reinittime is of importance
|
||||
# Values: NUM Default: -1
|
||||
#
|
||||
maxreinits = 1000
|
||||
|
||||
# NOTE: Interpolations
|
||||
#
|
||||
# fwstart, as well as fwend, fwcheck, fwban, fwunban, use interpolations
|
||||
# so %(__name__)s will be substituted by a name of each section
|
||||
# (unless the option is overriden in a section).
|
||||
# If you are going to use interpolations in your setup, please make
|
||||
# sure that you specified options port and protocol (which also has
|
||||
# an option in DEFAULT).
|
||||
#
|
||||
|
||||
# Option: hostsdeny
|
||||
# Notes.: hosts.deny file path.
|
||||
# Values: STR Default: /etc/hosts.deny
|
||||
#
|
||||
hostsdeny = /etc/hosts.deny
|
||||
|
||||
# Option: fwban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <failtime> unix timestamp of the last failure
|
||||
# <bantime> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
# Default: iptables -I INPUT 1 -s <ip> -j DROP
|
||||
#
|
||||
fwban = IP=<ip> && echo "ALL: $IP" >> %(hostsdeny)s
|
||||
|
||||
# Option: fwunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <bantime> unix timestamp of the ban time
|
||||
# <unbantime> unix timestamp of the unban time
|
||||
# Values: CMD
|
||||
# Default: iptables -D INPUT -s <ip> -j DROP
|
||||
#
|
||||
fwunban = IP=<ip> && sed -i.old s/ALL:\ $IP// %(hostsdeny)s
|
||||
|
||||
[MAIL]
|
||||
# Option: enabled
|
||||
# Notes.: enable mail notification when banning an IP address.
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
enabled = false
|
||||
|
||||
# Option: host
|
||||
# Notes.: host running the mail server.
|
||||
# Values: STR Default: localhost
|
||||
#
|
||||
host = localhost
|
||||
|
||||
# Option: port
|
||||
# Notes.: port of the mail server.
|
||||
# Values: INT Default: 25
|
||||
#
|
||||
port = 25
|
||||
|
||||
# Option: user
|
||||
# Notes.: the username for smtp-server if authentification is required.
|
||||
# if user is empty, no authentification is done.
|
||||
# Values: STR Default:
|
||||
#
|
||||
user =
|
||||
|
||||
# Option: password
|
||||
# Notes.: the smtp-user's password if authentification is required.
|
||||
# Values: STR Default:
|
||||
#
|
||||
password =
|
||||
|
||||
# Option: from
|
||||
# Notes.: e-mail address of the sender.
|
||||
# Values: MAIL Default: fail2ban
|
||||
#
|
||||
from = fail2ban
|
||||
|
||||
# Option: to
|
||||
# Notes.: e-mail addresses of the receiver. Addresses are space
|
||||
# separated.
|
||||
# Values: MAIL Default: root
|
||||
#
|
||||
to = root
|
||||
|
||||
# Option: localtime
|
||||
# Notes.: report local time (including timezone) or GMT
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
localtime = true
|
||||
|
||||
# Option: subject
|
||||
# Notes.: subject of the e-mail.
|
||||
# Tags: <section> active section (eg ssh, apache, etc)
|
||||
# <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <failtime> unix timestamp of the last failure
|
||||
# Values: TEXT Default: [Fail2Ban] <section>: Banned <ip>
|
||||
#
|
||||
subject = [Fail2Ban] <section>: Banned <ip>
|
||||
|
||||
# Option: message
|
||||
# Notes.: message of the e-mail.
|
||||
# Tags: <section> active section (eg ssh, apache, etc)
|
||||
# <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <failtime> unix timestamp of the last failure
|
||||
# <br> new line
|
||||
# Values: TEXT Default:
|
||||
#
|
||||
message = Hi,<br>
|
||||
The IP <ip> has just been banned by Fail2Ban after
|
||||
<failures> attempts against <section>.<br>
|
||||
Regards,<br>
|
||||
Fail2Ban
|
||||
|
||||
# You can define a new section for each log file to check for
|
||||
# password failure. Each section has to define the following
|
||||
# options: logfile, fwban, fwunban, timeregex, timepattern,
|
||||
# failregex.
|
||||
|
||||
|
||||
[Apache]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
enabled = false
|
||||
|
||||
# Option: logfile
|
||||
# Notes.: logfile to monitor.
|
||||
# Values: FILE Default: /var/log/httpd/access_log
|
||||
#
|
||||
logfile = /var/log/httpd/access_log
|
||||
|
||||
# Option: timeregex
|
||||
# Notes.: regex to match timestamp in Apache logfile. For TAI64N format,
|
||||
# use timeregex = @[0-9a-f]{24}
|
||||
# Values: [Wed Jan 05 15:08:01 2005]
|
||||
# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
|
||||
#
|
||||
timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
|
||||
|
||||
# Option: timepattern
|
||||
# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
|
||||
# For TAI64N format, use timepattern = tai64n
|
||||
# Values: TEXT Default: %%a %%b %%d %%H:%%M:%%S %%Y
|
||||
#
|
||||
timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failure messages in the logfile.
|
||||
# Values: TEXT Default: authentication failure|user .* not found
|
||||
#
|
||||
failregex = authentication failure|user .* not found
|
||||
|
||||
|
||||
[VSFTPD]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
enabled = false
|
||||
|
||||
# Option: logfile
|
||||
# Notes.: logfile to monitor.
|
||||
# Values: FILE Default: /var/log/secure
|
||||
#
|
||||
logfile = /var/log/vsftpd.log
|
||||
|
||||
# Option: port
|
||||
# Notes.: specifies port to monitor
|
||||
# Values: [ NUM | STRING ] Default:
|
||||
#
|
||||
port = ftp
|
||||
|
||||
# Option: timeregex
|
||||
# Notes.: regex to match timestamp in VSFTPD logfile.
|
||||
# Values: [Mar 7 17:53:28]
|
||||
# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
#
|
||||
timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
|
||||
# Option: timepattern
|
||||
# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
|
||||
# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
#
|
||||
timepattern = %%b %%d %%H:%%M:%%S
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
failregex = FAIL LOGIN
|
||||
|
||||
|
||||
[SSH]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
# Values: [true | false] Default: true
|
||||
#
|
||||
enabled = true
|
||||
|
||||
# Option: logfile
|
||||
# Notes.: logfile to monitor.
|
||||
# Values: FILE Default: /var/log/secure
|
||||
#
|
||||
logfile = /var/log/secure
|
||||
|
||||
# Option: timeregex
|
||||
# Notes.: regex to match timestamp in SSH logfile. For TAI64N format,
|
||||
# use timeregex = @[0-9a-f]{24}
|
||||
# Values: [Mar 7 17:53:28]
|
||||
# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
#
|
||||
timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
|
||||
# Option: timepattern
|
||||
# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
|
||||
# For TAI64N format, use timepattern = tai64n
|
||||
# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
#
|
||||
timepattern = %%b %%d %%H:%%M:%%S
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
failregex = Authentication failure|Failed password|Invalid user
|
||||
427
0.6.1-8/config/fail2ban.conf.iptables
Normal file
427
0.6.1-8/config/fail2ban.conf.iptables
Normal file
|
|
@ -0,0 +1,427 @@
|
|||
# Fail2Ban configuration file
|
||||
#
|
||||
# $Revision: 1.9 $
|
||||
#
|
||||
# 2005.06.21 modified for readability Iain Lea iain@bricbrac.de
|
||||
|
||||
[DEFAULT]
|
||||
# Option: background
|
||||
# Notes.: start fail2ban as a daemon. Output is redirect to logfile.
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
background = true
|
||||
|
||||
# Option: verbose
|
||||
# Notes.: verbosity of the output.
|
||||
# 0 - regular level
|
||||
# 1 - INFO level
|
||||
# 2 - DEBUG level (but commands get executed as opposed to
|
||||
# debug option)
|
||||
# Values: NUM Default: 0
|
||||
#
|
||||
verbose = 1
|
||||
|
||||
# Option: debug
|
||||
# Notes.: enable debug mode. No real commands gets executed but only
|
||||
# reported, more verbose output, bypass root user test.
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
debug = false
|
||||
|
||||
# Option: logtargets
|
||||
# Notes.: log targets. Space separated list of logging targets.
|
||||
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
|
||||
#
|
||||
logtargets = /var/log/fail2ban.log
|
||||
|
||||
# Option: syslog-target
|
||||
# Notes.: where to find syslog facility if logtarget SYSLOG.
|
||||
# Values: SOCKET HOST HOST:PORT Default: /dev/log
|
||||
#
|
||||
syslog-target = /dev/log
|
||||
|
||||
# Option: syslog-facility
|
||||
# Notes.: which syslog facility to use if logtarget SYSLOG.
|
||||
# Values: NUM Default: 1
|
||||
#
|
||||
syslog-facility = 1
|
||||
|
||||
# Option: pidlock
|
||||
# Notes.: path of the PID lock file (must be able to write to file).
|
||||
# Values: FILE Default: /var/run/fail2ban.pid
|
||||
#
|
||||
pidlock = /var/run/fail2ban.pid
|
||||
|
||||
# Option: maxfailures
|
||||
# Notes.: number of failures before IP gets banned.
|
||||
# Values: NUM Default: 5
|
||||
#
|
||||
maxfailures = 5
|
||||
|
||||
# Option: bantime
|
||||
# Notes.: number of seconds an IP will be banned. If set to a negative
|
||||
# value, IP will never be unbanned (permanent banning).
|
||||
# Values: NUM Default: 600
|
||||
#
|
||||
bantime = 600
|
||||
|
||||
# Option: findtime
|
||||
# Notes.: lifetime in seconds of a "failed" log entry.
|
||||
# Values: NUM Default: 600
|
||||
#
|
||||
findtime = 600
|
||||
|
||||
# Option: ignoreip
|
||||
# Notes.: space separated list of IP's to be ignored by fail2ban.
|
||||
# You can use CIDR mask in order to specify a range.
|
||||
# Example: ignoreip = 192.168.0.1/24 123.45.235.65
|
||||
# Values: IP Default:
|
||||
#
|
||||
ignoreip =
|
||||
|
||||
# Option: cmdstart
|
||||
# Notes.: command executed once at the start of Fail2Ban
|
||||
# Values: CMD Default:
|
||||
#
|
||||
cmdstart =
|
||||
|
||||
# Option: cmdend
|
||||
# Notes.: command executed once at the end of Fail2Ban.
|
||||
# Values: CMD Default:
|
||||
#
|
||||
cmdend =
|
||||
|
||||
# Option: polltime
|
||||
# Notes.: number of seconds fail2ban sleeps between iterations.
|
||||
# Values: NUM Default: 1
|
||||
#
|
||||
polltime = 1
|
||||
|
||||
# Option: reinittime
|
||||
# Notes.: minimal number of seconds between the re-initialization of
|
||||
# firewalls due to external changes in their rules (see fwcheck)
|
||||
# Values: NUM Default: 100
|
||||
#
|
||||
reinittime = 10
|
||||
|
||||
# Option: maxreinits
|
||||
# Notes.: maximal number of re-initialization of firewalls due to external
|
||||
# changes. -1 stays for infinite, so only reinittime is of importance
|
||||
# Values: NUM Default: -1
|
||||
#
|
||||
maxreinits = 1000
|
||||
|
||||
# NOTE: Interpolations
|
||||
#
|
||||
# fwstart, as well as fwend, fwcheck, fwban, fwunban, use interpolations
|
||||
# so %(__name__)s will be substituted by a name of each section
|
||||
# (unless the option is overriden in a section).
|
||||
# If you are going to use interpolations in your setup, please make
|
||||
# sure that you specified options port and protocol (which also has
|
||||
# an option in DEFAULT).
|
||||
#
|
||||
|
||||
# Option: protocol
|
||||
# Notes.: internally used by config reader for interpolations.
|
||||
# Values: [ tcp | udp | icmp | all ] Default: tcp
|
||||
#
|
||||
protocol = tcp
|
||||
|
||||
# Option: fwchain
|
||||
# Notes.: chain from which to jump into fail2ban chains
|
||||
# Values: TEXT Default: INPUT
|
||||
#
|
||||
fwchain = INPUT
|
||||
|
||||
# Option: fwstart
|
||||
# Notes.: command executed once at the start of Fail2Ban.
|
||||
# Values: CMD Default:
|
||||
#
|
||||
fwstart = iptables -N fail2ban-%(__name__)s
|
||||
iptables -A fail2ban-%(__name__)s -j RETURN
|
||||
iptables -I %(fwchain)s -p %(protocol)s --dport %(port)s -j fail2ban-%(__name__)s
|
||||
|
||||
# Option: fwend
|
||||
# Notes.: command executed once at the end of Fail2Ban
|
||||
# Values: CMD Default:
|
||||
#
|
||||
fwend = iptables -D %(fwchain)s -p %(protocol)s --dport %(port)s -j fail2ban-%(__name__)s
|
||||
iptables -F fail2ban-%(__name__)s
|
||||
iptables -X fail2ban-%(__name__)s
|
||||
|
||||
# Option: fwcheck
|
||||
# Notes.: command executed once before each fwban command
|
||||
# Values: CMD Default:
|
||||
#
|
||||
fwcheck = iptables -L %(fwchain)s | grep -q fail2ban-%(__name__)s
|
||||
|
||||
# Option: fwban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <failtime> unix timestamp of the last failure
|
||||
# <bantime> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
# Default: iptables -I INPUT 1 -s <ip> -j DROP
|
||||
#
|
||||
fwban = iptables -I fail2ban-%(__name__)s 1 -s <ip> -j DROP
|
||||
|
||||
# Option: fwunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <bantime> unix timestamp of the ban time
|
||||
# <unbantime> unix timestamp of the unban time
|
||||
# Values: CMD
|
||||
# Default: iptables -D INPUT -s <ip> -j DROP
|
||||
#
|
||||
fwunban = iptables -D fail2ban-%(__name__)s -s <ip> -j DROP
|
||||
|
||||
[MAIL]
|
||||
# Option: enabled
|
||||
# Notes.: enable mail notification when banning an IP address.
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
enabled = false
|
||||
|
||||
# Option: host
|
||||
# Notes.: host running the mail server.
|
||||
# Values: STR Default: localhost
|
||||
#
|
||||
host = localhost
|
||||
|
||||
# Option: port
|
||||
# Notes.: port of the mail server.
|
||||
# Values: INT Default: 25
|
||||
#
|
||||
port = 25
|
||||
|
||||
# Option: user
|
||||
# Notes.: the username for smtp-server if authentification is required.
|
||||
# if user is empty, no authentification is done.
|
||||
# Values: STR Default:
|
||||
#
|
||||
user =
|
||||
|
||||
# Option: password
|
||||
# Notes.: the smtp-user's password if authentification is required.
|
||||
# Values: STR Default:
|
||||
#
|
||||
password =
|
||||
|
||||
# Option: from
|
||||
# Notes.: e-mail address of the sender.
|
||||
# Values: MAIL Default: fail2ban
|
||||
#
|
||||
from = fail2ban@localhost
|
||||
|
||||
# Option: to
|
||||
# Notes.: e-mail addresses of the receiver. Addresses are space
|
||||
# separated.
|
||||
# Values: MAIL Default: root
|
||||
#
|
||||
to = root@localhost
|
||||
|
||||
# Option: localtime
|
||||
# Notes.: report local time (including timezone) or GMT
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
localtime = true
|
||||
|
||||
# Option: subject
|
||||
# Notes.: subject of the e-mail.
|
||||
# Tags: <section> active section (eg ssh, apache, etc)
|
||||
# <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <failtime> unix timestamp of the last failure
|
||||
# Values: TEXT Default: [Fail2Ban] <section>: Banned <ip>
|
||||
#
|
||||
subject = [Fail2Ban] <section>: Banned <ip>
|
||||
|
||||
# Option: message
|
||||
# Notes.: message of the e-mail.
|
||||
# Tags: <section> active section (eg ssh, apache, etc)
|
||||
# <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <failtime> unix timestamp of the last failure
|
||||
# <br> new line
|
||||
# Values: TEXT Default:
|
||||
#
|
||||
message = Hi,<br>
|
||||
The IP <ip> has just been banned by Fail2Ban after
|
||||
<failures> attempts against <section>.<br>
|
||||
Regards,<br>
|
||||
Fail2Ban
|
||||
|
||||
# You can define a new section for each log file to check for
|
||||
# password failure. Each section has to define the following
|
||||
# options: logfile, fwban, fwunban, timeregex, timepattern,
|
||||
# failregex.
|
||||
|
||||
|
||||
[Apache]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
enabled = false
|
||||
|
||||
# Option: logfile
|
||||
# Notes.: logfile to monitor.
|
||||
# Values: FILE Default: /var/log/apache/error.log
|
||||
#
|
||||
logfile = /var/log/apache/error.log
|
||||
|
||||
# Option: port
|
||||
# Notes.: specifies port to monitor
|
||||
# Values: [ NUM | STRING ] Default:
|
||||
#
|
||||
port = http
|
||||
|
||||
# Option: timeregex
|
||||
# Notes.: regex to match timestamp in Apache logfile. For TAI64N format,
|
||||
# use timeregex = @[0-9a-f]{24}
|
||||
# Values: [Wed Jan 05 15:08:01 2005]
|
||||
# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
|
||||
#
|
||||
timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
|
||||
|
||||
# Option: timepattern
|
||||
# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
|
||||
# For TAI64N format, use timepattern = tai64n
|
||||
# Values: TEXT Default: %%a %%b %%d %%H:%%M:%%S %%Y
|
||||
#
|
||||
timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failure messages in the logfile.
|
||||
# Values: TEXT Default: [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
|
||||
#
|
||||
failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
|
||||
|
||||
[ApacheAttacks]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
enabled = false
|
||||
|
||||
# Option: logfile
|
||||
# Notes.: logfile to monitor.
|
||||
# Values: FILE Default: /var/log/apache/access.log
|
||||
#
|
||||
logfile = /var/log/apache/access.log
|
||||
|
||||
# Option: port
|
||||
# Notes.: specifies port to monitor
|
||||
# Values: [ NUM | STRING ] Default:
|
||||
#
|
||||
port = http
|
||||
|
||||
# Option: maxfailures
|
||||
# Notes.: number of failures before IP gets banned.
|
||||
# Values: NUM Default: 5
|
||||
#
|
||||
maxfailures = 2
|
||||
|
||||
# Option: timeregex
|
||||
# Notes.: regex to match timestamp in Apache access logfile.
|
||||
# Values: [19/Feb/2006:08:38:18]
|
||||
# Default: \d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}
|
||||
#
|
||||
timeregex = \d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}
|
||||
|
||||
# Option: timepattern
|
||||
# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
|
||||
# Values: TEXT Default: %%d/%%b/%%Y:%%H:%%M:%%S
|
||||
#
|
||||
timepattern = %%d/%%b/%%Y:%%H:%%M:%%S
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failure messages in the logfile.
