You can subscribe to this list here.
2006 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
(1) |
Aug
(1) |
Sep
|
Oct
|
Nov
|
Dec
(24) |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2007 |
Jan
(31) |
Feb
(17) |
Mar
(14) |
Apr
(5) |
May
(14) |
Jun
(8) |
Jul
(9) |
Aug
(14) |
Sep
(4) |
Oct
(5) |
Nov
(3) |
Dec
(14) |
2008 |
Jan
(6) |
Feb
(5) |
Mar
(29) |
Apr
(6) |
May
(12) |
Jun
|
Jul
(5) |
Aug
(7) |
Sep
|
Oct
(5) |
Nov
|
Dec
|
2009 |
Jan
(7) |
Feb
(8) |
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
(17) |
Sep
(6) |
Oct
|
Nov
|
Dec
(2) |
2010 |
Jan
|
Feb
|
Mar
(1) |
Apr
|
May
(1) |
Jun
(3) |
Jul
|
Aug
|
Sep
(4) |
Oct
|
Nov
|
Dec
|
2011 |
Jan
|
Feb
|
Mar
(10) |
Apr
|
May
(1) |
Jun
(2) |
Jul
(3) |
Aug
(9) |
Sep
(1) |
Oct
|
Nov
|
Dec
|
From: <los...@us...> - 2007-04-01 20:42:05
|
Revision: 568 http://svn.sourceforge.net/fail2ban/?rev=568&view=rev Author: lostcontrol Date: 2007-04-01 13:42:05 -0700 (Sun, 01 Apr 2007) Log Message: ----------- - Added date format for asctime without year Modified Paths: -------------- trunk/CHANGELOG trunk/server/datedetector.py Modified: trunk/CHANGELOG =================================================================== --- trunk/CHANGELOG 2007-03-26 21:17:31 UTC (rev 567) +++ trunk/CHANGELOG 2007-04-01 20:42:05 UTC (rev 568) @@ -11,6 +11,7 @@ ---------- - Close opened handlers. Thanks to Yaroslav Halchenko - Fixed "reload" bug. Many many thanks to Yaroslav Halchenko +- Added date format for asctime without year ver. 0.7.8 (2007/03/21) - release candidate ---------- Modified: trunk/server/datedetector.py =================================================================== --- trunk/server/datedetector.py 2007-03-26 21:17:31 UTC (rev 567) +++ trunk/server/datedetector.py 2007-04-01 20:42:05 UTC (rev 568) @@ -56,6 +56,12 @@ template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}") template.setPattern("%a %b %d %H:%M:%S %Y") self.__templates.append(template) + # asctime without year + template = DateStrptime() + template.setName("Weekday Month Day Hour:Minute:Second") + template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}") + template.setPattern("%a %b %d %H:%M:%S") + self.__templates.append(template) # simple date template = DateStrptime() template.setName("Year/Month/Day Hour:Minute:Second") This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-03-26 21:17:30
|
Revision: 567 http://svn.sourceforge.net/fail2ban/?rev=567&view=rev Author: lostcontrol Date: 2007-03-26 14:17:31 -0700 (Mon, 26 Mar 2007) Log Message: ----------- - Fixed "reload" bug. Many many thanks to Yaroslav Halchenko Modified Paths: -------------- trunk/CHANGELOG trunk/server/actions.py trunk/server/filter.py trunk/server/filtergamin.py trunk/server/filterpoll.py trunk/server/jail.py trunk/server/jailthread.py trunk/server/server.py Modified: trunk/CHANGELOG =================================================================== --- trunk/CHANGELOG 2007-03-26 21:08:09 UTC (rev 566) +++ trunk/CHANGELOG 2007-03-26 21:17:31 UTC (rev 567) @@ -10,6 +10,7 @@ ver. 0.?.? (2007/??/??) - ??? ---------- - Close opened handlers. Thanks to Yaroslav Halchenko +- Fixed "reload" bug. Many many thanks to Yaroslav Halchenko ver. 0.7.8 (2007/03/21) - release candidate ---------- Modified: trunk/server/actions.py =================================================================== --- trunk/server/actions.py 2007-03-26 21:08:09 UTC (rev 566) +++ trunk/server/actions.py 2007-03-26 21:17:31 UTC (rev 567) @@ -125,10 +125,10 @@ # @return True when the thread exits nicely def run(self): + self.setActive(True) for action in self.__actions: action.execActionStart() - self.setActive(True) - while self.isActive(): + while self._isActive(): if not self.getIdle(): #logSys.debug(self.jail.getName() + ": action") ret = self.__checkBan() Modified: trunk/server/filter.py =================================================================== --- trunk/server/filter.py 2007-03-26 21:08:09 UTC (rev 566) +++ trunk/server/filter.py 2007-03-26 21:17:31 UTC (rev 567) @@ -385,7 +385,7 @@ self.__setFilePos() lastLine = None for line in self.__crtHandler: - if not self.isActive(): + if not self._isActive(): # The jail has been stopped break try: Modified: trunk/server/filtergamin.py =================================================================== --- trunk/server/filtergamin.py 2007-03-26 21:08:09 UTC (rev 566) +++ trunk/server/filtergamin.py 2007-03-26 21:17:31 UTC (rev 567) @@ -99,7 +99,7 @@ def run(self): self.setActive(True) - while self.isActive(): + while self._isActive(): if not self.getIdle(): # We cannot block here because we want to be able to # exit. Modified: trunk/server/filterpoll.py =================================================================== --- trunk/server/filterpoll.py 2007-03-26 21:08:09 UTC (rev 566) +++ trunk/server/filterpoll.py 2007-03-26 21:17:31 UTC (rev 567) @@ -93,7 +93,7 @@ def run(self): self.setActive(True) - while self.isActive(): + while self._isActive(): if not self.getIdle(): # Get file modification for f in self.getLogPath(): Modified: trunk/server/jail.py =================================================================== --- trunk/server/jail.py 2007-03-26 21:08:09 UTC (rev 566) +++ trunk/server/jail.py 2007-03-26 21:17:31 UTC (rev 567) @@ -89,10 +89,10 @@ self.__filter.join() self.__action.join() - def isActive(self): - isActive0 = self.__filter.isActive() - isActive1 = self.__action.isActive() - return isActive0 or isActive1 + def isAlive(self): + isAlive0 = self.__filter.isAlive() + isAlive1 = self.__action.isAlive() + return isAlive0 or isAlive1 def setIdle(self, value): self.__filter.setIdle(value) Modified: trunk/server/jailthread.py =================================================================== --- trunk/server/jailthread.py 2007-03-26 21:08:09 UTC (rev 566) +++ trunk/server/jailthread.py 2007-03-26 21:17:31 UTC (rev 567) @@ -105,7 +105,7 @@ # Check if the filter thread is running. # @return True if the thread is running - def isActive(self): + def _isActive(self): return self.__isRunning ## Modified: trunk/server/server.py =================================================================== --- trunk/server/server.py 2007-03-26 21:08:09 UTC (rev 566) +++ trunk/server/server.py 2007-03-26 21:17:31 UTC (rev 567) @@ -96,7 +96,7 @@ def startJail(self, name): try: self.__lock.acquire() - if not self.isActive(name): + if not self.isAlive(name): self.__jails.get(name).start() finally: self.__lock.release() @@ -104,7 +104,7 @@ def stopJail(self, name): try: self.__lock.acquire() - if self.isActive(name): + if self.isAlive(name): self.__jails.get(name).stop() self.delJail(name) finally: @@ -118,8 +118,8 @@ finally: self.__lock.release() - def isActive(self, name): - return self.__jails.get(name).isActive() + def isAlive(self, name): + return self.__jails.get(name).isAlive() def setIdleJail(self, name, value): self.__jails.get(name).setIdle(value) This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-03-26 21:08:13
