From fb116326ecba84bf68dcc842eb0deb7746d2226b Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 23 Feb 2007 01:25:53 +0000
Subject: [PATCH] made a branch for sarge-backports

---
 0.6.1-8/CHANGELOG                             | 191 ++++++
 0.6.1-8/PKG-INFO                              |  15 +
 0.6.1-8/README                                | 156 +++++
 0.6.1-8/TODO                                  |  95 +++
 0.6.1-8/config/debian-initd                   | 149 +++++
 0.6.1-8/config/fail2ban.conf.hostsdeny        | 327 ++++++++++
 0.6.1-8/config/fail2ban.conf.iptables         | 427 +++++++++++++
 0.6.1-8/config/fail2ban.conf.shorewall        | 314 ++++++++++
 0.6.1-8/config/fail2ban.logrotate             |  10 +
 0.6.1-8/config/gentoo-confd                   |  23 +
 0.6.1-8/config/gentoo-initd                   |  50 ++
 0.6.1-8/config/redhat-initd                   |  78 +++
 0.6.1-8/confreader/__init__.py                |  25 +
 0.6.1-8/confreader/configreader.py            |  94 +++
 0.6.1-8/debian/NEWS                           |  10 +
 0.6.1-8/debian/README.Debian                  | 117 ++++
 0.6.1-8/debian/TODO                           |   7 +
 0.6.1-8/debian/changelog                      | 342 +++++++++++
 0.6.1-8/debian/compat                         |   1 +
 0.6.1-8/debian/control                        |  23 +
 0.6.1-8/debian/copyright                      |  31 +
 0.6.1-8/debian/docs                           |   2 +
 .../debian/patches/00_proftpd_section.dpatch  | 160 +++++
 .../debian/patches/00_vsftpd_regexp.dpatch    |  44 ++
 0.6.1-8/debian/patches/00list                 |   4 +
 .../debian/patches/01_apache2_other.dpatch    |  19 +
 0.6.1-8/debian/patches/02_sasl_section.dpatch |  58 ++
 0.6.1-8/debian/postinst                       |  79 +++
 0.6.1-8/debian/postrm                         |  42 ++
 0.6.1-8/debian/rules                          |  91 +++
 0.6.1-8/debian/watch                          |   6 +
 0.6.1-8/fail2ban                              |  75 +++
 0.6.1-8/fail2ban.h2m                          |  37 ++
 0.6.1-8/fail2ban.py                           | 581 ++++++++++++++++++
 0.6.1-8/firewall/__init__.py                  |  25 +
 0.6.1-8/firewall/firewall.py                  | 192 ++++++
 0.6.1-8/logreader/__init__.py                 |  25 +
 0.6.1-8/logreader/logreader.py                | 234 +++++++
 0.6.1-8/man/fail2ban.8                        |  58 ++
 0.6.1-8/man/fail2ban.conf.5                   |  28 +
 0.6.1-8/setup.cfg                             |   5 +
 0.6.1-8/setup.py                              |  82 +++
 0.6.1-8/utils/__init__.py                     |  25 +
 0.6.1-8/utils/dns.py                          | 102 +++
 0.6.1-8/utils/mail.py                         |  91 +++
 0.6.1-8/utils/pidlock.py                      | 109 ++++
 0.6.1-8/utils/process.py                      | 137 +++++
 0.6.1-8/utils/strings.py                      |  40 ++
 0.6.1-8/version.py                            |  27 +
 49 files changed, 4863 insertions(+)
 create mode 100644 0.6.1-8/CHANGELOG
 create mode 100644 0.6.1-8/PKG-INFO
 create mode 100644 0.6.1-8/README
 create mode 100644 0.6.1-8/TODO
 create mode 100644 0.6.1-8/config/debian-initd
 create mode 100644 0.6.1-8/config/fail2ban.conf.hostsdeny
 create mode 100644 0.6.1-8/config/fail2ban.conf.iptables
 create mode 100644 0.6.1-8/config/fail2ban.conf.shorewall
 create mode 100644 0.6.1-8/config/fail2ban.logrotate
 create mode 100644 0.6.1-8/config/gentoo-confd
 create mode 100755 0.6.1-8/config/gentoo-initd
 create mode 100644 0.6.1-8/config/redhat-initd
 create mode 100644 0.6.1-8/confreader/__init__.py
 create mode 100644 0.6.1-8/confreader/configreader.py
 create mode 100644 0.6.1-8/debian/NEWS
 create mode 100644 0.6.1-8/debian/README.Debian
 create mode 100644 0.6.1-8/debian/TODO
 create mode 100644 0.6.1-8/debian/changelog
 create mode 100644 0.6.1-8/debian/compat
 create mode 100644 0.6.1-8/debian/control
 create mode 100644 0.6.1-8/debian/copyright
 create mode 100644 0.6.1-8/debian/docs
 create mode 100755 0.6.1-8/debian/patches/00_proftpd_section.dpatch
 create mode 100755 0.6.1-8/debian/patches/00_vsftpd_regexp.dpatch
 create mode 100644 0.6.1-8/debian/patches/00list
 create mode 100644 0.6.1-8/debian/patches/01_apache2_other.dpatch
 create mode 100755 0.6.1-8/debian/patches/02_sasl_section.dpatch
 create mode 100755 0.6.1-8/debian/postinst
 create mode 100755 0.6.1-8/debian/postrm
 create mode 100755 0.6.1-8/debian/rules
 create mode 100644 0.6.1-8/debian/watch
 create mode 100755 0.6.1-8/fail2ban
 create mode 100644 0.6.1-8/fail2ban.h2m
 create mode 100755 0.6.1-8/fail2ban.py
 create mode 100644 0.6.1-8/firewall/__init__.py
 create mode 100644 0.6.1-8/firewall/firewall.py
 create mode 100644 0.6.1-8/logreader/__init__.py
 create mode 100644 0.6.1-8/logreader/logreader.py
 create mode 100644 0.6.1-8/man/fail2ban.8
 create mode 100644 0.6.1-8/man/fail2ban.conf.5
 create mode 100644 0.6.1-8/setup.cfg
 create mode 100755 0.6.1-8/setup.py
 create mode 100644 0.6.1-8/utils/__init__.py
 create mode 100644 0.6.1-8/utils/dns.py
 create mode 100644 0.6.1-8/utils/mail.py
 create mode 100644 0.6.1-8/utils/pidlock.py
 create mode 100644 0.6.1-8/utils/process.py
 create mode 100644 0.6.1-8/utils/strings.py
 create mode 100644 0.6.1-8/version.py

diff --git a/0.6.1-8/CHANGELOG b/0.6.1-8/CHANGELOG
new file mode 100644
index 00000000..fd74f7ce
--- /dev/null
+++ b/0.6.1-8/CHANGELOG
@@ -0,0 +1,191 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+Fail2Ban (version 0.6.1)                           2006/03/16
+=============================================================
+
+ver. 0.6.1 (2006/03/16) - stable
+----------
+- Added permanent banning. Set banTime to a negative value to
+  enable this feature (-1 is perfect). Thanks to Mannone
+- Fixed locale bug. Thanks to Fernando José
+- Fixed crash when time format does not match data
+- Propagated patch from Debian to fix fail2ban search path 
+  addition to the path search list: now it is added first. 
+  Thanks to Nick Craig-Wood
+- Added SMTP authentification for mail notification. Thanks
+  to Markus Hoffmann
+- Removed debug mode as it is confusing for people
+- Added parsing of timestamp in TAI64N format (#1275325).
+  Thanks to Mark Edgington
+- Added patch #1382936 (Default formatted syslog logging).
+  Thanks to Patrick Börjesson
+- Removed 192.168.0.0/16 from ignoreip. Attacks could also
+  come from the local network.
+- Robust startup: if iptables module does not get fully
+  initialized after startup of fail2ban, fail2ban will do
+  "maxreinit" attempts to initialize its own firewall. It
+  will sleep between attempts for "polltime" number of
+  seconds (closes Debian: #334272). Thanks to Yaroslav
+  Halchenko
+- Added "interpolations" in fail2ban.conf. This is provided
+  by the ConfigParser module. Old configuration files still
+  work. Thanks to Yaroslav Halchenko
+- Added initial support for hosts.deny and shorewall. Need
+  more testing. Please test. Thanks to kojiro from Gentoo
+  forum for hosts.deny support
+- Added support for vsftpd. Thanks to zugeschmiert
+
+ver. 0.6.0 (2005/11/20) - stable
+----------
+- Propagated patches introduced by Debian maintainer 
+  (Yaroslav Halchenko):
+  * Added an option to report local time (including timezone)
+    or GMT in mail notification.
+
+ver. 0.5.5 (2005/10/26) - beta
+----------
+- Propagated patches introduced by Debian maintainer 
+  (Yaroslav Halchenko):
+  * Introduced fwcheck option to verify consistency of the
+    chains. Implemented automatic restart of fail2ban main
+    function in case check of fwban or fwunban command failed
+    (closes: #329163, #331695). (Introduced patch was further
+    adjusted by upstream author).
+  * Added -f command line parameter for [findtime].
+  * Added a cleanup of firewall rules on emergency shutdown
+    when unknown exception is catched.
+  * Fail2ban should not crash now if a wrong file name is
+    specified in config.
+  * reordered code a bit so that log targets are setup right
+    after background and then only loglevel (verbose, debug)
+    is processed, so the warning could be seen in the logs
+  * Added a keyword <section> in parsing of the subject and
+    the body of an email sent out by fail2ban (closes:
+    #330311)
+
+ver. 0.5.4 (2005/09/13) - beta
+----------
+- Fixed bug #1286222.
+- Propagated patches introduced by Debian maintainer 
+  (Yaroslav Halchenko):
+  * Fixed handling of SYSLOG logging target. Now it can log
+    to any SYSLOG target and facility as directed by the 
+    config
+  * Format of SYSLOG entries fixed to look closer to standard
+  * Fixed errata in config/gentoo-confd
+  * Introduced findtime configuration variable to control the
+    lifetime of caught "failed" log entries
+	
+ver. 0.5.3 (2005/09/08) - beta
+----------
+- Fixed a bug when overriding "maxfailures" or "bantime".
+  Thanks to Yaroslav Halchenko
+- Added more debug output if an error occurs when sending
+  mail. Thanks to Stephen Gildea
+- Renamed "maxretry" to "maxfailures" and changed default
+  value to 5. Thanks to Stephen Gildea
+- Hopefully fixed bug #1256075
+- Fixed bug #1262345
+- Fixed exception handling in PIDLock
+- Removed warning when using "-V" or "-h" with no config
+  file. Thanks to Yaroslav Halchenko
+- Removed "-i eth0" from config file. Thanks to Yaroslav
+  Halchenko
+
+ver. 0.5.2 (2005/08/06) - beta
+----------
+- Better PID lock file handling. Should close #1239562
+- Added man pages
+- Removed log4py dependency. Use logging module instead
+- "maxretry" and "bantime" can be overridden in each section
+- Fixed bug #1246278 (excessive memory usage)
+- Fixed crash on wrong option value in configuration file
+- Changed custom chains to lowercase
+
+ver. 0.5.1 (2005/07/23) - beta
+----------
+- Fixed bugs #1241756, #1239557
+- Added log targets in configuration file. Removed -l option
+- Changed iptables rules in order to create a separated chain
+  for each section
+- Fixed static banList in firewall.py
+- Added an initd script for Debian. Thanks to Yaroslav
+  Halchenko
+- Check for obsolete files after install
+
+ver. 0.5.0 (2005/07/12) - beta
+----------
+- Added support for CIDR mask in ignoreip
+- Added mail notification support
+- Fixed bug #1234699
+- Added tags replacement in rules definition. Should allow a
+  clean solution for Feature Request #1229479
+- Removed "interface" and "firewall" options
+- Added start and end commands in the configuration file.
+  Thanks to Yaroslav Halchenko
+- Added firewall rules definition in the configuration file
+- Cleaned fail2ban.py
+- Added an initd script for RedHat/Fedora. Thanks to Andrey
+  G. Grozin
+
+ver. 0.4.1 (2005/06/30) - stable
+----------
+- Fixed textToDNS method which generated wrong matches for
+  "rhost=12-xyz...". Thanks to Tom Pike
+- fail2ban.conf modified for readability. Thanks to Iain Lea
+- Added an initd script for Gentoo
+- Changed default PID lock file location from /tmp to
+  /var/run
+
+ver. 0.4.0 (2005/04/24) - stable
+----------
+- Fixed textToDNS which did not recognize strings like
+  "12-345-67-890.abcd.mnopqr.xyz"
+
+ver. 0.3.1 (2005/03/31) - beta
+----------
+- Corrected level of messages
+- Added DNS lookup support
+- Improved parsing speed. Only parse the new log messages
+- Added a second verbose level (-vv)
+
+ver. 0.3.0 (2005/02/24) - beta
+----------
+- Re-writting of parts of the code in order to handle several
+  log files with different rules
+- Removed sshd.py because it is no more needed
+- Fixed a bug when exiting with IP in the ban list
+- Added PID lock file
+- Improved some parts of the code
+- Added ipfw-start-rule option (thanks to Robert Edeker)
+- Added -k option which kills a currently running Fail2Ban
+
+ver. 0.1.2 (2004/11/21) - beta
+----------
+- Add ipfw and ipfwadm support. The rules are taken from
+  BlockIt. Thanks to Robert Edeker
+- Add -e option which allows to set the interface. Thanks to
+  Robert Edeker who reminded me this
+- Small code cleaning
+
+ver. 0.1.1 (2004/10/23) - beta
+----------
+- Add SIGTERM handler in order to exit nicely when in daemon
+  mode
+- Add -r option which allows to set the maximum number of
+  login failures
+- Remove the Metalog class as the log file are not so syslog
+  daemon specific
+- Rewrite log reader to be service centered. Sshd support
+  added. Match "Failed password" and "Illegal user"
+- Add /etc/fail2ban.conf configuration support
+- Code documentation
+
+
+ver. 0.1.0 (2004/10/12) - alpha
+----------
+- Initial release
diff --git a/0.6.1-8/PKG-INFO b/0.6.1-8/PKG-INFO
new file mode 100644
index 00000000..57b716d8
--- /dev/null
+++ b/0.6.1-8/PKG-INFO
@@ -0,0 +1,15 @@
+Metadata-Version: 1.0
+Name: fail2ban
+Version: 0.6.1
+Summary: Ban IPs that make too many password failure
+Home-page: http://fail2ban.sourceforge.net
+Author: Cyril Jaquier
+Author-email: lostcontrol@users.sourceforge.net
+License: GPL
+Description: 
+        Fail2Ban scans log files like /var/log/pwdfail or
+        /var/log/apache/error_log and bans IP that makes
+        too many password failures. It updates firewall rules
+        to reject the IP address or executes user defined
+        commands.
+Platform: Posix
diff --git a/0.6.1-8/README b/0.6.1-8/README
new file mode 100644
index 00000000..c7878a59
--- /dev/null
+++ b/0.6.1-8/README
@@ -0,0 +1,156 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+Fail2Ban (version 0.6.1)                           2006/03/16
+=============================================================
+
+Fail2Ban scans log files like /var/log/pwdfail and bans IP
+that makes too many password failures. It updates firewall
+rules to reject the IP address. These rules can be defined by
+the user. Fail2Ban can read multiple log files such as sshd
+or Apache web server ones.
+
+This is my first Python program. Moreover, English is not my
+mother tongue...
+
+
+More details:
+-------------
+
+Fail2Ban is rather simple. I have a home server connected to
+the Internet which runs apache, samba, sshd, ... I see in my
+logs that people are trying to log into my box using "manual"
+brute force or scripts. They try 10, 20 and sometimes more
+user/password (without success anyway). In order to
+discourage these script kiddies, I wanted that sshd refuse
+login from a specific ip after 3 password failures. After
+some Google searches, I found that sshd was not able of that.
+So I search for a script or program that do it. I found
+nothing :-( So I decide to write mine and to learn Python :-)
+
+For each sections defined in the configuration file, Fail2Ban
+tries to find lines which match the failregex. Then it
+retrieves the message time using timeregex and timepattern.
+It finally gets the ip and if it has already done 3 or more
+password failures in the last banTime, the ip is banned for
+banTime using a firewall rule. This rule is set by the user
+in the configuration file. Thus, Fail2Ban can be adapted for
+lots of firewall. After banTime, the rule is deleted. Notice
+that if no "plain" ip is available, Fail2Ban try to do DNS
+lookup in order to found one or several ip's to ban.
+
+Sections can be freely added so it is possible to monitor
+several daemons at the same time.
+
+Runs on my server and does its job rather well :-) The idea
+is to make fail2ban usable with daemons and services that
+require a login (sshd, telnetd, ...) and with different
+firewalls.
+
+
+Installation:
+-------------
+
+Require: python-2.4 (http://www.python.org)
+
+To install, just do:
+
+> tar xvfj fail2ban-0.6.1.tar.bz2
+> cd fail2ban-0.6.1
+> python setup.py install
+
+This will install Fail2Ban into /usr/lib/fail2ban. The
+fail2ban executable is placed into /usr/bin.
+
+Gentoo: ebuilds are available on the website.
+Debian: Fail2Ban is in Debian unstable.
+RedHat: packages are available on the website.
+
+Fail2Ban should now be correctly installed. Just type:
+
+> fail2ban -h
+
+to see if everything is alright. You can configure fail2ban
+with a config file. Different kind of configuration files are
+available:
+
+iptables:   copy config/fail2ban.conf.iptables to
+            /etc/fail2ban.conf
+hosts.deny: copy config/fail2ban.conf.hostsdeny to
+            /etc/fail2ban.conf
+shorewall:  copy config/fail2ban.conf.shorewall to
+            /etc/fail2ban.conf
+
+Do not forget to edit fail2ban.conf to meet your needs.
+
+You can use the initd script available in config/. Copy
+<dist>-initd to /etc/init.d/fail2ban. Gentoo users must copy
+gentoo-confd to /etc/conf.d/fail2ban. You can start fail2ban:
+
+> /etc/init.d/fail2ban start
+
+Gentoo users can add it to the default runlevel:
+
+> rc-update add fail2ban default
+
+Configuration:
+--------------
+
+You can configure fail2ban using the file /etc/fail2ban.conf
+or using command line options. Command line options override
+the value stored in fail2ban.conf. Here are the command line
+options:
+
+  -b         start in background
+  -c <FILE>  read configuration file FILE
+  -p <FILE>  create PID lock in FILE
+  -h         display this help message
+  -i <IP(s)> IP(s) to ignore
+  -k         kill a currently running instance
+  -r <VALUE> allow a max of VALUE password failure [maxfailures]
+  -t <TIME>  ban IP for TIME seconds [bantime]
+  -f <TIME>  lifetime in seconds of failed entry [findtime]
+  -v         verbose. Use twice for greater effect
+  -V         print software version
+
+Contact:
+--------
+
+You need some new features, you found bugs or you just
+appreciate this program, you can contact me at :
+
+Website: http://fail2ban.sourceforge.net
+
+Cyril Jaquier: <lostcontrol@users.sourceforge.net>
+
+
+Thanks:
+-------
+
+Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
+Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
+Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
+Edgington, Patrick Börjesson, kojiro, zugeschmiert
+
+License:
+--------
+
+Fail2Ban is free software; you can redistribute it
+and/or modify it under the terms of the GNU General Public
+License as published by the Free Software Foundation; either
+version 2 of the License, or (at your option) any later
+version.