|
||||
# Values: TEXT Default: [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
|
||||
#
|
||||
failregex = ^(?P<host>\S*) -.*"GET .*(?:awstats\.pl\?configdir=|index2\.php\?_REQUEST\[option\].*)\|echo.*
|
||||
|
||||
[VSFTPD]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
enabled = false
|
||||
|
||||
# Option: logfile
|
||||
# Notes.: logfile to monitor.
|
||||
# Values: FILE Default: /var/log/secure
|
||||
#
|
||||
logfile = /var/log/vsftpd.log
|
||||
|
||||
# Option: port
|
||||
# Notes.: specifies port to monitor
|
||||
# Values: [ NUM | STRING ] Default:
|
||||
#
|
||||
port = ftp
|
||||
|
||||
# Option: timeregex
|
||||
# Notes.: regex to match timestamp in VSFTPD logfile.
|
||||
# Values: [Mar 7 17:53:28]
|
||||
# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
#
|
||||
timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
|
||||
# Option: timepattern
|
||||
# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
|
||||
# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
#
|
||||
timepattern = %%b %%d %%H:%%M:%%S
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
failregex = FAIL LOGIN
|
||||
|
||||
[SSH]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
# Values: [true | false] Default: true
|
||||
#
|
||||
enabled = true
|
||||
|
||||
# Option: logfile
|
||||
# Notes.: logfile to monitor.
|
||||
# Values: FILE Default: /var/log/auth.log
|
||||
#
|
||||
logfile = /var/log/auth.log
|
||||
|
||||
# Option: port
|
||||
# Notes.: specifies port to monitor
|
||||
# Values: [ NUM | STRING ] Default:
|
||||
#
|
||||
port = ssh
|
||||
|
||||
# Option: timeregex
|
||||
# Notes.: regex to match timestamp in SSH logfile. For TAI64N format,
|
||||
# use timeregex = @[0-9a-f]{24}
|
||||
# Values: [Mar 7 17:53:28]
|
||||
# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
#
|
||||
timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
|
||||
# Option: timepattern
|
||||
# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
|
||||
# For TAI64N format, use timepattern = tai64n
|
||||
# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
#
|
||||
timepattern = %%b %%d %%H:%%M:%%S
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: (?:Authentication failure|Failed (?:keyboard-interactive/pam|password)) for(?: illegal user)? .* from (?:::f{4,6}:)?(?P<host>\S*)
|
||||
#
|
||||
failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
|
||||
314
0.6.1-8/config/fail2ban.conf.shorewall
Normal file
314
0.6.1-8/config/fail2ban.conf.shorewall
Normal file
|
|
@ -0,0 +1,314 @@
|
|||
# Fail2Ban configuration file
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
#
|
||||
# 2005.06.21 modified for readability Iain Lea iain@bricbrac.de
|
||||
|
||||
[DEFAULT]
|
||||
# Option: background
|
||||
# Notes.: start fail2ban as a daemon. Output is redirect to logfile.
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
background = false
|
||||
|
||||
# Option: logtargets
|
||||
# Notes.: log targets. Space separated list of logging targets.
|
||||
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
|
||||
#
|
||||
logtargets = /var/log/fail2ban.log
|
||||
|
||||
# Option: syslog-target
|
||||
# Notes.: where to find syslog facility if logtarget SYSLOG.
|
||||
# Values: SOCKET HOST HOST:PORT Default: /dev/log
|
||||
#
|
||||
syslog-target = /dev/log
|
||||
|
||||
# Option: syslog-facility
|
||||
# Notes.: which syslog facility to use if logtarget SYSLOG.
|
||||
# Values: NUM Default: 1
|
||||
#
|
||||
syslog-facility = 1
|
||||
|
||||
# Option: pidlock
|
||||
# Notes.: path of the PID lock file (must be able to write to file).
|
||||
# Values: FILE Default: /var/run/fail2ban.pid
|
||||
#
|
||||
pidlock = /var/run/fail2ban.pid
|
||||
|
||||
# Option: maxfailures
|
||||
# Notes.: number of failures before IP gets banned.
|
||||
# Values: NUM Default: 5
|
||||
#
|
||||
maxfailures = 5
|
||||
|
||||
# Option: bantime
|
||||
# Notes.: number of seconds an IP will be banned. If set to a negative
|
||||
# value, IP will never be unbanned (permanent banning).
|
||||
# Values: NUM Default: 600
|
||||
#
|
||||
bantime = 600
|
||||
|
||||
# Option: findtime
|
||||
# Notes.: lifetime in seconds of a "failed" log entry.
|
||||
# Values: NUM Default: 600
|
||||
#
|
||||
findtime = 600
|
||||
|
||||
# Option: ignoreip
|
||||
# Notes.: space separated list of IP's to be ignored by fail2ban.
|
||||
# You can use CIDR mask in order to specify a range.
|
||||
# Example: ignoreip = 192.168.0.1/24 123.45.235.65
|
||||
# Values: IP Default:
|
||||
#
|
||||
ignoreip =
|
||||
|
||||
# Option: cmdstart
|
||||
# Notes.: command executed once at the start of Fail2Ban
|
||||
# Values: CMD Default:
|
||||
#
|
||||
cmdstart =
|
||||
|
||||
# Option: cmdend
|
||||
# Notes.: command executed once at the end of Fail2Ban.
|
||||
# Values: CMD Default:
|
||||
#
|
||||
cmdend =
|
||||
|
||||
# Option: polltime
|
||||
# Notes.: number of seconds fail2ban sleeps between iterations.
|
||||
# Values: NUM Default: 1
|
||||
#
|
||||
polltime = 1
|
||||
|
||||
# Option: reinittime
|
||||
# Notes.: minimal number of seconds between the re-initialization of
|
||||
# firewalls due to external changes in their rules (see fwcheck)
|
||||
# Values: NUM Default: 100
|
||||
#
|
||||
reinittime = 10
|
||||
|
||||
# Option: maxreinits
|
||||
# Notes.: maximal number of re-initialization of firewalls due to external
|
||||
# changes. -1 stays for infinite, so only reinittime is of importance
|
||||
# Values: NUM Default: -1
|
||||
#
|
||||
maxreinits = 1000
|
||||
|
||||
# NOTE: Interpolations
|
||||
#
|
||||
# fwstart, as well as fwend, fwcheck, fwban, fwunban, use interpolations
|
||||
# so %(__name__)s will be substituted by a name of each section
|
||||
# (unless the option is overriden in a section).
|
||||
# If you are going to use interpolations in your setup, please make
|
||||
# sure that you specified options port and protocol (which also has
|
||||
# an option in DEFAULT).
|
||||
#
|
||||
|
||||
# Option: fwban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <failtime> unix timestamp of the last failure
|
||||
# <bantime> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
# Default: iptables -I INPUT 1 -s <ip> -j DROP
|
||||
#
|
||||
fwban = shorewall drop <ip>
|
||||
|
||||
# Option: fwunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <bantime> unix timestamp of the ban time
|
||||
# <unbantime> unix timestamp of the unban time
|
||||
# Values: CMD
|
||||
# Default: iptables -D INPUT -s <ip> -j DROP
|
||||
#
|
||||
fwunban = shorewall allow <ip>
|
||||
|
||||
[MAIL]
|
||||
# Option: enabled
|
||||
# Notes.: enable mail notification when banning an IP address.
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
enabled = false
|
||||
|
||||
# Option: host
|
||||
# Notes.: host running the mail server.
|
||||
# Values: STR Default: localhost
|
||||
#
|
||||
host = localhost
|
||||
|
||||
# Option: port
|
||||
# Notes.: port of the mail server.
|
||||
# Values: INT Default: 25
|
||||
#
|
||||
port = 25
|
||||
|
||||
# Option: user
|
||||
# Notes.: the username for smtp-server if authentification is required.
|
||||
# if user is empty, no authentification is done.
|
||||
# Values: STR Default:
|
||||
#
|
||||
user =
|
||||
|
||||
# Option: password
|
||||
# Notes.: the smtp-user's password if authentification is required.
|
||||
# Values: STR Default:
|
||||
#
|
||||
password =
|
||||
|
||||
# Option: from
|
||||
# Notes.: e-mail address of the sender.
|
||||
# Values: MAIL Default: fail2ban
|
||||
#
|
||||
from = fail2ban
|
||||
|
||||
# Option: to
|
||||
# Notes.: e-mail addresses of the receiver. Addresses are space
|
||||
# separated.
|
||||
# Values: MAIL Default: root
|
||||
#
|
||||
to = root
|
||||
|
||||
# Option: localtime
|
||||
# Notes.: report local time (including timezone) or GMT
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
localtime = true
|
||||
|
||||
# Option: subject
|
||||
# Notes.: subject of the e-mail.
|
||||
# Tags: <section> active section (eg ssh, apache, etc)
|
||||
# <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <failtime> unix timestamp of the last failure
|
||||
# Values: TEXT Default: [Fail2Ban] <section>: Banned <ip>
|
||||
#
|
||||
subject = [Fail2Ban] <section>: Banned <ip>
|
||||
|
||||
# Option: message
|
||||
# Notes.: message of the e-mail.
|
||||
# Tags: <section> active section (eg ssh, apache, etc)
|
||||
# <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <failtime> unix timestamp of the last failure
|
||||
# <br> new line
|
||||
# Values: TEXT Default:
|
||||
#
|
||||
message = Hi,<br>
|
||||
The IP <ip> has just been banned by Fail2Ban after
|
||||
<failures> attempts against <section>.<br>
|
||||
Regards,<br>
|
||||
Fail2Ban
|
||||
|
||||
# You can define a new section for each log file to check for
|
||||
# password failure. Each section has to define the following
|
||||
# options: logfile, fwban, fwunban, timeregex, timepattern,
|
||||
# failregex.
|
||||
|
||||
|
||||
[Apache]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
enabled = false
|
||||
|
||||
# Option: logfile
|
||||
# Notes.: logfile to monitor.
|
||||
# Values: FILE Default: /var/log/httpd/access_log
|
||||
#
|
||||
logfile = /var/log/httpd/access_log
|
||||
|
||||
# Option: timeregex
|
||||
# Notes.: regex to match timestamp in Apache logfile. For TAI64N format,
|
||||
# use timeregex = @[0-9a-f]{24}
|
||||
# Values: [Wed Jan 05 15:08:01 2005]
|
||||
# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
|
||||
#
|
||||
timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
|
||||
|
||||
# Option: timepattern
|
||||
# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
|
||||
# For TAI64N format, use timepattern = tai64n
|
||||
# Values: TEXT Default: %%a %%b %%d %%H:%%M:%%S %%Y
|
||||
#
|
||||
timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failure messages in the logfile.
|
||||
# Values: TEXT Default: authentication failure|user .* not found
|
||||
#
|
||||
failregex = authentication failure|user .* not found
|
||||
|
||||
[VSFTPD]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
# Values: [true | false] Default: false
|
||||
#
|
||||
enabled = false
|
||||
|
||||
# Option: logfile
|
||||
# Notes.: logfile to monitor.
|
||||
# Values: FILE Default: /var/log/secure
|
||||
#
|
||||
logfile = /var/log/vsftpd.log
|
||||
|
||||
# Option: timeregex
|
||||
# Notes.: regex to match timestamp in VSFTPD logfile.
|
||||
# Values: [Mar 7 17:53:28]
|
||||
# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
#
|
||||
timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
|
||||
# Option: timepattern
|
||||
# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
|
||||
# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
#
|
||||
timepattern = %%b %%d %%H:%%M:%%S
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
failregex = FAIL LOGIN
|
||||
|
||||
|
||||
[SSH]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
# Values: [true | false] Default: true
|
||||
#
|
||||
enabled = true
|
||||
|
||||
# Option: logfile
|
||||
# Notes.: logfile to monitor.
|
||||
# Values: FILE Default: /var/log/secure
|
||||
#
|
||||
logfile = /var/log/secure
|
||||
|
||||
# Option: timeregex
|
||||
# Notes.: regex to match timestamp in SSH logfile. For TAI64N format,
|
||||
# use timeregex = @[0-9a-f]{24}
|
||||
# Values: [Mar 7 17:53:28]
|
||||
# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
#
|
||||
timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
|
||||
# Option: timepattern
|
||||
# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
|
||||
# For TAI64N format, use timepattern = tai64n
|
||||
# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
#
|
||||
timepattern = %%b %%d %%H:%%M:%%S
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
failregex = Authentication failure|Failed password|Invalid user
|
||||
10
0.6.1-8/config/fail2ban.logrotate
Normal file
10
0.6.1-8/config/fail2ban.logrotate
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
/var/log/fail2ban.log {
|
||||
weekly
|
||||
rotate 4
|
||||
compress
|
||||
missingok
|
||||
postrotate
|
||||
/etc/init.d/fail2ban restart >/dev/null
|
||||
endscript
|
||||
create 640 root adm
|
||||
}
|
||||
23
0.6.1-8/config/gentoo-confd
Normal file
23
0.6.1-8/config/gentoo-confd
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
|
||||
# Command line options for Fail2Ban. Refer to "fail2ban -h" for
|
||||
# valid options.
|
||||
FAIL2BAN_OPTS=""
|
||||
50
0.6.1-8/config/gentoo-initd
Executable file
50
0.6.1-8/config/gentoo-initd
Executable file
|
|
@ -0,0 +1,50 @@
|
|||
#!/sbin/runscript
|
||||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
#
|
||||
# Author: Sireyessire, Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
|
||||
opts="start stop restart showlog"
|
||||
|
||||
FAIL2BAN="/usr/bin/fail2ban"
|
||||
|
||||
depend() {
|
||||
need net
|
||||
need logger
|
||||
after iptables
|
||||
}
|
||||
|
||||
start() {
|
||||
ebegin "Starting fail2ban"
|
||||
${FAIL2BAN} -b ${FAIL2BAN_OPTS} > /dev/null
|
||||
eend $? "Failed to start fail2ban"
|
||||
}
|
||||
|
||||
stop() {
|
||||
ebegin "Stopping fail2ban"
|
||||
${FAIL2BAN} -k > /dev/null
|
||||
eend $? "Failed to stop fail2ban"
|
||||
}
|
||||
|
||||
zap() {
|
||||
rm /var/run/fail2ban.pid
|
||||
}
|
||||
|
||||
showlog(){
|
||||
less /var/log/fail2ban.log
|
||||
}
|
||||
78
0.6.1-8/config/redhat-initd
Normal file
78
0.6.1-8/config/redhat-initd
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# fail2ban
|
||||
#
|
||||
# chkconfig: 345 91 9
|
||||
# description: if many unsuccessfull login attempts from some ip address \
|
||||
# during a short period happen, this address is banned \
|
||||
# by the firewall
|
||||
#
|
||||
# Author: Andrey G. Grozin
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
|
||||
# Source function library.
|
||||
. /etc/init.d/functions
|
||||
|
||||
# Get config.
|
||||
. /etc/sysconfig/network
|
||||
|
||||
# Check that networking is up.
|
||||
[ "${NETWORKING}" = "no" ] && exit 0
|
||||
[ -f /etc/fail2ban.conf ] || exit 0
|
||||
|
||||
FAIL2BAN="/usr/bin/fail2ban"
|
||||
PIDFILE="/var/run/fail2ban.pid"
|
||||
|
||||
RETVAL=0
|
||||
|
||||
start() {
|
||||
echo -n $"Starting fail2ban: "
|
||||
"${FAIL2BAN}" -b > /dev/null
|
||||
RETVAL=$?
|
||||
echo
|
||||
}
|
||||
|
||||
stop() {
|
||||
if [ -f "${PIDFILE}" ]; then
|
||||
echo -n $"Stopping fail2ban: "
|
||||
"${FAIL2BAN}" -k > /dev/null
|
||||
echo
|
||||
fi
|
||||
}
|
||||
|
||||
restart() {
|
||||
stop
|
||||
start
|
||||
}
|
||||
|
||||
# See how we were called.
|
||||
case "$1" in
|
||||
start)
|
||||
start
|
||||
;;
|
||||
stop)
|
||||
stop
|
||||
;;
|
||||
status)
|
||||
status fail2ban
|
||||
RETVAL=$?
|
||||
;;
|
||||
reload)
|
||||
restart
|
||||
;;
|
||||
restart)
|
||||
restart
|
||||
;;
|
||||
condrestart)
|
||||
if [ -f "${PIDFILE}" ]; then
|
||||
restart
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
echo $"Usage: $0 {start|stop|status|restart|condrestart}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
25
0.6.1-8/confreader/__init__.py
Normal file
25
0.6.1-8/confreader/__init__.py
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.1 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.1 $"
|
||||
__date__ = "$Date: 2005/02/18 13:26:41 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
94
0.6.1-8/confreader/configreader.py
Normal file
94
0.6.1-8/confreader/configreader.py
Normal file
|
|
@ -0,0 +1,94 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.6 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.6 $"
|
||||
__date__ = "$Date: 2005/11/20 17:07:47 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
import logging
|
||||
|
||||
from ConfigParser import *
|
||||
|
||||
# Gets the instance of the logger.
|
||||
logSys = logging.getLogger("fail2ban")
|
||||
|
||||
class ConfigReader:
|
||||
""" This class allow the handling of the configuration options.
|
||||
The DEFAULT section contains the global information about
|
||||
Fail2Ban. Each other section is for a different log file.
|
||||
"""
|
||||
|
||||
def __init__(self, confPath):
|
||||
self.confPath = confPath
|
||||
self.configParser = SafeConfigParser()
|
||||
|
||||
def openConf(self):
|
||||
""" Opens the configuration file.
|
||||
"""
|
||||
self.configParser.read(self.confPath)
|
||||
|
||||
def getSections(self):
|
||||
""" Returns all the sections present in the configuration
|
||||
file except the DEFAULT and MAIL sections.
|
||||
"""
|
||||
sections = self.configParser.sections()
|
||||
sections.remove("MAIL")
|
||||
logSys.debug("Found sections: " + `sections`)
|
||||
return sections
|
||||
|
||||
def setValue(self, sec, label, value):
|
||||
""" Override a value for a section
|
||||
"""
|
||||
self.configParser.set(sec, label, value)
|
||||
|
||||
|
||||
# Each optionValues entry is composed of an array with:
|
||||
# 0 -> the type of the option
|
||||
# 1 -> the name of the option
|
||||
# 2 -> the default value for the option
|
||||
def getLogOptions(self, sec, options):
|
||||
""" Gets all the options of a given section. The options
|
||||
are defined in the optionValues list.
|
||||
"""
|
||||
values = dict()
|
||||
for option in options:
|
||||
try:
|
||||
if option[0] == "bool":
|
||||
v = self.configParser.getboolean(sec, option[1])
|
||||
elif option[0] == "int":
|
||||
v = self.configParser.getint(sec, option[1])
|
||||
else:
|
||||
v = self.configParser.get(sec, option[1])
|
||||
|
||||
values[option[1]] = v
|
||||
logSys.debug("%s: Accepted value %s=%s"%(
|
||||
sec, option[1], `v`))
|
||||
except NoOptionError:
|
||||
logSys.warn("No '" + option[1] + "' defined in '" + sec +
|
||||
"'. Using default one: '" + `option[2]` + "'")
|
||||
values[option[1]] = option[2]
|
||||
except ValueError:
|
||||
logSys.warn("Wrong value for '" + option[1] + "' in '" + sec +
|
||||
"'. Using default one: '" + `option[2]` + "'")
|
||||
values[option[1]] = option[2]
|
||||
return values
|
||||
|
||||
10
0.6.1-8/debian/NEWS
Normal file
10
0.6.1-8/debian/NEWS
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
fail2ban (0.6.0-4) unstable; urgency=low
|
||||
|
||||
In this version the new section ApacheAttacks was introduced to ban IPs
|
||||
which are found to run some known attack on the host. For now it captures
|
||||
just awstats and mambo related attacks. To make this feature work, the bug of
|
||||
wrongly specified timeregexp for Apache's access.log file was fixed.
|
||||
Besides that group of log files has changed to be adm, and now they are
|
||||
readable by the group.