|
Revision: 566 http://svn.sourceforge.net/fail2ban/?rev=566&view=rev Author: lostcontrol Date: 2007-03-26 14:08:09 -0700 (Mon, 26 Mar 2007) Log Message: ----------- - Added a new line before "Regards," Modified Paths: -------------- trunk/config/action.d/mail-buffered.conf Modified: trunk/config/action.d/mail-buffered.conf =================================================================== --- trunk/config/action.d/mail-buffered.conf 2007-03-22 22:20:36 UTC (rev 565) +++ trunk/config/action.d/mail-buffered.conf 2007-03-26 21:08:09 UTC (rev 566) @@ -54,7 +54,7 @@ echo -en "Hi,\n These hosts have been banned by Fail2Ban.\n `cat <tmpfile>` - Regards,\n + \nRegards,\n Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary" <dest> rm <tmpfile> fi This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-03-22 22:20:57
|
Revision: 565 http://svn.sourceforge.net/fail2ban/?rev=565&view=rev Author: lostcontrol Date: 2007-03-22 15:20:36 -0700 (Thu, 22 Mar 2007) Log Message: ----------- - Updated Modified Paths: -------------- trunk/CHANGELOG trunk/common/version.py Modified: trunk/CHANGELOG =================================================================== --- trunk/CHANGELOG 2007-03-22 22:18:46 UTC (rev 564) +++ trunk/CHANGELOG 2007-03-22 22:20:36 UTC (rev 565) @@ -4,9 +4,13 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ============================================================= -Fail2Ban (version 0.7.8) 2007/03/21 +Fail2Ban (version 0.?.?) 2007/??/?? ============================================================= +ver. 0.?.? (2007/??/??) - ??? +---------- +- Close opened handlers. Thanks to Yaroslav Halchenko + ver. 0.7.8 (2007/03/21) - release candidate ---------- - Fixed asctime pattern in datedetector.py Modified: trunk/common/version.py =================================================================== --- trunk/common/version.py 2007-03-22 22:18:46 UTC (rev 564) +++ trunk/common/version.py 2007-03-22 22:20:36 UTC (rev 565) @@ -24,4 +24,4 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" -version = "0.7.8" +version = "0.7.8-SVN" This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-03-22 22:18:47
|
Revision: 564 http://svn.sourceforge.net/fail2ban/?rev=564&view=rev Author: lostcontrol Date: 2007-03-22 15:18:46 -0700 (Thu, 22 Mar 2007) Log Message: ----------- - Clean up resources. Does not seem to free resources correctly. Gamin bug??? Modified Paths: -------------- trunk/server/filtergamin.py Modified: trunk/server/filtergamin.py =================================================================== --- trunk/server/filtergamin.py 2007-03-22 22:17:41 UTC (rev 563) +++ trunk/server/filtergamin.py 2007-03-22 22:18:46 UTC (rev 564) @@ -117,5 +117,15 @@ time.sleep(self.getSleepTime()) else: time.sleep(self.getSleepTime()) + # Cleanup Gamin + self.__cleanup() logSys.debug(self.jail.getName() + ": filter terminated") return True + + ## + # Desallocates the resources used by Gamin. + + def __cleanup(self): + for path in Filter.getLogPath(self): + self.monitor.stop_watch(path) + del self.monitor This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-03-22 22:17:58
|
Revision: 563 http://svn.sourceforge.net/fail2ban/?rev=563&view=rev Author: lostcontrol Date: 2007-03-22 15:17:41 -0700 (Thu, 22 Mar 2007) Log Message: ----------- - Close opened handlers. Thanks to Yaroslav Halchenko Modified Paths: -------------- trunk/server/server.py Modified: trunk/server/server.py =================================================================== --- trunk/server/server.py 2007-03-21 21:47:18 UTC (rev 562) +++ trunk/server/server.py 2007-03-22 22:17:41 UTC (rev 563) @@ -326,15 +326,18 @@ else: # Target should be a file try: - open(target, "a") + open(target, "a").close() hdlr = logging.FileHandler(target) except IOError: logSys.error("Unable to log to " + target) logSys.info("Logging to previous target " + self.__logTarget) return False self.__logTarget = target - # Remove previous handler - logging.getLogger("fail2ban").handlers = [] + # Removes previous handlers + for handler in logging.getLogger("fail2ban").handlers: + # Closes the handler. + handler.close() + logging.getLogger("fail2ban").removeHandler(handler) # set a format which is simpler for console use formatter = logging.Formatter("%(asctime)s %(name)-16s: %(levelname)-6s %(message)s") # tell the handler to use this format This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-03-21 21:47:25
|
Revision: 562 http://svn.sourceforge.net/fail2ban/?rev=562&view=rev Author: lostcontrol Date: 2007-03-21 14:47:18 -0700 (Wed, 21 Mar 2007) Log Message: ----------- - Release 0.7.8 Added Paths: ----------- tags/FAIL2BAN-0_7_8/ Copied: tags/FAIL2BAN-0_7_8 (from rev 561, trunk) This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-03-21 21:44:16
|
Revision: 561 http://svn.sourceforge.net/fail2ban/?rev=561&view=rev Author: lostcontrol Date: 2007-03-21 14:44:07 -0700 (Wed, 21 Mar 2007) Log Message: ----------- - Updated for 0.7.8 Modified Paths: -------------- trunk/CHANGELOG trunk/README trunk/common/version.py Modified: trunk/CHANGELOG =================================================================== --- trunk/CHANGELOG 2007-03-19 20:32:28 UTC (rev 560) +++ trunk/CHANGELOG 2007-03-21 21:44:07 UTC (rev 561) @@ -4,10 +4,10 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ============================================================= -Fail2Ban (version 0.7.7) 2007/02/08 +Fail2Ban (version 0.7.8) 2007/03/21 ============================================================= -ver. 0.?.? (2007/??/??) - ??? +ver. 0.7.8 (2007/03/21) - release candidate ---------- - Fixed asctime pattern in datedetector.py - Added new filters/actions. Thanks to Yaroslav Halchenko Modified: trunk/README =================================================================== --- trunk/README 2007-03-19 20:32:28 UTC (rev 560) +++ trunk/README 2007-03-21 21:44:07 UTC (rev 561) @@ -4,7 +4,7 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ============================================================= -Fail2Ban (version 0.7.7) 2007/02/08 +Fail2Ban (version 0.7.8) 2007/03/21 ============================================================= Fail2Ban scans log files like /var/log/pwdfail and bans IP @@ -28,8 +28,8 @@ To install, just do: -> tar xvfj fail2ban-0.7.7.tar.bz2 -> cd fail2ban-0.7.7 +> tar xvfj fail2ban-0.7.8.tar.bz2 +> cd fail2ban-0.7.8 > python setup.py install This will install Fail2Ban into /usr/share/fail2ban. The Modified: trunk/common/version.py =================================================================== --- trunk/common/version.py 2007-03-19 20:32:28 UTC (rev 560) +++ trunk/common/version.py 2007-03-21 21:44:07 UTC (rev 561) @@ -24,4 +24,4 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" -version = "0.7.7-SVN" +version = "0.7.8" This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-03-19 20:39:25
