Commit graph

2750 commits

Author SHA1 Message Date
Yaroslav Halchenko
6ccd57813c BF: anchor apache- filters. Close #248
See https://vndh.net/note:fail2ban-089-denial-service for more information
2013-06-11 19:19:25 -04:00
Daniel Black
fd9f9f16e0 BF: need to anchor the start to avoid another repeat of DoS injection like Apache 2013-06-12 08:48:30 +10:00
Daniel Black
f2fa4d53a8 ENH: stricter regex thanks to Steven Hiscocks (kwirk) 2013-06-12 08:30:59 +10:00
Daniel Black
16d63434ef DOC: credits 2013-06-11 23:56:09 +10:00
Daniel Black
4787777cee DOC: credits for gh-244 2013-06-11 10:30:56 +10:00
Daniel Black
66d8210f80 Merge pull request #244 from clopez/filter-asterisk
Filter Asterisk: Add AUTH_UNKNOWN_DOMAIN error to list
2013-06-10 17:28:35 -07:00
Carlos Alberto Lopez Perez
7248ef4564 Filter Asterisk: Add sample log entry to testcase.
* Sample log entry for AUTH_UNKNOWN_DOMAIN (Not a local domain)
2013-06-11 02:13:37 +02:00
Carlos Alberto Lopez Perez
47b063b022 Filter Asterisk: Add AUTH_UNKNOWN_DOMAIN error to list
* I have been seeing bruteforcing attempts where asterisk fails with
   AUTH_UNKNOWN_DOMAIN (Not a local domain)
2013-06-10 19:50:35 +02:00
JP Espinosa
32b271c36e Update redhat-initd
- Using `-x` to remove previous socket on start
- Using Should- to wait for iptables and wrappers
2013-06-03 12:34:47 -04:00
JP Espinosa
3736d7ddbf Rewrite to use native init.d functions
- There was a bug with the old "getpid" function, when running linux containers you can see multiple fail2ban instances on hardware node and could stop one on a random virtual environment
- Added reload and status options
2013-06-03 06:29:36 -05:00
Yaroslav Halchenko
b53612cb10 Merge pull request #237 from grooverdan/asterisk-227
Asterisk enhancements
2013-05-29 18:38:15 -07:00
Daniel Black
05c88bd85d ENH: purge a few more .* 2013-05-30 11:34:04 +10:00
Daniel Black
28fc14d010 DOC: credits 2013-05-30 10:27:30 +10:00
Daniel Black
e54498f6fe DOC: how to do filter enhancements 2013-05-30 10:25:03 +10:00
Daniel Black
916b5a7c23 TST: normalize logs to use example.com and 1.2.3.4 as IP 2013-05-30 10:24:48 +10:00
Daniel Black
4cf402d60e ENH/BF: constrain regex. Fix ACL error regex 2013-05-30 10:15:58 +10:00
Daniel Black
0f7b609336 ENH: port optional 2013-05-30 09:43:39 +10:00
Daniel Black
278fd43429 Merge branch 'patch-1' of https://github.com/silviogarbes/fail2ban into asterisk-227 2013-05-30 09:39:12 +10:00
Daniel Black
eceede175a Merge branch 'patch-4' of https://github.com/silviogarbes/fail2ban into asterisk-227 2013-05-30 09:37:00 +10:00
Yaroslav Halchenko
9f9e9a33c6 BF: in 0.9 it is allowed to have multiple same actions with different names -- so use action_name
+ address RF action._ActionReader__cInfo -> action._initOpts
2013-05-29 12:38:03 -04:00
Yaroslav Halchenko
ea6f3bedb0 BF: DefinitionInitConfigReader has _file, not __file 2013-05-29 12:36:40 -04:00
Yaroslav Halchenko
a3161f59fa Merge commit '0.8.9-13-g39d32e0' into 0.9
* commit '0.8.9-13-g39d32e0':
  Changelog for previous PR
  DOC: Changelog entry fro preceeding merge from Terence
  TST: Fix fail2ban.conf reader test for unreliable dictionary order
  failregex when roundcube log driver is set to 'syslog'
  fixed failregex line for roundcube 0.9+
  TST: test all stock jails to have actions and correctly specifying blocktype
  CFG: assure actions for all the jails
  BF: blocktype must be defined within [Init] -- adding [Init] section.  Close #232
  ENH: since it seems the default is to use file based logging, $syslog is in Should-{Start|Stop} like Debian https://github.com/fail2ban/fail2ban/blob/debian/debian/fail2ban.init
  ENH: opensuse script from opensuse: https://build.opensuse.org/package/view_file?expand=1&file=fail2ban.init&package=fail2ban&project=openSUSE%3AFactory

Conflicts:
	ChangeLog
	config/jail.conf
	testcases/clientreadertestcase.py -- had to "git show XXX | patch -p2" under tests/ 2 commits: 8a57ffd 7a4db4b
2013-05-29 11:32:35 -04:00
Yaroslav Halchenko
39d32e0352 Changelog for previous PR 2013-05-29 09:56:15 -04:00
Yaroslav Halchenko
374e7c6fc9 Merge pull request #208 from grooverdan/opensuse_init
Opensuse init -- from stock suse distribution
2013-05-29 06:54:25 -07:00
Yaroslav Halchenko
567cd353a1 DOC: Changelog entry fro preceeding merge from Terence 2013-05-29 09:41:20 -04:00
Yaroslav Halchenko
fae2d5c0ce Merge branch 'patch-3' extending roundcube failregex to support v0.9+ (from https://github.com/teroz/fail2ban)
* 'patch-3' of https://github.com/teroz/fail2ban:
  failregex when roundcube log driver is set to 'syslog'
  fixed failregex line for roundcube 0.9+
2013-05-29 09:38:35 -04:00
Yaroslav Halchenko
92188a462d Merge remote-tracking branch 'origin/0.9' into 0.9
* origin/0.9:
  TST: Fix TraceBack tests when running via "setup"