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Fri, 10 Feb 2006 13:05:07 -0500
|
||||
117
0.6.1-8/debian/README.Debian
Normal file
117
0.6.1-8/debian/README.Debian
Normal file
|
|
@ -0,0 +1,117 @@
|
|||
fail2ban for Debian
|
||||
-------------------
|
||||
|
||||
This package is ~95% identical to the upstream version. Few features
|
||||
could have been added but not yet propagated into upstream version and
|
||||
some modifications might be Debian-specific (logsys logging
|
||||
format). And although due to tight collaboration with upstream author
|
||||
most of the Debian modifications penetrate into the next upstream, few
|
||||
features present in Debian release were rejected by the upstream
|
||||
author (-e option for instance).
|
||||
|
||||
Currently, the major difference with upstream: python libraries are
|
||||
placed under /usr/share/fail2ban instead of /usr/lib/fail2ban to
|
||||
comply with policy regarding architecture independent resources.
|
||||
|
||||
Also the main config file /etc/fail2ban.conf is a copy of
|
||||
/usr/share/doc/examples/fail2ban.conf.iptables. There are config files
|
||||
for banning via shorewall or hosts.deny are provided BUT they might
|
||||
miss additional sections present in fail2ban.conf. Please copy them
|
||||
taking care about added sections. Those files will be obsolete in the
|
||||
next release which would handle split configuration files.
|
||||
|
||||
Default behavior:
|
||||
-----------------
|
||||
|
||||
Only handling of ssh files is enabled by default. If you want to use
|
||||
fail2ban with apache, please enable apache section manually in
|
||||
/etc/fail2ban.conf or enable section using command line parameter -e
|
||||
in /etc/default/fail2ban to avoid conflicts during upgrade of the
|
||||
config file.
|
||||
|
||||
N.B. '-e' command line parameter is present solely in Debian release
|
||||
of fail2ban, thus it will not work if you decided to proceed with
|
||||
vanilla upstream.
|
||||
|
||||
Troubleshooting:
|
||||
---------------
|
||||
|
||||
* Updated failregex:
|
||||
|
||||
To resolve the security bug #330827 [1] failregex expressions must
|
||||
provide a named group (?P<host>...) as a placeholder of the abuser's
|
||||
host. The naming of the group was introduced to capture possible
|
||||
future generalizations of failregex to provide even more
|
||||
information. At a current point, all named groups are considered as
|
||||
possible locations of the host addresses, but usually you should need
|
||||
just a single group (?P<host>...)
|
||||
|
||||
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=330827
|
||||
|
||||
|
||||
* "Interpolations" in the config file:
|
||||
|
||||
Since version 0.6.0-3 to reduce duplication, thus to improve
|
||||
readability of the config file, interpolations provided by the module
|
||||
ConfigParser are used. If you had custom sections defined before, you
|
||||
might benefit from updating config file and adding appropriate
|
||||
information for the new sections.
|
||||
|
||||
N.B. If you have some nice additional sections defined, I would really
|
||||
appreciate if you share them with me, so they could be eventually
|
||||
included in the fail2ban package for general use by the rest of the
|
||||
community.
|
||||
|
||||
|
||||
* Mailing:
|
||||
|
||||
As it was reported (bug #329722) you might need to provide a full
|
||||
e-mail address in fail2ban.conf option MAIL:from to make your mail
|
||||
server accept that email. I've added @localhost to both MAIL:from and
|
||||
MAIL:to in the default configuration shipped with Debian. It seems to
|
||||
work nicely now
|
||||
|
||||
See TODO.Debian for more details, as well as the Debian Bug Tracking
|
||||
system.
|
||||
|
||||
|
||||
* Dirty exit:
|
||||
|
||||
If firewall rules gets cleaned out before fail2ban exits (like was
|
||||
happening with firestarter), errors get reported during the exit of
|
||||
fail2ban, but they are "safe" and can be ignored.
|
||||
|
||||
|
||||
** SSHD Configuration Specific Problems
|
||||
|
||||
* Ban "Not allowed" attempts:
|
||||
|
||||
Make sure that you have
|
||||
ChallengeResponseAuthentication no
|
||||
PasswordAuthentication yes
|
||||
|
||||
Details from the bug report #350980 [2]
|
||||
|
||||
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350980
|
||||
|
||||
|
||||
* Not caught attempts to login as root
|
||||
|
||||
On the boxes running older versions of openssh (e.g. sarge
|
||||
distribution) in the case when PermitRootLogin is set to something
|
||||
else than "yes" and iff AllowUsers is active, failed root logins do
|
||||
not confirm to the standard logging message -- they omit the source
|
||||
IP, thus allowing attack to persist since such messages are not caught
|
||||
by fail2ban.
|
||||
|
||||
|
||||
* Bantime:
|
||||
|
||||
An IP is banned for "bantime" not since the last failed login attempt
|
||||
from the IP, but rather since the moment when failed login was
|
||||
detected by fail2ban. Thus, if fail2ban gets [re]started, any IP which
|
||||
had enough of failed logins within "findtime" will be banned for
|
||||
"bantime" since [re]start moment, not since the last failed login
|
||||
time.
|
||||
|
||||
-- Yaroslav O. Halchenko <debian@onerussian.com>, Sun, 19 Mar 2006 00:27:22 -0500
|
||||
7
0.6.1-8/debian/TODO
Normal file
7
0.6.1-8/debian/TODO
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
* Collect more sections for other log files
|
||||
* Compose a filter for logwatch (almost done -- testing, submission)
|
||||
* In the next release split file configuration will be implemented,
|
||||
that is why no split files is enabled for current release
|
||||
(as of v0.6.1 Sun Mar 19 00:18:08 EST 2006)
|
||||
|
||||
-- Yaroslav O. Halchenko <debian@onerussian.com>, Sun Jan 15 15:18:13 2006
|
||||
342
0.6.1-8/debian/changelog
Normal file
342
0.6.1-8/debian/changelog
Normal file
|
|
@ -0,0 +1,342 @@
|
|||
fail2ban (0.6.1-7bpo2) sarge-backports; urgency=low
|
||||
|
||||
* Backported build of Debian package version 0.6.1-8 by pbuilder-ssh
|
||||
(v.0.2.63).
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Fri, 16 Jun 2006 14:42:27 -0400
|
||||
|
||||
fail2ban (0.6.1-8) unstable; urgency=low
|
||||
|
||||
* Removed bashism (arrays) from init.d script to make it POSIX shell
|
||||
complient (closes: #368218)
|
||||
* Added new proftpd section
|
||||
* Added new saslauthd section. Thanks to martin f krafft
|
||||
<madduck@debian.org> (closes: #369483)
|
||||
* Mentioned apache2 log file in Other. comment field for FILE in
|
||||
apache section. Nothing has to be changed besides the logfile path to
|
||||
work with apache2 (closes: #342144)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Mon, 22 May 2006 15:37:17 -0400
|
||||
|
||||
fail2ban (0.6.1-5) unstable; urgency=low
|
||||
|
||||
* Further fixed debian packaging: to comply with policy empty target
|
||||
binary-arch was provided
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Tue, 16 May 2006 16:43:37 -0400
|
||||
|
||||
fail2ban (0.6.1-4) unstable; urgency=low
|
||||
|
||||
* Adjusted debian packaging:
|
||||
- Clean up of debian/rules: removed commented out dh_ scripts which
|
||||
definetly will never be used
|
||||
- debhelper and dpatch moved to Build-Depends
|
||||
- added --no-compile for python setup.py install, and removed explicit
|
||||
cleaning of .pyc's
|
||||
- fixed separation binary-indep and binary-arch in debian/rules
|
||||
- restricted depends on python >= 2.3
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Tue, 16 May 2006 15:53:06 -0400
|
||||
|
||||
fail2ban (0.6.1-3) unstable; urgency=low
|
||||
|
||||
* Fixed vsftpd failregexp (closes: #366687)
|
||||
* Started to use dpatch
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Wed, 10 May 2006 11:45:57 -0400
|
||||
|
||||
fail2ban (0.6.1-2) unstable; urgency=low
|
||||
|
||||
* Assigned maxreinits to 1000 to be reasonable since otherwise logfile grows
|
||||
indefinetly if there is a real problem on the system (closes: #359218)
|
||||
* Adjusted debian/{copyright,watch}
|
||||
* New version of init.d script (Thanks to Aaron Isotton) (closes: #364278)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Mon, 27 Mar 2006 12:55:39 -0500
|
||||
|
||||
fail2ban (0.6.1-1) unstable; urgency=low
|
||||
|
||||
* New upstream release
|
||||
* In config file added fwchain to ease switching to another input chain
|
||||
(closes: #357164)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Sat, 18 Mar 2006 23:11:53 -0500
|
||||
|
||||
fail2ban (0.6.0-8) unstable; urgency=low
|
||||
|
||||
* Minor adjustments to reduce the deviation from the upstream code
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Sat, 11 Mar 2006 00:48:14 -0500
|
||||
|
||||
fail2ban (0.6.0-7) unstable; urgency=low
|
||||
|
||||
* Fixed a typo in failregex for SSH section (closes: #356112)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Thu, 9 Mar 2006 15:13:48 -0500
|
||||
|
||||
fail2ban (0.6.0-6) unstable; urgency=low
|
||||
|
||||
* Updated README.Debian with information about some cases with
|
||||
not-as-shipped configurations of sshd on the boxes running older versions
|
||||
of openssh server
|
||||
* Included regexps for SSH in case iff authentication as root using keys was
|
||||
attempted whenever PermitRootLogin is set to something else than "yes" and
|
||||
key authentication fails
|
||||
* Included postrm script to remove log files during purge to comply with
|
||||
policy 10.8 (closes: #355443)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Fri, 3 Mar 2006 16:32:38 -0500
|
||||
|
||||
fail2ban (0.6.0-5) unstable; urgency=low
|
||||
|
||||
* Fixed Apache section: changed filepath to point at error.log, thus I had
|
||||
to revert timeregex and timepattern to user RFC 2822 format (closes:
|
||||
#354346)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Sat, 25 Feb 2006 19:56:46 -0500
|
||||
|
||||
fail2ban (0.6.0-4) unstable; urgency=low
|
||||
|
||||
* Modifications in README.Debian to reflect a "finding" on
|
||||
not-AllowedUsers banning which requires default Debian configuration
|
||||
of "ChallengeResponseAuthentication no" and "PasswordAuthentication
|
||||
yes"
|
||||
* Fixed Apache timeregex and timepattern to confirm
|
||||
the fomat of time stamp used in Debian's acccess.log (error.log uses
|
||||
RFC 2822 format)
|
||||
* Added section ApacheAttacks to specify some common patterns of attacks on
|
||||
a webserver (awstats.pl as a try). This section stays split from Apache
|
||||
since it is of different nature and might be not appropriate for some
|
||||
users
|
||||
* Forced owner/permissions of log file to be root:adm/640 in postinst and
|
||||
logrotate (closes: #352053)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Mon, 16 Jan 2006 04:05:19 -0500
|
||||
|
||||
fail2ban (0.6.0-3) unstable; urgency=low
|
||||
|
||||
* ignoreip is now empty by default (closes: #347766)
|
||||
* increased verbosity in verbose=2 mode: now prints options accepted
|
||||
from the config file
|
||||
* to make fail2ban.conf more compact, thus to improve its readability,
|
||||
fail2ban.conf was converted to use "interpolations" provided by
|
||||
ConfigParser class. fw{start,end,{,un}ban} options were moved into
|
||||
DEFAULT section and required options (port, protocol) were added
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Thu, 12 Jan 2006 18:32:14 -0500
|
||||
|
||||
fail2ban (0.6.0-2) unstable; urgency=low
|
||||
|
||||
* fail2ban path is inserted first in the list to avoid a conflict with
|
||||
existing elsewhere modules with the same names. (Thanks for report and
|
||||
patch to Nick Craig-Wood) (closes: #343821)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Mon, 19 Dec 2005 17:44:58 +0200
|
||||
|
||||
fail2ban (0.6.0-1) unstable; urgency=low
|
||||
|
||||
* Merged with the latest stable upstream release. That incure some
|
||||
changes for the Debian configuration of the package to be more
|
||||
upstream-like. Visible one is: subject in the sent email includes
|
||||
section outside of "[Fail2Ban]"
|
||||
* Updated README.Debian to answer possible question regarding effective
|
||||
bantime starting moment
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Sun, 20 Nov 2005 14:56:41 -0500
|
||||
|
||||
fail2ban (0.5.4-10) unstable; urgency=low
|
||||
|
||||
* Fixed the order of ssh and apache rules to avoid possible race
|
||||
condition (Thanks to Jefferson Cowart for the bug report) (closes:
|
||||
#339133)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Mon, 14 Nov 2005 23:44:45 -0500
|
||||
|
||||
fail2ban (0.5.4-9) unstable; urgency=low
|
||||
|
||||
* Fixed init.d script so it doesn't return non-0 status if fail2ban is not
|
||||
running. That fixes issues with purging the package and leaving garbage in
|
||||
/usr/share/fail2ban (Thanx to Justin Pryzby for the insight)
|
||||
(closes: #337223)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Thu, 3 Nov 2005 17:05:20 -0500
|
||||
|
||||
fail2ban (0.5.4-8) unstable; urgency=low
|
||||
|
||||
* Added config option MAIL.localtime (closes: #336449)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Mon, 31 Oct 2005 16:53:19 -0500
|
||||
|
||||
fail2ban (0.5.4-7) unstable; urgency=low
|
||||
|
||||
* Adjusted init.d script so it is resistant to delayed shutdowns of
|
||||
fail2ban and in general more stable
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Thu, 20 Oct 2005 21:22:03 -0400
|
||||
|
||||
fail2ban (0.5.4-6.2) unstable; urgency=low
|
||||
|
||||
* Fixed typos (thanx to Ross Boylan).
|
||||
* Robust startup: if iptables module gets fully initialized after
|
||||
startup of fail2ban, fail2ban will do "maxreinit" attempts to
|
||||
initialize its own firewall. It will sleep between attempts for
|
||||
"polltime" number of seconds (closes: #334272).
|
||||
* To overcome possible conflict with other firewall solutions and as a
|
||||
secondary solution for the bug 334272, fail2ban startup is moved
|
||||
during bootup to the latest (S99) sequenece position. That should not
|
||||
cause any discomfort I believe.
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Tue, 18 Oct 2005 15:54:38 -0400
|
||||
|
||||
fail2ban (0.5.4-5.14) unstable; urgency=low
|
||||
|
||||
* Added a notification regarding the importance of 0.5.4-5 change of
|
||||
failregex in the config file.
|
||||
* Adjusted address to FSF.
|
||||
* Adjusted failregex for SSH so it bans "Illegal user" entries as well, and
|
||||
restricted full failregex more to include ":" at the beginning, because
|
||||
otherwise it might not be sufficient and would revive bug 330827 (closes:
|
||||
#333056).
|
||||
* Adjusted failregex for SSH to accommodate recent changes in logging of
|
||||
SSH: Illegal -> Invalid. Should match both now.
|
||||
* Fixed a problem of raise AttributeError exception reported as a side
|
||||
effect of crash during parsing of the config file.
|
||||
* Introduced fwcheck option to verify consistency of the
|
||||
chains. Implemented automatic restart of fail2ban main function in
|
||||
case check of fwban or fwunban command failed (closes: #329163, #331695).
|
||||
(Introduced patch was further adjusted by upstream author).
|
||||
* Added -f command line parameter for [findtime].
|
||||
* Fixed the issue of not respecting command line parameters for parameters
|
||||
within sections.
|
||||
* Added -e command line parameter to provide enabled sections from command
|
||||
line.
|
||||
* Added a cleanup of firewall rules on emergency shutdown when unknown
|
||||
exception is catched.
|
||||
* Fail2ban should not crash now if a wrong file name is specified in
|
||||
config.