|
Revision: 560 http://svn.sourceforge.net/fail2ban/?rev=560&view=rev Author: lostcontrol Date: 2007-03-19 13:32:28 -0700 (Mon, 19 Mar 2007) Log Message: ----------- - Added pure-ftpd filter. Thanks to Yaroslav Halchenko Modified Paths: -------------- trunk/MANIFEST Added Paths: ----------- trunk/config/filter.d/pure-ftpd.conf Modified: trunk/MANIFEST =================================================================== --- trunk/MANIFEST 2007-03-13 23:18:54 UTC (rev 559) +++ trunk/MANIFEST 2007-03-19 20:32:28 UTC (rev 560) @@ -60,26 +60,30 @@ common/version.py common/protocol.py config/jail.conf -config/filter.d/postfix.conf -config/filter.d/vsftpd.conf config/filter.d/apache-auth.conf +config/filter.d/apache-badbots.conf config/filter.d/apache-noscript.conf -config/filter.d/qmail.conf +config/filter.d/courierlogin.conf config/filter.d/couriersmtp.conf -config/filter.d/courierlogin.conf -config/filter.d/sshd.conf +config/filter.d/exim.conf +config/filter.d/postfix.conf config/filter.d/proftpd.conf +config/filter.d/pure-ftpd.conf +config/filter.d/qmail.conf config/filter.d/sasl.conf +config/filter.d/sshd.conf +config/filter.d/sshd-ddos.conf +config/filter.d/vsftpd.conf config/filter.d/wuftpd.conf +config/action.d/hostsdeny.conf +config/action.d/ipfw.conf config/action.d/iptables.conf config/action.d/iptables-multiport.conf config/action.d/iptables-new.conf -config/action.d/ipfw.conf +config/action.d/mail.conf +config/action.d/mail-buffered.conf config/action.d/mail-whois.conf config/action.d/mail-whois-lines.conf -config/action.d/mail.conf -config/action.d/mail-buffered.conf -config/action.d/hostsdeny.conf config/action.d/shorewall.conf config/fail2ban.conf man/fail2ban-client.1 @@ -90,6 +94,7 @@ man/fail2ban-regex.h2m man/generate-man files/gentoo-initd +files/gentoo-confd files/redhat-initd files/cacti/fail2ban_stats.sh files/cacti/cacti_host_template_fail2ban.xml Added: trunk/config/filter.d/pure-ftpd.conf =================================================================== --- trunk/config/filter.d/pure-ftpd.conf (rev 0) +++ trunk/config/filter.d/pure-ftpd.conf 2007-03-19 20:32:28 UTC (rev 560) @@ -0,0 +1,29 @@ +# Fail2Ban configuration file +# +# Author: Cyril Jaquier +# Modified: Yaroslav Halchenko for pure-ftpd +# +# $Revision: 3$ +# + +[Definition] + +# Error message specified in multiple languages +__errmsg = (?:Authentication failed for user|Erreur d'authentification pour l'utilisateur) + +# +# Option: failregex +# Notes.: regex to match the password failures messages in the logfile. The +# host must be matched by a group named "host". The tag "<HOST>" can +# be used for standard IP/hostname matching and is only an alias for +# (?:::f{4,6}:)?(?P<host>\S+) +# Values: TEXT +# +failregex = pure-ftpd: (.+?@<HOST>) \[WARNING\] %(__errmsg)s \[.+\]$ + +# Option: ignoreregex +# Notes.: regex to ignore. If this regex matches, the line is ignored. +# Values: TEXT +# +ignoreregex = + Property changes on: trunk/config/filter.d/pure-ftpd.conf ___________________________________________________________________ Name: svn:keywords + Author Date Id Revision This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-03-13 23:18:56
|
Revision: 559 http://svn.sourceforge.net/fail2ban/?rev=559&view=rev Author: lostcontrol Date: 2007-03-13 16:18:54 -0700 (Tue, 13 Mar 2007) Log Message: ----------- - Updated Gentoo script. Thanks to Rapha?\195?\171l Marichez Modified Paths: -------------- trunk/files/gentoo-initd Added Paths: ----------- trunk/files/gentoo-confd Added: trunk/files/gentoo-confd =================================================================== --- trunk/files/gentoo-confd (rev 0) +++ trunk/files/gentoo-confd 2007-03-13 23:18:54 UTC (rev 559) @@ -0,0 +1,8 @@ +# Config file for /etc/init.d/fail2ban +# +# For information on options, see "/usr/bin/fail2ban-client -h". + +FAIL2BAN_OPTIONS="" + +# Force execution of the server even if the socket already exists: +#FAIL2BAN_OPTIONS="-x" Modified: trunk/files/gentoo-initd =================================================================== --- trunk/files/gentoo-initd 2007-03-07 21:32:33 UTC (rev 558) +++ trunk/files/gentoo-initd 2007-03-13 23:18:54 UTC (rev 559) @@ -21,7 +21,7 @@ opts="start stop restart reload showlog" -FAIL2BAN="/usr/bin/fail2ban-client" +FAIL2BAN="/usr/bin/fail2ban-client ${FAIL2BAN_OPTIONS}" depend() { need net This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-03-07 21:32:37
|
Revision: 558 http://svn.sourceforge.net/fail2ban/?rev=558&view=rev Author: lostcontrol Date: 2007-03-07 13:32:33 -0800 (Wed, 07 Mar 2007) Log Message: ----------- - Improved failregex a bit - Added TrackBack/1.02 Modified Paths: -------------- trunk/config/filter.d/apache-badbots.conf Modified: trunk/config/filter.d/apache-badbots.conf =================================================================== --- trunk/config/filter.d/apache-badbots.conf 2007-03-07 20:55:08 UTC (rev 557) +++ trunk/config/filter.d/apache-badbots.conf 2007-03-07 21:32:33 UTC (rev 558) @@ -5,18 +5,19 @@ # # Author: Yaroslav Halchenko # -# [Definition] -badbotscustom = EmailCollector|WebEMailExtrac + +badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02 badbots = atSpider/1\.0|autoemailspider|China Local Browse 2\.6|ContentSmartz|DataCha0s/2\.0|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|MVAClient|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|sogou spider|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|WebVulnCrawl\.blogspot\.com/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00 # Option: failregex -# Notes.: Regexp to catch known spambots and software alike. Please verify that -# it is your intent to block IPs which were driven by abovementioned bots +# Notes.: Regexp to catch known spambots and software alike. Please verify +# that it is your intent to block IPs which were driven by +# abovementioned bots. # Values: TEXT # -failregex = ^(?P<host>\S*) -.*"GET.*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$ +failregex = ^<HOST> -.*"(GET|POST).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-03-07 20:55:17
|
Revision: 557 http://svn.sourceforge.net/fail2ban/?rev=557&view=rev Author: lostcontrol Date: 2007-03-07 12:55:08 -0800 (Wed, 07 Mar 2007) Log Message: ----------- - Updated Modified Paths: -------------- trunk/TODO Modified: trunk/TODO =================================================================== --- trunk/TODO 2007-03-07 20:54:32 UTC (rev 556) +++ trunk/TODO 2007-03-07 20:55:08 UTC (rev 557) @@ -13,6 +13,8 @@ # partially done * done +- Removed relative imports + - Discuss where Fail2ban should be installed (/usr/share, /usr/lib/python/site-packages/, etc) @@ -22,7 +24,7 @@ - Add timeout to external commands (signal alarm, watchdog thread, etc) -- New backend: pynotify +- New backend: pyinotify - Uniformize filters and actions name. Use the software name (openssh, postfix, proftp) This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-03-07 20:54:40