+
+Fail2Ban is distributed in the hope that it will be
+useful, but WITHOUT ANY WARRANTY; without even the implied
+warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public
+License along with Fail2Ban; if not, write to the Free
+Software Foundation, Inc., 59 Temple Place, Suite 330,
+Boston, MA  02111-1307  USA
diff --git a/0.6.1-8/TODO b/0.6.1-8/TODO
new file mode 100644
index 00000000..47ef6d93
--- /dev/null
+++ b/0.6.1-8/TODO
@@ -0,0 +1,95 @@
+               __      _ _ ___ _               
+              / _|__ _(_) |_  ) |__  __ _ _ _  
+             |  _/ _` | | |/ /| '_ \/ _` | ' \ 
+             |_| \__,_|_|_/___|_.__/\__,_|_||_|
+
+=============================================================
+ToDo                                        $Revision: 1.11 $
+=============================================================
+
+See Feature Request Tracking System at SourceForge.net
+
+- improve installation process (better prefix support)
+
+- improve documentation and website for user
+
+- use Doxygen
+
+- use PyLint to check the code
+
+- better configuration files
+
+- add a check to see if the time of the log messages is
+  correctly detected (valid regexp)
+
+- use Gentoo Portage style for scripts.
+  - banning engines script in /etc/fail2ban/scripts.d
+    Example: /etc/fail2ban/scripts.d/iptables
+    Will be mostly bash scripting which is more "user
+    friendly".
+  - split configuration files in /etc/fail2ban/services.d
+    for log files
+    Example: /etc/fail2ban/services.d/apache
+    Mainly regular expressions.
+  - template for common regex in /etc/fail2ban/templates.d
+    Example: /etc/fail2ban/templates.d/date
+    Mainly regular expressions.
+
+- remove debug mode (root check)
+
+- better return values in function
+
+- use more email.Utils in mail.py
+
+- add gettext support. Is this really needed for a server
+  utility?
+
+- send an email when fail2ban is running
+
+- add multithreading. Python threading is not really
+  efficient. However, fail2ban could benefit of it. We could
+  use threads like this:
+  - one thread which check for host to unban.
+  - one thread per file to watch. This will allow things like
+    different polling time for each file.
+  <srv> is read-only (we only read log files) thus no locks
+  are required. However, <meth> is read-write and must take
+  care of concurrency in case of multithreading.
+
+- add FAM/Gamin support. Should be quite efficient with
+  threading. Take care that handle_one_event() release the
+  Python lock.
+
+- add a test framework. We could use unittest which is in
+  Python since 2.1. It should be possible to run all tests
+  automatically.
+
+- add client/server using socket. Something similar to
+  gdesklets. DBUS seems to be designed for desktop use.
+  - fail2ban start -> start the daemon.
+  - fail2ban stop -> stop the daemon.
+  - fail2ban add <srv> <meth> -> add <srv> monitoring with
+    <meth> ban method (iptables, hosts.deny, etc).
+  - fail2ban del <srv> -> remove <srv> monitoring.
+  - fail2ban status <srv> -> query current fail2ban status.
+    Should return infos like a ban counter. Could be graph
+    with rrdtool.
+  - fail2ban pause <srv> -> suspend monitoring.
+  - fail2ban resume <srv> -> resume monitoring.
+  - fail2ban list -> list available services.
+  - fail2ban flush <srv> -> flush the <srv> ban list.
+  
+- remove PID file.
+
+- remove most of the command lines options if possible.
+
+- add the possibility to specify wildcard in log files.
+  Example: logfile = /var/log/apache2/access-*.log
+  Should we start one thread per file or just one thread per
+  serivce?
+
+- autodetect date format in log file. Match the most popular
+  format and sort them using the hit ratio. Should avoid
+  user problem with regex and not have a big impact on perfs.
+
+- restart automatically the daemon if an exception occurs.
diff --git a/0.6.1-8/config/debian-initd b/0.6.1-8/config/debian-initd
new file mode 100644
index 00000000..a6373ce6
--- /dev/null
+++ b/0.6.1-8/config/debian-initd
@@ -0,0 +1,149 @@
+#! /bin/sh
+### BEGIN INIT INFO
+# Provides:          fail2ban
+# Required-Start:    $local_fs $remote_fs
+# Required-Stop:     $local_fs $remote_fs
+# Should-Start:      $time $network $syslog iptables firehol shorewall ipmasq
+# Should-Stop:       $network $syslog iptables firehol shorewall ipmasq
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Start/stop fail2ban
+# Description:       Start/stop fail2ban, a daemon scanning the log files and
+#                    banning potential attackers.
+### END INIT INFO
+
+# Author: Aaron Isotton <aaron@isotton.com>
+# Modified: by Yaroslav Halchenko <debian@onerussian.com>
+#  reindented + minor corrections + to work on sarge without modifications
+#
+PATH=/usr/sbin:/usr/bin:/sbin:/bin
+DESC="authentication failure monitor"
+NAME=fail2ban
+DAEMON=/usr/bin/$NAME
+PIDFILE=/var/run/$NAME.pid
+SCRIPTNAME=/etc/init.d/$NAME
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+DAEMON_ARGS="$FAIL2BAN_OPTS"
+
+# Load the VERBOSE setting and other rcS variables
+[ -f /etc/default/rcS ] && . /etc/default/rcS
+
+# Predefine what can be missing from lsb source later on -- necessary to run
+# on sarge. Just present it in a bit more compact way from what was shipped
+log_daemon_msg () {
+	[ -z "$1" ] && return 1
+	echo -n "$1:"
+	[ -z "$2" ] || echo -n " $2"
+}
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
+# Actually has to (>=2.0-7) present in sarge. log_daemon_msg is predefined
+#  so we must be ok
+. /lib/lsb/init-functions
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+	# Return
+	#	0 if daemon has been started
+	#	1 if daemon was already running
+	#	2 if daemon could not be started
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
+		|| return 1
+	# we need to remove pid file or fail2ban would refuse to start
+	# probably check could be ommited but... better be safe
+	pidofproc $NAME $PIDFILE > /dev/null
+	[ $? -eq 2 ] && rm -rf $PIDFILE
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \
+		$DAEMON_ARGS \
+		|| return 2
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+	# Return
+	#	0 if daemon has been stopped
+	#	1 if daemon was already stopped
+	#	2 if daemon could not be stopped
+	#	other if a failure occurred
+	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
+	RETVAL="$?"
+	[ "$RETVAL" = 2 ] && return 2
+	start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
+	[ "$?" = 2 ] && return 2
+	return "$RETVAL"
+}
+
+
+# yoh:
+# shortcut function to don't duplicate case statements and to don't use
+# bashisms (arrays). Fixes #368218
+#
+log_end_msg_wrapper()
+{
+	[ $1 -lt $2 ] && value=0 || value=1
+	log_end_msg $value
+}
+
+case "$1" in
+	start)
+		[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
+		do_start
+		[ "$VERBOSE" != no ] && log_end_msg_wrapper $? 2
+		;;
+	stop)
+		[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
+		do_stop
+		[ "$VERBOSE" != no ] && log_end_msg_wrapper $? 2
+		;;
+	restart|force-reload)
+		log_daemon_msg "Restarting $DESC" "$NAME"
+		do_stop
+		case "$?" in
+			0|1)
+				do_start
+				log_end_msg_wrapper $? 1
+				;;
+			*)
+				# Failed to stop
+				log_end_msg 1
+				;;
+ 		esac
+		;;
+	status)
+		log_daemon_msg "Status of $DESC"
+		pidofproc $NAME $PIDFILE > /dev/null
+		status=$?
+		case $status in
+			0)  log_success_msg " $NAME is running"
+				exit 0
+				;;
+			1|2) log_failure_msg " $NAME is not running but $PIDFILE exists"
+				exit 1
+				;;
+			3)  log_warning_msg " $NAME is not running"
+				exit 3
+				;;
+			4)  log_failure_msg " $PIDFILE not readable, status of $NAME unknown"
+				exit 4
+				;;
+		esac
+		;;
+	*)
+		echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload|status}" >&2
+		exit 3
+		;;
+esac
+
+:
diff --git a/0.6.1-8/config/fail2ban.conf.hostsdeny b/0.6.1-8/config/fail2ban.conf.hostsdeny
new file mode 100644
index 00000000..09a129bb
--- /dev/null
+++ b/0.6.1-8/config/fail2ban.conf.hostsdeny
@@ -0,0 +1,327 @@
+# Fail2Ban configuration file
+#
+# $Revision: 1.2 $
+#
+# 2005.06.21  modified for readability  Iain Lea  iain@bricbrac.de
+
+[DEFAULT]
+# Option:  background
+# Notes.:  start fail2ban as a daemon. Output is redirect to logfile.
+# Values:  [true | false]  Default:  false
+#
+background = false
+
+# Option:  logtargets
+# Notes.:  log targets. Space separated list of logging targets.
+# Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
+#
+logtargets = /var/log/fail2ban.log
+
+# Option:  syslog-target
+# Notes.:  where to find syslog facility if logtarget SYSLOG.
+# Values:  SOCKET HOST HOST:PORT  Default: /dev/log
+#
+syslog-target = /dev/log
+
+# Option:  syslog-facility
+# Notes.:  which syslog facility to use if logtarget SYSLOG.
+# Values:  NUM  Default: 1
+#
+syslog-facility = 1
+
+# Option:  pidlock
+# Notes.:  path of the PID lock file (must be able to write to file).
+# Values:  FILE  Default:  /var/run/fail2ban.pid
+#
+pidlock = /var/run/fail2ban.pid
+
+# Option:  maxfailures
+# Notes.:  number of failures before IP gets banned.
+# Values:  NUM  Default:  5
+#
+maxfailures = 5
+
+# Option:  bantime
+# Notes.:  number of seconds an IP will be banned. If set to a negative
+#          value, IP will never be unbanned (permanent banning).
+# Values:  NUM  Default:  600
+#
+bantime = 600
+
+# Option:  findtime
+# Notes.:  lifetime in seconds of a "failed" log entry.
+# Values:  NUM  Default:  600
+#
+findtime = 600
+
+# Option:  ignoreip
+# Notes.:  space separated list of IP's to be ignored by fail2ban.
+#          You can use CIDR mask in order to specify a range.
+#          Example:  ignoreip = 192.168.0.1/24 123.45.235.65
+# Values:  IP  Default:  
+#
+ignoreip = 
+
+# Option:  cmdstart
+# Notes.:  command executed once at the start of Fail2Ban
+# Values:  CMD  Default:
+#
+cmdstart = 
+
+# Option:  cmdend
+# Notes.:  command executed once at the end of Fail2Ban.
+# Values:  CMD  Default:
+#
+cmdend = 
+
+# Option:  polltime
+# Notes.:  number of seconds fail2ban sleeps between iterations.
+# Values:  NUM  Default:  1
+#
+polltime = 1
+
+# Option:  reinittime
+# Notes.:  minimal number of seconds between the re-initialization of
+#          firewalls due to external changes in their rules (see fwcheck)
+# Values:  NUM  Default:  100
+#
+reinittime = 10
+
+# Option:  maxreinits
+# Notes.:  maximal number of re-initialization of firewalls due to external
+#          changes. -1 stays for infinite, so only reinittime is of importance
+# Values:  NUM  Default:  -1
+#
+maxreinits = 1000
+
+# NOTE: Interpolations
+#
+# fwstart, as well as fwend, fwcheck, fwban, fwunban, use interpolations
+# so %(__name__)s  will be substituted by a name of each section
+# (unless the option is overriden in a section).
+# If you are going to use interpolations in your setup, please make
+# sure that you specified options port and protocol (which also has
+# an option in DEFAULT).
+#
+
+# Option:  hostsdeny
+# Notes.:  hosts.deny file path.
+# Values:  STR  Default:  /etc/hosts.deny
+#
+hostsdeny = /etc/hosts.deny
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+fwban = IP=<ip> && echo "ALL: $IP" >> %(hostsdeny)s
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+fwunban = IP=<ip> && sed -i.old s/ALL:\ $IP// %(hostsdeny)s
+
+[MAIL]
+# Option:  enabled
+# Notes.:  enable mail notification when banning an IP address.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  host
+# Notes.:  host running the mail server.
+# Values:  STR  Default:  localhost
+#
+host = localhost
+
+# Option:  port
+# Notes.:  port of the mail server.
+# Values:  INT  Default:  25
+#
+port = 25
+
+# Option:  user
+# Notes.:  the username for smtp-server if authentification is required.
+#          if user is empty, no authentification is done.
+# Values:  STR  Default:  
+#
+user = 
+
+# Option:  password
+# Notes.:  the smtp-user's password if authentification is required.
+# Values:  STR  Default:  
+#
+password = 
+
+# Option:  from
+# Notes.:  e-mail address of the sender.
+# Values:  MAIL  Default:  fail2ban
+#
+from = fail2ban
+
+# Option:  to
+# Notes.:  e-mail addresses of the receiver. Addresses are space
+#          separated.
+# Values:  MAIL  Default:  root
+#
+to = root
+
+# Option:  localtime
+# Notes.:  report local time (including timezone) or GMT
+# Values:  [true | false]  Default:  false
+#
+localtime = true
+
+# Option:  subject
+# Notes.:  subject of the e-mail.
+# Tags:    <section> active section (eg ssh, apache, etc)
+#          <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+# Values:  TEXT  Default:  [Fail2Ban] <section>: Banned <ip>
+#
+subject = [Fail2Ban] <section>: Banned <ip>
+
+# Option:  message
+# Notes.:  message of the e-mail.
+# Tags:    <section> active section (eg ssh, apache, etc)
+#          <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <br>  new line
+# Values:  TEXT  Default:
+#
+message = Hi,<br>
+          The IP <ip> has just been banned by Fail2Ban after
+          <failures> attempts against <section>.<br>
+          Regards,<br>
+          Fail2Ban
+
+# You can define a new section for each log file to check for
+# password failure. Each section has to define the following
+# options: logfile, fwban, fwunban, timeregex, timepattern,
+# failregex.
+
+
+[Apache]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/httpd/access_log
+#
+logfile = /var/log/httpd/access_log
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in Apache logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
+# Values:  [Wed Jan 05 15:08:01 2005]
+# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+#
+timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
+# Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
+#
+timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile.
+# Values:  TEXT  Default:  authentication failure|user .* not found
+#
+failregex = authentication failure|user .* not found
+
+
+[VSFTPD]
+# Option: enabled
+# Notes.: enable monitoring for this section.
+# Values: [true | false] Default: false
+#
+enabled = false
+
+# Option: logfile
+# Notes.: logfile to monitor.
+# Values: FILE Default: /var/log/secure
+#
+logfile = /var/log/vsftpd.log
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ftp
+
+# Option: timeregex
+# Notes.: regex to match timestamp in VSFTPD logfile.
+# Values: [Mar 7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option: timepattern
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT Default: Authentication failure|Failed password|Invalid user
+#
+failregex = FAIL LOGIN
+
+
+[SSH]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  true
+#
+enabled = true
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/secure
+#
+logfile = /var/log/secure
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
+# Values:  [Mar  7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
+# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile.
+# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
+#
+failregex = Authentication failure|Failed password|Invalid user
diff --git a/0.6.1-8/config/fail2ban.conf.iptables b/0.6.1-8/config/fail2ban.conf.iptables
new file mode 100644
index 00000000..225ffa60
--- /dev/null
+++ b/0.6.1-8/config/fail2ban.conf.iptables
@@ -0,0 +1,427 @@
+# Fail2Ban configuration file
+#
+# $Revision: 1.9 $
+#
+# 2005.06.21  modified for readability  Iain Lea  iain@bricbrac.de
+
+[DEFAULT]
+# Option:  background
+# Notes.:  start fail2ban as a daemon. Output is redirect to logfile.
+# Values:  [true | false]  Default:  false
+#
+background = true
+
+# Option:  verbose
+# Notes.:  verbosity of the output.
+#           0 - regular level
+#           1 - INFO level
+#           2 - DEBUG level (but commands get executed as opposed to
+#                debug option)
+# Values:  NUM  Default:  0
+#
+verbose = 1
+
+# Option:  debug
+# Notes.:  enable debug mode. No real commands gets executed but only
+#          reported, more verbose output, bypass root user test.
+# Values:  [true | false]  Default:  false
+#
+debug = false
+
+# Option:  logtargets
+# Notes.:  log targets. Space separated list of logging targets.
+# Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
+#
+logtargets = /var/log/fail2ban.log
+
+# Option:  syslog-target
+# Notes.:  where to find syslog facility if logtarget SYSLOG.
+# Values:  SOCKET HOST HOST:PORT  Default: /dev/log
+#
+syslog-target = /dev/log
+
+# Option:  syslog-facility
+# Notes.:  which syslog facility to use if logtarget SYSLOG.
+# Values:  NUM  Default: 1
+#
+syslog-facility = 1
+
+# Option:  pidlock
+# Notes.:  path of the PID lock file (must be able to write to file).
+# Values:  FILE  Default:  /var/run/fail2ban.pid
+#
+pidlock = /var/run/fail2ban.pid
+
+# Option:  maxfailures
+# Notes.:  number of failures before IP gets banned.
+# Values:  NUM  Default:  5
+#
+maxfailures = 5
+
+# Option:  bantime
+# Notes.:  number of seconds an IP will be banned. If set to a negative
+#          value, IP will never be unbanned (permanent banning).
+# Values:  NUM  Default:  600
+#
+bantime = 600
+
+# Option:  findtime
+# Notes.:  lifetime in seconds of a "failed" log entry.
+# Values:  NUM  Default:  600
+#
+findtime = 600
+
+# Option:  ignoreip
+# Notes.:  space separated list of IP's to be ignored by fail2ban.
+#          You can use CIDR mask in order to specify a range.
+#          Example:  ignoreip = 192.168.0.1/24 123.45.235.65
+# Values:  IP  Default:  
+#
+ignoreip = 
+
+# Option:  cmdstart
+# Notes.:  command executed once at the start of Fail2Ban
+# Values:  CMD  Default:
+#
+cmdstart = 
+
+# Option:  cmdend
+# Notes.:  command executed once at the end of Fail2Ban.
+# Values:  CMD  Default:
+#
+cmdend = 
+
+# Option:  polltime
+# Notes.:  number of seconds fail2ban sleeps between iterations.
+# Values:  NUM  Default:  1
+#
+polltime = 1
+
+# Option:  reinittime
+# Notes.:  minimal number of seconds between the re-initialization of
+#          firewalls due to external changes in their rules (see fwcheck)
+# Values:  NUM  Default:  100
+#
+reinittime = 10
+
+# Option:  maxreinits
+# Notes.:  maximal number of re-initialization of firewalls due to external
+#          changes. -1 stays for infinite, so only reinittime is of importance
+# Values:  NUM  Default:  -1
+#
+maxreinits = 1000
+
+# NOTE: Interpolations
+#
+# fwstart, as well as fwend, fwcheck, fwban, fwunban, use interpolations
+# so %(__name__)s  will be substituted by a name of each section
+# (unless the option is overriden in a section).