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Mon, 3 Oct 2005 22:26:28 -1000
|
||||
|
||||
fail2ban (0.5.4-5) unstable; urgency=low
|
||||
|
||||
* Made failregex'es more specific to don't allow usernames to be used as a
|
||||
tool for denial of service attacks. Config files (or at least
|
||||
failregex'es) must be updated from this package, otherwise the security
|
||||
breach would remain open and only warning gets issued (closes: #330827)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Sat, 1 Oct 2005 02:42:23 -1000
|
||||
|
||||
fail2ban (0.5.4-4) unstable; urgency=low
|
||||
|
||||
* On a request from Calum Mackay added reporting of the enabled sections
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Thu, 29 Sep 2005 11:20:43 -1000
|
||||
|
||||
fail2ban (0.5.4-3) unstable; urgency=low
|
||||
|
||||
* Resolved the mystery of debug mode in which commands are not really
|
||||
executed: added verbose option to config file, removed -v from
|
||||
/etc/default/fail2ban, reordered code a bit so that log targets are
|
||||
setup right after background and then only loglevel (verbose,debug) is
|
||||
processed, so the warning could be seen in the logs
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Thu, 29 Sep 2005 00:20:43 -1000
|
||||
|
||||
fail2ban (0.5.4-2) unstable; urgency=low
|
||||
|
||||
* Now exporting PATH explicitely in init.d/fail2ban script, to avoid
|
||||
problems finding iptables in the cases when PATH was not exported outside
|
||||
(cfengine, broken shell environment) (closes: #329304)
|
||||
* Removed -b from start-stop-daemon because fail2ban detahes on its own
|
||||
* Added @localhost to MAIL:from and MAIL:to in fail2ban.conf and placed
|
||||
a note to README.Debian regarding necessity to specify full email
|
||||
address in MAIL:from (closes: #329722)
|
||||
* Added a keyword <section> in parsing of the subject and the body of an
|
||||
email sent out by fail2ban (closes: #330311)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Wed, 27 Sep 2005 08:09:06 -0400
|
||||
|
||||
fail2ban (0.5.4-1) unstable; urgency=low
|
||||
|
||||
* New upstream release
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Tue, 20 Sep 2005 12:19:19 -0400
|
||||
|
||||
fail2ban (0.5.3-2) unstable; urgency=low
|
||||
|
||||
* Refined comments in README.Debian
|
||||
* Reindented init.d script
|
||||
P.S. Was not released
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Sun, 11 Sep 2005 15:19:44 -0400
|
||||
|
||||
fail2ban (0.5.3-1) unstable; urgency=low
|
||||
|
||||
* New upstream release
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Fri, 9 Sep 2005 16:55:00 -0400
|
||||
|
||||
fail2ban (0.5.2-5) unstable; urgency=low
|
||||
|
||||
* Included a patch from Stephen Gildea to provide "status" report by
|
||||
init.d script
|
||||
* Included a note in README.Debian regarding the fail2ban iptable's
|
||||
chains
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Fri, 9 Sep 2005 14:52:24 -0400
|
||||
|
||||
fail2ban (0.5.2-4) unstable; urgency=low
|
||||
|
||||
* Format of SYSLOG entries is up to the standard now
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Fri, 19 Aug 2005 00:06:44 -1000
|
||||
|
||||
fail2ban (0.5.2-3) unstable; urgency=low
|
||||
|
||||
* Fixed errata in /etc/default/fail2ban (closes: #323451)
|
||||
* Fixed handling of SYSLOG logging target. Now it can log to any syslog
|
||||
target and facility as directed by the config (revisions 160:166 patch
|
||||
from syslog branch) (closes: #323543)
|
||||
* Included upstream README and TODO
|
||||
* Mentioned in README.Debian that apache section is disabled by default
|
||||
* Adjusted man pages to cross-reference each other
|
||||
* Moved fail2ban man page under section 8 as in upstream
|
||||
* Introduced findtime configuration variable to control the lifetime
|
||||
of caught "failed" log entries (closes: #323840)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Tue, 16 Aug 2005 11:23:28 -1000
|
||||
|
||||
fail2ban (0.5.2-2) unstable; urgency=low
|
||||
|
||||
* Updated description to reflect flexibility in application of fail2ban
|
||||
* Included logrotate (Thanks to Baruch Even)
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Sat, 13 Aug 2005 04:51:57 -0400
|
||||
|
||||
fail2ban (0.5.2-1) unstable; urgency=low
|
||||
|
||||
* New upstream release
|
||||
* No log4py any more
|
||||
* removed -i eth0 from config
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Sat, 6 Aug 2005 09:21:07 -1000
|
||||
|
||||
fail2ban (0.5.1-1) unstable; urgency=low
|
||||
|
||||
* New upstream release
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Sat, 23 Jul 2005 08:50:00 -1000
|
||||
|
||||
fail2ban (0.5.0-1) unstable; urgency=low
|
||||
|
||||
* New upstream release
|
||||
* Libraries placed under /usr/share/fail2ban instead of /usr/lib/fail2ban
|
||||
* Corrections to the description of the package
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Tue, 12 Jul 2005 23:33:20 -1000
|
||||
|
||||
fail2ban (0.4.1-1) unstable; urgency=low
|
||||
|
||||
* First upstream release of a Debian package
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Mon, 04 Jul 2005 11:47:23 +0300
|
||||
1
0.6.1-8/debian/compat
Normal file
1
0.6.1-8/debian/compat
Normal file
|
|
@ -0,0 +1 @@
|
|||
4
|
||||
23
0.6.1-8/debian/control
Normal file
23
0.6.1-8/debian/control
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
Source: fail2ban
|
||||
Section: net
|
||||
Priority: optional
|
||||
Maintainer: Yaroslav Halchenko <debian@onerussian.com>
|
||||
Uploaders: Barak Pearlmutter <bap@debian.org>
|
||||
Build-Depends: debhelper (>= 4.1.67), dpatch
|
||||
Build-Depends-Indep: python, python-dev, help2man
|
||||
Standards-Version: 3.7.2
|
||||
|
||||
Package: fail2ban
|
||||
Architecture: all
|
||||
Depends: python (>=2.3), iptables, lsb-base (>=2.0-7)
|
||||
Description: bans IPs that cause multiple authentication errors
|
||||
Monitors (in daemon mode) or just scans log files (e.g. /var/log/auth.log,
|
||||
/var/log/apache/access.log) and temporarily bans failure-prone
|
||||
addresses by updating existing firewall rules. Currently, by default,
|
||||
supports ssh/apache but configuration can be easily extended for scanning
|
||||
the other ASCII log files. Firewall rules are given in the config file,
|
||||
thus it can be adopted to be used with a variety of firewalls (e.g. iptables,
|
||||
ipfwadm).
|
||||
.
|
||||
Homepage: http://www.sourceforge.net/projects/fail2ban
|
||||
|
||||
31
0.6.1-8/debian/copyright
Normal file
31
0.6.1-8/debian/copyright
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
This package was originally debianized by Yaroslav Halchenko
|
||||
<debian@onerussian.com> on Mon Jul 4 14:41:34 HST 2005
|
||||
|
||||
It was downloaded from http://www.sourceforge.net/projects/fail2ban
|
||||
|
||||
Author: Cyril Jaquier: <lostcontrol@users.sourceforge.net>
|
||||
http://fail2ban.sourceforge.net
|
||||
|
||||
Copyright: 2004, 2005, 2006 Cyril Jaquier
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 2 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program; if not, write to the
|
||||
Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
|
||||
MA 02110-1301, USA.
|
||||
|
||||
On Debian systems, the complete text of the GNU General Public
|
||||
License, version 2, can be found in /usr/share/common-licenses/GPL-2.
|
||||
|
||||
The Debian packaging is (C) 2006, Yaroslav Halchenko <debian@onerussian.com>
|
||||
and is licensed under the GPL, see above.
|
||||
|
||||
2
0.6.1-8/debian/docs
Normal file
2
0.6.1-8/debian/docs
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
README
|
||||
TODO
|
||||
160
0.6.1-8/debian/patches/00_proftpd_section.dpatch
Executable file
160
0.6.1-8/debian/patches/00_proftpd_section.dpatch
Executable file
|
|
@ -0,0 +1,160 @@
|
|||
#! /bin/sh /usr/share/dpatch/dpatch-run
|
||||
## 00_proftpd_section.dpatch by <debian@onerussian.com>
|
||||
##
|
||||
## All lines beginning with `## DP:' are a description of the patch.
|
||||
## DP: New section for proftpd
|
||||
|
||||
@DPATCH@
|
||||
|
||||
diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.hostsdeny fail2ban-0.6.1.post/config/fail2ban.conf.hostsdeny
|
||||
--- fail2ban-0.6.1.pre/config/fail2ban.conf.hostsdeny 2006-05-27 22:57:03.000000000 -0400
|
||||
+++ fail2ban-0.6.1.post/config/fail2ban.conf.hostsdeny 2006-05-27 23:01:11.000000000 -0400
|
||||
@@ -291,6 +291,47 @@
|
||||
failregex = FAIL LOGIN
|
||||
|
||||
|
||||
+[PROFTPD]
|
||||
+# Option: enabled
|
||||
+# Notes.: enable monitoring for this section.
|
||||
+# Values: [true | false] Default: false
|
||||
+#
|
||||
+enabled = false
|
||||
+
|
||||
+# Option: logfile
|
||||
+# Notes.: logfile to monitor.
|
||||
+# Values: FILE Default: /var/log/proftpd/proftpd.log
|
||||
+# Other.: /var/log/auth.log
|
||||
+#
|
||||
+logfile = /var/log/proftpd/proftpd.log
|
||||
+
|
||||
+# Option: port
|
||||
+# Notes.: specifies port to monitor
|
||||
+# Values: [ NUM | STRING ] Default: ftp
|
||||
+#
|
||||
+port = ftp
|
||||
+
|
||||
+# Option: timeregex
|
||||
+# Notes.: regex to match timestamp in VSFTPD logfile.
|
||||
+# Values: [Mar 7 17:53:28]
|
||||
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+#
|
||||
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+
|
||||
+# Option: timepattern
|
||||
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
|
||||
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
+#
|
||||
+timepattern = %%b %%d %%H:%%M:%%S
|
||||
+
|
||||
+# Option: failregex
|
||||
+# Notes.: regex to match the password failures messages in the logfile.
|
||||
+# Values: TEXT Default:
|
||||
+#
|
||||
+failregex = USER \S+: no such user found from \S* ?\[(?P<host>\S+)\] to \S+\s*$
|
||||
+
|
||||
+
|
||||
[SSH]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.iptables fail2ban-0.6.1.post/config/fail2ban.conf.iptables
|
||||
--- fail2ban-0.6.1.pre/config/fail2ban.conf.iptables 2006-05-27 22:57:03.000000000 -0400
|
||||
+++ fail2ban-0.6.1.post/config/fail2ban.conf.iptables 2006-05-27 23:01:20.000000000 -0400
|
||||
@@ -385,6 +385,48 @@
|
||||
#
|
||||
failregex = FAIL LOGIN
|
||||
|
||||
+
|
||||
+[PROFTPD]
|
||||
+# Option: enabled
|
||||
+# Notes.: enable monitoring for this section.
|
||||
+# Values: [true | false] Default: false
|
||||
+#
|
||||
+enabled = false
|
||||
+
|
||||
+# Option: logfile
|
||||
+# Notes.: logfile to monitor.
|
||||
+# Values: FILE Default: /var/log/proftpd/proftpd.log
|
||||
+# Other.: /var/log/auth.log
|
||||
+#
|
||||
+logfile = /var/log/proftpd/proftpd.log
|
||||
+
|
||||
+# Option: port
|
||||
+# Notes.: specifies port to monitor
|
||||
+# Values: [ NUM | STRING ] Default: ftp
|
||||
+#
|
||||
+port = ftp
|
||||
+
|
||||
+# Option: timeregex
|
||||
+# Notes.: regex to match timestamp in VSFTPD logfile.
|
||||
+# Values: [Mar 7 17:53:28]
|
||||
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+#
|
||||
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+
|
||||
+# Option: timepattern
|
||||
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
|
||||
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
+#
|
||||
+timepattern = %%b %%d %%H:%%M:%%S
|
||||
+
|
||||
+# Option: failregex
|
||||
+# Notes.: regex to match the password failures messages in the logfile.
|
||||
+# Values: TEXT Default:
|
||||
+#
|
||||
+failregex = USER \S+: no such user found from \S* ?\[(?P<host>\S+)\] to \S+\s*$
|
||||
+
|
||||
+
|
||||
[SSH]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.shorewall fail2ban-0.6.1.post/config/fail2ban.conf.shorewall
|
||||
--- fail2ban-0.6.1.pre/config/fail2ban.conf.shorewall 2006-05-27 22:57:03.000000000 -0400
|
||||
+++ fail2ban-0.6.1.post/config/fail2ban.conf.shorewall 2006-05-27 23:00:32.000000000 -0400
|
||||
@@ -277,6 +277,45 @@
|
||||
#
|
||||
failregex = FAIL LOGIN
|
||||
|
||||
+[PROFTPD]
|
||||
+# Option: enabled
|
||||
+# Notes.: enable monitoring for this section.
|
||||
+# Values: [true | false] Default: false
|
||||
+#
|
||||
+enabled = false
|
||||
+
|
||||
+# Option: logfile
|
||||
+# Notes.: logfile to monitor.
|
||||
+# Values: FILE Default: /var/log/proftpd/proftpd.log
|
||||
+# Other.: /var/log/auth.log
|
||||
+#
|
||||
+logfile = /var/log/proftpd/proftpd.log
|
||||
+
|
||||
+# Option: port
|
||||
+# Notes.: specifies port to monitor
|
||||
+# Values: [ NUM | STRING ] Default: ftp
|
||||
+#
|
||||
+port = ftp
|
||||
+
|
||||
+# Option: timeregex
|
||||
+# Notes.: regex to match timestamp in VSFTPD logfile.
|
||||
+# Values: [Mar 7 17:53:28]
|
||||
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+#
|
||||
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+
|
||||
+# Option: timepattern
|
||||
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
|
||||
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
+#
|
||||
+timepattern = %%b %%d %%H:%%M:%%S
|
||||
+
|
||||
+# Option: failregex
|
||||
+# Notes.: regex to match the password failures messages in the logfile.
|
||||
+# Values: TEXT Default:
|
||||
+#
|
||||
+failregex = USER \S+: no such user found from \S* ?\[(?P<host>\S+)\] to \S+\s*$
|
||||
|
||||
[SSH]
|
||||
# Option: enabled
|
||||
44
0.6.1-8/debian/patches/00_vsftpd_regexp.dpatch
Executable file
44
0.6.1-8/debian/patches/00_vsftpd_regexp.dpatch
Executable file
|
|
@ -0,0 +1,44 @@
|
|||
#! /bin/sh /usr/share/dpatch/dpatch-run
|
||||
## 00_vsftpd_regexp.dpatch by <debian@onerussian.com>
|
||||
##
|
||||
## All lines beginning with `## DP:' are a description of the patch.
|
||||
## DP: Fix of debian bug #366687: strict regexp for vsftpd
|
||||
|
||||
@DPATCH@
|
||||
|
||||
diff -rNu fail2ban-0.6.1.orig/config/fail2ban.conf.iptables fail2ban-0.6.1.fixed/config/fail2ban.conf.iptables
|
||||
--- fail2ban-0.6.1.orig/config/fail2ban.conf.iptables 2006-03-27 12:56:38.000000000 -0500
|
||||
+++ fail2ban-0.6.1.fixed/config/fail2ban.conf.iptables 2006-05-10 13:47:40.000000000 -0400
|
||||
@@ -383,7 +383,7 @@
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
-failregex = FAIL LOGIN
|
||||
+failregex = \[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$
|
||||
|
||||
[PROFTPD]
|
||||
# Option: enabled
|
||||
diff -rNu fail2ban-0.6.1.orig/config/fail2ban.conf.shorewall fail2ban-0.6.1.fixed/config/fail2ban.conf.shorewall
|
||||
--- fail2ban-0.6.1.orig/config/fail2ban.conf.shorewall 2006-03-27 12:56:38.000000000 -0500
|
||||
+++ fail2ban-0.6.1.fixed/config/fail2ban.conf.shorewall 2006-05-10 13:47:40.000000000 -0400
|
||||
@@ -383,7 +383,7 @@
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
-failregex = FAIL LOGIN
|
||||
+failregex = \[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$
|
||||
|
||||
[PROFTPD]
|
||||
# Option: enabled
|
||||
diff -rNu fail2ban-0.6.1.orig/config/fail2ban.conf.hostsdeny fail2ban-0.6.1.fixed/config/fail2ban.conf.hostsdeny
|
||||
--- fail2ban-0.6.1.orig/config/fail2ban.conf.hostsdeny 2006-03-27 12:56:38.000000000 -0500
|
||||
+++ fail2ban-0.6.1.fixed/config/fail2ban.conf.hostsdeny 2006-05-10 13:47:40.000000000 -0400
|
||||
@@ -383,7 +383,7 @@
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
-failregex = FAIL LOGIN
|
||||
+failregex = \[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$
|
||||
|
||||
[PROFTPD]
|
||||
# Option: enabled
|
||||
4
0.6.1-8/debian/patches/00list
Normal file
4
0.6.1-8/debian/patches/00list
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
00_proftpd_section
|
||||
00_vsftpd_regexp
|
||||
01_apache2_other
|
||||
02_sasl_section
|
||||
19
0.6.1-8/debian/patches/01_apache2_other.dpatch
Normal file
19
0.6.1-8/debian/patches/01_apache2_other.dpatch
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
#! /bin/sh /usr/share/dpatch/dpatch-run
|
||||
## 01_apache2_other.dpatch by <debian@onerussian.com>
|
||||
##
|
||||
## All lines beginning with `## DP:' are a description of the patch.
|
||||
## DP: Tiny patch to mention apache2 possibility
|
||||
|
||||
@DPATCH@
|
||||
|
||||
diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.iptables fail2ban-0.6.1.post/config/fail2ban.conf.iptables
|
||||
--- fail2ban-0.6.1.pre/config/fail2ban.conf.iptables 2006-05-27 23:23:51.000000000 -0400
|
||||
+++ fail2ban-0.6.1.post/config/fail2ban.conf.iptables 2006-05-27 23:27:30.000000000 -0400
|
||||
@@ -270,6 +270,7 @@
|
||||
# Option: logfile
|
||||
# Notes.: logfile to monitor.
|
||||
# Values: FILE Default: /var/log/apache/error.log
|
||||
+# Other.: /var/log/apache2/error.log
|
||||
#
|
||||
logfile = /var/log/apache/error.log
|
||||
|
||||
58
0.6.1-8/debian/patches/02_sasl_section.dpatch
Executable file
58
0.6.1-8/debian/patches/02_sasl_section.dpatch
Executable file
|
|
@ -0,0 +1,58 @@
|
|||
#! /bin/sh /usr/share/dpatch/dpatch-run
|
||||
## 02_sasl_config.dpatch by <debian@onerussian.com>
|
||||
##
|
||||
## All lines beginning with `## DP:' are a description of the patch.
|
||||
## DP: Added saslauthd section from martin f krafft <madduck@debian.org>
|
||||
|
||||
@DPATCH@
|
||||
|
||||
diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.iptables fail2ban-0.6.1.post/config/fail2ban.conf.iptables
|
||||
--- fail2ban-0.6.1.pre/config/fail2ban.conf.iptables 2006-05-30 10:03:16.000000000 -0400
|
||||
+++ fail2ban-0.6.1.post/config/fail2ban.conf.iptables 2006-05-30 10:13:56.000000000 -0400
|
||||
@@ -260,6 +260,46 @@
|
||||
# failregex.
|
||||
|
||||
|
||||
+[SASL]
|
||||
+# Option: enabled
|
||||
+# Notes.: enable monitoring for this section.