|
Revision: 556 http://svn.sourceforge.net/fail2ban/?rev=556&view=rev Author: lostcontrol Date: 2007-03-07 12:54:32 -0800 (Wed, 07 Mar 2007) Log Message: ----------- - Added more comments Modified Paths: -------------- trunk/server/action.py trunk/server/actions.py trunk/server/mytime.py Modified: trunk/server/action.py =================================================================== --- trunk/server/action.py 2007-03-07 20:53:37 UTC (rev 555) +++ trunk/server/action.py 2007-03-07 20:54:32 UTC (rev 556) @@ -54,18 +54,48 @@ self.__actionStop = '' logSys.debug("Created Action") + ## + # Sets the action name. + # + # @param name the name of the action + def setName(self, name): self.__name = name + ## + # Returns the action name. + # + # @return the name of the action + def getName(self): return self.__name + ## + # Sets a "CInfo". + # + # CInfo are statically defined properties. They can be definied by + # the user and are used to set e-mail addresses, port, host or + # anything that should not change during the life of the server. + # + # @param key the property name + # @param value the property value + def setCInfo(self, key, value): self.__cInfo[key] = value + ## + # Returns a "CInfo". + # + # @param key the property name + def getCInfo(self, key): return self.__cInfo[key] + ## + # Removes a "CInfo". + # + # @param key the property name + def delCInfo(self, key): del self.__cInfo[key] @@ -86,6 +116,14 @@ def getActionStart(self): return self.__actionStart + ## + # Executes the action "start" command. + # + # Replaces the tags in the action command with value of "cInfo" + # and executes the resulting command. + # + # @return True if the command succeeded + def execActionStart(self): startCmd = Action.replaceTag(self.__actionStart, self.__cInfo) return Action.executeCmd(startCmd) @@ -107,6 +145,11 @@ def getActionBan(self): return self.__actionBan + ## + # Executes the action "ban" command. + # + # @return True if the command succeeded + def execActionBan(self, aInfo): return self.__processCmd(self.__actionBan, aInfo) @@ -127,6 +170,11 @@ def getActionUnban(self): return self.__actionUnban + ## + # Executes the action "unban" command. + # + # @return True if the command succeeded + def execActionUnban(self, aInfo): return self.__processCmd(self.__actionUnban, aInfo) @@ -164,10 +212,25 @@ def getActionStop(self): return self.__actionStop + ## + # Executes the action "stop" command. + # + # Replaces the tags in the action command with value of "cInfo" + # and executes the resulting command. + # + # @return True if the command succeeded + def execActionStop(self): stopCmd = Action.replaceTag(self.__actionStop, self.__cInfo) return Action.executeCmd(stopCmd) + ## + # Replaces tags in query with property values in aInfo. + # + # @param query the query string with tags + # @param aInfo the properties + # @return a string + @staticmethod def replaceTag(query, aInfo): """ Replace tags in query @@ -179,6 +242,19 @@ string = string.replace("<br>", '\n') return string + ## + # Executes a command with preliminary checks and substitutions. + # + # Before executing any commands, executes the "check" command first + # in order to check if prerequirements are met. If this check fails, + # it tries to restore a sane environnement before executing the real + # command. + # Replaces "aInfo" and "cInfo" in the query too. + # + # @param cmd The command to execute + # @param aInfo Dynamic properties + # @return True if the command succeeded + def __processCmd(self, cmd, aInfo = None): """ Executes an OS command. """ @@ -209,6 +285,18 @@ return Action.executeCmd(realCmd) + ## + # Executes a command. + # + # We need a shell here because commands are mainly shell script. They + # contain pipe, redirection, etc. + # + # @todo Force the use of bash!? + # @todo Kill the command after a given timeout + # + # @param realCmd the command to execute + # @return True if the command succeeded + @staticmethod def executeCmd(realCmd): logSys.debug(realCmd) Modified: trunk/server/actions.py =================================================================== --- trunk/server/actions.py 2007-03-07 20:53:37 UTC (rev 555) +++ trunk/server/actions.py 2007-03-07 20:54:32 UTC (rev 556) @@ -56,22 +56,45 @@ ## The ban manager. self.__banManager = BanManager() + ## + # Adds an action. + # + # @param name The action name + def addAction(self, name): action = Action(name) self.__actions.append(action) + ## + # Removes an action. + # + # @param name The action name + def delAction(self, name): for action in self.__actions: if action.getName() == name: self.__actions.remove(action) break + ## + # Returns an action. + # + # Raises a KeyError exception if the action does not exist. + # + # @param name the action name + # @return the action + def getAction(self, name): for action in self.__actions: if action.getName() == name: return action raise KeyError + ## + # Returns the last defined action. + # + # @return The last defined action. + def getLastAction(self): action = self.__actions.pop() self.__actions.append(action) Modified: trunk/server/mytime.py =================================================================== --- trunk/server/mytime.py 2007-03-07 20:53:37 UTC (rev 555) +++ trunk/server/mytime.py 2007-03-07 20:54:32 UTC (rev 556) @@ -26,14 +26,35 @@ import time +## +# MyTime class. +# +# This class is a wrapper around time.time() and time.gmtime(). When +# performing unit test, it is very useful to get a fixed value from these +# functions. +# Thus, time.time() and time.gmtime() should never be called directly. +# This wrapper should be called instead. The API are equivalent. + class MyTime: myTime = None + ## + # Sets the current time. + # + # Use None in order to always get the real current time. + # + # @param t the time to set or None + @staticmethod def setTime(t): MyTime.myTime = t + ## + # Equivalent to time.time() + # + # @return time.time() if setTime was called with None + @staticmethod def time(): if MyTime.myTime == None: @@ -41,6 +62,11 @@ else: return MyTime.myTime + ## + # Equivalent to time.gmtime() + # + # @return time.gmtime() if setTime was called with None + @staticmethod def gmtime(): if MyTime.myTime == None: This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-03-07 20:53:45
|