+# If you are going to use interpolations in your setup, please make
+# sure that you specified options port and protocol (which also has
+# an option in DEFAULT).
+#
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  fwchain
+# Notes.:  chain from which to jump into fail2ban chains
+# Values:  TEXT  Default: INPUT
+#
+fwchain = INPUT
+
+# Option:  fwstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD  Default:
+#
+fwstart = iptables -N fail2ban-%(__name__)s
+          iptables -A fail2ban-%(__name__)s -j RETURN
+          iptables -I %(fwchain)s -p %(protocol)s --dport %(port)s -j fail2ban-%(__name__)s
+
+# Option:  fwend
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD  Default:
+#
+fwend = iptables -D %(fwchain)s -p %(protocol)s --dport %(port)s -j fail2ban-%(__name__)s
+        iptables -F fail2ban-%(__name__)s
+        iptables -X fail2ban-%(__name__)s
+
+# Option:  fwcheck
+# Notes.:  command executed once before each fwban command
+# Values:  CMD  Default:
+#
+fwcheck = iptables -L %(fwchain)s | grep -q fail2ban-%(__name__)s
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+fwban = iptables -I fail2ban-%(__name__)s 1 -s <ip> -j DROP
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+fwunban = iptables -D fail2ban-%(__name__)s -s <ip> -j DROP
+
+[MAIL]
+# Option:  enabled
+# Notes.:  enable mail notification when banning an IP address.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  host
+# Notes.:  host running the mail server.
+# Values:  STR  Default:  localhost
+#
+host = localhost
+
+# Option:  port
+# Notes.:  port of the mail server.
+# Values:  INT  Default:  25
+#
+port = 25
+
+# Option:  user
+# Notes.:  the username for smtp-server if authentification is required.
+#          if user is empty, no authentification is done.
+# Values:  STR  Default:  
+#
+user = 
+
+# Option:  password
+# Notes.:  the smtp-user's password if authentification is required.
+# Values:  STR  Default:  
+#
+password = 
+
+# Option:  from
+# Notes.:  e-mail address of the sender.
+# Values:  MAIL  Default:  fail2ban
+#
+from = fail2ban@localhost
+
+# Option:  to
+# Notes.:  e-mail addresses of the receiver. Addresses are space
+#          separated.
+# Values:  MAIL  Default:  root
+#
+to = root@localhost
+
+# Option:  localtime
+# Notes.:  report local time (including timezone) or GMT
+# Values:  [true | false]  Default:  false
+#
+localtime = true
+
+# Option:  subject
+# Notes.:  subject of the e-mail.
+# Tags:    <section> active section (eg ssh, apache, etc)
+#          <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+# Values:  TEXT  Default:  [Fail2Ban] <section>: Banned <ip>
+#
+subject = [Fail2Ban] <section>: Banned <ip>
+
+# Option:  message
+# Notes.:  message of the e-mail.
+# Tags:    <section> active section (eg ssh, apache, etc)
+#          <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <br>  new line
+# Values:  TEXT  Default:
+#
+message = Hi,<br>
+          The IP <ip> has just been banned by Fail2Ban after
+          <failures> attempts against <section>.<br>
+          Regards,<br>
+          Fail2Ban
+
+# You can define a new section for each log file to check for
+# password failure. Each section has to define the following
+# options: logfile, fwban, fwunban, timeregex, timepattern,
+# failregex.
+
+
+[Apache]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/apache/error.log
+#
+logfile = /var/log/apache/error.log
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = http
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in Apache logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
+# Values:  [Wed Jan 05 15:08:01 2005]
+# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+#
+timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
+# Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
+#
+timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile.
+# Values:  TEXT  Default:  [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
+#
+failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
+
+[ApacheAttacks]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/apache/access.log
+#
+logfile = /var/log/apache/access.log
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = http
+
+# Option:  maxfailures
+# Notes.:  number of failures before IP gets banned.
+# Values:  NUM  Default:  5
+#
+maxfailures = 2
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in Apache access logfile.
+# Values:  [19/Feb/2006:08:38:18]
+# Default: \d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}
+#
+timeregex = \d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values:  TEXT  Default: %%d/%%b/%%Y:%%H:%%M:%%S
+#
+timepattern = %%d/%%b/%%Y:%%H:%%M:%%S
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile.
+# Values:  TEXT  Default:  [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
+#
+failregex = ^(?P<host>\S*) -.*"GET .*(?:awstats\.pl\?configdir=|index2\.php\?_REQUEST\[option\].*)\|echo.*
+
+[VSFTPD]
+# Option: enabled
+# Notes.: enable monitoring for this section.
+# Values: [true | false] Default: false
+#
+enabled = false
+
+# Option: logfile
+# Notes.: logfile to monitor.
+# Values: FILE Default: /var/log/secure
+#
+logfile = /var/log/vsftpd.log
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ftp
+
+# Option: timeregex
+# Notes.: regex to match timestamp in VSFTPD logfile.
+# Values: [Mar 7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option: timepattern
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT Default: Authentication failure|Failed password|Invalid user
+#
+failregex = FAIL LOGIN
+
+[SSH]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  true
+#
+enabled = true
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/auth.log
+#
+logfile = /var/log/auth.log
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
+# Values:  [Mar  7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
+# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile.
+# Values:  TEXT  Default:  (?:Authentication failure|Failed (?:keyboard-interactive/pam|password)) for(?: illegal user)? .* from (?:::f{4,6}:)?(?P<host>\S*)
+#
+failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
diff --git a/0.6.1-8/config/fail2ban.conf.shorewall b/0.6.1-8/config/fail2ban.conf.shorewall
new file mode 100644
index 00000000..1086d001
--- /dev/null
+++ b/0.6.1-8/config/fail2ban.conf.shorewall
@@ -0,0 +1,314 @@
+# Fail2Ban configuration file
+#
+# $Revision: 1.2 $
+#
+# 2005.06.21  modified for readability  Iain Lea  iain@bricbrac.de
+
+[DEFAULT]
+# Option:  background
+# Notes.:  start fail2ban as a daemon. Output is redirect to logfile.
+# Values:  [true | false]  Default:  false
+#
+background = false
+
+# Option:  logtargets
+# Notes.:  log targets. Space separated list of logging targets.
+# Values:  STDERR SYSLOG file  Default:  /var/log/fail2ban.log
+#
+logtargets = /var/log/fail2ban.log
+
+# Option:  syslog-target
+# Notes.:  where to find syslog facility if logtarget SYSLOG.
+# Values:  SOCKET HOST HOST:PORT  Default: /dev/log
+#
+syslog-target = /dev/log
+
+# Option:  syslog-facility
+# Notes.:  which syslog facility to use if logtarget SYSLOG.
+# Values:  NUM  Default: 1
+#
+syslog-facility = 1
+
+# Option:  pidlock
+# Notes.:  path of the PID lock file (must be able to write to file).
+# Values:  FILE  Default:  /var/run/fail2ban.pid
+#
+pidlock = /var/run/fail2ban.pid
+
+# Option:  maxfailures
+# Notes.:  number of failures before IP gets banned.
+# Values:  NUM  Default:  5
+#
+maxfailures = 5
+
+# Option:  bantime
+# Notes.:  number of seconds an IP will be banned. If set to a negative
+#          value, IP will never be unbanned (permanent banning).
+# Values:  NUM  Default:  600
+#
+bantime = 600
+
+# Option:  findtime
+# Notes.:  lifetime in seconds of a "failed" log entry.
+# Values:  NUM  Default:  600
+#
+findtime = 600
+
+# Option:  ignoreip
+# Notes.:  space separated list of IP's to be ignored by fail2ban.
+#          You can use CIDR mask in order to specify a range.
+#          Example:  ignoreip = 192.168.0.1/24 123.45.235.65
+# Values:  IP  Default:  
+#
+ignoreip = 
+
+# Option:  cmdstart
+# Notes.:  command executed once at the start of Fail2Ban
+# Values:  CMD  Default:
+#
+cmdstart = 
+
+# Option:  cmdend
+# Notes.:  command executed once at the end of Fail2Ban.
+# Values:  CMD  Default:
+#
+cmdend = 
+
+# Option:  polltime
+# Notes.:  number of seconds fail2ban sleeps between iterations.
+# Values:  NUM  Default:  1
+#
+polltime = 1
+
+# Option:  reinittime
+# Notes.:  minimal number of seconds between the re-initialization of
+#          firewalls due to external changes in their rules (see fwcheck)
+# Values:  NUM  Default:  100
+#
+reinittime = 10
+
+# Option:  maxreinits
+# Notes.:  maximal number of re-initialization of firewalls due to external
+#          changes. -1 stays for infinite, so only reinittime is of importance
+# Values:  NUM  Default:  -1
+#
+maxreinits = 1000
+
+# NOTE: Interpolations
+#
+# fwstart, as well as fwend, fwcheck, fwban, fwunban, use interpolations
+# so %(__name__)s  will be substituted by a name of each section
+# (unless the option is overriden in a section).
+# If you are going to use interpolations in your setup, please make
+# sure that you specified options port and protocol (which also has
+# an option in DEFAULT).
+#
+
+# Option:  fwban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <bantime>  unix timestamp of the ban time
+# Values:  CMD
+# Default: iptables -I INPUT 1 -s <ip> -j DROP
+#
+fwban = shorewall drop <ip>
+
+# Option:  fwunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <bantime>  unix timestamp of the ban time
+#          <unbantime>  unix timestamp of the unban time
+# Values:  CMD
+# Default: iptables -D INPUT -s <ip> -j DROP
+#
+fwunban = shorewall allow <ip>
+
+[MAIL]
+# Option:  enabled
+# Notes.:  enable mail notification when banning an IP address.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  host
+# Notes.:  host running the mail server.
+# Values:  STR  Default:  localhost
+#
+host = localhost
+
+# Option:  port
+# Notes.:  port of the mail server.
+# Values:  INT  Default:  25
+#
+port = 25
+
+# Option:  user
+# Notes.:  the username for smtp-server if authentification is required.
+#          if user is empty, no authentification is done.
+# Values:  STR  Default:  
+#
+user = 
+
+# Option:  password
+# Notes.:  the smtp-user's password if authentification is required.
+# Values:  STR  Default:  
+#
+password = 
+
+# Option:  from
+# Notes.:  e-mail address of the sender.
+# Values:  MAIL  Default:  fail2ban
+#
+from = fail2ban
+
+# Option:  to
+# Notes.:  e-mail addresses of the receiver. Addresses are space
+#          separated.
+# Values:  MAIL  Default:  root
+#
+to = root
+
+# Option:  localtime
+# Notes.:  report local time (including timezone) or GMT
+# Values:  [true | false]  Default:  false
+#
+localtime = true
+
+# Option:  subject
+# Notes.:  subject of the e-mail.
+# Tags:    <section> active section (eg ssh, apache, etc)
+#          <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+# Values:  TEXT  Default:  [Fail2Ban] <section>: Banned <ip>
+#
+subject = [Fail2Ban] <section>: Banned <ip>
+
+# Option:  message
+# Notes.:  message of the e-mail.
+# Tags:    <section> active section (eg ssh, apache, etc)
+#          <ip>  IP address
+#          <failures>  number of failures
+#          <failtime>  unix timestamp of the last failure
+#          <br>  new line
+# Values:  TEXT  Default:
+#
+message = Hi,<br>
+          The IP <ip> has just been banned by Fail2Ban after
+          <failures> attempts against <section>.<br>
+          Regards,<br>
+          Fail2Ban
+
+# You can define a new section for each log file to check for
+# password failure. Each section has to define the following
+# options: logfile, fwban, fwunban, timeregex, timepattern,
+# failregex.
+
+
+[Apache]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  false
+#
+enabled = false
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/httpd/access_log
+#
+logfile = /var/log/httpd/access_log
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in Apache logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
+# Values:  [Wed Jan 05 15:08:01 2005]
+# Default: \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+#
+timeregex = \S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
+# Values:  TEXT  Default:  %%a %%b %%d %%H:%%M:%%S %%Y
+#
+timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile.
+# Values:  TEXT  Default:  authentication failure|user .* not found
+#
+failregex = authentication failure|user .* not found
+
+[VSFTPD]
+# Option: enabled
+# Notes.: enable monitoring for this section.
+# Values: [true | false] Default: false
+#
+enabled = false
+
+# Option: logfile
+# Notes.: logfile to monitor.
+# Values: FILE Default: /var/log/secure
+#
+logfile = /var/log/vsftpd.log
+
+# Option: timeregex
+# Notes.: regex to match timestamp in VSFTPD logfile.
+# Values: [Mar 7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option: timepattern
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT Default: Authentication failure|Failed password|Invalid user
+#
+failregex = FAIL LOGIN
+
+
+[SSH]
+# Option:  enabled
+# Notes.:  enable monitoring for this section.
+# Values:  [true | false]  Default:  true
+#
+enabled = true
+
+# Option:  logfile
+# Notes.:  logfile to monitor.
+# Values:  FILE  Default:  /var/log/secure
+#
+logfile = /var/log/secure
+
+# Option:  timeregex
+# Notes.:  regex to match timestamp in SSH logfile. For TAI64N format,
+#          use timeregex = @[0-9a-f]{24}
+# Values:  [Mar  7 17:53:28]
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+#
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
+
+# Option:  timepattern
+# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
+#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule).
+#          For TAI64N format, use timepattern = tai64n
+# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
+#
+timepattern = %%b %%d %%H:%%M:%%S
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile.
+# Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
+#
+failregex = Authentication failure|Failed password|Invalid user
diff --git a/0.6.1-8/config/fail2ban.logrotate b/0.6.1-8/config/fail2ban.logrotate
new file mode 100644
index 00000000..fe745f64
--- /dev/null
+++ b/0.6.1-8/config/fail2ban.logrotate
@@ -0,0 +1,10 @@
+/var/log/fail2ban.log {
+    weekly
+    rotate 4
+    compress
+    missingok
+    postrotate
+	/etc/init.d/fail2ban restart >/dev/null
+    endscript
+    create 640 root adm
+}
diff --git a/0.6.1-8/config/gentoo-confd b/0.6.1-8/config/gentoo-confd
new file mode 100644
index 00000000..b6a44448
--- /dev/null
+++ b/0.6.1-8/config/gentoo-confd
@@ -0,0 +1,23 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.2 $
+
+# Command line options for Fail2Ban. Refer to "fail2ban -h" for
+# valid options.
+FAIL2BAN_OPTS=""
diff --git a/0.6.1-8/config/gentoo-initd b/0.6.1-8/config/gentoo-initd
new file mode 100755
index 00000000..94ac3801
--- /dev/null
+++ b/0.6.1-8/config/gentoo-initd
@@ -0,0 +1,50 @@
+#!/sbin/runscript
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#
+# Author: Sireyessire, Cyril Jaquier
+# 
+# $Revision: 1.2 $
+
+opts="start stop restart showlog"
+
+FAIL2BAN="/usr/bin/fail2ban"
+
+depend() {
+	need net
+	need logger
+	after iptables
+}
+
+start() {
+	ebegin "Starting fail2ban"
+	${FAIL2BAN} -b ${FAIL2BAN_OPTS} > /dev/null
+	eend $? "Failed to start fail2ban"
+}
+
+stop() {
+	ebegin "Stopping fail2ban"
+	${FAIL2BAN} -k > /dev/null
+	eend $? "Failed to stop fail2ban"
+}
+
+zap() {
+	rm /var/run/fail2ban.pid
+}
+
+showlog(){
+	less /var/log/fail2ban.log
+}
diff --git a/0.6.1-8/config/redhat-initd b/0.6.1-8/config/redhat-initd
new file mode 100644
index 00000000..3ae84490
--- /dev/null
+++ b/0.6.1-8/config/redhat-initd
@@ -0,0 +1,78 @@
+#!/bin/bash
+#
+# fail2ban
+#
+# chkconfig: 345 91 9
+# description: if many unsuccessfull login attempts from some ip address \
+#              during a short period happen, this address is banned \
+#              by the firewall
+#
+# Author: Andrey G. Grozin
+# 
+# $Revision: 1.2 $
+
+# Source function library.
+. /etc/init.d/functions
+
+# Get config.
+. /etc/sysconfig/network
+
+# Check that networking is up.
+[ "${NETWORKING}" = "no" ] && exit 0
+[ -f /etc/fail2ban.conf ] || exit 0
+
+FAIL2BAN="/usr/bin/fail2ban"
+PIDFILE="/var/run/fail2ban.pid"
+
+RETVAL=0
+
+start() {
+    echo -n $"Starting fail2ban: "
+    "${FAIL2BAN}" -b > /dev/null
+    RETVAL=$?
+    echo
+}
+
+stop() {
+    if [ -f "${PIDFILE}" ]; then
+	echo -n $"Stopping fail2ban: "
+	"${FAIL2BAN}" -k > /dev/null
+	echo
+    fi
+}
+
+restart() {
+    stop
+    start
+}
+
+# See how we were called.
+case "$1" in
+  start)
+        start
+        ;;
+  stop)
+        stop
+        ;;
+  status)
+        status fail2ban
+        RETVAL=$?
+        ;;
+  reload)
+        restart
+        ;;
+  restart)
+        restart
+        ;;
+  condrestart)
+        if [ -f "${PIDFILE}" ]; then
+            restart
+        fi
+        ;;
+  *)
+        echo $"Usage: $0 {start|stop|status|restart|condrestart}"
+        exit 1
+        ;;
+esac
+
+exit $RETVAL
diff --git a/0.6.1-8/confreader/__init__.py b/0.6.1-8/confreader/__init__.py
new file mode 100644
index 00000000..b920907f
--- /dev/null
+++ b/0.6.1-8/confreader/__init__.py
@@ -0,0 +1,25 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2005/02/18 13:26:41 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
\ No newline at end of file
diff --git a/0.6.1-8/confreader/configreader.py b/0.6.1-8/confreader/configreader.py
new file mode 100644
index 00000000..a32292a3
--- /dev/null
+++ b/0.6.1-8/confreader/configreader.py
@@ -0,0 +1,94 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.6 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.6 $"
+__date__ = "$Date: 2005/11/20 17:07:47 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+
+from ConfigParser import *
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+class ConfigReader:
+	""" This class allow the handling of the configuration options.
+		The DEFAULT section contains the global information about
+		Fail2Ban. Each other section is for a different log file.
+	"""
+
+	def __init__(self, confPath):
+		self.confPath = confPath
+		self.configParser = SafeConfigParser()
+		
+	def openConf(self):
+		""" Opens the configuration file.
+		"""
+		self.configParser.read(self.confPath)
+	
+	def getSections(self):
+		""" Returns all the sections present in the configuration
+			file except the DEFAULT and MAIL sections.