|
||||
+# Values: [true | false] Default: true
|
||||
+#
|
||||
+enabled = false
|
||||
+
|
||||
+# Option: port
|
||||
+# Notes.: specifies port to monitor
|
||||
+# Values: [ NUM | STRING ] Default:
|
||||
+#
|
||||
+port = smtp
|
||||
+
|
||||
+# Option: logfile
|
||||
+# Notes.: logfile to monitor.
|
||||
+# Values: FILE Default: /var/log/auth.log
|
||||
+#
|
||||
+logfile = /var/log/mail.log
|
||||
+
|
||||
+# Option: timeregex
|
||||
+# Notes.: regex to match timestamp
|
||||
+# Values: [Mar 7 17:53:28]
|
||||
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+#
|
||||
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+
|
||||
+# Option: timepattern
|
||||
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
|
||||
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
+#
|
||||
+timepattern = %%b %%d %%H:%%M:%%S
|
||||
+
|
||||
+# Option: failregex
|
||||
+# Notes.: regex to match the password failures messages in the logfile.
|
||||
+# Values: TEXT Default:
|
||||
+#
|
||||
+failregex = : warning: [-._\w]+\[(?P<host>[.\d]+)\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
|
||||
+
|
||||
+
|
||||
[Apache]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
79
0.6.1-8/debian/postinst
Executable file
79
0.6.1-8/debian/postinst
Executable file
|
|
@ -0,0 +1,79 @@
|
|||
#! /bin/sh
|
||||
# postinst script for fail2ban
|
||||
#
|
||||
# see: dh_installdeb(1)
|
||||
|
||||
set -e
|
||||
|
||||
# summary of how this script can be called:
|
||||
# * <postinst> `configure' <most-recently-configured-version>
|
||||
# * <old-postinst> `abort-upgrade' <new version>
|
||||
# * <conflictor's-postinst> `abort-remove' `in-favour' <package>
|
||||
# <new-version>
|
||||
# * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
|
||||
# <failed-install-package> <version> `removing'
|
||||
# <conflicting-package> <version>
|
||||
# for details, see http://www.debian.org/doc/debian-policy/ or
|
||||
# the debian-policy package
|
||||
#
|
||||
preversion=$2
|
||||
|
||||
case "$1" in
|
||||
configure)
|
||||
# To fix the bug in generated by previous version files permissions
|
||||
# also closes #352053
|
||||
|
||||
LOG=/var/log/fail2ban.log
|
||||
touch $LOG
|
||||
chown root:adm ${LOG}*
|
||||
chmod 640 ${LOG}*
|
||||
|
||||
# Note regarding changed configuration file
|
||||
if [ ! -z $preversion ] \
|
||||
&& dpkg --compare-versions $preversion lt 0.5.4-5.14;
|
||||
then
|
||||
cat <<EOF
|
||||
WARNING!
|
||||
|
||||
Configuration file /etc/fail2ban.conf, failregex configuration
|
||||
parameter specificly, were changed in 0.5.4-5 to close reported
|
||||
security breach, and in 0.5.4-5.14 to close few other bugs.
|
||||
|
||||
updating from <0.5.4-5
|
||||
Unless configuration file (or corresponding failregex'es) gets updated,
|
||||
security breach is not closed and corresponding warning will be reported
|
||||
by the fail2ban (in the log files).
|
||||
|
||||
updating from <0.5.4-5.14
|
||||
Bugs #329163, #331695 dealing with changed iptables rules
|
||||
outside of fail2ban were fixed in 0.5.4-5.14, and require upgrade of the
|
||||
configuration file (fwcheck option was introduced) to take full
|
||||
advantage of the problem solution (otherwise some problems might
|
||||
persist)
|
||||
|
||||
Please review the configuration file and make appropriate changes.
|
||||
ENJOY!
|
||||
|
||||
EOF
|
||||
fi
|
||||
|
||||
;;
|
||||
|
||||
abort-upgrade|abort-remove|abort-deconfigure)
|
||||
|
||||
;;
|
||||
|
||||
*)
|
||||
echo "postinst called with unknown argument \`$1'" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# dh_installdeb will replace this with shell code automatically
|
||||
# generated by other debhelper scripts.
|
||||
|
||||
#DEBHELPER#
|
||||
|
||||
exit 0
|
||||
|
||||
|
||||
42
0.6.1-8/debian/postrm
Executable file
42
0.6.1-8/debian/postrm
Executable file
|
|
@ -0,0 +1,42 @@
|
|||
#! /bin/sh
|
||||
# postrm script for fail2ban
|
||||
#
|
||||
# see: dh_installdeb(1)
|
||||
|
||||
set -e
|
||||
|
||||
# summary of how this script can be called:
|
||||
# * <postrm> `remove'
|
||||
# * <postrm> `purge'
|
||||
# * <old-postrm> `upgrade' <new-version>
|
||||
# * <new-postrm> `failed-upgrade' <old-version>
|
||||
# * <new-postrm> `abort-install'
|
||||
# * <new-postrm> `abort-install' <old-version>
|
||||
# * <new-postrm> `abort-upgrade' <old-version>
|
||||
# * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
|
||||
# for details, see /usr/doc/packaging-manual/
|
||||
|
||||
|
||||
case "$1" in
|
||||
purge|disappear)
|
||||
|
||||
# Remove configuration
|
||||
rm -f /etc/fail2ban.conf
|
||||
|
||||
# Remove logs
|
||||
rm -f /var/log/fail2ban*
|
||||
|
||||
;;
|
||||
remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
|
||||
# nothing
|
||||
# We may not delete the user fail2ban, as there may be
|
||||
# files owned by it in /var/log/ and /etc/.
|
||||
;;
|
||||
esac
|
||||
|
||||
# dh_installdeb will replace this with shell code automatically
|
||||
# generated by other debhelper scripts.
|
||||
|
||||
#DEBHELPER#
|
||||
|
||||
|
||||
91
0.6.1-8/debian/rules
Executable file
91
0.6.1-8/debian/rules
Executable file
|
|
@ -0,0 +1,91 @@
|
|||
#!/usr/bin/make -f
|
||||
# -*- makefile -*-
|
||||
# Sample debian/rules that uses debhelper.
|
||||
# This file was originally written by Joey Hess and Craig Small.
|
||||
# As a special exception, when this file is copied by dh-make into a
|
||||
# dh-make output file, you may use that output file without restriction.
|
||||
# This special exception was added by Craig Small in version 0.37 of dh-make.
|
||||
|
||||
# Uncomment this to turn on verbose mode.
|
||||
#export DH_VERBOSE=1
|
||||
|
||||
MANPAGE=fail2ban.8
|
||||
DESTDIR=$(CURDIR)/debian/fail2ban
|
||||
|
||||
# no parallel execution -- required for dpatch
|
||||
.NOTPARALLEL:
|
||||
|
||||
include /usr/share/dpatch/dpatch.make
|
||||
|
||||
configure: configure-stamp
|
||||
configure-stamp:
|
||||
dh_testdir
|
||||
# Add here commands to configure the package.
|
||||
touch configure-stamp
|
||||
|
||||
build: patch
|
||||
|
||||
copy-inits:
|
||||
cp config/gentoo-confd debian/fail2ban.default
|
||||
cp config/debian-initd debian/fail2ban.init
|
||||
cp config/fail2ban.logrotate debian/
|
||||
|
||||
clean-inits:
|
||||
rm -f debian/fail2ban.{default,init,logrotate}
|
||||
|
||||
clean: clean-inits unpatch
|
||||
dh_testdir
|
||||
dh_testroot
|
||||
rm -f build-stamp configure-stamp
|
||||
|
||||
# Add here commands to clean up after the build process.
|
||||
rm -rf changelog.gz $(MANPAGE) build*
|
||||
|
||||
dh_clean
|
||||
|
||||
install: build copy-inits
|
||||
dh_testdir
|
||||
dh_testroot
|
||||
dh_clean -k
|
||||
dh_installdirs
|
||||
|
||||
# Add here commands to install the package into debian/fail2ban.
|
||||
python setup.py install --root=$(DESTDIR) --no-compile
|
||||
mkdir -p $(DESTDIR)/etc
|
||||
cp config/fail2ban.conf.iptables $(DESTDIR)/etc/fail2ban.conf
|
||||
|
||||
# To build manpage
|
||||
$(MANPAGE): fail2ban fail2ban.h2m
|
||||
help2man --include fail2ban.h2m --section=1x --no-info --output $@ ./fail2ban
|
||||
#
|
||||
# Just to comply with policy 4.8
|
||||
binary-arch:
|
||||
|
||||
# Build architecture-independent files here.
|
||||
binary-indep: install $(MANPAGE)
|
||||
dh_testdir
|
||||
dh_testroot
|
||||
dh_installchangelogs CHANGELOG
|
||||
dh_installdocs
|
||||
dh_installexamples config/fail2ban.conf.*
|
||||
# dh_install
|
||||
# dh_installdebconf
|
||||
dh_installlogrotate
|
||||
dh_installinit -- defaults 99
|
||||
# dh_installcron
|
||||
# dh_installinfo
|
||||
dh_installman fail2ban.8 man/fail2ban.conf.5
|
||||
# just for maint scripts. I don't want to use ${python:Depends} to be portable between
|
||||
# systems with different pythons
|
||||
dh_python
|
||||
dh_link
|
||||
dh_compress
|
||||
dh_fixperms
|
||||
dh_installdeb
|
||||
dh_shlibdeps
|
||||
dh_gencontrol
|
||||
dh_md5sums
|
||||
dh_builddeb
|
||||
|
||||
binary: binary-indep
|
||||
.PHONY: build clean binary-indep binary-arch binary install configure copy-inits clean-inits
|
||||
6
0.6.1-8/debian/watch
Normal file
6
0.6.1-8/debian/watch
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
# watch control file for uscan
|
||||
# Run the "uscan" command to check for upstream updates and more.
|
||||
# Site Directory Pattern Version Script
|
||||
version=3
|
||||
|
||||
http://sf.net/fail2ban/ fail2ban-(.*)\.tar\.bz2 debian svn-upgrade
|
||||
75
0.6.1-8/fail2ban
Executable file
75
0.6.1-8/fail2ban
Executable file
|
|
@ -0,0 +1,75 @@
|
|||
#!/usr/bin/env python
|
||||
|
||||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.7 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.7 $"
|
||||
__date__ = "$Date: 2005/12/27 15:09:50 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
import sys, traceback, logging, locale
|
||||
|
||||
# Set the locale with the user's default setting
|
||||
try:
|
||||
locale.setlocale(locale.LC_ALL, '')
|
||||
except Exception:
|
||||
print "Unable to set locale to " + `locale.getdefaultlocale()`
|
||||
sys.exit(-1)
|
||||
|
||||
# Inserts our own modules path first in the list
|
||||
# fix for bug #343821
|
||||
sys.path.insert(1, "/usr/share/fail2ban")
|
||||
|
||||
# Now we can import our modules.
|
||||
import fail2ban
|
||||
from utils.pidlock import PIDLock
|
||||
|
||||
# Get the instance of the logger.
|
||||
logSys = logging.getLogger("fail2ban")
|
||||
|
||||
# Get PID lock file instance
|
||||
pidLock = PIDLock()
|
||||
|
||||
# Handle all the unhandled exceptions
|
||||
try:
|
||||
# Start the application
|
||||
fail2ban.main()
|
||||
except SystemExit:
|
||||
# We called sys.exit(). Nothing wrong so just pass
|
||||
pass
|
||||
except Exception, e:
|
||||
# Print the exception data
|
||||
(type, value, tb) = sys.exc_info()
|
||||
tbStack = traceback.extract_tb(tb)
|
||||
logSys.error("Fail2Ban got an unhandled exception and died.")
|
||||
logSys.error("Type: " + `type.__name__` + "\n" +
|
||||
"Value: " + `e.args` + "\n" +
|
||||
"TB: " + `tbStack`)
|
||||
# Try to clean up after ourselves
|
||||
# just for extreme caution - wrapping with try
|
||||
try:
|
||||
fail2ban.restoreFwRules()
|
||||
except Exception:
|
||||
pass
|
||||
# Remove the PID lock file. Should close #1239562
|
||||
pidLock.remove()
|
||||
logging.shutdown()
|
||||
37
0.6.1-8/fail2ban.h2m
Normal file
37
0.6.1-8/fail2ban.h2m
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
Include file for help2man man page
|
||||
$Id: $
|
||||
|
||||
[name]
|
||||
fail2ban \- Ban IPs that make too many password failure
|
||||
|
||||
|
||||
[files]
|
||||
\fI/etc/fail2ban.conf\fR, \fI/etc/default/fail2ban\fR
|
||||
|
||||
[REPORTING BUGS]
|
||||
|
||||
Please report Debian related bugs via Debian bug tracking system
|
||||
http://www.debian.org/Bugs/
|
||||
|
||||
[copyright]
|
||||
Copyright (c) 2004 Cyril Jaquier
|
||||
.br
|
||||
Copyright of modifications held by their respective authors.
|
||||
.PP
|
||||
Licensed under the GNU General Public License v2 (GPL).
|
||||
|
||||
|
||||
[author]
|
||||
Original fail2ban by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
|
||||
.br
|
||||
Modified and packaged for Debian by
|
||||
.br
|
||||
- Yaroslav O. Halchenko <debian@onerussian.com>.
|
||||
.br
|
||||
Sponsored for Debian by
|
||||
.br
|
||||
- Barak A. Pearlmutter <barak@cs.nuim.ie>.
|
||||
|
||||
[see also]
|
||||
.br
|
||||
fail2ban.conf(5)
|
||||
581
0.6.1-8/fail2ban.py
Executable file
581
0.6.1-8/fail2ban.py
Executable file
|
|
@ -0,0 +1,581 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
# Modified by: Yaroslav Halchenko (SYSLOG, findtime, and oth)
|
||||
#
|
||||
# $Revision: 1.24 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.24 $"
|
||||
__date__ = "$Date: 2006/01/22 11:10:29 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
import time, sys, getopt, os, string, signal, logging, logging.handlers, copy
|
||||
from ConfigParser import *
|
||||
|
||||
from version import version
|
||||
from firewall.firewall import Firewall
|
||||
from logreader.logreader import LogReader
|
||||
from confreader.configreader import ConfigReader
|
||||
from utils.mail import Mail
|
||||
from utils.pidlock import PIDLock
|
||||
from utils.dns import *
|
||||
from utils.process import *
|
||||
|
||||
# Get the instance of the logger.
|
||||
logSys = logging.getLogger("fail2ban")
|
||||
|
||||
# Get PID lock file instance
|
||||
pidLock = PIDLock()
|
||||
|
||||
# Global variables
|
||||
logFwList = list()
|
||||
conf = dict()
|
||||
|
||||
def dispUsage():
|
||||
""" Prints Fail2Ban command line options and exits
|
||||
"""
|
||||
print "Usage: "+sys.argv[0]+" [OPTIONS]"
|
||||
print
|
||||
print "Fail2Ban v"+version+" reads log file that contains password failure report"
|
||||
print "and bans the corresponding IP addresses using firewall rules."
|
||||
print
|
||||
print " -b start in background"
|
||||
print " -d start in debug mode"
|
||||
print " -c <FILE> read configuration file FILE"
|
||||
print " -p <FILE> create PID lock in FILE"
|
||||
print " -h display this help message"
|
||||
print " -i <IP(s)> IP(s) to ignore"
|
||||
print " -k kill a currently running instance"
|
||||
print " -r <VALUE> allow a max of VALUE password failures [maxfailures]"
|
||||
print " -t <TIME> ban IP for TIME seconds [bantime]"
|
||||
print " -f <TIME> lifetime in seconds of failed entry [findtime]"
|
||||
print " -e <NAMEs> enable sections listed in NAMEs (coma or colon separated)"
|
||||
print " -v verbose. Use twice for greater effect"
|
||||
print " -V print software version"
|
||||
print
|
||||
print "Report bugs to <lostcontrol@users.sourceforge.net>"
|
||||
sys.exit(0)
|
||||
|
||||
def dispVersion():
|
||||
""" Prints Fail2Ban version and exits
|
||||
"""
|
||||
print sys.argv[0]+" "+version
|
||||
sys.exit(0)
|
||||
|
||||
def checkForRoot():
|
||||
""" Check for root user.
|
||||
"""
|
||||
uid = `os.getuid()`
|
||||
if uid == '0':
|
||||
return True
|
||||
else:
|
||||
return False
|
||||
|
||||
def sigTERMhandler(signum, frame):
|
||||
""" Handles the TERM signal when in daemon mode in order to
|
||||
exit properly.
|
||||
"""
|
||||
logSys.debug("Signal handler called with sig "+`signum`)
|
||||
killApp()
|
||||
|
||||
def setFwMustCheck(value):
|
||||
""" Set the mustCheck value of the firewalls (True/False)
|
||||
"""
|
||||
for element in logFwList:
|
||||
element[2].setMustCheck(value)
|
||||
|
||||
def initializeFwRules():
|
||||
""" Initializes firewalls by running cmdstart and then
|
||||
fwstart for each section
|
||||
"""
|
||||
# Execute global start command
|
||||
executeCmd(conf["cmdstart"], conf["debug"])
|
||||
# Execute start command of each section
|
||||
for element in logFwList:
|
||||
element[2].initialize(conf["debug"])
|
||||
|
||||
def reBan():
|
||||
""" For each section asks the Firewall to reban known IPs
|
||||
"""
|
||||
for element in logFwList:
|
||||
element[2].reBan(conf["debug"])
|
||||
|
||||
def restoreFwRules():
|
||||
""" Flush the ban list
|
||||
"""
|
||||
logSys.warn("Restoring firewall rules...")
|
||||
try:
|
||||
for element in logFwList:
|
||||
# Execute end command of each section
|
||||
element[2].restore(conf["debug"])
|
||||
# Execute global end command
|
||||
executeCmd(conf["cmdend"], conf["debug"])
|
||||
except ExternalError:
|
||||
# nothing bad really - we can survive :-)
|
||||
pass
|
||||
|
||||
def killApp():
|
||||
""" Flush the ban list, remove the PID lock file and exit
|
||||
nicely.
|
||||
"""
|
||||
# Restore Fw rules
|
||||
restoreFwRules()
|
||||
# Remove the PID lock
|
||||
pidLock.remove()
|
||||
logSys.info("Exiting...")