Revision: 555 http://svn.sourceforge.net/fail2ban/?rev=555&view=rev Author: lostcontrol Date: 2007-03-07 12:53:37 -0800 (Wed, 07 Mar 2007) Log Message: ----------- - Catched socket.error raised by socket.accept on some platform - Modified some socket settings Modified Paths: -------------- trunk/server/ssocket.py Modified: trunk/server/ssocket.py =================================================================== --- trunk/server/ssocket.py 2007-03-07 20:47:41 UTC (rev 554) +++ trunk/server/ssocket.py 2007-03-07 20:53:37 UTC (rev 555) @@ -68,7 +68,7 @@ #self.__ssock.bind(("localhost", 2222)) self.__ssock.bind(sock) # Become a server socket - self.__ssock.listen(5) + self.__ssock.listen(1) def run(self): self.__isRunning = True @@ -80,6 +80,9 @@ except socket.timeout: # Do nothing here pass + except socket.error: + # Do nothing here + pass self.__ssock.close() # Remove socket if os.path.exists(self.__socket): @@ -122,7 +125,7 @@ def __receive(sock): msg = '' while msg.rfind(SSocket.END_STRING) == -1: - chunk = sock.recv(6) + chunk = sock.recv(128) if chunk == '': raise RuntimeError, "socket connection broken" msg = msg + chunk This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-03-07 20:47:54
|
Revision: 554 http://svn.sourceforge.net/fail2ban/?rev=554&view=rev Author: lostcontrol Date: 2007-03-07 12:47:41 -0800 (Wed, 07 Mar 2007) Log Message: ----------- - Removed actionstart and actionstop which are now obsolete Modified Paths: -------------- trunk/config/action.d/hostsdeny.conf Modified: trunk/config/action.d/hostsdeny.conf =================================================================== --- trunk/config/action.d/hostsdeny.conf 2007-02-25 23:53:22 UTC (rev 553) +++ trunk/config/action.d/hostsdeny.conf 2007-03-07 20:47:41 UTC (rev 554) @@ -11,13 +11,13 @@ # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = touch <tmpfile> +actionstart = # Option: actionend # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = rm -f <tmpfile> +actionstop = # Option: actioncheck # Notes.: command executed once before each actionban command This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-02-25 23:53:25
|
Revision: 553 http://svn.sourceforge.net/fail2ban/?rev=553&view=rev Author: lostcontrol Date: 2007-02-25 15:53:22 -0800 (Sun, 25 Feb 2007) Log Message: ----------- - Moved every locking statements in a try..finally block Modified Paths: -------------- trunk/CHANGELOG trunk/server/banmanager.py trunk/server/datedetector.py trunk/server/failmanager.py Modified: trunk/CHANGELOG =================================================================== --- trunk/CHANGELOG 2007-02-22 21:11:30 UTC (rev 552) +++ trunk/CHANGELOG 2007-02-25 23:53:22 UTC (rev 553) @@ -13,6 +13,7 @@ - Added new filters/actions. Thanks to Yaroslav Halchenko - Added Suse init script and modified gentoo-initd. Thanks to Christian Rauch +- Moved every locking statements in a try..finally block ver. 0.7.7 (2007/02/08) - release candidate ---------- Modified: trunk/server/banmanager.py =================================================================== --- trunk/server/banmanager.py 2007-02-22 21:11:30 UTC (rev 552) +++ trunk/server/banmanager.py 2007-02-25 23:53:22 UTC (rev 553) @@ -62,9 +62,11 @@ # @param value the time def setBanTime(self, value): - self.__lock.acquire() - self.__banTime = int(value) - self.__lock.release() + try: + self.__lock.acquire() + self.__banTime = int(value) + finally: + self.__lock.release() ## # Get the ban time. @@ -85,9 +87,11 @@ # @param value total number def setBanTotal(self, value): - self.__lock.acquire() - self.__banTotal = value - self.__lock.release() + try: + self.__lock.acquire() + self.__banTotal = value + finally: + self.__lock.release() ## # Get the total number of banned address. Modified: trunk/server/datedetector.py =================================================================== --- trunk/server/datedetector.py 2007-02-22 21:11:30 UTC (rev 552) +++ trunk/server/datedetector.py 2007-02-25 23:53:22 UTC (rev 553) @@ -42,44 +42,48 @@ self.__defTemplate = DateStrptime() def addDefaultTemplate(self): - # standard - template = DateStrptime() - template.setName("Month Day Hour:Minute:Second") - template.setRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}") - template.setPattern("%b %d %H:%M:%S") - self.__templates.append(template) - # asctime - template = DateStrptime() - template.setName("Weekday Month Day Hour:Minute:Second Year") - template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}") - template.setPattern("%a %b %d %H:%M:%S %Y") - self.__templates.append(template) - # simple date - template = DateStrptime() - template.setName("Year/Month/Day Hour:Minute:Second") - template.setRegex("\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}") - template.setPattern("%Y/%m/%d %H:%M:%S") - self.__templates.append(template) - # Apache format [31/Oct/2006:09:22:55 -0000] - template = DateStrptime() - template.setName("Day/Month/Year:Hour:Minute:Second") - template.setRegex("\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}") - template.setPattern("%d/%b/%Y:%H:%M:%S") - self.__templates.append(template) - # Exim 2006-12-21 06:43:20 - template = DateStrptime() - template.setName("Year-Month-Day Hour:Minute:Second") - template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}") - template.setPattern("%Y-%m-%d %H:%M:%S") - self.__templates.append(template) - # TAI64N - template = DateTai64n() - template.setName("TAI64N") - self.__templates.append(template) - # Epoch - template = DateEpoch() - template.setName("Epoch") - self.__templates.append(template) + try: + self.__lock.acquire() + # standard + template = DateStrptime() + template.setName("Month Day Hour:Minute:Second") + template.setRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}") + template.setPattern("%b %d %H:%M:%S") + self.__templates.append(template) + # asctime + template = DateStrptime() + template.setName("Weekday Month Day Hour:Minute:Second Year") + template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}") + template.setPattern("%a %b %d %H:%M:%S %Y") + self.__templates.append(template) + # simple date + template = DateStrptime() + template.setName("Year/Month/Day Hour:Minute:Second") + template.setRegex("\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}") + template.setPattern("%Y/%m/%d %H:%M:%S") + self.__templates.append(template) + # Apache format [31/Oct/2006:09:22:55 -0000] + template = DateStrptime() + template.setName("Day/Month/Year:Hour:Minute:Second") + template.setRegex("\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}") + template.setPattern("%d/%b/%Y:%H:%M:%S") + self.__templates.append(template) + # Exim 2006-12-21 06:43:20 + template = DateStrptime() + template.setName("Year-Month-Day Hour:Minute:Second") + template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}") + template.setPattern("%Y-%m-%d %H:%M:%S") + self.__templates.append(template) + # TAI64N + template = DateTai64n() + template.setName("TAI64N") + self.__templates.append(template) + # Epoch + template = DateEpoch() + template.setName("Epoch") + self.__templates.append(template) + finally: + self.__lock.release() def getTemplates(self): return self.__templates @@ -100,14 +104,15 @@ if self.