Conflicts:
	fail2ban/tests/misctestcase.py -- choose my version since it also could
be ran 'nosetests' or probably even some other tester, so better just to check
if it is a straight invocation of the fail2ban-tests
2013-05-28 07:40:46 -04:00
Yaroslav Halchenko
d379c0c06d Merge branch 'sshd-locked' of https://github.com/kwirk/fail2ban into 0.9
* 'sshd-locked' of https://github.com/kwirk/fail2ban:
  DOC: Update man page for <SKIPLINES> usage
  ENH: Add new regex for locked accounts for sshd
  BF: fail2ban-regex adding duplicate lines with each regex
2013-05-28 00:27:34 -04:00
Yaroslav Halchenko
84e8ba698a BF: remedy traceback testing case -- just check if called from fail2ban-testcases 2013-05-28 00:26:54 -04:00
Steven Hiscocks
296a3f37e8 TST: Fix TraceBack tests when running via "setup" 2013-05-27 22:34:02 +01:00
Steven Hiscocks
5f87e59911 DOC: Update man page for <SKIPLINES> usage 2013-05-27 22:07:30 +01:00
Steven Hiscocks
49261925d7 ENH: Add new regex for locked accounts for sshd 2013-05-27 22:06:49 +01:00
Steven Hiscocks
e73b3dd53e BF: fail2ban-regex adding duplicate lines with each regex
This issue was caused by the fact that every "line" is processed for each
regex, meaning each line was duplicated for every regex. This caused
duplicate fail matches and the buffer filling too quickly and possibly
missing failures.
2013-05-27 18:11:08 +01:00
Steven Hiscocks
7a4db4b4b9 TST: Fix fail2ban.conf reader test for unreliable dictionary order 2013-05-26 14:36:51 +01:00
Steven Hiscocks
01109e3a04 BF: Fix status of systemd filter backend 2013-05-26 14:05:11 +01:00
Terence Namusonge
098c88a67b failregex when roundcube log driver is set to 'syslog' 2013-05-26 07:46:29 +02:00
Terence Namusonge
244a96f9b3 fixed failregex line for roundcube 0.9+
# Only works only if  log driver: is set to  'syslog'. this is becoz fail2ban fails to 'read' the line due to the
 brackets around the date timestamp on logline when log driver is set to file
2013-05-25 19:26:13 +02:00
Yaroslav Halchenko
8a57ffd2fb TST: test all stock jails to have actions and correctly specifying blocktype 2013-05-24 14:33:48 -04:00
Yaroslav Halchenko
d2b1c73b92 CFG: assure actions for all the jails 2013-05-24 14:33:08 -04:00
Yaroslav Halchenko
89e06bba15 BF: blocktype must be defined within [Init] -- adding [Init] section. Close #232 2013-05-24 11:15:46 -04:00
Steven Hiscocks
00e289e11b BF+TST: Fix handling of spaces and + char for journalmatch
Previous fix attempted shlex split which whilst worked for reading from
config file, failed when using fail2ban-client, as the input is already
effectively shelx split by the executing shell.

FilterSystemd journal match methods now handle list structures which
should be shlex split when reading from config file, and simply pass all
the relevant arguments from the shell when using fail2ban-client
2013-05-15 00:31:16 +01:00
silviogarbes
52fa5f19b0 Update asterisk 2013-05-14 12:58:43 -03:00
silviogarbes
5c8fb68a2c Update asterisk.conf
Para ficar compatível com asterisk 11
2013-05-14 08:04:11 -03:00
Steven Hiscocks
82211e3891 TST: TravisCI coverage now includes untested systemd backend elements 2013-05-13 23:44:01 +01:00
Steven Hiscocks
09199095b4 BF: Allow journal matches with spaces and "+" in 2013-05-13 23:42:33 +01:00
Steven Hiscocks
c1226afe92 TST: Add tests for transmitter journalmatch 2013-05-13 23:42:09 +01:00
Yaroslav Halchenko
6a380139bd Merge remote-tracking branch 'origin/0.9' into 0.9
* origin/0.9:
  TST: Move test files to correct folder for 0.9 branch
  BF: fail2ban-regex fix for maxlines init option reader
2013-05-13 16:38:39 -04:00
Steven Hiscocks
fe3ed176df DOC: Update jail.conf man page with systemd elements 2013-05-13 21:12:58 +01:00
Yaroslav Halchenko
c21b7c3b9e Merge branch 'master' into 0.9 -- with that also progress into 0.9.0a1
* master:
  Getting ready for further development

Conflicts:
	ChangeLog
	fail2ban/version.py
2013-05-13 12:58:53 -04:00
Yaroslav Halchenko
725d666ee6 Getting ready for further development 2013-05-13 12:56:21 -04:00