|
||||
logging.shutdown()
|
||||
sys.exit(0)
|
||||
|
||||
|
||||
def isEnabledSection(b, name):
|
||||
""" Uses @b or searches @name in the conf['enabledsections'] to
|
||||
determine if section is enabled. Removes also a value from the
|
||||
list if it was there
|
||||
Decided to place as a function to avoid duplication between
|
||||
MAIL and regular sections
|
||||
"""
|
||||
v = b
|
||||
if (name.upper() in conf["enabledsections"]):
|
||||
v = True
|
||||
conf["enabledsections"].remove(name.upper())
|
||||
return v
|
||||
|
||||
def getCmdLineOptions(optList):
|
||||
""" Gets the command line options
|
||||
"""
|
||||
# enabledsections can be defined just from the command line
|
||||
conf["enabledsections"] = []
|
||||
for opt in optList:
|
||||
if opt[0] == "-v":
|
||||
conf["verbose"] = conf["verbose"] + 1
|
||||
if opt[0] == "-b":
|
||||
conf["background"] = True
|
||||
if opt[0] == "-d":
|
||||
conf["debug"] = True
|
||||
if opt[0] == "-t":
|
||||
try:
|
||||
conf["bantime"] = int(opt[1])
|
||||
except ValueError:
|
||||
logSys.warn("banTime must be an integer")
|
||||
logSys.warn("Using default value")
|
||||
if opt[0] == "-f":
|
||||
try:
|
||||
conf["findtime"] = int(opt[1])
|
||||
except ValueError:
|
||||
logSys.warn("findTime must be an integer")
|
||||
logSys.warn("Using default value")
|
||||
if opt[0] == "-i":
|
||||
conf["ignoreip"] = opt[1]
|
||||
if opt[0] == "-r":
|
||||
conf["maxfailures"] = int(opt[1])
|
||||
if opt[0] == "-p":
|
||||
conf["pidlock"] = opt[1]
|
||||
if opt[0] == "-k":
|
||||
conf["kill"] = True
|
||||
if opt[0] == "-e":
|
||||
conf["enabledsections"] = map(lambda x: x.upper(),
|
||||
re.split("[:, \t\n]", opt[1]))
|
||||
|
||||
def main():
|
||||
""" Fail2Ban main function
|
||||
"""
|
||||
|
||||
# Add the default logging handler
|
||||
stdout = logging.StreamHandler(sys.stdout)
|
||||
logSys.addHandler(stdout)
|
||||
|
||||
# Default formatter
|
||||
formatterstring='%(levelname)s: %(message)s'
|
||||
formatter = logging.Formatter('%(asctime)s ' + formatterstring)
|
||||
stdout.setFormatter(formatter)
|
||||
|
||||
conf["kill"] = False
|
||||
conf["debug"] = False
|
||||
conf["verbose"] = 0
|
||||
conf["conffile"] = "/etc/fail2ban.conf"
|
||||
|
||||
# Reads the command line options.
|
||||
try:
|
||||
cmdOpts = 'hvVbdkc:t:f:i:r:p:e:'
|
||||
cmdLongOpts = ['help','version']
|
||||
optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
|
||||
except getopt.GetoptError:
|
||||
dispUsage()
|
||||
|
||||
# Pre-parsing of command line options for the -c option
|
||||
for opt in optList:
|
||||
if opt[0] == "-c":
|
||||
conf["conffile"] = opt[1]
|
||||
if opt[0] in ["-h", "--help"]:
|
||||
dispUsage()
|
||||
if opt[0] in ["-V", "--version"]:
|
||||
dispVersion()
|
||||
|
||||
# Reads the config file and create a LogReader instance for
|
||||
# each log file to check.
|
||||
confReader = ConfigReader(conf["conffile"])
|
||||
confReader.openConf()
|
||||
|
||||
# Options
|
||||
optionValues = (["bool", "background", False],
|
||||
["str", "logtargets", "/var/log/fail2ban.log"],
|
||||
["str", "syslog-target", "/dev/log"],
|
||||
["int", "syslog-facility", 1],
|
||||
["bool", "debug", False],
|
||||
["int", "verbose", conf["verbose"]],
|
||||
["str", "pidlock", "/var/run/fail2ban.pid"],
|
||||
["int", "maxfailures", 5],
|
||||
["int", "bantime", 600],
|
||||
["int", "findtime", 600],
|
||||
["str", "ignoreip", ""],
|
||||
["int", "polltime", 1],
|
||||
["str", "cmdstart", ""],
|
||||
["str", "cmdend", ""],
|
||||
["int", "reinittime", 100],
|
||||
["int", "maxreinits", 100])
|
||||
|
||||
# Gets global configuration options
|
||||
conf.update(confReader.getLogOptions("DEFAULT", optionValues))
|
||||
|
||||
# Gets command line options
|
||||
getCmdLineOptions(optList)
|
||||
|
||||
# Now we need to update confReader.configParser with 'commandline'
|
||||
# overwritten parameters. There is no way to assign configParser
|
||||
# with defaults (as I thought before) below in the code: thus defaults
|
||||
# have to be overridden
|
||||
for t, label, v in optionValues:
|
||||
confReader.setValue("DEFAULT", label, `conf[label]`)
|
||||
|
||||
# PID lock
|
||||
pidLock.setPath(conf["pidlock"])
|
||||
|
||||
# Now we can kill properly a running instance if needed
|
||||
if conf["kill"]:
|
||||
pid = pidLock.exists()
|
||||
if pid:
|
||||
killPID(int(pid))
|
||||
logSys.warn("Killed Fail2Ban with PID "+pid)
|
||||
sys.exit(0)
|
||||
else:
|
||||
logSys.error("No running Fail2Ban found")
|
||||
sys.exit(-1)
|
||||
|
||||
# Start Fail2Ban in daemon mode
|
||||
if conf["background"]:
|
||||
retCode = createDaemon()
|
||||
signal.signal(signal.SIGTERM, sigTERMhandler)
|
||||
if not retCode:
|
||||
logSys.error("Unable to start daemon")
|
||||
sys.exit(-1)
|
||||
|
||||
# Process some options
|
||||
# First setup Log targets
|
||||
# Bug fix for #1234699
|
||||
os.umask(0077)
|
||||
for target in conf["logtargets"].split():
|
||||
# target formatter
|
||||
# By default global formatter is taken. Is different for SYSLOG
|
||||
tformatter = formatter
|
||||
if target == "STDERR":
|
||||
hdlr = logging.StreamHandler(sys.stderr)
|
||||
elif target == "SYSLOG":
|
||||
# SYSLOG target can be either
|
||||
# a socket (file, so it starts with /)
|
||||
# or hostname
|
||||
# or hostname:port
|
||||
syslogtargets = re.findall("(/[\w/]*)|([^/ ][^: ]*)(:(\d+)){,1}",
|
||||
conf["syslog-target"])
|
||||
# we are waiting for a single match
|
||||
syslogtargets = syslogtargets[0]
|
||||
|
||||
# assign facility if it was defined
|
||||
if conf["syslog-facility"] < 0:
|
||||
facility = handlers.SysLogHandler.LOG_USER
|
||||
else:
|
||||
facility = conf["syslog-facility"]
|
||||
|
||||
if len(syslogtargets) == 0: # everything default
|
||||
hdlr = logging.handlers.SysLogHandler()
|
||||
else:
|
||||
if not ( syslogtargets[0] == "" ): # got socket
|
||||
syslogtarget = syslogtargets[0]
|
||||
else: # got hostname and maybe a port
|
||||
if syslogtargets[3] == "": # no port specified
|
||||
port = 514
|
||||
else:
|
||||
port = int(syslogtargets[3])
|
||||
syslogtarget = (syslogtargets[1], port)
|
||||
hdlr = logging.handlers.SysLogHandler(syslogtarget, facility)
|
||||
tformatter = logging.Formatter("fail2ban[%(process)d]: " +
|
||||
formatterstring);
|
||||
else:
|
||||
# Target should be a file
|
||||
try:
|
||||
open(target, "a")
|
||||
hdlr = logging.FileHandler(target)
|
||||
except IOError:
|
||||
logSys.error("Unable to log to " + target)
|
||||
continue
|
||||
# Set formatter and add handler to logger
|
||||
hdlr.setFormatter(tformatter)
|
||||
logSys.addHandler(hdlr)
|
||||
|
||||
# Verbose level
|
||||
if conf["verbose"]:
|
||||
logSys.warn("Verbose level is "+`conf["verbose"]`)
|
||||
if conf["verbose"] == 1:
|
||||
logSys.setLevel(logging.INFO)
|
||||
elif conf["verbose"] > 1:
|
||||
logSys.setLevel(logging.DEBUG)
|
||||
if conf["verbose"] > 2:
|
||||
formatterstring = ('%(levelname)s: [%(filename)s (%(lineno)d)] ' +
|
||||
'%(message)s')
|
||||
formatter = logging.Formatter("%(asctime)s " + formatterstring)
|
||||
stdout.setFormatter(formatter)
|
||||
|
||||
# Debug mode. Should only be used by developers
|
||||
if conf["debug"]:
|
||||
logSys.warn("DEBUG MODE: FIREWALL COMMANDS ARE _NOT_ EXECUTED BUT " +
|
||||
"ONLY DISPLAYED IN THE LOG MESSAGES")
|
||||
|
||||
# Ignores IP list
|
||||
ignoreIPList = conf["ignoreip"].split(' ')
|
||||
|
||||
# Checks for root user. This is necessary because log files
|
||||
# are owned by root and firewall needs root access.
|
||||
if not checkForRoot():
|
||||
logSys.error("You must be root")
|
||||
if not conf["debug"]:
|
||||
sys.exit(-1)
|
||||
|
||||
# Checks that no instance of Fail2Ban is currently running.
|
||||
pid = pidLock.exists()
|
||||
if pid:
|
||||
logSys.error("Fail2Ban already running with PID "+pid)
|
||||
sys.exit(-1)
|
||||
else:
|
||||
ret = pidLock.create()
|
||||
if not ret:
|
||||
# Unable to create PID lock. Exit
|
||||
sys.exit(-1)
|
||||
|
||||
logSys.debug("ConfFile is " + conf["conffile"])
|
||||
logSys.debug("BanTime is " + `conf["bantime"]`)
|
||||
logSys.debug("FindTime is " + `conf["findtime"]`)
|
||||
logSys.debug("MaxFailure is " + `conf["maxfailures"]`)
|
||||
|
||||
# Options
|
||||
optionValues = (["bool", "enabled", False],
|
||||
["str", "host", "localhost"],
|
||||
["int", "port", "25"],
|
||||
["str", "from", "root"],
|
||||
["str", "to", "root"],
|
||||
["str", "user", ''],
|
||||
["str", "password", ''],
|
||||
["bool", "localtime", False],
|
||||
["str", "subject", "[Fail2Ban] Banned <ip>"],
|
||||
["str", "message", "Fail2Ban notification"])
|
||||
|
||||
# Gets global configuration options
|
||||
mailConf = confReader.getLogOptions("MAIL", optionValues)
|
||||
|
||||
# Create mailer if enabled
|
||||
if isEnabledSection(mailConf["enabled"], "MAIL"):
|
||||
logSys.debug("Mail enabled")
|
||||
mail = Mail(mailConf["host"], mailConf["port"])
|
||||
mail.setFromAddr(mailConf["from"])
|
||||
mail.setUser(mailConf["user"])
|
||||
mail.setPassword(mailConf["password"])
|
||||
mail.setToAddr(mailConf["to"])
|
||||
mail.setLocalTimeFlag(mailConf["localtime"])
|
||||
logSys.debug("to: " + mailConf["to"] + " from: " + mailConf["from"])
|
||||
|
||||
# Options
|
||||
optionValues = (["bool", "enabled", False],
|
||||
["str", "logfile", "/dev/null"],
|
||||
["int", "maxfailures", conf["maxfailures"]],
|
||||
["int", "bantime", conf["bantime"]],
|
||||
["int", "findtime", conf["findtime"]],
|
||||
["str", "timeregex", ""],
|
||||
["str", "timepattern", ""],
|
||||
["str", "failregex", ""],
|
||||
["str", "fwstart", ""],
|
||||
["str", "fwend", ""],
|
||||
["str", "fwban", ""],
|
||||
["str", "fwunban", ""],
|
||||
["str", "fwcheck", ""])
|
||||
|
||||
logSys.info("Fail2Ban v" + version + " is running")
|
||||
|
||||
enabledSections = []
|
||||
# Gets the options of each sections
|
||||
for t in confReader.getSections():
|
||||
l = confReader.getLogOptions(t, optionValues)
|
||||
if isEnabledSection(l["enabled"], t):
|
||||
# Creates a logreader object
|
||||
enabledSections.append(t)
|
||||
lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
|
||||
l["failregex"], l["maxfailures"], l["findtime"])
|
||||
# Creates a firewall object
|
||||
fObj = Firewall(l["fwstart"], l["fwend"], l["fwban"], l["fwunban"],
|
||||
l["fwcheck"], l["bantime"])
|
||||
# "Name" the firewall
|
||||
fObj.setSection(t)
|
||||
# Links them into a list. I'm not really happy
|
||||
# with this :/
|
||||
logFwList.append([t, lObj, fObj, dict()])
|
||||
|
||||
logSys.info("Enabled sections: %s"%enabledSections)
|
||||
|
||||
# Warn about such "bad" sections
|
||||
if len(conf["enabledsections"])>0:
|
||||
logSys.warn("Sections %s defined in command "%conf["enabledsections"] +
|
||||
"line were not found in config, thus ignored")
|
||||
|
||||
# We add 127.0.0.1 to the ignore list has we do not want
|
||||
# to be ban ourself.
|
||||
for element in logFwList:
|
||||
element[1].addIgnoreIP("127.0.0.1")
|
||||
while len(ignoreIPList) > 0:
|
||||
ip = ignoreIPList.pop()
|
||||
# Bug fix for #1239557
|
||||
if isValidIP(ip):
|
||||
for element in logFwList:
|
||||
element[1].addIgnoreIP(ip)
|
||||
else:
|
||||
logSys.warn(ip + " is not a valid IP address")
|
||||
|
||||
# Startup loop -- necessary to avoid crash if it takes time for iptables
|
||||
# to startup. To avoid introduction of new config options, reusing
|
||||
# maxreinits and polltime.
|
||||
reinits = 0
|
||||
while True:
|
||||
try:
|
||||
initializeFwRules()
|
||||
break
|
||||
except ExternalError, e:
|
||||
reinits += 1
|
||||
logSys.warn(e)
|
||||
if conf["maxreinits"] < 0 or (reinits < conf["maxreinits"]):
|
||||
logSys.warn("#%d attempt to initialize the firewalls" % reinits)
|
||||
else:
|
||||
logSys.error("Exiting: Too many attempts to initialize the " +
|
||||
"firewall")
|
||||
killApp()
|
||||
time.sleep(conf["polltime"])
|
||||
|
||||
# try to reinit once if it fails immediately
|
||||
lastReinitTime = time.time() - conf["reinittime"] - 1
|
||||
reinits = 0
|
||||
# Main loop
|
||||
while True:
|
||||
try:
|
||||
sys.stdout.flush()
|
||||
sys.stderr.flush()
|
||||
|
||||
# Checks if some IP have to be remove from ban
|
||||
# list.
|
||||
for element in logFwList:
|
||||
element[2].checkForUnBan(conf["debug"])
|
||||
|
||||
# If the log file has not been modified since the
|
||||
# last time, we sleep for 1 second. This is active
|
||||
# polling so not very effective.
|
||||
modList = list()
|
||||
for element in logFwList:
|
||||
if element[1].isModified():
|
||||
modList.append(element)
|
||||
|
||||
if len(modList) == 0:
|
||||
time.sleep(conf["polltime"])
|
||||
continue
|
||||
|
||||
# Gets the failure list from the log file. For a given IP,
|
||||
# takes only the service which has the most password failures.
|
||||
for element in modList:
|
||||
e = element[1].getFailures()
|
||||
for key in e.iterkeys():
|
||||
if element[3].has_key(key):
|
||||
element[3][key] = (element[3][key][0] + e[key][0],
|
||||
e[key][1])
|
||||
else:
|
||||
element[3][key] = (e[key][0], e[key][1])
|
||||
|
||||
# Remove the oldest failure attempts from the global list.
|
||||
# We iterate the failure list and ban IP that make
|
||||
# *retryAllowed* login failures.
|
||||
unixTime = time.time()
|
||||
for element in logFwList:
|
||||
fails = element[3].copy()
|
||||
findTime = element[1].getFindTime()
|
||||
for attempt in fails:
|
||||
failTime = fails[attempt][1]
|
||||
if failTime < unixTime - findTime:
|
||||
del element[3][attempt]
|
||||
elif fails[attempt][0] >= element[1].getMaxRetry():
|
||||
aInfo = {"section": element[0],
|
||||
"ip": attempt,
|
||||
"failures": element[3][attempt][0],
|
||||
"failtime": failTime}
|
||||
logSys.info(element[0] + ": " + aInfo["ip"] +
|
||||
" has " + `aInfo["failures"]` +
|
||||
" login failure(s). Banned.")
|
||||
element[2].addBanIP(aInfo, conf["debug"])
|
||||
# Send a mail notification
|
||||
if 'mail' in locals():
|
||||
mail.sendmail(mailConf["subject"],
|
||||
mailConf["message"], aInfo)
|
||||
del element[3][attempt]
|
||||
except ExternalError, e:
|
||||
# Something wrong while dealing with Iptables.
|
||||
# May be chain got removed?
|
||||
reinits += 1
|
||||
logSys.error(e)
|
||||
if ((unixTime - lastReinitTime > conf["reinittime"]) and
|
||||
((conf["maxreinits"] < 0) or (reinits < conf["maxreinits"]))):
|
||||
logSys.warn("#%d reinitialization of firewalls"%reinits)
|
||||
lastReinitTime = unixTime
|
||||
else:
|
||||
logSys.error("Exiting: reinits follow too often, or too many " +
|
||||
"reinit attempts")
|
||||
killApp()
|
||||
# We already failed runCheck so disable it until
|
||||
# restoring a safe state
|
||||
setFwMustCheck(False)
|
||||
# save firewalls to keep a list of IPs for rebanning
|
||||
logFwListCopy = copy.deepcopy(logFwList)
|
||||
try:
|
||||
# restore as much as possible
|
||||
restoreFwRules()
|
||||
# reinitialize all the chains
|
||||
initializeFwRules()
|
||||
# restore the lists of baned IPs
|
||||
logFwList.__init__(logFwListCopy)
|
||||
# reBan known IPs
|
||||
reBan()
|
||||
# Now we can enable the runCheck test again
|
||||
setFwMustCheck(True)
|
||||
except ExternalError:
|
||||
raise ExternalError("Big Oops happened: situation is out of " +
|
||||
"control. Something is wrong with your " +
|
||||
"setup. Please check your settings")
|
||||
except KeyboardInterrupt:
|
||||
# When the user press <ctrl>+<c> we exit nicely.
|
||||
killApp()
|
||||
25
0.6.1-8/firewall/__init__.py
Normal file
25
0.6.1-8/firewall/__init__.py
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.1 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.1 $"
|
||||
__date__ = "$Date: 2004/10/09 15:33:33 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
192
0.6.1-8/firewall/firewall.py
Normal file
192
0.6.1-8/firewall/firewall.py
Normal file
|
|
@ -0,0 +1,192 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.10 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.10 $"
|
||||
__date__ = "$Date: 2005/12/16 23:48:52 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
import time, os, logging, re
|
||||
|
||||
from utils.process import executeCmd
|
||||
# unfortunately but I have to bring ExternalError in especially
|
||||
# for flushBanList: if one of IPs got flushed manually outside or something,
|
||||
# we might endup with not "full" flush unless we handle exception within the loop
|
||||
from utils.process import ExternalError
|
||||
from utils.strings import replaceTag
|
||||
|
||||
# Gets the instance of the logger.
|
||||
logSys = logging.getLogger("fail2ban")
|
||||
|
||||
class Firewall:
|
||||
""" Manages the ban list and executes the command that ban
|
||||
the IP.
|
||||
"""
|
||||
|
||||
def __init__(self, startRule, endRule, banRule, unBanRule, checkRule,
|
||||
banTime):
|
||||
self.banRule = banRule
|
||||
self.unBanRule = unBanRule
|
||||
self.checkRule = checkRule
|
||||
self.startRule = startRule
|
||||
self.endRule = endRule
|
||||
self.banTime = banTime
|
||||
self.banList = dict()
|
||||
self.section = ""
|
||||
self.mustCheck = True
|
||||
|
||||
def setSection(self, section):
|
||||
""" Set optional section name for clarify of logging
|
||||
"""
|
||||
self.section = section
|
||||
|
||||
def getMustCheck(self):
|
||||
""" Return true if the runCheck test is executed
|
||||
"""
|
||||
return self.mustCheck
|
||||
|
||||
def setMustCheck(self, value):
|
||||
""" Enable or disable the execution of runCheck test
|
||||
"""
|
||||
self.mustCheck = value
|
||||
|
||||
def initialize(self, debug):
|
||||
logSys.debug("%s: Initialize firewall rules"%self.section)
|
||||
executeCmd(self.startRule, debug)
|
||||
|
||||
def restore(self, debug):
|
||||
logSys.debug("%s: Restore firewall rules"%self.section)
|
||||
try:
|
||||
self.flushBanList(debug)
|
||||
executeCmd(self.endRule, debug)
|
||||
except ExternalError:
|
||||
pass
|
||||
|
||||
def addBanIP(self, aInfo, debug):
|
||||
""" Bans an IP.
|
||||
"""
|
||||
ip = aInfo["ip"]
|
||||
if not self.inBanList(ip):
|
||||
crtTime = time.time()
|
||||
if self.banTime < 0:
|
||||
banMsg = "Ban (permanent)"
|
||||
else:
|
||||
banMsg = "Ban (%d s)"%self.banTime
|
||||
logSys.warn("%s: %s "%(self.section, banMsg) + ip)
|
||||
self.banList[ip] = crtTime
|
||||
aInfo["bantime"] = crtTime
|
||||
self.runCheck(debug)
|
||||
cmd = self.banIP(aInfo)
|
||||
if executeCmd(cmd, debug):
|
||||
raise ExternalError("Firewall: execution of fwban command " +
|
||||
"'%s' failed"%cmd)
|
||||
else:
|
||||
self.runCheck(debug)
|
||||
logSys.error("%s: "%self.section+ip+" already in ban list")
|
||||
|
||||
def delBanIP(self, aInfo, debug):
|
||||
""" Unban an IP.
|
||||
"""
|
||||
ip = aInfo["ip"]
|
||||
if self.inBanList(ip):
|
||||
logSys.warn("%s: Unban "%self.section + ip)
|
||||
del self.banList[ip]
|
||||
self.runCheck(debug)
|
||||
executeCmd(self.unBanIP(aInfo), debug)
|
||||
else:
|
||||
logSys.error("%s: "%self.section+ip+" not in ban list")
|
||||
|
||||
def reBan(self, debug):
|
||||
""" Re-Bans known IPs.
|
||||
TODO: implement "failures" and "failtime"
|
||||
"""
|
||||
for ip in self.banList:
|
||||
aInfo = {"ip": ip,
|
||||
"bantime":self.banList[ip]}
|
||||
logSys.warn("%s: ReBan "%self.section + ip)
|
||||
# next piece is similar to the on in addBanIp
|
||||
# so might be one more function will not hurt
|
||||
self.runCheck(debug)
|
||||
executeCmd(self.banIP(aInfo), debug)
|
||||
|
||||
def inBanList(self, ip):
|
||||
""" Checks if IP is in ban list.
|
||||
"""
|
||||
return self.banList.has_key(ip)
|
||||
|
||||
def runCheck(self, debug):
|
||||
""" Runs fwcheck command and throws an exception if it returns non-0
|
||||
result
|
||||
"""
|
||||
if self.mustCheck:
|
||||
executeCmd(self.checkRule, debug)
|
||||
else:
|
||||
return None
|
||||
|
||||
def checkForUnBan(self, debug):
|
||||
""" Check for IP to remove from ban list. If banTime is smaller than
|
||||
zero, IP will be never removed.
|
||||
"""
|
||||
if self.banTime < 0:
|
||||
# Permanent banning
|
||||
return
|
||||
banListTemp = self.banList.copy()
|
||||
for element in banListTemp.iteritems():
|
||||
btime = element[1]
|
||||
if btime < time.time()-self.banTime:
|
||||
aInfo = {"ip": element[0],
|
||||
"bantime": btime,
|
||||
"unbantime": time.time()}
|
||||
self.delBanIP(aInfo, debug)
|
||||
|
||||
def flushBanList(self, debug):
|
||||
""" Flushes the ban list and of course the firewall rules.
|
||||
Called when fail2ban exits.
|
||||
"""
|
||||
banListTemp = self.banList.copy()
|
||||
for element in banListTemp.iteritems():
|
||||
aInfo = {"ip": element[0],
|
||||
"bantime": element[1],
|
||||
"unbantime": time.time()}
|
||||
try:
|
||||
self.delBanIP(aInfo, debug)
|
||||
except ExternalError:
|
||||
# we must let it fail here in the loop, or we don't
|
||||
# flush properly
|
||||
pass
|
||||
|
||||
def banIP(self, aInfo):
|
||||
""" Returns query to ban IP.
|
||||
"""
|
||||
query = replaceTag(self.banRule, aInfo)
|
||||
return query
|
||||
|
||||
def unBanIP(self, aInfo):
|
||||
""" Returns query to unban IP.
|
||||
"""
|
||||
query = replaceTag(self.unBanRule, aInfo)
|
||||
return query
|
||||
|
||||
def viewBanList(self):
|
||||
""" Prints the ban list on screen. Usefull for debugging.
|
||||
"""
|
||||
for element in self.banList.iteritems():
|
||||
print element
|
||||
25
0.6.1-8/logreader/__init__.py
Normal file
25
0.6.1-8/logreader/__init__.py
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.1 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.1 $"
|
||||
__date__ = "$Date: 2004/10/10 13:33:40 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
234
0.6.1-8/logreader/logreader.py
Normal file
234
0.6.1-8/logreader/logreader.py
Normal file
|
|
@ -0,0 +1,234 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.16 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.16 $"
|
||||
__date__ = "$Date: 2006/01/03 15:13:04 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
import os, sys, time, re, logging
|
||||
|
||||
from utils.dns import *
|
||||
|
||||
# Gets the instance of the logger.
|
||||
logSys = logging.getLogger("fail2ban")
|
||||
|
||||
class LogReader:
|
||||
""" Reads a log file and reports information about IP that make password
|
||||
failure, bad user or anything else that is considered as doubtful login
|
||||
attempt.
|
||||
"""
|
||||
|
||||
def __init__(self, logPath, timeregex, timepattern, failregex,
|
||||
maxRetry, findTime):
|
||||
self.logPath = logPath
|
||||
self.maxRetry = maxRetry
|
||||
self.timeregex = timeregex
|
||||
self.timepattern = timepattern
|
||||
self.failregex = failregex
|
||||
self.findTime = findTime
|
||||
self.ignoreIpList = []
|
||||
self.lastModTime = 0
|
||||
self.lastPos = 0
|
||||
self.lastDate = 0
|
||||
self.logStats = None
|
||||
|
||||
def getMaxRetry(self):
|
||||
""" Gets the maximum number of failures
|
||||
"""
|
||||
return self.maxRetry
|
||||
|
||||
def getFindTime(self):
|
||||
""" Gets the find time.
|
||||
"""
|
||||
return self.findTime
|
||||
|
||||
def addIgnoreIP(self, ip):
|
||||
""" Adds an IP to the ignore list.
|
||||
"""
|
||||
logSys.debug("Add "+ip+" to ignore list")
|
||||
self.ignoreIpList.append(ip)
|
||||
|
||||
def inIgnoreIPList(self, ip):
|
||||
""" Checks if IP is in the ignore list.
|
||||
"""
|
||||
for i in self.ignoreIpList:
|
||||
s = i.split('/', 1)
|
||||
# IP address without CIDR mask
|
||||
if len(s) == 1:
|
||||
s.insert(1, '32')
|
||||
s[1] = long(s[1])
|
||||
a = cidr(s[0], s[1])
|
||||
b = cidr(ip, s[1])
|
||||
if a == b:
|
||||
return True
|
||||
return False
|
||||
|
||||
def openLogFile(self):
|
||||
""" Opens the log file specified on init.
|
||||
"""
|
||||
try:
|
||||
fileHandler = open(self.logPath)
|
||||
except OSError:
|
||||
logSys.error("Unable to open "+self.logPath)
|
||||
|
||||
return fileHandler
|
||||
|
||||
def isModified(self):
|
||||
""" Checks if the log file has been modified using os.stat().
|
||||
"""
|
||||
try:
|
||||
self.logStats = os.stat(self.logPath)
|
||||
if self.lastModTime == self.logStats.st_mtime:
|
||||
return False
|
||||
else:
|
||||
logSys.debug(self.logPath+" has been modified")
|
||||
self.lastModTime = self.logStats.st_mtime
|
||||
return True
|
||||
except OSError:
|
||||
logSys.error("Unable to get stat on "+self.logPath)
|
||||
return False
|
||||
|
||||
def setFilePos(self, file):
|
||||
""" Sets the file position. We must take care of log file rotation
|
||||
and reset the position to 0 in that case. Use the log message
|
||||
timestamp in order to detect this.
|
||||
"""
|
||||
line = file.readline()
|
||||
if self.lastDate < self.getTime(line):
|
||||
logSys.debug("Date " + `self.lastDate` + " is " + "smaller than " +
|
||||
`self.getTime(line)`)
|
||||
logSys.debug("Log rotation detected for " + self.logPath)
|
||||
self.lastPos = 0
|
||||
|
||||
logSys.debug("Setting file position to " + `self.lastPos` + " for " +
|
||||
self.logPath)
|
||||
file.seek(self.lastPos)
|
||||
|
||||
def getFailures(self):
|
||||
""" Gets all the failure in the log file which are
|
||||
newer than time.time()-self.findTime.
|
||||
|
||||
Returns a dict with the IP, the number of failure
|
||||
and the latest failure time.
|
||||
"""
|
||||
ipList = dict()
|
||||
logSys.debug(self.logPath)
|
||||
logFile = self.openLogFile()
|
||||
self.setFilePos(logFile)
|
||||
lastLine = None
|
||||
for line in logFile:
|
||||
if not self.hasTime(line):
|
||||
# There is no valid time in this line
|
||||
continue
|
||||
lastLine = line
|
||||
for element in self.findFailure(line):
|
||||
ip = element[0]
|
||||
unixTime = element[1]
|
||||
if unixTime < time.time()-self.findTime:
|
||||
break
|
||||
if self.inIgnoreIPList(ip):
|
||||
logSys.debug("Ignore "+ip)
|
||||
continue
|
||||
logSys.debug("Found "+ip)
|
||||
if ipList.has_key(ip):
|
||||
ipList[ip] = (ipList[ip][0]+1, unixTime)
|
||||
else:
|
||||
ipList[ip] = (1, unixTime)
|
||||
self.lastPos = logFile.tell()
|
||||
if lastLine:
|
||||
self.lastDate = self.getTime(lastLine)
|
||||
logFile.close()
|
||||
return ipList
|
||||
|
||||
def findFailure(self, line):
|
||||
""" Finds the failure in line. Uses the failregex pattern
|
||||
to find it and timeregex in order to find the logging
|
||||
time.
|
||||
|
||||
Returns a dict with IP and timestamp.
|
||||
"""
|
||||
failList = list()
|
||||
match = re.search(self.failregex, line)
|
||||
if match:
|
||||
timeMatch = re.search(self.timeregex, match.string)
|
||||
if timeMatch:
|
||||
date = self.getUnixTime(timeMatch.group())
|
||||
# Bug fix for Debian #330827
|
||||
hostMatch = match.groupdict()
|
||||
if len(hostMatch)==0:
|
||||
logSys.warn("Must have been using old style of failregex! "
|
||||
"Security Breach! Read README.Debian")
|
||||
ipMatch = textToIp(match.string)
|
||||
else:
|
||||
ipMatch = reduce(lambda x,y:x+textToIp(y),
|
||||
hostMatch.values(), [])
|
||||
|
||||
if ipMatch:
|
||||
for ip in ipMatch:
|
||||
failList.append([ip, date])
|
||||
return failList
|
||||
|
||||
def hasTime(self, line):
|
||||
""" Return true if the line contains a date
|
||||
"""
|
||||
timeMatch = re.search(self.timeregex, line)
|
||||
if timeMatch:
|
||||
return True
|
||||
else:
|
||||
return False
|
||||
|
||||
def getTime(self, line):
|
||||
""" Gets the time of a log message.
|
||||
"""
|
||||
date = 0
|
||||
timeMatch = re.search(self.timeregex, line)
|
||||
if timeMatch:
|
||||
date = self.getUnixTime(timeMatch.group())
|
||||
return date
|
||||
|
||||
def getUnixTime(self, value):
|
||||
""" Returns the Unix timestamp of the given value.
|
||||
Pattern should describe the date construction of
|
||||
value.
|
||||
"""
|
||||
try:
|
||||
# Check if the parsed value is in TAI64N format
|
||||
if not self.timepattern.lower() == "tai64n":
|
||||
date = list(time.strptime(value, self.timepattern))
|
||||
else:
|
||||
# extract part of format which represents seconds since epoch
|
||||
seconds_since_epoch = value[2:17]
|
||||
date = list(time.gmtime(int(seconds_since_epoch, 16)))
|
||||
except ValueError, e:
|
||||
logSys.error(e)
|
||||
logSys.error("Please check the format and your locale settings.")
|
||||
return None
|
||||
if date[0] < 2000:
|
||||
# There is probably no year field in the logs
|
||||
date[0] = time.gmtime()[0]
|
||||
# Bug fix for #1241756
|
||||
# If the date is greater than the current time, we suppose
|
||||
# that the log is not from this year but from the year before
|
||||
if time.mktime(date) > time.time():
|
||||
date[0] -= 1
|
||||
unixTime = time.mktime(date)
|
||||
return unixTime
|
||||
58
0.6.1-8/man/fail2ban.8
Normal file
58
0.6.1-8/man/fail2ban.8
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
.\"
|
||||
.TH "FAIL2BAN" "8" "July 2005" "Cyril Jaquier" "System administration tools"
|
||||
.SH "NAME"
|
||||
fail2ban \- bans IP that makes too many password failures
|
||||
.SH "SYNOPSIS"
|
||||
.B fail2ban
|
||||
[\fIOPTIONS\fR]
|
||||
.SH "DESCRIPTION"
|
||||
\fBFail2Ban\fR reads log file that contains password failure report
|
||||
and bans the corresponding IP addresses using firewall rules. It updates
|
||||
firewall rules to reject the IP address.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-b\fR
|
||||
start in background
|
||||
.TP
|
||||
\fB\-c\fR \fIFILE\fR
|
||||
read configuration file \fIFILE\fR
|
||||
.TP
|
||||
\fB\-p\fR \fIFILE\fR
|
||||
create PID lock in \fIFILE\fR
|
||||
.TP
|
||||
\fB\-h, \-\-help\fR
|
||||
display this help message
|
||||
.TP
|
||||
\fB\-i\fR \fIIP\fR
|
||||
\fIIP\fR(s) to ignore
|
||||
.TP
|
||||
\fB\-k\fR
|
||||
kill a currently running Fail2Ban instance
|
||||
.TP
|
||||
\fB\-r\fR \fIVALUE\fR
|
||||
allow a max of \fIVALUE\fR password failure [maxfailures]
|
||||
.TP
|
||||
\fB\-t\fR \fITIME\fR
|
||||
ban IP for \fITIME\fR seconds [bantime]
|
||||
.TP
|
||||
\fB\-f\fR \fITIME\fR
|
||||
lifetime in seconds of failed entry [findtime]
|
||||
.TP
|
||||
\fB\-v\fR
|
||||
verbose. Use twice for greater effect
|
||||
.TP
|
||||
\fB\-V, \-\-version\fR
|
||||
print software version
|
||||
.SH "FILES"
|
||||
.I /etc/fail2ban.conf
|
||||
.RS
|
||||
The configuration file. See \fBfail2ban.conf\fR(5) for further details.
|
||||
.SH "REPORTING BUGS"
|
||||
Please report bugs at http://sourceforge.net/projects/fail2ban/
|
||||
via bug tracker
|
||||
.SH "AUTHOR"
|
||||
Cyril Jaquier <lostcontrol@users.sourceforge.net>
|
||||
.SH "SEE ALSO"
|
||||
.TP
|
||||
See
|
||||
.BR "http://fail2ban.sourceforge.net/".
|
||||
28
0.6.1-8/man/fail2ban.conf.5
Normal file
28
0.6.1-8/man/fail2ban.conf.5
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
.\"
|
||||
.TH "FAIL2BAN.CONF" "5" "July 2005" "Cyril Jaquier" "System administration tools"
|
||||
.SH "NAME"
|
||||
fail2ban.conf \- configuration data for fail2ban
|
||||
.SH "DESCRIPTION"
|
||||
\fB/etc/fail2ban.conf\fR contains data about the general configuration of fail2ban, the mail notification and services to monitor.