__defTemplate.isValid(): return self.__defTemplate.matchDate(line) else: - self.__lock.acquire() - for template in self.__templates: - match = template.matchDate(line) - if not match == None: - self.__lock.release() - return match - self.__lock.release() - return None + try: + self.__lock.acquire() + for template in self.__templates: + match = template.matchDate(line) + if not match == None: + return match + return None + finally: + self.__lock.release() def getTime(self, line): if self.__defTemplate.isValid(): @@ -117,19 +122,20 @@ except ValueError: return None else: - self.__lock.acquire() - for template in self.__templates: - try: - date = template.getDate(line) - if date == None: - continue - template.incHits() - self.__lock.release() - return date - except ValueError: - pass - self.__lock.release() - return None + try: + self.__lock.acquire() + for template in self.__templates: + try: + date = template.getDate(line) + if date == None: + continue + template.incHits() + return date + except ValueError: + pass + return None + finally: + self.__lock.release() def getUnixTime(self, line): date = self.getTime(line) @@ -143,8 +149,11 @@ # in this object and thus should be called from time to time. def sortTemplate(self): - self.__lock.acquire() - logSys.debug("Sorting the template list") - self.__templates.sort(cmp = lambda x, y: cmp(x.getHits(), y.getHits()), - reverse=True) - self.__lock.release() + try: + self.__lock.acquire() + logSys.debug("Sorting the template list") + self.__templates.sort(cmp = lambda x, y: + cmp(x.getHits(), y.getHits()), + reverse = True) + finally: + self.__lock.release() Modified: trunk/server/failmanager.py =================================================================== --- trunk/server/failmanager.py 2007-02-22 21:11:30 UTC (rev 552) +++ trunk/server/failmanager.py 2007-02-25 23:53:22 UTC (rev 553) @@ -42,9 +42,11 @@ self.__failTotal = 0 def setFailTotal(self, value): - self.__lock.acquire() - self.__failTotal = value - self.__lock.release() + try: + self.__lock.acquire() + self.__failTotal = value + finally: + self.__lock.release() def getFailTotal(self): try: @@ -54,9 +56,11 @@ self.__lock.release() def setMaxRetry(self, value): - self.__lock.acquire() - self.__maxRetry = value - self.__lock.release() + try: + self.__lock.acquire() + self.__maxRetry = value + finally: + self.__lock.release() def getMaxRetry(self): try: @@ -66,9 +70,11 @@ self.__lock.release() def setMaxTime(self, value): - self.__lock.acquire() - self.__maxTime = value - self.__lock.release() + try: + self.__lock.acquire() + self.__maxTime = value + finally: + self.__lock.release() def getMaxTime(self): try: @@ -78,20 +84,22 @@ self.__lock.release() def addFailure(self, ticket): - self.__lock.acquire() - ip = ticket.getIP() - unixTime = ticket.getTime() - if self.__failList.has_key(ip): - fData = self.__failList[ip] - fData.inc() - fData.setLastTime(unixTime) - else: - fData = FailData() - fData.inc() - fData.setLastTime(unixTime) - self.__failList[ip] = fData - self.__failTotal += 1 - self.__lock.release() + try: + self.__lock.acquire() + ip = ticket.getIP() + unixTime = ticket.getTime() + if self.__failList.has_key(ip): + fData = self.__failList[ip] + fData.inc() + fData.setLastTime(unixTime) + else: + fData = FailData() + fData.inc() + fData.setLastTime(unixTime) + self.__failList[ip] = fData + self.__failTotal += 1 + finally: + self.__lock.release() def size(self): try: @@ -101,12 +109,14 @@ self.__lock.release() def cleanup(self, time): - self.__lock.acquire() - tmp = self.__failList.copy() - for item in tmp: - if tmp[item].getLastTime() < time - self.__maxTime: - self.__delFailure(item) - self.__lock.release() + try: + self.__lock.acquire() + tmp = self.__failList.copy() + for item in tmp: + if tmp[item].getLastTime() < time - self.__maxTime: + self.__delFailure(item) + finally: + self.__lock.release() def __delFailure(self, ip): if self.__failList.has_key(ip): @@ -129,4 +139,3 @@ class FailManagerEmpty(Exception): pass - \ No newline at end of file This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-02-22 21:11:29
|
Revision: 552 http://svn.sourceforge.net/fail2ban/?rev=552&view=rev Author: lostcontrol Date: 2007-02-22 13:11:30 -0800 (Thu, 22 Feb 2007) Log Message: ----------- - Added a new example for vsftpd. Thanks to Christian Rauch Modified Paths: -------------- trunk/config/jail.conf Modified: trunk/config/jail.conf =================================================================== --- trunk/config/jail.conf 2007-02-22 20:52:35 UTC (rev 551) +++ trunk/config/jail.conf 2007-02-22 21:11:30 UTC (rev 552) @@ -117,6 +117,18 @@ maxretry = 5 bantime = 1800 +# Same as above but with banning the IP address. + +[vsftpd-iptables] + +enabled = false +filter = vsftpd +action = iptables[name=VSFTPD, port=ftp, protocol=tcp] + mail-whois[name=VSFTPD, dest=you...@ma...] +logpath = /var/log/vsftpd.log +maxretry = 5 +bantime = 1800 + # Ban hosts which agent identifies spammer robots crawling the web # for email addresses. The mail outputs are buffered. This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-02-22 20:52:40
|
Revision: 551 http://svn.sourceforge.net/fail2ban/?rev=551&view=rev Author: lostcontrol Date: 2007-02-22 12:52:35 -0800 (Thu, 22 Feb 2007) Log Message: ----------- - Fixed bug #1664386. Thanks to Harry Rarig Modified Paths: -------------- trunk/config/filter.d/sshd.conf Modified: trunk/config/filter.d/sshd.conf =================================================================== --- trunk/config/filter.d/sshd.conf 2007-02-20 20:44:47 UTC (rev 550) +++ trunk/config/filter.d/sshd.conf 2007-02-22 20:52:35 UTC (rev 551) @@ -15,7 +15,7 @@ # Values: TEXT # failregex = Authentication failure for .* from <HOST> - Failed [-/\w+]+ for .* from <HOST> + Failed [-/\w]+ for .* from <HOST> ROOT LOGIN REFUSED .* FROM <HOST> [iI](?:llegal|nvalid) user .* from <HOST> This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-02-20 20:44:52
|