+		"""
+		sections = self.configParser.sections()
+		sections.remove("MAIL")
+		logSys.debug("Found sections: " + `sections`)
+		return sections
+
+	def setValue(self, sec, label, value):
+		""" Override a value for a section
+		"""
+		self.configParser.set(sec, label, value)
+
+	
+	# Each optionValues entry is composed of an array with:
+	# 0 -> the type of the option
+	# 1 -> the name of the option
+	# 2 -> the default value for the option
+	def getLogOptions(self, sec, options):
+		""" Gets all the options of a given section. The options
+			are defined in the optionValues list.
+		"""
+		values = dict()
+		for option in options:
+			try:
+				if option[0] == "bool":
+					v = self.configParser.getboolean(sec, option[1])
+				elif option[0] == "int":
+					v = self.configParser.getint(sec, option[1])
+				else:
+					v = self.configParser.get(sec, option[1])
+				
+				values[option[1]] = v
+				logSys.debug("%s: Accepted value %s=%s"%(
+					sec, option[1], `v`))
+			except NoOptionError:
+				logSys.warn("No '" + option[1] + "' defined in '" + sec +
+							"'. Using default one: '" + `option[2]` + "'")
+				values[option[1]] = option[2]
+			except ValueError:
+				logSys.warn("Wrong value for '" + option[1] + "' in '" + sec +
+							"'. Using default one: '" + `option[2]` + "'")
+				values[option[1]] = option[2]
+		return values
+		
diff --git a/0.6.1-8/debian/NEWS b/0.6.1-8/debian/NEWS
new file mode 100644
index 00000000..bcc78e93
--- /dev/null
+++ b/0.6.1-8/debian/NEWS
@@ -0,0 +1,10 @@
+fail2ban (0.6.0-4) unstable; urgency=low
+
+  In this version the new section ApacheAttacks was introduced to ban IPs
+  which are found to run some known attack on the host. For now it captures
+  just awstats and mambo related attacks. To make this feature work, the bug of
+  wrongly specified timeregexp for Apache's access.log file was fixed.
+  Besides that group of log files has changed to be adm, and now they are
+  readable by the group.
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Fri, 10 Feb 2006 13:05:07 -0500
diff --git a/0.6.1-8/debian/README.Debian b/0.6.1-8/debian/README.Debian
new file mode 100644
index 00000000..1f175a7f
--- /dev/null
+++ b/0.6.1-8/debian/README.Debian
@@ -0,0 +1,117 @@
+fail2ban for Debian
+-------------------
+
+This package is ~95% identical to the upstream version. Few features
+could have been added but not yet propagated into upstream version and
+some modifications might be Debian-specific (logsys logging
+format). And although due to tight collaboration with upstream author
+most of the Debian modifications penetrate into the next upstream, few
+features present in Debian release were rejected by the upstream
+author (-e option for instance).
+
+Currently, the major difference with upstream: python libraries are
+placed under /usr/share/fail2ban instead of /usr/lib/fail2ban to
+comply with policy regarding architecture independent resources.
+
+Also the main config file /etc/fail2ban.conf is a copy of
+/usr/share/doc/examples/fail2ban.conf.iptables. There are config files
+for banning via shorewall or hosts.deny are provided BUT they might
+miss additional sections present in fail2ban.conf. Please copy them
+taking care about added sections. Those files will be obsolete in the
+next release which would handle split configuration files.
+
+Default behavior:
+-----------------
+
+Only handling of ssh files is enabled by default. If you want to use
+fail2ban with apache, please enable apache section manually in
+/etc/fail2ban.conf or enable section using command line parameter -e
+in /etc/default/fail2ban to avoid conflicts during upgrade of the
+config file.
+
+N.B. '-e' command line parameter is present solely in Debian release
+ of fail2ban, thus it will not work if you decided to proceed with
+ vanilla upstream.
+
+Troubleshooting:
+---------------
+
+* Updated failregex:
+
+To resolve the security bug #330827 [1] failregex expressions must
+provide a named group (?P<host>...) as a placeholder of the abuser's
+host. The naming of the group was introduced to capture possible
+future generalizations of failregex to provide even more
+information. At a current point, all named groups are considered as
+possible locations of the host addresses, but usually you should need
+just a single group (?P<host>...)
+
+[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=330827
+
+
+* "Interpolations" in the config file:
+
+Since version 0.6.0-3 to reduce duplication, thus to improve
+readability of the config file, interpolations provided by the module
+ConfigParser are used. If you had custom sections defined before, you
+might benefit from updating config file and adding appropriate
+information for the new sections.
+
+N.B. If you have some nice additional sections defined, I would really
+appreciate if you share them with me, so they could be eventually
+included in the fail2ban package for general use by the rest of the
+community.
+
+
+* Mailing:
+
+As it was reported (bug #329722) you might need to provide a full
+e-mail address in fail2ban.conf option MAIL:from to make your mail
+server accept that email. I've added @localhost to both MAIL:from and
+MAIL:to in the default configuration shipped with Debian. It seems to
+work nicely now
+
+See TODO.Debian for more details, as well as the Debian Bug Tracking
+system.
+
+
+* Dirty exit:
+
+If firewall rules gets cleaned out before fail2ban exits (like was
+happening with firestarter), errors get reported during the exit of
+fail2ban, but they are "safe" and can be ignored.
+
+
+** SSHD Configuration Specific Problems
+
+* Ban "Not allowed" attempts:
+
+Make sure that you have
+ChallengeResponseAuthentication no
+PasswordAuthentication yes
+
+Details from the bug report #350980 [2]
+
+[2]  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350980
+
+
+* Not caught attempts to login as root
+
+On the boxes running older versions of openssh (e.g. sarge
+distribution) in the case when PermitRootLogin is set to something
+else than "yes" and iff AllowUsers is active, failed root logins do
+not confirm to the standard logging message -- they omit the source
+IP, thus allowing attack to persist since such messages are not caught
+by fail2ban.
+
+
+* Bantime:
+
+An IP is banned for "bantime" not since the last failed login attempt
+from the IP, but rather since the moment when failed login was
+detected by fail2ban. Thus, if fail2ban gets [re]started, any IP which
+had enough of failed logins within "findtime" will be banned for
+"bantime" since [re]start moment, not since the last failed login
+time.
+
+ -- Yaroslav O. Halchenko <debian@onerussian.com>, Sun, 19 Mar 2006 00:27:22 -0500
diff --git a/0.6.1-8/debian/TODO b/0.6.1-8/debian/TODO
new file mode 100644
index 00000000..cd9eff97
--- /dev/null
+++ b/0.6.1-8/debian/TODO
@@ -0,0 +1,7 @@
+* Collect more sections for other log files
+* Compose a filter for logwatch (almost done -- testing, submission)
+* In the next release split file configuration will be implemented,
+   that is why no split files is enabled for current release 
+   (as of v0.6.1   Sun Mar 19 00:18:08 EST 2006)
+
+ -- Yaroslav O. Halchenko <debian@onerussian.com>, Sun Jan 15 15:18:13 2006
diff --git a/0.6.1-8/debian/changelog b/0.6.1-8/debian/changelog
new file mode 100644
index 00000000..69961ff4
--- /dev/null
+++ b/0.6.1-8/debian/changelog
@@ -0,0 +1,342 @@
+fail2ban (0.6.1-7bpo2) sarge-backports; urgency=low
+
+  * Backported build of Debian package version 0.6.1-8 by pbuilder-ssh
+    (v.0.2.63).
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Fri, 16 Jun 2006 14:42:27 -0400
+
+fail2ban (0.6.1-8) unstable; urgency=low
+
+  * Removed bashism (arrays) from init.d script to make it POSIX shell
+    complient (closes: #368218)
+  * Added new proftpd section
+  * Added new saslauthd section. Thanks to martin f krafft
+    <madduck@debian.org> (closes: #369483)
+  * Mentioned apache2 log file in Other. comment field for FILE in 
+    apache section.  Nothing has to be changed besides the logfile path to
+    work with apache2 (closes: #342144)
+    
+ -- Yaroslav Halchenko <debian@onerussian.com>  Mon, 22 May 2006 15:37:17 -0400
+
+fail2ban (0.6.1-5) unstable; urgency=low
+
+  * Further fixed debian packaging: to comply with policy empty target
+    binary-arch was provided
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Tue, 16 May 2006 16:43:37 -0400
+
+fail2ban (0.6.1-4) unstable; urgency=low
+
+  * Adjusted debian packaging:
+    - Clean up of debian/rules: removed commented out dh_ scripts which
+      definetly will never be used
+    - debhelper and dpatch moved to Build-Depends
+    - added --no-compile for python setup.py install, and removed explicit
+      cleaning of .pyc's
+    - fixed separation binary-indep and binary-arch in debian/rules
+    - restricted depends on python >= 2.3
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Tue, 16 May 2006 15:53:06 -0400
+
+fail2ban (0.6.1-3) unstable; urgency=low
+
+  * Fixed vsftpd failregexp (closes: #366687)
+  * Started to use dpatch
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Wed, 10 May 2006 11:45:57 -0400
+
+fail2ban (0.6.1-2) unstable; urgency=low
+
+  * Assigned maxreinits to 1000 to be reasonable since otherwise logfile grows
+    indefinetly if there is a real problem on the system (closes: #359218)
+  * Adjusted debian/{copyright,watch}
+  * New version of init.d script (Thanks to Aaron Isotton) (closes: #364278)
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Mon, 27 Mar 2006 12:55:39 -0500
+
+fail2ban (0.6.1-1) unstable; urgency=low
+
+  * New upstream release
+  * In config file added fwchain to ease switching to another input chain
+    (closes: #357164)
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Sat, 18 Mar 2006 23:11:53 -0500
+
+fail2ban (0.6.0-8) unstable; urgency=low
+
+  * Minor adjustments to reduce the deviation from the upstream code
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Sat, 11 Mar 2006 00:48:14 -0500
+
+fail2ban (0.6.0-7) unstable; urgency=low
+
+  * Fixed a typo in failregex for SSH section (closes: #356112)
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Thu,  9 Mar 2006 15:13:48 -0500
+
+fail2ban (0.6.0-6) unstable; urgency=low
+
+  * Updated README.Debian with information about some cases with
+    not-as-shipped configurations of sshd on the boxes running older versions
+    of openssh server
+  * Included regexps for SSH in case iff authentication as root using keys was
+    attempted whenever PermitRootLogin is set to something else than "yes" and
+    key authentication fails
+  * Included postrm script to remove log files during purge to comply with
+    policy 10.8 (closes: #355443)
+ 
+ -- Yaroslav Halchenko <debian@onerussian.com>  Fri,  3 Mar 2006 16:32:38 -0500
+
+fail2ban (0.6.0-5) unstable; urgency=low
+
+  * Fixed Apache section: changed filepath to point at error.log, thus I had
+    to revert timeregex and timepattern to user RFC 2822 format (closes:
+    #354346)
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Sat, 25 Feb 2006 19:56:46 -0500
+
+fail2ban (0.6.0-4) unstable; urgency=low
+
+  * Modifications in README.Debian to reflect a "finding" on
+    not-AllowedUsers banning which requires default Debian configuration
+    of "ChallengeResponseAuthentication no" and "PasswordAuthentication
+    yes"
+  * Fixed Apache timeregex and timepattern to confirm
+    the fomat of time stamp used in Debian's acccess.log (error.log uses
+    RFC 2822 format)
+  * Added section ApacheAttacks to specify some common patterns of attacks on
+    a webserver (awstats.pl as a try). This section stays split from Apache
+    since it is of different nature and might be not appropriate for some
+    users
+  * Forced owner/permissions of log file to be root:adm/640 in postinst and
+    logrotate (closes: #352053)
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Mon, 16 Jan 2006 04:05:19 -0500
+
+fail2ban (0.6.0-3) unstable; urgency=low
+
+  * ignoreip is now empty by default (closes: #347766)
+  * increased verbosity in verbose=2 mode: now prints options accepted
+    from the config file
+  * to make fail2ban.conf more compact, thus to improve its readability,
+    fail2ban.conf was converted to use "interpolations" provided by
+    ConfigParser class. fw{start,end,{,un}ban} options were moved into
+    DEFAULT section and required options (port, protocol) were added
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Thu, 12 Jan 2006 18:32:14 -0500
+
+fail2ban (0.6.0-2) unstable; urgency=low
+
+  * fail2ban path is inserted first in the list to avoid a conflict with
+    existing elsewhere modules with the same names. (Thanks for report and
+    patch to Nick Craig-Wood) (closes: #343821) 
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Mon, 19 Dec 2005 17:44:58 +0200
+
+fail2ban (0.6.0-1) unstable; urgency=low
+
+  * Merged with the latest stable upstream release. That incure some
+    changes for the Debian configuration of the package to be more
+    upstream-like. Visible one is: subject in the sent email includes
+    section outside of "[Fail2Ban]"
+  * Updated README.Debian to answer possible question regarding effective
+    bantime starting moment
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Sun, 20 Nov 2005 14:56:41 -0500
+
+fail2ban (0.5.4-10) unstable; urgency=low
+
+  * Fixed the order of ssh and apache rules to avoid possible race
+    condition (Thanks to Jefferson Cowart for the bug report) (closes:
+    #339133)
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Mon, 14 Nov 2005 23:44:45 -0500
+
+fail2ban (0.5.4-9) unstable; urgency=low
+
+  * Fixed init.d script so it doesn't return non-0 status if fail2ban is not
+    running. That fixes issues with purging the package and leaving garbage in
+    /usr/share/fail2ban (Thanx to Justin Pryzby for the insight)
+    (closes: #337223)
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Thu,  3 Nov 2005 17:05:20 -0500
+
+fail2ban (0.5.4-8) unstable; urgency=low
+
+  * Added config option MAIL.localtime (closes: #336449)
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Mon, 31 Oct 2005 16:53:19 -0500
+
+fail2ban (0.5.4-7) unstable; urgency=low
+
+  * Adjusted init.d script so it is resistant to delayed shutdowns of
+    fail2ban and in general more stable
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Thu, 20 Oct 2005 21:22:03 -0400
+
+fail2ban (0.5.4-6.2) unstable; urgency=low
+
+  * Fixed typos (thanx to Ross Boylan).
+  * Robust startup: if iptables module gets fully initialized after
+    startup of fail2ban, fail2ban will do "maxreinit" attempts to
+    initialize its own firewall. It will sleep between attempts for
+    "polltime" number of seconds (closes: #334272).
+  * To overcome possible conflict with other firewall solutions and as a
+    secondary solution for the bug 334272, fail2ban startup is moved
+    during bootup to the latest (S99) sequenece position. That should not
+    cause any discomfort I believe.
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Tue, 18 Oct 2005 15:54:38 -0400
+
+fail2ban (0.5.4-5.14) unstable; urgency=low
+
+  * Added a notification regarding the importance of 0.5.4-5 change of
+    failregex in the config file.
+  * Adjusted address to FSF.
+  * Adjusted failregex for SSH so it bans "Illegal user" entries as well, and
+    restricted full failregex more to include ":" at the beginning, because
+    otherwise it might not be sufficient and would revive bug 330827 (closes:
+    #333056).
+  * Adjusted failregex for SSH to accommodate recent changes in logging of
+    SSH: Illegal -> Invalid. Should match both now.
+  * Fixed a problem of raise AttributeError exception reported as a side
+    effect of crash during parsing of the config file.
+  * Introduced fwcheck option to verify consistency of the
+    chains. Implemented automatic restart of fail2ban main function in
+    case check of fwban or fwunban command failed (closes: #329163, #331695).
+    (Introduced patch was further adjusted by upstream author).
+  * Added -f command line parameter for [findtime].
+  * Fixed the issue of not respecting command line parameters for parameters
+    within sections.
+  * Added -e command line parameter to provide enabled sections from command
+    line.
+  * Added a cleanup of firewall rules on emergency shutdown when unknown
+    exception is catched.
+  * Fail2ban should not crash now if a wrong file name is specified in
+    config.
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Mon,  3 Oct 2005 22:26:28 -1000
+
+fail2ban (0.5.4-5) unstable; urgency=low
+
+  * Made failregex'es more specific to don't allow usernames to be used as a
+    tool for denial of service attacks. Config files (or at least
+    failregex'es) must be updated from this package, otherwise the security
+    breach would remain open and only warning gets issued (closes: #330827)
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Sat,  1 Oct 2005 02:42:23 -1000
+
+fail2ban (0.5.4-4) unstable; urgency=low
+
+  * On a request from Calum Mackay added reporting of the enabled sections
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Thu, 29 Sep 2005 11:20:43 -1000
+
+fail2ban (0.5.4-3) unstable; urgency=low
+
+  * Resolved the mystery of debug mode in which commands are not really
+    executed: added verbose option to config file, removed -v from
+    /etc/default/fail2ban, reordered code a bit so that log targets are
+    setup right after background and then only loglevel (verbose,debug) is
+    processed, so the warning could be seen in the logs
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Thu, 29 Sep 2005 00:20:43 -1000
+
+fail2ban (0.5.4-2) unstable; urgency=low
+
+  * Now exporting PATH explicitely in init.d/fail2ban script, to avoid
+    problems finding iptables in the cases when PATH was not exported outside
+    (cfengine, broken shell environment) (closes: #329304)
+  * Removed -b from start-stop-daemon because fail2ban detahes on its own
+  * Added @localhost to MAIL:from and MAIL:to in fail2ban.conf and placed
+    a note to README.Debian regarding necessity to specify full email
+    address in MAIL:from (closes: #329722)
+  * Added a keyword <section> in parsing of the subject and the body of an
+    email sent out by fail2ban (closes: #330311)
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Wed, 27 Sep 2005 08:09:06 -0400
+
+fail2ban (0.5.4-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Tue, 20 Sep 2005 12:19:19 -0400
+
+fail2ban (0.5.3-2) unstable; urgency=low
+
+  * Refined comments in README.Debian
+  * Reindented init.d script
+  P.S. Was not released
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Sun, 11 Sep 2005 15:19:44 -0400
+
+fail2ban (0.5.3-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Fri,  9 Sep 2005 16:55:00 -0400
+
+fail2ban (0.5.2-5) unstable; urgency=low
+
+  * Included a patch from Stephen Gildea to provide "status" report by
+    init.d script
+  * Included a note in README.Debian regarding the fail2ban iptable's
+    chains
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Fri,  9 Sep 2005 14:52:24 -0400
+
+fail2ban (0.5.2-4) unstable; urgency=low
+
+  * Format of SYSLOG entries is up to the standard now
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Fri, 19 Aug 2005 00:06:44 -1000
+
+fail2ban (0.5.2-3) unstable; urgency=low
+
+  * Fixed errata in /etc/default/fail2ban (closes: #323451)
+  * Fixed handling of SYSLOG logging target. Now it can log to any syslog
+    target and facility as directed by the config (revisions 160:166 patch
+    from syslog branch) (closes: #323543)
+  * Included upstream README and TODO
+  * Mentioned in README.Debian that apache section is disabled by default
+  * Adjusted man pages to cross-reference each other
+  * Moved fail2ban man page under section 8 as in upstream
+  * Introduced findtime configuration variable to control the lifetime
+    of caught "failed" log entries (closes: #323840)
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Tue, 16 Aug 2005 11:23:28 -1000
+
+fail2ban (0.5.2-2) unstable; urgency=low
+
+  * Updated description to reflect flexibility in application of fail2ban
+  * Included logrotate (Thanks to Baruch Even)
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Sat, 13 Aug 2005 04:51:57 -0400
+
+fail2ban (0.5.2-1) unstable; urgency=low
+
+  * New upstream release
+  * No log4py any more
+  * removed -i eth0 from config
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Sat,  6 Aug 2005 09:21:07 -1000
+
+fail2ban (0.5.1-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Sat, 23 Jul 2005 08:50:00 -1000
+
+fail2ban (0.5.0-1) unstable; urgency=low
+
+  * New upstream release
+  * Libraries placed under /usr/share/fail2ban instead of /usr/lib/fail2ban
+  * Corrections to the description of the package
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Tue, 12 Jul 2005 23:33:20 -1000
+
+fail2ban (0.4.1-1) unstable; urgency=low
+
+  * First upstream release of a Debian package
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Mon, 04 Jul 2005 11:47:23 +0300
diff --git a/0.6.1-8/debian/compat b/0.6.1-8/debian/compat
new file mode 100644
index 00000000..b8626c4c
--- /dev/null
+++ b/0.6.1-8/debian/compat
@@ -0,0 +1 @@
+4
diff --git a/0.6.1-8/debian/control b/0.6.1-8/debian/control
new file mode 100644
index 00000000..5930a534
--- /dev/null
+++ b/0.6.1-8/debian/control
@@ -0,0 +1,23 @@
+Source: fail2ban
+Section: net
+Priority: optional
+Maintainer: Yaroslav Halchenko <debian@onerussian.com>
+Uploaders: Barak Pearlmutter <bap@debian.org>
+Build-Depends: debhelper (>= 4.1.67), dpatch
+Build-Depends-Indep: python, python-dev, help2man
+Standards-Version: 3.7.2
+
+Package: fail2ban
+Architecture: all
+Depends: python (>=2.3), iptables, lsb-base (>=2.0-7)
+Description: bans IPs that cause multiple authentication errors
+ Monitors (in daemon mode) or just scans log files (e.g. /var/log/auth.log,
+ /var/log/apache/access.log) and temporarily bans failure-prone
+ addresses by updating existing firewall rules.  Currently, by default, 
+ supports ssh/apache but configuration can be easily extended for scanning
+ the other ASCII log files. Firewall rules are given in the config file,
+ thus it can be adopted to be used with a variety of firewalls (e.g. iptables,
+ ipfwadm).