|
||||
.SH "VARIABLES"
|
||||
Please look at the file itself
|
||||
.SH "FILES"
|
||||
.I /etc/fail2ban.conf
|
||||
.SH "REPORTING BUGS"
|
||||
Please report bugs at http://sourceforge.net/projects/fail2ban/
|
||||
via bug tracker
|
||||
.SH "AUTHOR"
|
||||
Cyril Jaquier <lostcontrol@users.sourceforge.net>
|
||||
.br
|
||||
Modified by
|
||||
.br
|
||||
- Yaroslav O. Halchenko <debian@onerussian.com>.
|
||||
.br
|
||||
Sponsored for Debian by
|
||||
.br
|
||||
- Barak A. Pearlmutter <barak@cs.nuim.ie>.
|
||||
.SH "SEE ALSO"
|
||||
.BR fail2ban(8)
|
||||
.TP
|
||||
See
|
||||
.BR "http://fail2ban.sourceforge.net/".
|
||||
5
0.6.1-8/setup.cfg
Normal file
5
0.6.1-8/setup.cfg
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
[install]
|
||||
install-purelib=/usr/share/fail2ban
|
||||
|
||||
[sdist]
|
||||
formats=bztar
|
||||
82
0.6.1-8/setup.py
Executable file
82
0.6.1-8/setup.py
Executable file
|
|
@ -0,0 +1,82 @@
|
|||
#!/usr/bin/env python
|
||||
|
||||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.6 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.6 $"
|
||||
__date__ = "$Date: 2006/01/22 11:08:42 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
from distutils.core import setup
|
||||
from version import version
|
||||
from os.path import isfile, join
|
||||
from sys import exit, argv
|
||||
|
||||
longdesc = '''
|
||||
Fail2Ban scans log files like /var/log/pwdfail or
|
||||
/var/log/apache/error_log and bans IP that makes
|
||||
too many password failures. It updates firewall rules
|
||||
to reject the IP address or executes user defined
|
||||
commands.'''
|
||||
|
||||
setup(
|
||||
name = "fail2ban",
|
||||
version = version,
|
||||
description = "Ban IPs that make too many password failure",
|
||||
long_description = longdesc,
|
||||
author = "Cyril Jaquier",
|
||||
author_email = "lostcontrol@users.sourceforge.net",
|
||||
url = "http://fail2ban.sourceforge.net",
|
||||
license = "GPL",
|
||||
platforms = "Posix",
|
||||
scripts = ['fail2ban'],
|
||||
py_modules = ['fail2ban', 'version'],
|
||||
packages = ['firewall', 'logreader', 'confreader', 'utils']
|
||||
)
|
||||
|
||||
# Do some checks after installation
|
||||
# Search for obsolete files.
|
||||
obsoleteFiles = []
|
||||
elements = {"/usr/bin/": ["fail2ban.py"],
|
||||
"/usr/share/fail2ban/firewall/": ["iptables.py", "ipfwadm.py",
|
||||
"ipfw.py"]}
|
||||
for dir in elements:
|
||||
for f in elements[dir]:
|
||||
path = join(dir, f)
|
||||
if isfile(path):
|
||||
obsoleteFiles.append(path)
|
||||
if obsoleteFiles:
|
||||
print
|
||||
print "Obsolete files from previous Fail2Ban versions were found on " \
|
||||
"your system."
|
||||
print "Please delete them:"
|
||||
print
|
||||
for f in obsoleteFiles:
|
||||
print "\t" + f
|
||||
print
|
||||
|
||||
# Update config file
|
||||
if argv[1] == "install":
|
||||
print
|
||||
print "Please do not forget to update your configuration file."
|
||||
print "Use config/fail2ban.conf.* as example."
|
||||
print
|
||||
25
0.6.1-8/utils/__init__.py
Normal file
25
0.6.1-8/utils/__init__.py
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.1 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.1 $"
|
||||
__date__ = "$Date: 2005/03/06 17:51:24 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
102
0.6.1-8/utils/dns.py
Normal file
102
0.6.1-8/utils/dns.py
Normal file
|
|
@ -0,0 +1,102 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.8 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.8 $"
|
||||
__date__ = "$Date: 2005/11/20 17:07:47 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
import os, re, socket, struct
|
||||
|
||||
def dnsToIp(dns):
|
||||
""" Convert a DNS into an IP address using the Python socket module.
|
||||
Thanks to Kevin Drapel.
|
||||
"""
|
||||
try:
|
||||
return socket.gethostbyname_ex(dns)[2]
|
||||
except socket.gaierror:
|
||||
return list()
|
||||
|
||||
def textToDns(text):
|
||||
""" Search for possible DNS in an arbitrary text.
|
||||
Thanks to Tom Pike.
|
||||
"""
|
||||
match = re.findall("(?:(?:\w|-)+\.){2,}\w+", text)
|
||||
if match:
|
||||
return match
|
||||
else:
|
||||
return []
|
||||
|
||||
def searchIP(text):
|
||||
""" Search if an IP address if directly available and return
|
||||
it.
|
||||
"""
|
||||
match = re.findall("(?:\d{1,3}\.){3}\d{1,3}", text)
|
||||
if match:
|
||||
return match
|
||||
else:
|
||||
return []
|
||||
|
||||
def isValidIP(str):
|
||||
""" Return true if str is a valid IP
|
||||
"""
|
||||
s = str.split('/', 1)
|
||||
try:
|
||||
socket.inet_aton(s[0])
|
||||
return True
|
||||
except socket.error:
|
||||
return False
|
||||
|
||||
def textToIp(text):
|
||||
""" Return the IP of DNS found in a given text.
|
||||
"""
|
||||
ipList = list()
|
||||
# Search for plain IP
|
||||
plainIP = searchIP(text)
|
||||
for element in plainIP:
|
||||
if isValidIP(element):
|
||||
ipList.append(element)
|
||||
if not ipList:
|
||||
# Try to get IP from possible DNS
|
||||
dnsList = textToDns(text)
|
||||
for element in dnsList:
|
||||
dns = dnsToIp(element)
|
||||
for e in dns:
|
||||
ipList.append(e)
|
||||
return ipList
|
||||
|
||||
def cidr(i, n):
|
||||
""" Convert an IP address string with a CIDR mask into a 32-bit
|
||||
integer.
|
||||
"""
|
||||
# 32-bit IPv4 address mask
|
||||
MASK = 0xFFFFFFFFL
|
||||
return ~(MASK >> n) & MASK & addr2bin(i)
|
||||
|
||||
def addr2bin(str):
|
||||
""" Convert a string IPv4 address into an unsigned integer.
|
||||
"""
|
||||
return struct.unpack("!L", socket.inet_aton(str))[0]
|
||||
|
||||
def bin2addr(addr):
|
||||
""" Convert a numeric IPv4 address into string n.n.n.n form.
|
||||
"""
|
||||
return socket.inet_ntoa(struct.pack("!L", addr))
|
||||
91
0.6.1-8/utils/mail.py
Normal file
91
0.6.1-8/utils/mail.py
Normal file
|
|
@ -0,0 +1,91 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.3 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.3 $"
|
||||
__date__ = "$Date: 2006/01/03 15:13:41 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
import logging, smtplib, email.Utils
|
||||
|
||||
from utils.strings import replaceTag
|
||||
|
||||
# Gets the instance of the logger.
|
||||
logSys = logging.getLogger("fail2ban")
|
||||
|
||||
class Mail:
|
||||
""" Mailer class
|
||||
"""
|
||||
|
||||
def __init__(self, host, port = 25):
|
||||
self.host = host
|
||||
self.port = port
|
||||
self.localTimeFlag = False
|
||||
|
||||
def setFromAddr(self, fromAddr):
|
||||
""" Set from: address
|
||||
"""
|
||||
self.fromAddr = fromAddr
|
||||
|
||||
def setUser(self, user):
|
||||
""" Set smtpuser
|
||||
"""
|
||||
self.user = user
|
||||
|
||||
def setPassword(self, password):
|
||||
""" Set smtppassword
|
||||
"""
|
||||
self.password = password
|
||||
|
||||
def setToAddr(self, toAddr):
|
||||
""" Set to: address
|
||||
"""
|
||||
self.toAddr = toAddr.split()
|
||||
|
||||
def setLocalTimeFlag(self, localTimeFlag):
|
||||
""" Set to: address
|
||||
"""
|
||||
self.localTimeFlag = localTimeFlag
|
||||
|
||||
def sendmail(self, subject, message, aInfo):
|
||||
""" Send an email using smtplib
|
||||
"""
|
||||
subj = replaceTag(subject, aInfo)
|
||||
msg = replaceTag(message, aInfo)
|
||||
|
||||
mail = ("From: %s\r\nTo: %s\r\nDate: %s\r\nSubject: %s\r\n\r\n" %
|
||||
(self.fromAddr, ", ".join(self.toAddr),
|
||||
email.Utils.formatdate(localtime = self.localTimeFlag),
|
||||
subj)) + msg
|
||||
|
||||
try:
|
||||
server = smtplib.SMTP(self.host, self.port)
|
||||
#server.set_debuglevel(1)
|
||||
if not self.user == '':
|
||||
server.login(self.user, self.password)
|
||||
server.sendmail(self.fromAddr, self.toAddr, mail)
|
||||
logSys.debug("Email sent to " + `self.toAddr`)
|
||||
server.quit()
|
||||
except Exception, e:
|
||||
logSys.error("Unable to send mail to " + self.host + ":" +
|
||||
`self.port` + " from " + self.fromAddr + " to " +
|
||||
`self.toAddr` + ": " + `e` + ": " + `e.args`)
|
||||
|
||||
109
0.6.1-8/utils/pidlock.py
Normal file
109
0.6.1-8/utils/pidlock.py
Normal file
|
|
@ -0,0 +1,109 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.2 $"
|
||||
__date__ = "$Date: 2005/11/20 17:07:47 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
import os, logging
|
||||
|
||||
# Gets the instance of the logger.
|
||||
logSys = logging.getLogger("fail2ban")
|
||||
|
||||
class PIDLock:
|
||||
""" Manages the PID lock file.
|
||||
|
||||
The following class shows how to implement the singleton pattern[1] in
|
||||
Python. A singleton is a class that makes sure only one instance of it
|
||||
is ever created. Typically such classes are used to manage resources
|
||||
that by their very nature can only exist once.
|
||||
|
||||
http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/52558
|
||||
"""
|
||||
|
||||
class __impl:
|
||||
""" Implementation of the singleton interface """
|
||||
|
||||
def setPath(self, path):
|
||||
""" Set PID lock file path.
|
||||
"""
|
||||
self.path = path
|
||||
|
||||
def create(self):
|
||||
""" Create PID lock.
|
||||
"""
|
||||
try:
|
||||
fileHandler = open(self.path, mode='w')
|
||||
pid = os.getpid()
|
||||
fileHandler.write(`pid` + '\n')
|
||||
fileHandler.close()
|
||||
logSys.debug("Created PID lock (" + `pid` + ") in " + self.path)
|
||||
return True
|
||||
except:
|
||||
logSys.error("Unable to create PID lock " + self.path)
|
||||
return False
|
||||
|
||||
def remove(self):
|
||||
""" Remove PID lock.
|
||||
"""
|
||||
try:
|
||||
os.remove(self.path)
|
||||
logSys.debug("Removed PID lock " + self.path)
|
||||
except OSError:
|
||||
logSys.error("Unable to remove PID lock " + self.path)
|
||||
except AttributeError:
|
||||
# AttributeError if self.path wasn't specified yet
|
||||
logSys.debug("PID lock not removed because not defined yet")
|
||||
|
||||
def exists(self):
|
||||
""" Returns the current PID if Fail2Ban is running or False
|
||||
if no instance found.
|
||||
"""
|
||||
try:
|
||||
fileHandler = open(self.path)
|
||||
pid = fileHandler.readline()
|
||||
fileHandler.close()
|
||||
return pid
|
||||
except IOError:
|
||||
return False
|
||||
|
||||
# storage for the instance reference
|
||||
__instance = None
|
||||
|
||||
def __init__(self):
|
||||
""" Create singleton instance """
|
||||
# Check whether we already have an instance
|
||||
if PIDLock.__instance is None:
|
||||
# Create and remember instance
|
||||
PIDLock.__instance = PIDLock.__impl()
|
||||
|
||||
# Store instance reference as the only member in the handle
|
||||
self.__dict__['_PIDLock__instance'] = PIDLock.__instance
|
||||
|
||||
def __getattr__(self, attr):
|
||||
""" Delegate access to implementation """
|
||||
return getattr(self.__instance, attr)
|
||||
|
||||
def __setattr__(self, attr, value):
|
||||
""" Delegate access to implementation """
|
||||
return setattr(self.__instance, attr, value)
|
||||
|
||||
137
0.6.1-8/utils/process.py
Normal file
137
0.6.1-8/utils/process.py
Normal file
|
|
@ -0,0 +1,137 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.2 $"
|
||||
__date__ = "$Date: 2005/11/20 17:07:47 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
import os, logging, signal
|
||||
|
||||
# Gets the instance of the logger.
|
||||
logSys = logging.getLogger("fail2ban")
|
||||
|
||||
class ExternalError(UserWarning):
|
||||
""" Exception to warn about failed fwcheck or fwban command
|
||||
"""
|
||||
pass
|
||||
|
||||
def createDaemon():
|
||||
""" Detach a process from the controlling terminal and run it in the
|
||||
background as a daemon.
|
||||
|
||||
http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
|
||||
"""
|
||||
|
||||
try:
|
||||
# Fork a child process so the parent can exit. This will return control
|
||||
# to the command line or shell. This is required so that the new process
|
||||
# is guaranteed not to be a process group leader. We have this guarantee
|
||||
# because the process GID of the parent is inherited by the child, but
|
||||
# the child gets a new PID, making it impossible for its PID to equal its
|
||||
# PGID.
|
||||
pid = os.fork()
|
||||
except OSError, e:
|
||||
return((e.errno, e.strerror)) # ERROR (return a tuple)
|
||||
|
||||
if (pid == 0): # The first child.
|
||||
|
||||
# Next we call os.setsid() to become the session leader of this new
|
||||
# session. The process also becomes the process group leader of the
|
||||
# new process group. Since a controlling terminal is associated with a
|
||||
# session, and this new session has not yet acquired a controlling
|
||||
# terminal our process now has no controlling terminal. This shouldn't
|
||||
# fail, since we're guaranteed that the child is not a process group
|
||||
# leader.
|
||||
os.setsid()
|
||||
|
||||
# When the first child terminates, all processes in the second child
|
||||
# are sent a SIGHUP, so it's ignored.
|
||||
signal.signal(signal.SIGHUP, signal.SIG_IGN)
|
||||
|
||||
try:
|
||||
# Fork a second child to prevent zombies. Since the first child is
|
||||
# a session leader without a controlling terminal, it's possible for
|
||||
# it to acquire one by opening a terminal in the future. This second
|
||||
# fork guarantees that the child is no longer a session leader, thus
|
||||
# preventing the daemon from ever acquiring a controlling terminal.
|
||||
pid = os.fork() # Fork a second child.
|
||||
except OSError, e:
|
||||
return((e.errno, e.strerror)) # ERROR (return a tuple)
|
||||
|
||||
if (pid == 0): # The second child.
|
||||
# Ensure that the daemon doesn't keep any directory in use. Failure
|
||||
# to do this could make a filesystem unmountable.
|
||||
os.chdir("/")
|
||||
else:
|
||||
os._exit(0) # Exit parent (the first child) of the second child.
|
||||
else:
|
||||
os._exit(0) # Exit parent of the first child.
|
||||
|
||||
# Close all open files. Try the system configuration variable, SC_OPEN_MAX,
|
||||
# for the maximum number of open files to close. If it doesn't exist, use
|
||||
# the default value (configurable).
|
||||
try:
|
||||
maxfd = os.sysconf("SC_OPEN_MAX")
|
||||
except (AttributeError, ValueError):
|
||||
maxfd = 256 # default maximum
|
||||
|
||||
for fd in range(0, maxfd):
|
||||
try:
|
||||
os.close(fd)
|
||||
except OSError: # ERROR (ignore)
|
||||
pass
|
||||
|
||||
# Redirect the standard file descriptors to /dev/null.
|
||||
os.open("/dev/null", os.O_RDONLY) # standard input (0)
|
||||
os.open("/dev/null", os.O_RDWR) # standard output (1)
|
||||
os.open("/dev/null", os.O_RDWR) # standard error (2)
|
||||
|
||||
return True
|
||||
|
||||
def killPID(pid):
|
||||
""" Kills the process with the given PID using the
|
||||
INT signal (same effect as <ctrl>+<c>).
|
||||
"""
|
||||
try:
|
||||
return os.kill(pid, 2)
|
||||
except OSError:
|
||||
logSys.error("Can not kill process " + `pid` + ". Please check that " +
|
||||
"Fail2Ban is not running and remove the file " +
|
||||
"'/tmp/fail2ban.pid'")
|
||||
return False
|
||||
|
||||
def executeCmd(cmd, debug):
|
||||
""" Executes an OS command.
|
||||
"""
|
||||
if cmd == "":
|
||||
logSys.debug("Nothing to do")
|
||||
return None
|
||||
|
||||
logSys.debug(cmd)
|
||||
if not debug:
|
||||
retval = os.system(cmd)
|
||||
if not retval == 0:
|
||||
logSys.error("'" + cmd + "' returned " + `retval`)
|
||||
raise ExternalError("Execution of command '%s' failed" % cmd)
|
||||
return retval
|
||||
else:
|
||||
return None
|
||||
40
0.6.1-8/utils/strings.py
Normal file
40
0.6.1-8/utils/strings.py
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.2 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.2 $"
|
||||
__date__ = "$Date: 2005/11/20 17:07:47 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
import logging
|
||||
|
||||
# Gets the instance of the logger.
|
||||
logSys = logging.getLogger("fail2ban")
|
||||
|
||||
def replaceTag(query, aInfo):
|
||||
""" Replace tags in query
|
||||
"""
|
||||
string = query
|
||||
for tag in aInfo:
|
||||
string = string.replace('<'+tag+'>', `aInfo[tag]`)
|
||||
# New line
|
||||
string = string.replace('<br>', '\n')
|
||||
return string
|
||||
27
0.6.1-8/version.py
Normal file
27
0.6.1-8/version.py
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# This file is part of Fail2Ban.
|
||||
#
|
||||
# Fail2Ban is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Fail2Ban is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Fail2Ban; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
#
|
||||
# $Revision: 1.15 $
|
||||
|
||||
__author__ = "Cyril Jaquier"
|
||||
__version__ = "$Revision: 1.15 $"
|
||||
__date__ = "$Date: 2006/03/15 23:07:12 $"
|
||||
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
||||
__license__ = "GPL"
|
||||
|
||||
version = "0.6.1"
|
||||
Loading…
Reference in a new issue