Revision: 550 http://svn.sourceforge.net/fail2ban/?rev=550&view=rev Author: lostcontrol Date: 2007-02-20 12:44:47 -0800 (Tue, 20 Feb 2007) Log Message: ----------- - Added Suse init script and modified gentoo-initd. Thanks to Christian Rauch Modified Paths: -------------- trunk/CHANGELOG trunk/README trunk/files/gentoo-initd Added Paths: ----------- trunk/files/suse-initd Modified: trunk/CHANGELOG =================================================================== --- trunk/CHANGELOG 2007-02-12 21:50:50 UTC (rev 549) +++ trunk/CHANGELOG 2007-02-20 20:44:47 UTC (rev 550) @@ -11,6 +11,8 @@ ---------- - Fixed asctime pattern in datedetector.py - Added new filters/actions. Thanks to Yaroslav Halchenko +- Added Suse init script and modified gentoo-initd. Thanks to + Christian Rauch ver. 0.7.7 (2007/02/08) - release candidate ---------- Modified: trunk/README =================================================================== --- trunk/README 2007-02-12 21:50:50 UTC (rev 549) +++ trunk/README 2007-02-20 20:44:47 UTC (rev 550) @@ -73,7 +73,7 @@ Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler, Nick Munger, Christoph Haas, Justin Shore, Joël Bertrand, -René Berber, mEDI, Axel Thimm, Eric Gerbier +René Berber, mEDI, Axel Thimm, Eric Gerbier, Christian Rauch License: -------- Modified: trunk/files/gentoo-initd =================================================================== --- trunk/files/gentoo-initd 2007-02-12 21:50:50 UTC (rev 549) +++ trunk/files/gentoo-initd 2007-02-20 20:44:47 UTC (rev 550) @@ -42,29 +42,11 @@ } restart() { - if ! service_stopped "${SVCNAME}" ; then - svc_stop || return "$?" - einfon "Waiting for server to shutdown ." - cnt=0 - while [ 1 ]; do - # Ping fail2ban-server - ${FAIL2BAN} ping &> /dev/null - if [ ! "$?" == "0" ]; then - break - fi - cnt=`expr $cnt + 1` - if [ $cnt -gt 60 ] ; then - # We have waited 1 minute. Failed - echo - eend 1 "Failed" - break - fi - sleep 1 - echo -n "." - done - echo - fi - svc_start + if ! service_stopped "${SVCNAME}" ; then + svc_stop || return "$?" + sleep 1 + fi + svc_start } reload() { Added: trunk/files/suse-initd =================================================================== --- trunk/files/suse-initd (rev 0) +++ trunk/files/suse-initd 2007-02-20 20:44:47 UTC (rev 550) @@ -0,0 +1,87 @@ +#!/bin/sh +# +# /etc/init.d/fail2ban +# and its symbolic link +# /usr/sbin/rcfail2ban +# +### BEGIN INIT INFO +# Provides: fail2ban +# Required-Start: $syslog $remote_fs postfix +# Required-Stop: $syslog $remote_fs +# Should-Stop: $time ypbind sendmail +# Default-Start: 3 5 +# Default-Stop: 0 1 2 6 +# Description: startup Fail2Ban +### END INIT INFO +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin +FAIL2BAN_BIN=/usr/local/bin/fail2ban-client +FAIL2BAN_SERVER=/usr/local/bin/fail2ban-server +FAIL2BAN_SOCKET=/tmp/fail2ban.sock +test -x $FAIL2BAN_BIN || { echo "$FAIL2BAN_BIN not installed"; + if [ "$1" = "stop" ]; then exit 0; + else exit 5; fi; } + +# Check for existence of needed config file and read it +FAIL2BAN_CONFIG=/etc/fail2ban/fail2ban.conf +test -r $FAIL2BAN_CONFIG || { echo "$FAIL2BAN_CONFIG not existing"; + if [ "$1" = "stop" ]; then exit 0; + else exit 6; fi; } + +. /etc/rc.status + +# Reset status of this service +rc_reset + +case "$1" in + start) + echo -n "Starting Fail2Ban " + /sbin/startproc $FAIL2BAN_BIN -q start 2>1 > /dev/null + rc_status -v + ;; + stop) + echo -n "Shutting down Fail2ban " + /sbin/startproc $FAIL2BAN_BIN -q stop + rc_status -v + ;; + try-restart|condrestart) + if test "$1" = "condrestart"; then + echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}" + fi + $0 status + if test $? = 0; then + $0 restart + else + rc_reset # Not running is not a failure. + fi + rc_status + ;; + restart) + $0 stop + i=60 + while [ -e $FAIL2BAN_SOCKET ] && [ $i -gt 60 ] + sleep 1 + i=$[i-1] + echo -n "." + done + echo "." + $0 start + + # Remember status and be quiet + rc_status + ;; + force-reload) + echo -n "Reload service Fail2ban " + /sbin/startproc $FAIL2BAN_BIN -q reload + rc_status -v + ;; + reload) + echo -n "Reload service Fail2ban " + /sbin/startproc $FAIL2BAN_BIN -q reload + rc_status -v + ;; + status) + echo -n "Checking for service Fail2ban " + /sbin/checkproc $FAIL2BAN_SERVER + rc_status -v + ;; + probe) Property changes on: trunk/files/suse-initd ___________________________________________________________________ Name: svn:executable + * This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-02-12 21:50:59
|
Revision: 549 http://svn.sourceforge.net/fail2ban/?rev=549&view=rev Author: lostcontrol Date: 2007-02-12 13:50:50 -0800 (Mon, 12 Feb 2007) Log Message: ----------- - Added new filter for spam bots - Added new action for buffered mails Modified Paths: -------------- trunk/CHANGELOG trunk/MANIFEST trunk/config/jail.conf Added Paths: ----------- trunk/config/action.d/mail-buffered.conf trunk/config/filter.d/apache-badbots.conf Modified: trunk/CHANGELOG =================================================================== --- trunk/CHANGELOG 2007-02-11 23:22:32 UTC (rev 548) +++ trunk/CHANGELOG 2007-02-12 21:50:50 UTC (rev 549) @@ -10,6 +10,7 @@ ver. 0.?.? (2007/??/??) - ??? ---------- - Fixed asctime pattern in datedetector.py +- Added new filters/actions. Thanks to Yaroslav Halchenko ver. 0.7.7 (2007/02/08) - release candidate ---------- Modified: trunk/MANIFEST =================================================================== --- trunk/MANIFEST 2007-02-11 23:22:32 UTC (rev 548) +++ trunk/MANIFEST 2007-02-12 21:50:50 UTC (rev 549) @@ -78,6 +78,7 @@ config/action.d/mail-whois.conf config/action.d/mail-whois-lines.conf config/action.d/mail.conf +config/action.d/mail-buffered.conf config/action.d/hostsdeny.conf config/action.d/shorewall.conf config/fail2ban.conf Added: trunk/config/action.d/mail-buffered.conf =================================================================== --- trunk/config/action.d/mail-buffered.conf (rev 0) +++ trunk/config/action.d/mail-buffered.conf 2007-02-12 21:50:50 UTC (rev 549) @@ -0,0 +1,88 @@ +# Fail2Ban configuration file +# +# Author: Cyril Jaquier +# +# $Revision: 510 $ +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = echo -en "Hi,\n + The jail <name> has been started successfuly.\n + Output will be buffered until <lines> lines are available.\n + Regards,\n + Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest> + +# Option: actionend +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = if [ -d <tmpfile> ]; then + echo -en "Hi,\n + These hosts have been banned by Fail2Ban.\n + `cat <tmpfile>` + Regards,\n + Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary" <dest> + rm <tmpfile> + fi + echo -en "Hi,\n + The jail <name> has been stopped.\n + Regards,\n + Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest> + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: <ip> IP address +# <failures> number of failures +# <time> unix timestamp of the ban time +# Values: CMD +# +actionban = echo `date`": <ip> (<failures> failures)" >> <tmpfile> + LINE=$( wc -l <tmpfile> | awk '{ print $1 }' ) + if [ $LINE -eq <lines> ]; then + echo -en "Hi,\n + These hosts have been banned by Fail2Ban.