+ .
+ Homepage: http://www.sourceforge.net/projects/fail2ban
+
diff --git a/0.6.1-8/debian/copyright b/0.6.1-8/debian/copyright
new file mode 100644
index 00000000..cfaba9d9
--- /dev/null
+++ b/0.6.1-8/debian/copyright
@@ -0,0 +1,31 @@
+This package was originally debianized by Yaroslav Halchenko
+<debian@onerussian.com> on Mon Jul  4 14:41:34 HST 2005
+
+It was downloaded from http://www.sourceforge.net/projects/fail2ban
+
+Author: Cyril Jaquier: <lostcontrol@users.sourceforge.net>
+        http://fail2ban.sourceforge.net
+
+Copyright: 2004, 2005, 2006 Cyril Jaquier
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the 
+Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+MA 02110-1301, USA.
+
+On Debian systems, the complete text of the GNU General Public
+License, version 2, can be found in /usr/share/common-licenses/GPL-2.
+
+The Debian packaging is (C) 2006, Yaroslav Halchenko <debian@onerussian.com>
+and is licensed under the GPL, see above.
+
diff --git a/0.6.1-8/debian/docs b/0.6.1-8/debian/docs
new file mode 100644
index 00000000..724e0844
--- /dev/null
+++ b/0.6.1-8/debian/docs
@@ -0,0 +1,2 @@
+README
+TODO
diff --git a/0.6.1-8/debian/patches/00_proftpd_section.dpatch b/0.6.1-8/debian/patches/00_proftpd_section.dpatch
new file mode 100755
index 00000000..cd4dd824
--- /dev/null
+++ b/0.6.1-8/debian/patches/00_proftpd_section.dpatch
@@ -0,0 +1,160 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 00_proftpd_section.dpatch by  <debian@onerussian.com>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: New section for proftpd
+
+@DPATCH@
+
+diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.hostsdeny fail2ban-0.6.1.post/config/fail2ban.conf.hostsdeny
+--- fail2ban-0.6.1.pre/config/fail2ban.conf.hostsdeny	2006-05-27 22:57:03.000000000 -0400
++++ fail2ban-0.6.1.post/config/fail2ban.conf.hostsdeny	2006-05-27 23:01:11.000000000 -0400
+@@ -291,6 +291,47 @@
+ failregex = FAIL LOGIN
+ 
+ 
++[PROFTPD]
++# Option: enabled
++# Notes.: enable monitoring for this section.
++# Values: [true | false] Default: false
++#
++enabled = false
++
++# Option: logfile
++# Notes.: logfile to monitor.
++# Values: FILE Default: /var/log/proftpd/proftpd.log
++# Other.: /var/log/auth.log
++#
++logfile = /var/log/proftpd/proftpd.log
++
++# Option:  port
++# Notes.:  specifies port to monitor
++# Values:  [ NUM | STRING ]  Default: ftp
++#
++port = ftp
++
++# Option: timeregex
++# Notes.: regex to match timestamp in VSFTPD logfile.
++# Values: [Mar 7 17:53:28]
++# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
++#
++timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
++
++# Option: timepattern
++# Notes.: format used in "timeregex" fields definition. Note that '%' must be
++# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
++# Values: TEXT Default: %%b %%d %%H:%%M:%%S
++#
++timepattern = %%b %%d %%H:%%M:%%S
++
++# Option: failregex
++# Notes.: regex to match the password failures messages in the logfile.
++# Values: TEXT Default:
++#
++failregex = USER \S+: no such user found from \S* ?\[(?P<host>\S+)\] to \S+\s*$
++
++
+ [SSH]
+ # Option:  enabled
+ # Notes.:  enable monitoring for this section.
+diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.iptables fail2ban-0.6.1.post/config/fail2ban.conf.iptables
+--- fail2ban-0.6.1.pre/config/fail2ban.conf.iptables	2006-05-27 22:57:03.000000000 -0400
++++ fail2ban-0.6.1.post/config/fail2ban.conf.iptables	2006-05-27 23:01:20.000000000 -0400
+@@ -385,6 +385,48 @@
+ #
+ failregex = FAIL LOGIN
+ 
++
++[PROFTPD]
++# Option: enabled
++# Notes.: enable monitoring for this section.
++# Values: [true | false] Default: false
++#
++enabled = false
++
++# Option: logfile
++# Notes.: logfile to monitor.
++# Values: FILE Default: /var/log/proftpd/proftpd.log
++# Other.: /var/log/auth.log
++#
++logfile = /var/log/proftpd/proftpd.log
++
++# Option:  port
++# Notes.:  specifies port to monitor
++# Values:  [ NUM | STRING ]  Default: ftp
++#
++port = ftp
++
++# Option: timeregex
++# Notes.: regex to match timestamp in VSFTPD logfile.
++# Values: [Mar 7 17:53:28]
++# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
++#
++timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
++
++# Option: timepattern
++# Notes.: format used in "timeregex" fields definition. Note that '%' must be
++# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
++# Values: TEXT Default: %%b %%d %%H:%%M:%%S
++#
++timepattern = %%b %%d %%H:%%M:%%S
++
++# Option: failregex
++# Notes.: regex to match the password failures messages in the logfile.
++# Values: TEXT Default:
++#
++failregex = USER \S+: no such user found from \S* ?\[(?P<host>\S+)\] to \S+\s*$
++
++
+ [SSH]
+ # Option:  enabled
+ # Notes.:  enable monitoring for this section.
+diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.shorewall fail2ban-0.6.1.post/config/fail2ban.conf.shorewall
+--- fail2ban-0.6.1.pre/config/fail2ban.conf.shorewall	2006-05-27 22:57:03.000000000 -0400
++++ fail2ban-0.6.1.post/config/fail2ban.conf.shorewall	2006-05-27 23:00:32.000000000 -0400
+@@ -277,6 +277,45 @@
+ #
+ failregex = FAIL LOGIN
+ 
++[PROFTPD]
++# Option: enabled
++# Notes.: enable monitoring for this section.
++# Values: [true | false] Default: false
++#
++enabled = false
++
++# Option: logfile
++# Notes.: logfile to monitor.
++# Values: FILE Default: /var/log/proftpd/proftpd.log
++# Other.: /var/log/auth.log
++#
++logfile = /var/log/proftpd/proftpd.log
++
++# Option:  port
++# Notes.:  specifies port to monitor
++# Values:  [ NUM | STRING ]  Default: ftp
++#
++port = ftp
++
++# Option: timeregex
++# Notes.: regex to match timestamp in VSFTPD logfile.
++# Values: [Mar 7 17:53:28]
++# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
++#
++timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
++
++# Option: timepattern
++# Notes.: format used in "timeregex" fields definition. Note that '%' must be
++# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
++# Values: TEXT Default: %%b %%d %%H:%%M:%%S
++#
++timepattern = %%b %%d %%H:%%M:%%S
++
++# Option: failregex
++# Notes.: regex to match the password failures messages in the logfile.
++# Values: TEXT Default:
++#
++failregex = USER \S+: no such user found from \S* ?\[(?P<host>\S+)\] to \S+\s*$
+ 
+ [SSH]
+ # Option:  enabled
diff --git a/0.6.1-8/debian/patches/00_vsftpd_regexp.dpatch b/0.6.1-8/debian/patches/00_vsftpd_regexp.dpatch
new file mode 100755
index 00000000..bcb4f92f
--- /dev/null
+++ b/0.6.1-8/debian/patches/00_vsftpd_regexp.dpatch
@@ -0,0 +1,44 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 00_vsftpd_regexp.dpatch by  <debian@onerussian.com>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix of debian bug #366687: strict regexp for vsftpd
+
+@DPATCH@
+
+diff -rNu fail2ban-0.6.1.orig/config/fail2ban.conf.iptables fail2ban-0.6.1.fixed/config/fail2ban.conf.iptables
+--- fail2ban-0.6.1.orig/config/fail2ban.conf.iptables	2006-03-27 12:56:38.000000000 -0500
++++ fail2ban-0.6.1.fixed/config/fail2ban.conf.iptables	2006-05-10 13:47:40.000000000 -0400
+@@ -383,7 +383,7 @@
+ # Notes.: regex to match the password failures messages in the logfile.
+ # Values: TEXT Default: Authentication failure|Failed password|Invalid user
+ #
+-failregex = FAIL LOGIN
++failregex = \[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$
+ 
+ [PROFTPD]
+ # Option:  enabled
+diff -rNu fail2ban-0.6.1.orig/config/fail2ban.conf.shorewall fail2ban-0.6.1.fixed/config/fail2ban.conf.shorewall
+--- fail2ban-0.6.1.orig/config/fail2ban.conf.shorewall	2006-03-27 12:56:38.000000000 -0500
++++ fail2ban-0.6.1.fixed/config/fail2ban.conf.shorewall	2006-05-10 13:47:40.000000000 -0400
+@@ -383,7 +383,7 @@
+ # Notes.: regex to match the password failures messages in the logfile.
+ # Values: TEXT Default: Authentication failure|Failed password|Invalid user
+ #
+-failregex = FAIL LOGIN
++failregex = \[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$
+ 
+ [PROFTPD]
+ # Option:  enabled
+diff -rNu fail2ban-0.6.1.orig/config/fail2ban.conf.hostsdeny fail2ban-0.6.1.fixed/config/fail2ban.conf.hostsdeny
+--- fail2ban-0.6.1.orig/config/fail2ban.conf.hostsdeny	2006-03-27 12:56:38.000000000 -0500
++++ fail2ban-0.6.1.fixed/config/fail2ban.conf.hostsdeny	2006-05-10 13:47:40.000000000 -0400
+@@ -383,7 +383,7 @@
+ # Notes.: regex to match the password failures messages in the logfile.
+ # Values: TEXT Default: Authentication failure|Failed password|Invalid user
+ #
+-failregex = FAIL LOGIN
++failregex = \[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$
+ 
+ [PROFTPD]
+ # Option:  enabled
diff --git a/0.6.1-8/debian/patches/00list b/0.6.1-8/debian/patches/00list
new file mode 100644
index 00000000..eb9074b2
--- /dev/null
+++ b/0.6.1-8/debian/patches/00list
@@ -0,0 +1,4 @@
+00_proftpd_section
+00_vsftpd_regexp
+01_apache2_other
+02_sasl_section
diff --git a/0.6.1-8/debian/patches/01_apache2_other.dpatch b/0.6.1-8/debian/patches/01_apache2_other.dpatch
new file mode 100644
index 00000000..711d1de7
--- /dev/null
+++ b/0.6.1-8/debian/patches/01_apache2_other.dpatch
@@ -0,0 +1,19 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 01_apache2_other.dpatch by  <debian@onerussian.com>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Tiny patch to mention apache2 possibility
+
+@DPATCH@
+
+diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.iptables fail2ban-0.6.1.post/config/fail2ban.conf.iptables
+--- fail2ban-0.6.1.pre/config/fail2ban.conf.iptables	2006-05-27 23:23:51.000000000 -0400
++++ fail2ban-0.6.1.post/config/fail2ban.conf.iptables	2006-05-27 23:27:30.000000000 -0400
+@@ -270,6 +270,7 @@
+ # Option:  logfile
+ # Notes.:  logfile to monitor.
+ # Values:  FILE  Default:  /var/log/apache/error.log
++# Other.: /var/log/apache2/error.log
+ #
+ logfile = /var/log/apache/error.log
+ 
diff --git a/0.6.1-8/debian/patches/02_sasl_section.dpatch b/0.6.1-8/debian/patches/02_sasl_section.dpatch
new file mode 100755
index 00000000..f4c9fd77
--- /dev/null
+++ b/0.6.1-8/debian/patches/02_sasl_section.dpatch
@@ -0,0 +1,58 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 02_sasl_config.dpatch by  <debian@onerussian.com>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Added saslauthd section from martin f krafft <madduck@debian.org>
+
+@DPATCH@
+
+diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.iptables fail2ban-0.6.1.post/config/fail2ban.conf.iptables
+--- fail2ban-0.6.1.pre/config/fail2ban.conf.iptables	2006-05-30 10:03:16.000000000 -0400
++++ fail2ban-0.6.1.post/config/fail2ban.conf.iptables	2006-05-30 10:13:56.000000000 -0400
+@@ -260,6 +260,46 @@
+ # failregex.
+ 
+ 
++[SASL]
++# Option:  enabled
++# Notes.:  enable monitoring for this section.
++# Values:  [true | false]  Default:  true
++#
++enabled = false
++
++# Option:  port
++# Notes.:  specifies port to monitor
++# Values:  [ NUM | STRING ]  Default:
++#
++port = smtp
++
++# Option:  logfile
++# Notes.:  logfile to monitor.
++# Values:  FILE  Default:  /var/log/auth.log
++#
++logfile = /var/log/mail.log
++
++# Option:  timeregex
++# Notes.:  regex to match timestamp
++# Values:  [Mar  7 17:53:28]
++# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
++#
++timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
++
++# Option:  timepattern
++# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
++#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
++# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
++#
++timepattern = %%b %%d %%H:%%M:%%S
++
++# Option:  failregex
++# Notes.:  regex to match the password failures messages in the logfile.
++# Values:  TEXT  Default:
++#
++failregex = : warning: [-._\w]+\[(?P<host>[.\d]+)\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
++
++
+ [Apache]
+ # Option:  enabled
+ # Notes.:  enable monitoring for this section.
diff --git a/0.6.1-8/debian/postinst b/0.6.1-8/debian/postinst
new file mode 100755
index 00000000..5ef9f91b
--- /dev/null
+++ b/0.6.1-8/debian/postinst
@@ -0,0 +1,79 @@
+#! /bin/sh
+# postinst script for fail2ban
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+#
+preversion=$2
+
+case "$1" in
+    configure)
+       # To fix the bug in generated by previous version files permissions
+       # also closes #352053
+
+       LOG=/var/log/fail2ban.log
+       touch $LOG
+       chown root:adm ${LOG}*
+       chmod 640 ${LOG}*
+        
+       # Note regarding changed configuration file
+		if [ ! -z $preversion ] \
+			&& dpkg --compare-versions $preversion lt 0.5.4-5.14;
+			then
+			cat <<EOF
+WARNING!
+
+ Configuration file /etc/fail2ban.conf, failregex configuration
+ parameter specificly, were changed in 0.5.4-5 to close reported
+ security breach, and in 0.5.4-5.14 to close few other bugs.
+
+updating from <0.5.4-5
+ Unless configuration file (or corresponding failregex'es) gets updated,
+ security breach is not closed and corresponding warning will be reported
+ by the fail2ban (in the log files).
+
+updating from <0.5.4-5.14
+ Bugs #329163, #331695 dealing with changed iptables rules
+ outside of fail2ban were fixed in 0.5.4-5.14, and require upgrade of the
+ configuration file (fwcheck option was introduced) to take full
+ advantage of the problem solution (otherwise some problems might
+ persist)
+
+ Please review the configuration file and make appropriate changes.
+ENJOY!
+
+EOF
+		fi
+
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
+
+
diff --git a/0.6.1-8/debian/postrm b/0.6.1-8/debian/postrm
new file mode 100755
index 00000000..1e6c5ccd
--- /dev/null
+++ b/0.6.1-8/debian/postrm
@@ -0,0 +1,42 @@
+#! /bin/sh
+# postrm script for fail2ban
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
+# for details, see /usr/doc/packaging-manual/
+
+
+case "$1" in
+       purge|disappear)
+       				
+		# Remove configuration
+                rm -f /etc/fail2ban.conf
+		
+		# Remove logs
+		rm -f /var/log/fail2ban*
+		
+		;;
+       remove|upgrade|failed-upgrade|abort-install|abort-upgrade)
+		# nothing
+		# We may not delete the user fail2ban, as there may be
+		# files owned by it in /var/log/ and /etc/.
+        	;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+
diff --git a/0.6.1-8/debian/rules b/0.6.1-8/debian/rules
new file mode 100755
index 00000000..2425f768
--- /dev/null
+++ b/0.6.1-8/debian/rules
@@ -0,0 +1,91 @@
+#!/usr/bin/make -f
+# -*- makefile -*-
+# Sample debian/rules that uses debhelper.
+# This file was originally written by Joey Hess and Craig Small.
+# As a special exception, when this file is copied by dh-make into a
+# dh-make output file, you may use that output file without restriction.
+# This special exception was added by Craig Small in version 0.37 of dh-make.
+
+# Uncomment this to turn on verbose mode.
+#export DH_VERBOSE=1
+
+MANPAGE=fail2ban.8
+DESTDIR=$(CURDIR)/debian/fail2ban
+
+# no parallel execution -- required for dpatch
+.NOTPARALLEL:
+
+include /usr/share/dpatch/dpatch.make
+
+configure: configure-stamp
+configure-stamp:
+	dh_testdir
+	# Add here commands to configure the package.
+	touch configure-stamp
+
+build: patch
+
+copy-inits:
+	cp config/gentoo-confd debian/fail2ban.default
+	cp config/debian-initd debian/fail2ban.init
+	cp config/fail2ban.logrotate debian/
+
+clean-inits:
+	rm -f debian/fail2ban.{default,init,logrotate}
+
+clean: clean-inits unpatch
+	dh_testdir
+	dh_testroot
+	rm -f build-stamp configure-stamp
+
+	# Add here commands to clean up after the build process.
+	rm -rf changelog.gz $(MANPAGE) build* 
+
+	dh_clean
+
+install: build copy-inits
+	dh_testdir
+	dh_testroot
+	dh_clean -k
+	dh_installdirs
+
+	# Add here commands to install the package into debian/fail2ban.
+	python setup.py install --root=$(DESTDIR) --no-compile
+	mkdir -p $(DESTDIR)/etc
+	cp config/fail2ban.conf.iptables $(DESTDIR)/etc/fail2ban.conf
+
+# To build manpage
+$(MANPAGE): fail2ban fail2ban.h2m
+	help2man --include fail2ban.h2m --section=1x --no-info --output $@ ./fail2ban
+# 
+# Just to comply with policy 4.8
+binary-arch:
+
+# Build architecture-independent files here.
+binary-indep: install $(MANPAGE)
+	dh_testdir
+	dh_testroot
+	dh_installchangelogs CHANGELOG
+	dh_installdocs
+	dh_installexamples config/fail2ban.conf.*
+#	dh_install
+#	dh_installdebconf
+	dh_installlogrotate
+	dh_installinit -- defaults 99
+#	dh_installcron
+#	dh_installinfo
+	dh_installman fail2ban.8 man/fail2ban.conf.5
+# just for maint scripts. I don't want to use ${python:Depends} to be portable between
+# systems with different pythons
+	dh_python
+	dh_link
+	dh_compress
+	dh_fixperms
+	dh_installdeb
+	dh_shlibdeps
+	dh_gencontrol
+	dh_md5sums
+	dh_builddeb
+
+binary: binary-indep
+.PHONY: build clean binary-indep binary-arch binary install configure copy-inits clean-inits
diff --git a/0.6.1-8/debian/watch b/0.6.1-8/debian/watch
new file mode 100644
index 00000000..630882b1
--- /dev/null
+++ b/0.6.1-8/debian/watch
@@ -0,0 +1,6 @@
+# watch control file for uscan
+# Run the "uscan" command to check for upstream updates and more.
+# Site		Directory		Pattern			Version	Script
+version=3
+
+http://sf.net/fail2ban/ fail2ban-(.*)\.tar\.bz2 debian svn-upgrade
diff --git a/0.6.1-8/fail2ban b/0.6.1-8/fail2ban
new file mode 100755
index 00000000..53cd196f
--- /dev/null
+++ b/0.6.1-8/fail2ban
@@ -0,0 +1,75 @@
+#!/usr/bin/env python
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.7 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.7 $"
+__date__ = "$Date: 2005/12/27 15:09:50 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import sys, traceback, logging, locale
+
+# Set the locale with the user's default setting
+try:
+	locale.setlocale(locale.LC_ALL, '')
+except Exception:
+	print "Unable to set locale to " + `locale.getdefaultlocale()`
+	sys.exit(-1)
+
+# Inserts our own modules path first in the list
+# fix for bug #343821
+sys.path.insert(1, "/usr/share/fail2ban")
+
+# Now we can import our modules.
+import fail2ban
+from utils.pidlock import PIDLock
+
+# Get the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+# Get PID lock file instance
+pidLock = PIDLock()
+
+# Handle all the unhandled exceptions
+try:
+	# Start the application
+	fail2ban.main()
+except SystemExit:
+	# We called sys.exit(). Nothing wrong so just pass
+	pass
+except Exception, e:
+	# Print the exception data
+	(type, value, tb) = sys.exc_info()
+	tbStack = traceback.extract_tb(tb)
+	logSys.error("Fail2Ban got an unhandled exception and died.")
+	logSys.error("Type: " + `type.__name__` + "\n" +
+				 "Value: " + `e.args` + "\n" +
+				 "TB: " + `tbStack`)
+	# Try to clean up after ourselves
+	# just for extreme caution - wrapping with try
+	try:
+		fail2ban.restoreFwRules()
+	except Exception:
+		pass
+	# Remove the PID lock file. Should close #1239562
+	pidLock.remove()
+	logging.shutdown()
diff --git a/0.6.1-8/fail2ban.h2m b/0.6.1-8/fail2ban.h2m
new file mode 100644
index 00000000..3fb546bd
--- /dev/null
+++ b/0.6.1-8/fail2ban.h2m
@@ -0,0 +1,37 @@
+Include file for help2man man page
+$Id:  $
+
+[name]
+fail2ban \- Ban IPs that make too many password failure
+
+
+[files]
+\fI/etc/fail2ban.conf\fR, \fI/etc/default/fail2ban\fR
+
+[REPORTING BUGS]
+
+Please report Debian related bugs via Debian bug tracking system
+http://www.debian.org/Bugs/
+
+[copyright]
+Copyright (c) 2004 Cyril Jaquier
+.br
+Copyright of modifications held by their respective authors.
+.PP
+Licensed under the GNU General Public License v2 (GPL).
+
+
+[author]
+Original fail2ban by Cyril Jaquier <lostcontrol@users.sourceforge.net>.
+.br
+Modified and packaged for Debian by
+.br
+ - Yaroslav O. Halchenko <debian@onerussian.com>.
+.br
+Sponsored for Debian by
+.br
+ - Barak A. Pearlmutter <barak@cs.nuim.ie>.
+
+[see also]
+.br 
+fail2ban.conf(5)
diff --git a/0.6.1-8/fail2ban.py b/0.6.1-8/fail2ban.py
new file mode 100755
index 00000000..1b311d04
--- /dev/null
+++ b/0.6.1-8/fail2ban.py
@@ -0,0 +1,581 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# Modified by: Yaroslav Halchenko (SYSLOG, findtime, and oth)
+# 
+# $Revision: 1.24 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.24 $"
+__date__ = "$Date: 2006/01/22 11:10:29 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time, sys, getopt, os, string, signal, logging, logging.handlers, copy
+from ConfigParser import *
+
+from version import version
+from firewall.firewall import Firewall
+from logreader.logreader import LogReader
+from confreader.configreader import ConfigReader
+from utils.mail import Mail
+from utils.pidlock import PIDLock
+from utils.dns import *
+from utils.process import *
+
+# Get the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+# Get PID lock file instance
+pidLock = PIDLock()
+
+# Global variables
+logFwList = list()
+conf = dict()
+
+def dispUsage():
+	""" Prints Fail2Ban command line options and exits
+	"""
+	print "Usage: "+sys.argv[0]+" [OPTIONS]"
+	print
+	print "Fail2Ban v"+version+" reads log file that contains password failure report"
+	print "and bans the corresponding IP addresses using firewall rules."
+	print
+	print "  -b         start in background"
+	print "  -d         start in debug mode"
+	print "  -c <FILE>  read configuration file FILE"
+	print "  -p <FILE>  create PID lock in FILE"
+	print "  -h         display this help message"
+	print "  -i <IP(s)> IP(s) to ignore"
+	print "  -k         kill a currently running instance"
+	print "  -r <VALUE> allow a max of VALUE password failures [maxfailures]"
+	print "  -t <TIME>  ban IP for TIME seconds [bantime]"
+	print "  -f <TIME>  lifetime in seconds of failed entry [findtime]"
+	print "  -e <NAMEs> enable sections listed in NAMEs (coma or colon separated)"
+	print "  -v         verbose. Use twice for greater effect"
+	print "  -V         print software version"
+	print
+	print "Report bugs to <lostcontrol@users.sourceforge.net>"
+	sys.exit(0)
+
+def dispVersion():
+	""" Prints Fail2Ban version and exits
+	"""
+	print sys.argv[0]+" "+version
+	sys.exit(0)
+
+def checkForRoot():
+	""" Check for root user.
+	"""
+	uid = `os.getuid()`
+	if uid == '0':
+		return True
+	else:
+		return False
+
+def sigTERMhandler(signum, frame):
+	""" Handles the TERM signal when in daemon mode in order to
+		exit properly.
+	"""
+	logSys.debug("Signal handler called with sig "+`signum`)
+	killApp()
+
+def setFwMustCheck(value):
+	""" Set the mustCheck value of the firewalls (True/False)
+	"""
+	for element in logFwList:
+		element[2].setMustCheck(value)
+
+def initializeFwRules():
+	""" Initializes firewalls by running cmdstart and then
+	    fwstart for each section
+	"""
+	# Execute global start command
+	executeCmd(conf["cmdstart"], conf["debug"])
+	# Execute start command of each section
+	for element in logFwList:
+		element[2].initialize(conf["debug"])
+
+def reBan():
+	""" For each section asks the Firewall to reban known IPs
+	"""
+	for element in logFwList:
+		element[2].reBan(conf["debug"])
+
+def restoreFwRules():
+	""" Flush the ban list
+	"""
+	logSys.warn("Restoring firewall rules...")
+	try:
+		for element in logFwList:
+			# Execute end command of each section
+			element[2].restore(conf["debug"])
+		# Execute global end command
+		executeCmd(conf["cmdend"], conf["debug"])
+	except ExternalError:
+		# nothing bad really - we can survive :-)
+		pass
+
+def killApp():
+	""" Flush the ban list, remove the PID lock file and exit
+		nicely.
+	"""
+	# Restore Fw rules
+	restoreFwRules()
+	# Remove the PID lock
+	pidLock.remove()
+	logSys.info("Exiting...")
+	logging.shutdown()
+	sys.exit(0)
+
+
+def isEnabledSection(b, name):
+	""" Uses @b or searches @name in the conf['enabledsections'] to
+		determine if section is enabled. Removes also a value from the
+		list if it was there
+		Decided to place as a function to avoid duplication between
+		MAIL and regular sections
+	"""
+	v = b
+	if (name.upper() in conf["enabledsections"]):
+		v = True
+		conf["enabledsections"].remove(name.upper())
+	return v
+
+def getCmdLineOptions(optList):
+	""" Gets the command line options
+	"""
+	# enabledsections can be defined just from the command line
+	conf["enabledsections"] = []
+	for opt in optList:
+		if opt[0] == "-v":
+			conf["verbose"] = conf["verbose"] + 1
+		if opt[0] == "-b":
+			conf["background"] = True
+		if opt[0] == "-d":
+			conf["debug"] = True
+		if opt[0] == "-t":
+			try:
+				conf["bantime"] = int(opt[1])
+			except ValueError:
+				logSys.warn("banTime must be an integer")
+				logSys.warn("Using default value")
+		if opt[0] == "-f":
+			try:
+				conf["findtime"] = int(opt[1])
+			except ValueError:
+				logSys.warn("findTime must be an integer")
+				logSys.warn("Using default value")
+		if opt[0] == "-i":
+			conf["ignoreip"] = opt[1]
+		if opt[0] == "-r":
+			conf["maxfailures"] = int(opt[1])
+		if opt[0] == "-p":
+			conf["pidlock"] = opt[1]
+		if opt[0] == "-k":
+			conf["kill"] = True
+		if opt[0] == "-e":
+			conf["enabledsections"] = map(lambda x: x.upper(),
+										  re.split("[:, \t\n]", opt[1]))
+
+def main():
+	""" Fail2Ban main function
+	"""
+	
+	# Add the default logging handler
+	stdout = logging.StreamHandler(sys.stdout)
+	logSys.addHandler(stdout)
+	
+	# Default formatter
+	formatterstring='%(levelname)s: %(message)s'
+	formatter = logging.Formatter('%(asctime)s ' + formatterstring)
+	stdout.setFormatter(formatter)
+	
+	conf["kill"] = False
+	conf["debug"] = False
+	conf["verbose"] = 0
+	conf["conffile"] = "/etc/fail2ban.conf"
+	
+	# Reads the command line options.
+	try:
+		cmdOpts = 'hvVbdkc:t:f:i:r:p:e:'
+		cmdLongOpts = ['help','version']
+		optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
+	except getopt.GetoptError:
+		dispUsage()
+	
+	# Pre-parsing of command line options for the -c option
+	for opt in optList:
+		if opt[0] == "-c":
+			conf["conffile"] = opt[1]
+		if opt[0] in ["-h", "--help"]:
+ 			dispUsage()
+		if opt[0] in ["-V", "--version"]:
+			dispVersion()
+	
+	# Reads the config file and create a LogReader instance for
+	# each log file to check.
+	confReader = ConfigReader(conf["conffile"])
+	confReader.openConf()
+	
+	# Options
+	optionValues = (["bool", "background", False],
+					["str", "logtargets", "/var/log/fail2ban.log"],
+					["str", "syslog-target", "/dev/log"],
+					["int", "syslog-facility", 1],
+					["bool", "debug", False],
+					["int", "verbose", conf["verbose"]],
+					["str", "pidlock", "/var/run/fail2ban.pid"],
+					["int", "maxfailures", 5],
+					["int", "bantime", 600],
+					["int", "findtime", 600],
+					["str", "ignoreip", ""],
+					["int", "polltime", 1],
+					["str", "cmdstart", ""],
+					["str", "cmdend", ""],
+					["int", "reinittime", 100],
+					["int", "maxreinits", 100])
+	
+	# Gets global configuration options
+	conf.update(confReader.getLogOptions("DEFAULT", optionValues))
+	
+	# Gets command line options
+	getCmdLineOptions(optList)
+
+	# Now we need to update confReader.configParser with 'commandline'
+	# overwritten parameters. There is no way to assign configParser
+	# with defaults (as I thought before) below in the code: thus defaults
+	# have to be overridden
+	for t, label, v in optionValues:
+		confReader.setValue("DEFAULT", label, `conf[label]`)
+	
+	# PID lock
+	pidLock.setPath(conf["pidlock"])
+	
+	# Now we can kill properly a running instance if needed
+	if conf["kill"]:
+		pid = pidLock.exists()
+		if pid:
+			killPID(int(pid))
+			logSys.warn("Killed Fail2Ban with PID "+pid)
+			sys.exit(0)
+		else:
+			logSys.error("No running Fail2Ban found")
+			sys.exit(-1)
+
+	# Start Fail2Ban in daemon mode
+	if conf["background"]:
+		retCode = createDaemon()
+		signal.signal(signal.SIGTERM, sigTERMhandler)
+		if not retCode:
+			logSys.error("Unable to start daemon")
+			sys.exit(-1)
+
+	# Process some options
+	# First setup Log targets
+	# Bug fix for #1234699
+	os.umask(0077)
+	for target in conf["logtargets"].split():
+		# target formatter 
+		# By default global formatter is taken. Is different for SYSLOG
+		tformatter = formatter
+		if target == "STDERR":
+			hdlr = logging.StreamHandler(sys.stderr)
+		elif target == "SYSLOG":
+			# SYSLOG target can be either
+			# a socket (file, so it starts with /)
+			# or hostname
+			# or hostname:port
+			syslogtargets = re.findall("(/[\w/]*)|([^/ ][^: ]*)(:(\d+)){,1}",
+									   conf["syslog-target"])
+			# we are waiting for a single match
+			syslogtargets = syslogtargets[0]
+
+			# assign facility if it was defined
+			if conf["syslog-facility"] < 0:
+				facility = handlers.SysLogHandler.LOG_USER
+			else:
+				facility = conf["syslog-facility"]
+
+			if len(syslogtargets) == 0: # everything default
+				hdlr = logging.handlers.SysLogHandler()
+			else:
+				if not ( syslogtargets[0] == "" ): # got socket
+					syslogtarget = syslogtargets[0]
+				else:		# got hostname and maybe a port
+					if syslogtargets[3] == "": # no port specified
+						port = 514
+					else:
+						port = int(syslogtargets[3])
+					syslogtarget = (syslogtargets[1], port)
+				hdlr = logging.handlers.SysLogHandler(syslogtarget, facility)
+			tformatter = logging.Formatter("fail2ban[%(process)d]: " +
+										   formatterstring);
+		else:
+			# Target should be a file
+			try:
+				open(target, "a")
+				hdlr = logging.FileHandler(target)
+			except IOError:
+				logSys.error("Unable to log to " + target)
+				continue
+		# Set formatter and add handler to logger
+		hdlr.setFormatter(tformatter)
+		logSys.addHandler(hdlr)
+	
+	# Verbose level
+	if conf["verbose"]:
+		logSys.warn("Verbose level is "+`conf["verbose"]`)
+		if conf["verbose"] == 1:
+			logSys.setLevel(logging.INFO)
+		elif conf["verbose"] > 1:
+			logSys.setLevel(logging.DEBUG)
+		if conf["verbose"] > 2:
+			formatterstring = ('%(levelname)s: [%(filename)s (%(lineno)d)] ' +
+						   '%(message)s')
+			formatter = logging.Formatter("%(asctime)s " + formatterstring)
+			stdout.setFormatter(formatter)
+	
+	# Debug mode. Should only be used by developers
+	if conf["debug"]:
+		logSys.warn("DEBUG MODE: FIREWALL COMMANDS ARE _NOT_ EXECUTED BUT " +
+					"ONLY DISPLAYED IN THE LOG MESSAGES")
+	
+	# Ignores IP list
+	ignoreIPList = conf["ignoreip"].split(' ')
+
+	# Checks for root user. This is necessary because log files
+	# are owned by root and firewall needs root access.
+	if not checkForRoot():
+		logSys.error("You must be root")
+		if not conf["debug"]:
+			sys.exit(-1)
+			
+	# Checks that no instance of Fail2Ban is currently running.
+	pid = pidLock.exists()
+	if pid:
+		logSys.error("Fail2Ban already running with PID "+pid)
+		sys.exit(-1)
+	else:
+		ret = pidLock.create()
+		if not ret:
+			# Unable to create PID lock. Exit
+			sys.exit(-1)
+	
+	logSys.debug("ConfFile is " + conf["conffile"])
+	logSys.debug("BanTime is " + `conf["bantime"]`)
+	logSys.debug("FindTime is " + `conf["findtime"]`)
+	logSys.debug("MaxFailure is " + `conf["maxfailures"]`)
+	
+	# Options
+	optionValues = (["bool", "enabled", False],
+					["str", "host", "localhost"],
+					["int", "port", "25"],
+					["str", "from", "root"],
+					["str", "to", "root"],
+					["str", "user", ''],
+					["str", "password", ''],
+					["bool", "localtime", False],
+					["str", "subject", "[Fail2Ban] Banned <ip>"],
+					["str", "message", "Fail2Ban notification"])
+	
+	# Gets global configuration options
+	mailConf = confReader.getLogOptions("MAIL", optionValues)
+	
+	# Create mailer if enabled
+	if isEnabledSection(mailConf["enabled"], "MAIL"):
+		logSys.debug("Mail enabled")
+		mail = Mail(mailConf["host"], mailConf["port"])
+		mail.setFromAddr(mailConf["from"])
+		mail.setUser(mailConf["user"])
+		mail.setPassword(mailConf["password"])
+		mail.setToAddr(mailConf["to"])
+		mail.setLocalTimeFlag(mailConf["localtime"])
+		logSys.debug("to: " + mailConf["to"] + " from: " + mailConf["from"])
+	
+	# Options
+	optionValues = (["bool", "enabled", False],
+					["str", "logfile", "/dev/null"],
+					["int", "maxfailures", conf["maxfailures"]],
+					["int", "bantime", conf["bantime"]],
+					["int", "findtime", conf["findtime"]],
+					["str", "timeregex", ""],
+					["str", "timepattern", ""],
+					["str", "failregex", ""],
+					["str", "fwstart", ""],
+					["str", "fwend", ""],
+					["str", "fwban", ""],
+					["str", "fwunban", ""],
+					["str", "fwcheck", ""])
+	
+	logSys.info("Fail2Ban v" + version + " is running")
+	
+	enabledSections = []
+	# Gets the options of each sections
+	for t in confReader.getSections():
+		l = confReader.getLogOptions(t, optionValues)
+		if isEnabledSection(l["enabled"], t):
+			# Creates a logreader object
+			enabledSections.append(t)
+			lObj = LogReader(l["logfile"], l["timeregex"], l["timepattern"],
+							 l["failregex"], l["maxfailures"], l["findtime"])
+			# Creates a firewall object
+			fObj = Firewall(l["fwstart"], l["fwend"], l["fwban"], l["fwunban"],
+							l["fwcheck"], l["bantime"])
+			# "Name" the firewall
+			fObj.setSection(t)
+			# Links them into a list. I'm not really happy
+			# with this :/
+			logFwList.append([t, lObj, fObj, dict()])
+	
+	logSys.info("Enabled sections: %s"%enabledSections)
+
+	# Warn about such "bad" sections
+	if len(conf["enabledsections"])>0:
+		logSys.warn("Sections %s defined in command "%conf["enabledsections"] +
+					"line were not found in config, thus ignored")
+	
+	# We add 127.0.0.1 to the ignore list has we do not want
+	# to be ban ourself.
+	for element in logFwList:
+		element[1].addIgnoreIP("127.0.0.1")
+	while len(ignoreIPList) > 0:
+		ip = ignoreIPList.pop()
+		# Bug fix for #1239557
+		if isValidIP(ip):
+			for element in logFwList:
+				element[1].addIgnoreIP(ip)
+		else:
+			logSys.warn(ip + " is not a valid IP address")
+	
+	# Startup loop -- necessary to avoid crash if it takes time for iptables
+	# to startup. To avoid introduction of new config options, reusing
+	# maxreinits and polltime.
+	reinits = 0
+	while True:
+		try:
+			initializeFwRules()
+			break
+		except ExternalError, e:
+			reinits += 1
+			logSys.warn(e)
+			if conf["maxreinits"] < 0 or (reinits < conf["maxreinits"]):
+				logSys.warn("#%d attempt to initialize the firewalls" % reinits)
+			else:
+				logSys.error("Exiting: Too many attempts to initialize the " +
+							 "firewall")
+				killApp()
+			time.sleep(conf["polltime"])
+
+	# try to reinit once if it fails immediately
+	lastReinitTime = time.time() - conf["reinittime"] - 1
+	reinits = 0
+	# Main loop
+	while True:
+		try:
+			sys.stdout.flush()
+			sys.stderr.flush()
+			
+			# Checks if some IP have to be remove from ban
+			# list.
+			for element in logFwList:
+				element[2].checkForUnBan(conf["debug"])
+
+			# If the log file has not been modified since the
+			# last time, we sleep for 1 second. This is active
+			# polling so not very effective.
+			modList = list()
+			for element in logFwList:
+				if element[1].isModified():
+					modList.append(element)
+			
+			if len(modList) == 0:
+				time.sleep(conf["polltime"])
+				continue
+			
+			# Gets the failure list from the log file. For a given IP,
+			# takes only the service which has the most password failures.
+			for element in modList:
+				e = element[1].getFailures()
+				for key in e.iterkeys():
+					if element[3].has_key(key):
+						element[3][key] = (element[3][key][0] + e[key][0],
+											e[key][1])
+					else:
+						element[3][key] = (e[key][0], e[key][1])
+			
+			# Remove the oldest failure attempts from the global list.
+			# We iterate the failure list and ban IP that make
+			# *retryAllowed* login failures.
+			unixTime = time.time()
+			for element in logFwList:
+				fails = element[3].copy()
+				findTime = element[1].getFindTime()
+				for attempt in fails:
+					failTime = fails[attempt][1]
+					if failTime < unixTime - findTime:
+						del element[3][attempt]
+					elif fails[attempt][0] >= element[1].getMaxRetry():
+						aInfo = {"section": element[0],
+								 "ip": attempt,
+								 "failures": element[3][attempt][0],
+								 "failtime": failTime}
+						logSys.info(element[0] + ": " + aInfo["ip"] +
+									" has " + `aInfo["failures"]` +
+									" login failure(s). Banned.")
+						element[2].addBanIP(aInfo, conf["debug"])
+						# Send a mail notification
+						if 'mail' in locals():
+							mail.sendmail(mailConf["subject"],
+										  mailConf["message"], aInfo)
+						del element[3][attempt]
+		except ExternalError, e:
+			# Something wrong while dealing with Iptables.
+			# May be chain got removed?
+			reinits += 1
+			logSys.error(e)
+			if ((unixTime - lastReinitTime > conf["reinittime"]) and
+				((conf["maxreinits"] < 0) or (reinits < conf["maxreinits"]))):
+				logSys.warn("#%d reinitialization of firewalls"%reinits)
+				lastReinitTime = unixTime
+			else:
+				logSys.error("Exiting: reinits follow too often, or too many " +
+							 "reinit attempts")
+				killApp()
+			# We already failed runCheck so disable it until
+			# restoring a safe state
+			setFwMustCheck(False)
+			# save firewalls to keep a list of IPs for rebanning
+			logFwListCopy = copy.deepcopy(logFwList)
+			try:
+				# restore as much as possible
+				restoreFwRules()
+				# reinitialize all the chains
+				initializeFwRules()
+				# restore the lists of baned IPs
+				logFwList.__init__(logFwListCopy)
+				# reBan known IPs
+				reBan()
+				# Now we can enable the runCheck test again
+				setFwMustCheck(True)
+			except ExternalError:
+				raise ExternalError("Big Oops happened: situation is out of " +
+									"control. Something is wrong with your " +
+									"setup. Please check your settings")
+		except KeyboardInterrupt:
+			# When the user press <ctrl>+<c> we exit nicely.
+			killApp()
diff --git a/0.6.1-8/firewall/__init__.py b/0.6.1-8/firewall/__init__.py
new file mode 100644
index 00000000..f25221f9
--- /dev/null
+++ b/0.6.1-8/firewall/__init__.py
@@ -0,0 +1,25 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/09 15:33:33 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
\ No newline at end of file
diff --git a/0.6.1-8/firewall/firewall.py b/0.6.1-8/firewall/firewall.py
new file mode 100644
index 00000000..66fba96b
--- /dev/null
+++ b/0.6.1-8/firewall/firewall.py
@@ -0,0 +1,192 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.10 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.10 $"
+__date__ = "$Date: 2005/12/16 23:48:52 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import time, os, logging, re
+
+from utils.process import executeCmd
+# unfortunately but I have to bring ExternalError in especially
+# for flushBanList: if one of IPs got flushed manually outside or something,
+# we might endup with not "full" flush unless we handle exception within the loop
+from utils.process import ExternalError
+from utils.strings import replaceTag
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+class Firewall:
+	""" Manages the ban list and executes the command that ban
+		the IP.
+	"""
+	
+	def __init__(self, startRule, endRule, banRule, unBanRule, checkRule,
+				 banTime):
+		self.banRule = banRule
+		self.unBanRule = unBanRule
+		self.checkRule = checkRule
+		self.startRule = startRule
+		self.endRule = endRule
+		self.banTime = banTime
+		self.banList = dict()
+		self.section = ""
+		self.mustCheck = True
+
+	def setSection(self, section):
+		""" Set optional section name for clarify of logging
+		"""
+		self.section = section
+		
+	def getMustCheck(self):
+		""" Return true if the runCheck test is executed
+		"""
+		return self.mustCheck
+	
+	def setMustCheck(self, value):
+		""" Enable or disable the execution of runCheck test
+		"""
+		self.mustCheck = value
+
+  	def initialize(self, debug):
+		logSys.debug("%s: Initialize firewall rules"%self.section)
+  		executeCmd(self.startRule, debug)
+
+	def restore(self, debug):
+		logSys.debug("%s: Restore firewall rules"%self.section)
+		try:
+			self.flushBanList(debug)
+			executeCmd(self.endRule, debug)
+		except ExternalError:
+			pass
+
+	def addBanIP(self, aInfo, debug):
+		""" Bans an IP.
+		"""
+		ip = aInfo["ip"]
+		if not self.inBanList(ip):
+			crtTime = time.time()
+			if self.banTime < 0:
+				banMsg = "Ban (permanent)"
+			else:
+				banMsg = "Ban (%d s)"%self.banTime
+			logSys.warn("%s: %s "%(self.section, banMsg) + ip)
+			self.banList[ip] = crtTime
+			aInfo["bantime"] = crtTime
+			self.runCheck(debug)
+			cmd = self.banIP(aInfo)
+			if executeCmd(cmd, debug):
+				raise ExternalError("Firewall: execution of fwban command " +
+									"'%s' failed"%cmd)
+		else:
+			self.runCheck(debug)
+			logSys.error("%s: "%self.section+ip+" already in ban list")
+	
+	def delBanIP(self, aInfo, debug):
+		""" Unban an IP.
+		"""
+		ip = aInfo["ip"]
+		if self.inBanList(ip):
+			logSys.warn("%s: Unban "%self.section + ip)
+			del self.banList[ip]
+			self.runCheck(debug)
+			executeCmd(self.unBanIP(aInfo), debug)
+		else:
+			logSys.error("%s: "%self.section+ip+" not in ban list")
+
+	def reBan(self, debug):
+		""" Re-Bans known IPs.
+			TODO: implement "failures" and "failtime"
+		"""
+		for ip in self.banList:
+			aInfo = {"ip": ip,
+					 "bantime":self.banList[ip]}
+			logSys.warn("%s: ReBan "%self.section + ip)
+			# next piece is similar to the on in addBanIp
+			# so might be one more function will not hurt
+			self.runCheck(debug)
+			executeCmd(self.banIP(aInfo), debug)
+	
+	def inBanList(self, ip):
+		""" Checks if IP is in ban list.
+		"""
+		return self.banList.has_key(ip)
+
+	def runCheck(self, debug):
+		""" Runs fwcheck command and throws an exception if it returns non-0
+			result
+		"""
+		if self.mustCheck:
+			executeCmd(self.checkRule, debug)
+		else:
+			return None
+
+	def checkForUnBan(self, debug):
+		""" Check for IP to remove from ban list. If banTime is smaller than
+			zero, IP will be never removed.
+		"""
+		if self.banTime < 0:
+			# Permanent banning
+			return
+		banListTemp = self.banList.copy()
+		for element in banListTemp.iteritems():
+			btime = element[1]
+			if btime < time.time()-self.banTime:
+				aInfo = {"ip": element[0],
+						 "bantime": btime,
+						 "unbantime": time.time()}
+				self.delBanIP(aInfo, debug)
+	
+	def flushBanList(self, debug):
+		""" Flushes the ban list and of course the firewall rules.
+			Called when fail2ban exits.
+		"""
+		banListTemp = self.banList.copy()
+		for element in banListTemp.iteritems():
+			aInfo = {"ip": element[0],
+					 "bantime": element[1],
+					 "unbantime": time.time()}
+			try:
+				self.delBanIP(aInfo, debug)
+			except ExternalError:
+				# we must let it fail here in the loop, or we don't
+				# flush properly
+				pass
+			
+	def banIP(self, aInfo):
+		""" Returns query to ban IP.
+		"""
+		query = replaceTag(self.banRule, aInfo)
+		return query
+	
+	def unBanIP(self, aInfo):
+		""" Returns query to unban IP.
+		"""
+		query = replaceTag(self.unBanRule, aInfo)
+		return query
+	
+	def viewBanList(self):
+		""" Prints the ban list on screen. Usefull for debugging.
+		"""
+		for element in self.banList.iteritems():
+			print element
diff --git a/0.6.1-8/logreader/__init__.py b/0.6.1-8/logreader/__init__.py
new file mode 100644
index 00000000..60ef5531
--- /dev/null
+++ b/0.6.1-8/logreader/__init__.py
@@ -0,0 +1,25 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2004/10/10 13:33:40 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
\ No newline at end of file
diff --git a/0.6.1-8/logreader/logreader.py b/0.6.1-8/logreader/logreader.py
new file mode 100644
index 00000000..b4fcdd19
--- /dev/null
+++ b/0.6.1-8/logreader/logreader.py
@@ -0,0 +1,234 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.16 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.16 $"
+__date__ = "$Date: 2006/01/03 15:13:04 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os, sys, time, re, logging
+
+from utils.dns import *
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+class LogReader:
+	""" Reads a log file and reports information about IP that make password
+		failure, bad user or anything else that is considered as doubtful login
+		attempt.	
+	"""
+	
+	def __init__(self, logPath, timeregex, timepattern, failregex,
+				  maxRetry, findTime):
+		self.logPath = logPath
+		self.maxRetry = maxRetry
+		self.timeregex = timeregex
+		self.timepattern = timepattern
+		self.failregex = failregex
+		self.findTime = findTime
+		self.ignoreIpList = []
+		self.lastModTime = 0
+		self.lastPos = 0
+		self.lastDate = 0
+		self.logStats = None
+	
+	def getMaxRetry(self):
+		""" Gets the maximum number of failures
+		"""
+		return self.maxRetry
+	
+	def getFindTime(self):
+		""" Gets the find time.
+		"""
+		return self.findTime
+	
+	def addIgnoreIP(self, ip):
+		""" Adds an IP to the ignore list.
+		"""
+		logSys.debug("Add "+ip+" to ignore list")
+		self.ignoreIpList.append(ip)
+		
+	def inIgnoreIPList(self, ip):
+		""" Checks if IP is in the ignore list.
+		"""
+		for i in self.ignoreIpList:
+			s = i.split('/', 1)
+			# IP address without CIDR mask
+			if len(s) == 1:
+				s.insert(1, '32')
+			s[1] = long(s[1])
+			a = cidr(s[0], s[1])
+			b = cidr(ip, s[1])
+			if a == b:
+				return True
+		return False
+	
+	def openLogFile(self):
+		""" Opens the log file specified on init.
+		"""
+		try:
+			fileHandler = open(self.logPath)
+		except OSError:
+			logSys.error("Unable to open "+self.logPath)
+			
+		return fileHandler
+		
+	def isModified(self):
+		""" Checks if the log file has been modified using os.stat().
+		"""
+		try:
+			self.logStats = os.stat(self.logPath)
+			if self.lastModTime == self.logStats.st_mtime:
+				return False
+			else:
+				logSys.debug(self.logPath+" has been modified")
+				self.lastModTime = self.logStats.st_mtime
+				return True
+		except OSError:
+			logSys.error("Unable to get stat on "+self.logPath)
+			return False
+	
+	def setFilePos(self, file):
+		""" Sets the file position. We must take care of log file rotation
+			and reset the position to 0 in that case. Use the log message
+			timestamp in order to detect this.		
+		"""
+		line = file.readline()
+		if self.lastDate < self.getTime(line):
+			logSys.debug("Date " + `self.lastDate` + " is " + "smaller than " +
+							`self.getTime(line)`)
+			logSys.debug("Log rotation detected for " + self.logPath)
+			self.lastPos = 0
+		
+		logSys.debug("Setting file position to " + `self.lastPos` + " for " +
+						self.logPath)
+		file.seek(self.lastPos)
+	
+	def getFailures(self):
+		""" Gets all the failure in the log file which are
+			newer than time.time()-self.findTime.
+			
+			Returns a dict with the IP, the number of failure
+			and the latest failure time.
+		"""
+		ipList = dict()
+		logSys.debug(self.logPath)
+		logFile = self.openLogFile()
+		self.setFilePos(logFile)
+		lastLine = None
+		for line in logFile:
+			if not self.hasTime(line):
+				# There is no valid time in this line
+				continue
+			lastLine = line
+			for element in self.findFailure(line):
+				ip = element[0]
+				unixTime = element[1]
+				if unixTime < time.time()-self.findTime:
+					break
+				if self.inIgnoreIPList(ip):
+					logSys.debug("Ignore "+ip)
+					continue
+				logSys.debug("Found "+ip)
+				if ipList.has_key(ip):
+					ipList[ip] = (ipList[ip][0]+1, unixTime)
+				else:
+					ipList[ip] = (1, unixTime)
+		self.lastPos = logFile.tell()
+		if lastLine:
+			self.lastDate = self.getTime(lastLine)
+		logFile.close()
+		return ipList
+
+	def findFailure(self, line):
+		""" Finds the failure in line. Uses the failregex pattern
+			to find it and timeregex in order to find the logging
+			time.
+			
+			Returns a dict with IP and timestamp.
+		"""
+		failList = list()
+		match = re.search(self.failregex, line)
+		if match:
+			timeMatch = re.search(self.timeregex, match.string)
+			if timeMatch:
+				date = self.getUnixTime(timeMatch.group())
+				# Bug fix for Debian #330827
+				hostMatch = match.groupdict()
+				if len(hostMatch)==0:
+					logSys.warn("Must have been using old style of failregex! "
+								"Security Breach! Read README.Debian")
+					ipMatch = textToIp(match.string)
+				else:
+ 					ipMatch = reduce(lambda x,y:x+textToIp(y),
+									 hostMatch.values(), [])
+					
+				if ipMatch:
+					for ip in ipMatch:
+						failList.append([ip, date])
+		return failList
+	
+	def hasTime(self, line):
+		""" Return true if the line contains a date
+		"""
+		timeMatch = re.search(self.timeregex, line)
+		if timeMatch:
+			return True
+		else:
+			return False
+	
+	def getTime(self, line):
+		""" Gets the time of a log message.
+		"""
+		date = 0
+		timeMatch = re.search(self.timeregex, line)
+		if timeMatch:
+			date = self.getUnixTime(timeMatch.group())
+		return date
+		
+	def getUnixTime(self, value):
+		""" Returns the Unix timestamp of the given value.
+			Pattern should describe the date construction of
+			value.
+		"""
+		try:
+			# Check if the parsed value is in TAI64N format
+			if not self.timepattern.lower() == "tai64n":
+				date = list(time.strptime(value, self.timepattern))
+			else:
+				# extract part of format which represents seconds since epoch
+				seconds_since_epoch = value[2:17]
+				date = list(time.gmtime(int(seconds_since_epoch, 16)))
+		except ValueError, e:
+			logSys.error(e)
+			logSys.error("Please check the format and your locale settings.")
+			return None
+		if date[0] < 2000:
+			# There is probably no year field in the logs
+			date[0] = time.gmtime()[0]
+			# Bug fix for #1241756
+			# If the date is greater than the current time, we suppose
+			# that the log is not from this year but from the year before
+			if time.mktime(date) > time.time():
+				date[0] -= 1
+		unixTime = time.mktime(date)
+		return unixTime
diff --git a/0.6.1-8/man/fail2ban.8 b/0.6.1-8/man/fail2ban.8
new file mode 100644
index 00000000..1c2e4f73
--- /dev/null
+++ b/0.6.1-8/man/fail2ban.8
@@ -0,0 +1,58 @@
+.\" 
+.TH "FAIL2BAN" "8" "July 2005" "Cyril Jaquier" "System administration tools"
+.SH "NAME"
+fail2ban \- bans IP that makes too many password failures
+.SH "SYNOPSIS"
+.B fail2ban
+[\fIOPTIONS\fR]
+.SH "DESCRIPTION"
+\fBFail2Ban\fR reads log file that contains password failure report
+and bans the corresponding IP addresses using firewall rules. It updates
+firewall rules to reject the IP address.
+.SH "OPTIONS"
+.TP 
+\fB\-b\fR
+start in background
+.TP 
+\fB\-c\fR \fIFILE\fR
+read configuration file \fIFILE\fR
+.TP 
+\fB\-p\fR \fIFILE\fR
+create PID lock in \fIFILE\fR
+.TP 
+\fB\-h, \-\-help\fR
+display this help message
+.TP 
+\fB\-i\fR \fIIP\fR
+\fIIP\fR(s) to ignore
+.TP 
+\fB\-k\fR
+kill a currently running Fail2Ban instance
+.TP 
+\fB\-r\fR \fIVALUE\fR
+allow a max of \fIVALUE\fR password failure [maxfailures]
+.TP 
+\fB\-t\fR \fITIME\fR
+ban IP for \fITIME\fR seconds [bantime]
+.TP 
+\fB\-f\fR \fITIME\fR
+lifetime in seconds of failed entry [findtime]
+.TP 
+\fB\-v\fR
+verbose. Use twice for greater effect
+.TP 
+\fB\-V, \-\-version\fR
+print software version
+.SH "FILES"
+.I /etc/fail2ban.conf
+.RS
+The configuration file. See \fBfail2ban.conf\fR(5) for further details.
+.SH "REPORTING BUGS"
+Please report bugs at http://sourceforge.net/projects/fail2ban/
+via bug tracker
+.SH "AUTHOR"
+Cyril Jaquier <lostcontrol@users.sourceforge.net>
+.SH "SEE ALSO"
+.TP 
+See
+.BR "http://fail2ban.sourceforge.net/".
diff --git a/0.6.1-8/man/fail2ban.conf.5 b/0.6.1-8/man/fail2ban.conf.5
new file mode 100644
index 00000000..b495d2ea
--- /dev/null
+++ b/0.6.1-8/man/fail2ban.conf.5
@@ -0,0 +1,28 @@
+.\" 
+.TH "FAIL2BAN.CONF" "5" "July 2005" "Cyril Jaquier" "System administration tools"
+.SH "NAME"
+fail2ban.conf \- configuration data for fail2ban
+.SH "DESCRIPTION"
+\fB/etc/fail2ban.conf\fR contains data about the general configuration of fail2ban, the mail notification and services to monitor.
+.SH "VARIABLES"
+Please look at the file itself
+.SH "FILES"
+.I /etc/fail2ban.conf
+.SH "REPORTING BUGS"
+Please report bugs at http://sourceforge.net/projects/fail2ban/
+via bug tracker
+.SH "AUTHOR"
+Cyril Jaquier <lostcontrol@users.sourceforge.net>
+.br
+Modified by
+.br
+ - Yaroslav O. Halchenko <debian@onerussian.com>.
+.br
+Sponsored for Debian by
+.br
+ - Barak A. Pearlmutter <barak@cs.nuim.ie>.
+.SH "SEE ALSO"
+.BR fail2ban(8)
+.TP 
+See
+.BR "http://fail2ban.sourceforge.net/".
diff --git a/0.6.1-8/setup.cfg b/0.6.1-8/setup.cfg
new file mode 100644
index 00000000..cdc25b29
--- /dev/null
+++ b/0.6.1-8/setup.cfg
@@ -0,0 +1,5 @@
+[install]
+install-purelib=/usr/share/fail2ban
+
+[sdist]
+formats=bztar
diff --git a/0.6.1-8/setup.py b/0.6.1-8/setup.py
new file mode 100755
index 00000000..dc41eddd
--- /dev/null
+++ b/0.6.1-8/setup.py
@@ -0,0 +1,82 @@
+#!/usr/bin/env python
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.6 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.6 $"
+__date__ = "$Date: 2006/01/22 11:08:42 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+from distutils.core import setup
+from version import version
+from os.path import isfile, join
+from sys import exit, argv
+
+longdesc = '''
+Fail2Ban scans log files like /var/log/pwdfail or
+/var/log/apache/error_log and bans IP that makes
+too many password failures. It updates firewall rules
+to reject the IP address or executes user defined
+commands.'''
+
+setup(
+	name = "fail2ban",
+	version = version,
+	description = "Ban IPs that make too many password failure",
+	long_description = longdesc,
+	author = "Cyril Jaquier",
+	author_email = "lostcontrol@users.sourceforge.net",
+	url = "http://fail2ban.sourceforge.net",
+	license = "GPL",
+	platforms = "Posix",
+	scripts = ['fail2ban'],
+	py_modules = ['fail2ban', 'version'],
+	packages = ['firewall', 'logreader', 'confreader', 'utils']
+)
+
+# Do some checks after installation
+# Search for obsolete files.
+obsoleteFiles = []
+elements = {"/usr/bin/": ["fail2ban.py"],
+			"/usr/share/fail2ban/firewall/": ["iptables.py", "ipfwadm.py",
+											"ipfw.py"]}
+for dir in elements:
+	for f in elements[dir]:
+		path = join(dir, f)
+		if isfile(path):
+			obsoleteFiles.append(path)
+if obsoleteFiles:
+	print
+	print "Obsolete files from previous Fail2Ban versions were found on " \
+		  "your system."
+	print "Please delete them:"
+	print
+	for f in obsoleteFiles:
+		print "\t" + f
+	print
+
+# Update config file
+if argv[1] == "install":
+	print
+	print "Please do not forget to update your configuration file."
+	print "Use config/fail2ban.conf.* as example."
+	print
diff --git a/0.6.1-8/utils/__init__.py b/0.6.1-8/utils/__init__.py
new file mode 100644
index 00000000..7545b531
--- /dev/null
+++ b/0.6.1-8/utils/__init__.py
@@ -0,0 +1,25 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.1 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.1 $"
+__date__ = "$Date: 2005/03/06 17:51:24 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
\ No newline at end of file
diff --git a/0.6.1-8/utils/dns.py b/0.6.1-8/utils/dns.py
new file mode 100644
index 00000000..1f859d12
--- /dev/null
+++ b/0.6.1-8/utils/dns.py
@@ -0,0 +1,102 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.8 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.8 $"
+__date__ = "$Date: 2005/11/20 17:07:47 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os, re, socket, struct
+
+def dnsToIp(dns):
+	""" Convert a DNS into an IP address using the Python socket module.
+		Thanks to Kevin Drapel.
+	"""
+	try:
+		return socket.gethostbyname_ex(dns)[2]
+	except socket.gaierror:
+		return list()
+
+def textToDns(text):
+	""" Search for possible DNS in an arbitrary text.
+		Thanks to Tom Pike.
+	"""
+	match = re.findall("(?:(?:\w|-)+\.){2,}\w+", text)
+	if match:
+		return match
+	else:
+		return []
+
+def searchIP(text):
+	""" Search if an IP address if directly available and return
+		it.
+	"""
+	match = re.findall("(?:\d{1,3}\.){3}\d{1,3}", text)
+	if match:
+		return match
+	else:
+		return []
+
+def isValidIP(str):
+	""" Return true if str is a valid IP
+	"""
+	s = str.split('/', 1)
+	try:
+		socket.inet_aton(s[0])
+		return True
+	except socket.error:
+		return False
+
+def textToIp(text):
+	""" Return the IP of DNS found in a given text.
+	"""
+	ipList = list()
+	# Search for plain IP
+	plainIP = searchIP(text)
+	for element in plainIP:
+		if isValidIP(element):
+			ipList.append(element)
+	if not ipList:
+		# Try to get IP from possible DNS
+		dnsList = textToDns(text)
+		for element in dnsList:
+			dns = dnsToIp(element)
+			for e in dns:
+				ipList.append(e)
+	return ipList
+
+def cidr(i, n):
+	""" Convert an IP address string with a CIDR mask into a 32-bit
+		integer.
+	"""
+	# 32-bit IPv4 address mask
+	MASK = 0xFFFFFFFFL
+	return ~(MASK >> n) & MASK & addr2bin(i)
+
+def addr2bin(str):
+	""" Convert a string IPv4 address into an unsigned integer.
+	"""
+	return struct.unpack("!L", socket.inet_aton(str))[0]
+
+def bin2addr(addr):
+	""" Convert a numeric IPv4 address into string n.n.n.n form.
+	"""
+	return socket.inet_ntoa(struct.pack("!L", addr))
diff --git a/0.6.1-8/utils/mail.py b/0.6.1-8/utils/mail.py
new file mode 100644
index 00000000..ec763a18
--- /dev/null
+++ b/0.6.1-8/utils/mail.py
@@ -0,0 +1,91 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.3 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.3 $"
+__date__ = "$Date: 2006/01/03 15:13:41 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging, smtplib, email.Utils
+
+from utils.strings import replaceTag
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+class Mail:
+	""" Mailer class
+	"""
+	
+	def __init__(self, host, port = 25):
+		self.host = host
+		self.port = port
+		self.localTimeFlag = False
+		
+	def setFromAddr(self, fromAddr):
+		""" Set from: address
+		"""
+		self.fromAddr = fromAddr
+
+	def setUser(self, user):
+		""" Set smtpuser
+		"""
+		self.user = user
+
+	def setPassword(self, password):
+		""" Set smtppassword
+		"""
+		self.password = password
+	
+	def setToAddr(self, toAddr):
+		""" Set to: address
+		"""
+		self.toAddr = toAddr.split()
+
+	def setLocalTimeFlag(self, localTimeFlag):
+		""" Set to: address
+		"""
+		self.localTimeFlag = localTimeFlag
+
+	def sendmail(self, subject, message, aInfo):
+		""" Send an email using smtplib
+		"""
+		subj = replaceTag(subject, aInfo)
+		msg = replaceTag(message, aInfo)
+		
+		mail = ("From: %s\r\nTo: %s\r\nDate: %s\r\nSubject: %s\r\n\r\n" %
+				(self.fromAddr, ", ".join(self.toAddr),
+				email.Utils.formatdate(localtime = self.localTimeFlag),
+				subj)) + msg
+		
+		try:
+			server = smtplib.SMTP(self.host, self.port)
+			#server.set_debuglevel(1)
+			if not self.user == '':
+				server.login(self.user, self.password)
+			server.sendmail(self.fromAddr, self.toAddr, mail)
+			logSys.debug("Email sent to " + `self.toAddr`)
+			server.quit()	
+		except Exception, e:
+			logSys.error("Unable to send mail to " + self.host + ":" +
+						 `self.port` + " from " + self.fromAddr + " to " +
+						 `self.toAddr` + ": " + `e` + ": " + `e.args`)
+		
diff --git a/0.6.1-8/utils/pidlock.py b/0.6.1-8/utils/pidlock.py
new file mode 100644
index 00000000..35f50068
--- /dev/null
+++ b/0.6.1-8/utils/pidlock.py
@@ -0,0 +1,109 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.2 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.2 $"
+__date__ = "$Date: 2005/11/20 17:07:47 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os, logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+class PIDLock:
+	""" Manages the PID lock file.
+	
+		The following class shows how to implement the singleton pattern[1] in
+		Python. A singleton is a class that makes sure only one instance of it
+		is ever created. Typically such classes are used to manage resources
+		that by their very nature can only exist once.
+		
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/52558
+	"""
+	
+	class __impl:
+		""" Implementation of the singleton interface """
+
+		def setPath(self, path):
+			""" Set PID lock file path.
+			"""
+			self.path = path
+		
+		def create(self):
+			""" Create PID lock.
+			"""
+			try:
+				fileHandler = open(self.path, mode='w')
+				pid = os.getpid()
+				fileHandler.write(`pid` + '\n')
+				fileHandler.close()
+				logSys.debug("Created PID lock (" + `pid` + ") in " + self.path)
+				return True
+			except:
+				logSys.error("Unable to create PID lock " + self.path)
+				return False	
+		
+		def remove(self):
+			""" Remove PID lock.
+			"""
+			try:
+				os.remove(self.path)
+				logSys.debug("Removed PID lock " + self.path)
+			except OSError:
+				logSys.error("Unable to remove PID lock " + self.path)
+			except AttributeError:
+				# AttributeError if self.path wasn't specified yet
+				logSys.debug("PID lock not removed because not defined yet")
+		
+		def exists(self):
+			""" Returns the current PID if Fail2Ban is running or False
+				if no instance found.
+			"""
+			try:
+				fileHandler = open(self.path)
+				pid = fileHandler.readline()
+				fileHandler.close()
+				return pid
+			except IOError:
+				return False
+
+	# storage for the instance reference
+	__instance = None
+
+	def __init__(self):
+		""" Create singleton instance """
+		# Check whether we already have an instance
+		if PIDLock.__instance is None:
+			# Create and remember instance
+			PIDLock.__instance = PIDLock.__impl()
+
+		# Store instance reference as the only member in the handle
+		self.__dict__['_PIDLock__instance'] = PIDLock.__instance
+
+	def __getattr__(self, attr):
+		""" Delegate access to implementation """
+		return getattr(self.__instance, attr)
+
+	def __setattr__(self, attr, value):
+		""" Delegate access to implementation """
+		return setattr(self.__instance, attr, value)
+	
diff --git a/0.6.1-8/utils/process.py b/0.6.1-8/utils/process.py
new file mode 100644
index 00000000..a4310ecf
--- /dev/null
+++ b/0.6.1-8/utils/process.py
@@ -0,0 +1,137 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.2 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.2 $"
+__date__ = "$Date: 2005/11/20 17:07:47 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import os, logging, signal
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+class ExternalError(UserWarning):
+	""" Exception to warn about failed fwcheck or fwban command
+	"""
+	pass
+
+def createDaemon():
+	""" Detach a process from the controlling terminal and run it in the
+		background as a daemon.
+	
+		http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
+	"""
+
+	try:
+		# Fork a child process so the parent can exit.  This will return control
+		# to the command line or shell.  This is required so that the new process
+		# is guaranteed not to be a process group leader.  We have this guarantee
+		# because the process GID of the parent is inherited by the child, but
+		# the child gets a new PID, making it impossible for its PID to equal its
+		# PGID.
+		pid = os.fork()
+	except OSError, e:
+		return((e.errno, e.strerror))	 # ERROR (return a tuple)
+
+	if (pid == 0):	   # The first child.
+
+		# Next we call os.setsid() to become the session leader of this new
+		# session.  The process also becomes the process group leader of the
+		# new process group.  Since a controlling terminal is associated with a
+		# session, and this new session has not yet acquired a controlling
+		# terminal our process now has no controlling terminal.  This shouldn't
+		# fail, since we're guaranteed that the child is not a process group
+		# leader.
+		os.setsid()
+	
+		# When the first child terminates, all processes in the second child
+		# are sent a SIGHUP, so it's ignored.
+		signal.signal(signal.SIGHUP, signal.SIG_IGN)
+	
+		try:
+			# Fork a second child to prevent zombies.  Since the first child is
+			# a session leader without a controlling terminal, it's possible for
+			# it to acquire one by opening a terminal in the future.  This second
+			# fork guarantees that the child is no longer a session leader, thus
+			# preventing the daemon from ever acquiring a controlling terminal.
+			pid = os.fork()		# Fork a second child.
+		except OSError, e:
+			return((e.errno, e.strerror))  # ERROR (return a tuple)
+	
+		if (pid == 0):	  # The second child.
+			# Ensure that the daemon doesn't keep any directory in use.  Failure
+			# to do this could make a filesystem unmountable.
+			os.chdir("/")
+		else:
+			os._exit(0)	  # Exit parent (the first child) of the second child.
+	else:
+		os._exit(0)		 # Exit parent of the first child.
+
+	# Close all open files.  Try the system configuration variable, SC_OPEN_MAX,
+	# for the maximum number of open files to close.  If it doesn't exist, use
+	# the default value (configurable).
+	try:
+		maxfd = os.sysconf("SC_OPEN_MAX")
+	except (AttributeError, ValueError):
+		maxfd = 256	   # default maximum
+
+	for fd in range(0, maxfd):
+		try:
+			os.close(fd)
+		except OSError:   # ERROR (ignore)
+			pass
+
+	# Redirect the standard file descriptors to /dev/null.
+   	os.open("/dev/null", os.O_RDONLY)	# standard input (0)
+	os.open("/dev/null", os.O_RDWR)		# standard output (1)
+	os.open("/dev/null", os.O_RDWR)		# standard error (2)
+
+	return True
+
+def killPID(pid):
+	""" Kills the process with the given PID using the
+		INT signal (same effect as <ctrl>+<c>).
+	"""
+	try:
+		return os.kill(pid, 2)
+	except OSError:
+		logSys.error("Can not kill process " + `pid` + ". Please check that " +
+					"Fail2Ban is not running and remove the file " +
+					"'/tmp/fail2ban.pid'")
+		return False
+
+def executeCmd(cmd, debug):
+	""" Executes an OS command.
+	"""
+	if cmd == "":
+		logSys.debug("Nothing to do")
+		return None
+	
+	logSys.debug(cmd)
+	if not debug:
+		retval = os.system(cmd)
+		if not retval == 0:
+			logSys.error("'" + cmd + "' returned " + `retval`)
+			raise ExternalError("Execution of command '%s' failed" % cmd)
+		return retval
+	else:
+		return None
diff --git a/0.6.1-8/utils/strings.py b/0.6.1-8/utils/strings.py
new file mode 100644
index 00000000..25e19ca3
--- /dev/null
+++ b/0.6.1-8/utils/strings.py
@@ -0,0 +1,40 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.2 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.2 $"
+__date__ = "$Date: 2005/11/20 17:07:47 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import logging
+
+# Gets the instance of the logger.
+logSys = logging.getLogger("fail2ban")
+
+def replaceTag(query, aInfo):
+	""" Replace tags in query
+	"""
+	string = query
+	for tag in aInfo:
+		string = string.replace('<'+tag+'>', `aInfo[tag]`)
+	# New line
+	string = string.replace('<br>', '\n')
+	return string
diff --git a/0.6.1-8/version.py b/0.6.1-8/version.py
new file mode 100644
index 00000000..9a7f95ae
--- /dev/null
+++ b/0.6.1-8/version.py
@@ -0,0 +1,27 @@
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+# Author: Cyril Jaquier
+# 
+# $Revision: 1.15 $
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision: 1.15 $"
+__date__ = "$Date: 2006/03/15 23:07:12 $"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+version = "0.6.1"