\n + `cat <tmpfile>` + Regards,\n + Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary" <dest> + rm <tmpfile> + fi + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: <ip> IP address +# <failures> number of failures +# <time> unix timestamp of the ban time +# Values: CMD +# +actionunban = + +[Init] + +# Default name of the chain +# +name = default + +# Default number of lines that are buffered +# +lines = 5 + +# Default temporary file +# +tmpfile = /tmp/fail2ban-mail.txt + +# Destination/Addressee of the mail +# +dest = root Added: trunk/config/filter.d/apache-badbots.conf =================================================================== --- trunk/config/filter.d/apache-badbots.conf (rev 0) +++ trunk/config/filter.d/apache-badbots.conf 2007-02-12 21:50:50 UTC (rev 549) @@ -0,0 +1,25 @@ +# Fail2Ban configuration file +# +# List of bad bots fetched from http://www.user-agents.org +# Generated on Sun Feb 11 01:09:15 EST 2007 by ./badbots.sh +# +# Author: Yaroslav Halchenko +# +# + +[Definition] +badbotscustom = EmailCollector|WebEMailExtrac +badbots = atSpider/1\.0|autoemailspider|China Local Browse 2\.6|ContentSmartz|DataCha0s/2\.0|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|MVAClient|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|sogou spider|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|WebVulnCrawl\.blogspot\.com/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00 + +# Option: failregex +# Notes.: Regexp to catch known spambots and software alike. Please verify that +# it is your intent to block IPs which were driven by abovementioned bots +# Values: TEXT +# +failregex = ^(?P<host>\S*) -.*"GET.*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$ + +# Option: ignoreregex +# Notes.: regex to ignore. If this regex matches, the line is ignored. +# Values: TEXT +# +ignoreregex = Modified: trunk/config/jail.conf =================================================================== --- trunk/config/jail.conf 2007-02-11 23:22:32 UTC (rev 548) +++ trunk/config/jail.conf 2007-02-12 21:50:50 UTC (rev 549) @@ -117,6 +117,19 @@ maxretry = 5 bantime = 1800 +# Ban hosts which agent identifies spammer robots crawling the web +# for email addresses. The mail outputs are buffered. + +[apache-badbots] + +enabled = false +filter = apache-badbots +action = iptables-multiport[name=BadBots, port="http,https"] + mail-buffered[name=BadBots, lines=5, dest=you...@ma...] +logpath = /var/www/*/logs/access_log +bantime = 172800 +maxretry = 1 + # Use shorewall instead of iptables. [apache-shorewall] This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-02-11 23:22:31
|
Revision: 548 http://svn.sourceforge.net/fail2ban/?rev=548&view=rev Author: lostcontrol Date: 2007-02-11 15:22:32 -0800 (Sun, 11 Feb 2007) Log Message: ----------- - Updated Modified Paths: -------------- trunk/CHANGELOG trunk/TODO Modified: trunk/CHANGELOG =================================================================== --- trunk/CHANGELOG 2007-02-11 23:21:56 UTC (rev 547) +++ trunk/CHANGELOG 2007-02-11 23:22:32 UTC (rev 548) @@ -7,6 +7,10 @@ Fail2Ban (version 0.7.7) 2007/02/08 ============================================================= +ver. 0.?.? (2007/??/??) - ??? +---------- +- Fixed asctime pattern in datedetector.py + ver. 0.7.7 (2007/02/08) - release candidate ---------- - Added signal handling in fail2ban-client Modified: trunk/TODO =================================================================== --- trunk/TODO 2007-02-11 23:21:56 UTC (rev 547) +++ trunk/TODO 2007-02-11 23:22:32 UTC (rev 548) @@ -13,6 +13,12 @@ # partially done * done +- Discuss where Fail2ban should be installed (/usr/share, + /usr/lib/python/site-packages/, etc) + +- Cleanup fail2ban-client and fail2ban-server. Move code to + server/ and client/ + - Add timeout to external commands (signal alarm, watchdog thread, etc) @@ -22,7 +28,7 @@ (openssh, postfix, proftp) - Added <USER> tag for failregex. Add features using this - information + information. Maybe add more tags - Look at the memory consumption. Decrease memory usage This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-02-11 23:22:02
|
Revision: 547 http://svn.sourceforge.net/fail2ban/?rev=547&view=rev Author: lostcontrol Date: 2007-02-11 15:21:56 -0800 (Sun, 11 Feb 2007) Log Message: ----------- - Display the IP list correctly Modified Paths: -------------- trunk/client/beautifier.py Modified: trunk/client/beautifier.py =================================================================== --- trunk/client/beautifier.py 2007-02-11 23:19:32 UTC (rev 546) +++ trunk/client/beautifier.py 2007-02-11 23:21:56 UTC (rev 547) @@ -68,13 +68,18 @@ msg = "Added jail " + response elif inC[0:1] == ['status']: if len(inC) > 1: + # Create IP list + ipList = "" + for ip in response[1][1][2][1]: + ipList += ip + " " + # Display information msg = "Status for the jail: " + inC[1] + "\n" msg = msg + "|- " + response[0][0] + "\n" msg = msg + "| |- " + response[0][1][0][0] + ":\t" + `response[0][1][0][1]` + "\n" msg = msg + "| `- " + response[0][1][1][0] + ":\t" + `response[0][1][1][1]` + "\n" msg = msg + "`- " + response[1][0] + "\n" msg = msg + " |- " + response[1][1][0][0] + ":\t" + `response[1][1][0][1]` + "\n" - msg = msg + " | `- " + response[1][1][2][0] + ":\t" + `response[1][1][2][1]` + "\n" + msg = msg + " | `- " + response[1][1][2][0] + ":\t" + ipList + "\n" msg = msg + " `- " + response[1][1][1][0] + ":\t" + `response[1][1][1][1]` else: msg = "Status\n" This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-02-11 23:19:31
|
Revision: 546 http://svn.sourceforge.net/fail2ban/?rev=546&view=rev Author: lostcontrol Date: 2007-02-11 15:19:32 -0800 (Sun, 11 Feb 2007) Log Message: ----------- - Fixed asctime pattern in datedetector.py Modified Paths: -------------- trunk/server/datedetector.py Modified: trunk/server/datedetector.py =================================================================== --- trunk/server/datedetector.py 2007-02-11 23:18:58 UTC (rev 545) +++ trunk/server/datedetector.py 2007-02-11 23:19:32 UTC (rev 546) @@ -51,7 +51,7 @@ # asctime template = DateStrptime() template.setName("Weekday Month Day Hour:Minute:Second Year") - template.setRegex("\S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}") + template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}") template.setPattern("%a %b %d %H:%M:%S %Y") self.__templates.append(template) # simple date This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-02-11 23:18:57
|
Revision: 545 http://svn.sourceforge.net/fail2ban/?rev=545&view=rev Author: lostcontrol Date: 2007-02-11 15:18:58 -0800 (Sun, 11 Feb 2007) Log Message: ----------- - Updated Modified Paths: -------------- trunk/common/version.py Modified: trunk/common/version.py =================================================================== --- trunk/common/version.py 2007-02-08 21:23:20 UTC (rev 544) +++ trunk/common/version.py 2007-02-11 23:18:58 UTC (rev 545) @@ -24,4 +24,4 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" -version = "0.7.7" +version = "0.7.7-SVN" This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <los...@us...> - 2007-02-08 21:23:20
|
Revision: 544 http://svn.sourceforge.net/fail2ban/?rev=544&view=rev Author: lostcontrol Date: 2007-02-08 13:23:20 -0800 (Thu, 08 Feb 2007) Log Message: ----------- - Tag for 0.7.7 Added Paths: ----------- tags/FAIL2BAN-0_7_7/ Copied: tags/FAIL2BAN-0_7_7 (from rev 543, trunk) This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |