You can subscribe to this list here.
2005 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
(11) |
Oct
(8) |
Nov
(10) |
Dec
(8) |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2006 |
Jan
(6) |
Feb
(1) |
Mar
(43) |
Apr
(17) |
May
(2) |
Jun
(8) |
Jul
(9) |
Aug
(14) |
Sep
(15) |
Oct
(25) |
Nov
(20) |
Dec
(12) |
2007 |
Jan
(29) |
Feb
(19) |
Mar
(8) |
Apr
(12) |
May
(10) |
Jun
(9) |
Jul
(40) |
Aug
(33) |
Sep
(74) |
Oct
(19) |
Nov
(31) |
Dec
(13) |
2008 |
Jan
(50) |
Feb
(52) |
Mar
(43) |
Apr
(21) |
May
(68) |
Jun
(28) |
Jul
(6) |
Aug
(25) |
Sep
(14) |
Oct
(32) |
Nov
(7) |
Dec
(13) |
2009 |
Jan
(25) |
Feb
(1) |
Mar
(2) |
Apr
(8) |
May
(4) |
Jun
(6) |
Jul
(24) |
Aug
(40) |
Sep
(24) |
Oct
(15) |
Nov
(31) |
Dec
(35) |
2010 |
Jan
(6) |
Feb
(1) |
Mar
(23) |
Apr
(16) |
May
(4) |
Jun
(36) |
Jul
(20) |
Aug
(13) |
Sep
(36) |
Oct
(12) |
Nov
(9) |
Dec
(2) |
2011 |
Jan
(16) |
Feb
(9) |
Mar
(21) |
Apr
(33) |
May
(27) |
Jun
(31) |
Jul
(20) |
Aug
(7) |
Sep
(20) |
Oct
(41) |
Nov
(29) |
Dec
(52) |
2012 |
Jan
(127) |
Feb
(36) |
Mar
(15) |
Apr
(40) |
May
(23) |
Jun
(43) |
Jul
(84) |
Aug
(50) |
Sep
(31) |
Oct
(45) |
Nov
(43) |
Dec
(47) |
2013 |
Jan
(39) |
Feb
(83) |
Mar
(50) |
Apr
(50) |
May
(79) |
Jun
(87) |
Jul
(71) |
Aug
(41) |
Sep
(39) |
Oct
(81) |
Nov
(61) |
Dec
(74) |
2014 |
Jan
(76) |
Feb
(50) |
Mar
(45) |
Apr
(62) |
May
(59) |
Jun
(21) |
Jul
(93) |
Aug
(64) |
Sep
(53) |
Oct
(44) |
Nov
(37) |
Dec
(43) |
2015 |
Jan
(60) |
Feb
(72) |
Mar
(35) |
Apr
(50) |
May
(52) |
Jun
(89) |
Jul
(110) |
Aug
(94) |
Sep
(77) |
Oct
(82) |
Nov
(41) |
Dec
(26) |
2016 |
Jan
(42) |
Feb
(44) |
Mar
(26) |
Apr
(55) |
May
(26) |
Jun
(17) |
Jul
(63) |
Aug
(38) |
Sep
(43) |
Oct
(50) |
Nov
(45) |
Dec
(55) |
2017 |
Jan
(26) |
Feb
(29) |
Mar
(28) |
Apr
(40) |
May
(2) |
Jun
(16) |
Jul
(22) |
Aug
(21) |
Sep
(35) |
Oct
(47) |
Nov
(10) |
Dec
(15) |
2018 |
Jan
(18) |
Feb
(35) |
Mar
(71) |
Apr
(9) |
May
(39) |
Jun
(19) |
Jul
(14) |
Aug
(108) |
Sep
(5) |
Oct
(34) |
Nov
(24) |
Dec
(13) |
2019 |
Jan
(13) |
Feb
(19) |
Mar
(33) |
Apr
(11) |
May
(21) |
Jun
(61) |
Jul
(21) |
Aug
(80) |
Sep
(26) |
Oct
(10) |
Nov
(8) |
Dec
(4) |
2020 |
Jan
(26) |
Feb
(81) |
Mar
(31) |
Apr
(37) |
May
(52) |
Jun
(10) |
Jul
(47) |
Aug
(25) |
Sep
(63) |
Oct
(36) |
Nov
(19) |
Dec
(18) |
2021 |
Jan
(49) |
Feb
(11) |
Mar
(18) |
Apr
(21) |
May
(66) |
Jun
(8) |
Jul
(35) |
Aug
(30) |
Sep
(10) |
Oct
(31) |
Nov
(4) |
Dec
(23) |
2022 |
Jan
(1) |
Feb
(16) |
Mar
(34) |
Apr
(6) |
May
(2) |
Jun
|
Jul
(1) |
Aug
(17) |
Sep
(1) |
Oct
(2) |
Nov
(4) |
Dec
(16) |
2023 |
Jan
(10) |
Feb
(39) |
Mar
(7) |
Apr
(44) |
May
(17) |
Jun
(20) |
Jul
|
Aug
(2) |
Sep
(10) |
Oct
(7) |
Nov
(3) |
Dec
(3) |
2024 |
Jan
(1) |
Feb
(10) |
Mar
(8) |
Apr
(1) |
May
(19) |
Jun
(15) |
Jul
(3) |
Aug
(5) |
Sep
|
Oct
|
Nov
|
Dec
|
From: Yaroslav H. <li...@on...> - 2006-06-01 14:55:47
|
yeah -- there is something funky happening... didn't get it yet -- it seems something with firewall configs although firewall (ipmasq + custom iptables rules) restart helped. Also our local IT department constantly mangling network at the moment... the problem partially is that web server itself runs inside vserver and doesn't have a separate IP address so I need to do all DNAT/SNAT forwards - some issues get tricky to troubleshoot... I will keep an eye on it On Thu, 01 Jun 2006, Chris Withers wrote: > Yaroslav Halchenko wrote: > > deb http://itanix.rutgers.edu/rumba/ sarge backport > Has this server been a bit up & down recently? > It time out when I did an aptitude upgrade && aptitude update last > weekend... > Chris -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Chris W. <ch...@si...> - 2006-06-01 06:59:08
|
Yaroslav Halchenko wrote: > deb http://itanix.rutgers.edu/rumba/ sarge backport Has this server been a bit up & down recently? It time out when I did an aptitude upgrade && aptitude update last weekend... Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk |
From: Chris W. <ch...@si...> - 2006-06-01 06:59:08
|
Hi All, Should I expect any negative interactions between Shorewall and fail2ban? cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk |
From: Yaroslav H. <de...@on...> - 2006-05-08 18:45:17
|
Hi Willi, Sorry for the delay... work work work ;-) Please get a fresh version http://www.onerussian.com/Linux/fail2ban/logwatch/fail2ban.logwatch.7x.debi= an.20060508-1.tgz I adjusted parsing script to take care about those cases. Now with default detail level (5) those lines are summarized into: --------------------- fail2ban-messages Begin ------------------------=20 Banned services with Fail2Ban: Bans:Unbans Exim4: [ 0:1 ] 60.50.161.218 0:1 =20 SSH: [ 1:1 ] 192.168.22.27 1:1 =20 =20 13 faulty iptables invocation(s) 1 fail2ban rules reinitialization(s)=20 ---------------------- fail2ban-messages End -------------------------=20 On high detail level (>5) we get more information: --------------------- fail2ban-messages Begin ------------------------=20 Banned services with Fail2Ban: Bans:Unbans Exim4: [ 0:1 ] 60.50.161.218 0:1 =20 SSH: [ 1:1 ] 192.168.22.27 1:1 =20 Failed 5 7 times 1 Duplicate Ban attempts 1 ReBans due to rules reinitilizations =20 13 faulty iptables invocation(s): 2006-05-08 14:22:58,554 ERROR: 'iptables -L INPUT | grep -q fail2ban-SSH' = returned 256 2006-05-08 14:22:58,555 ERROR: Execution of command 'iptables -L INPUT | g= rep -q fail2ban-SSH' failed 2006-05-08 14:22:58,683 ERROR: 'iptables -D INPUT -p tcp --dport http -j f= ail2ban-ApacheAttacks 2006-05-08 14:22:58,731 ERROR: 'iptables -D INPUT -p tcp --dport http -j f= ail2ban-ApacheAttacks 2006-05-08 14:22:58,778 ERROR: 'iptables -D INPUT -p tcp --dport http -j f= ail2ban-ApacheAttacks 2006-05-08 14:22:58,824 ERROR: 'iptables -D INPUT -p tcp --dport http -j f= ail2ban-ApacheAttacks 2006-05-08 14:22:58,918 ERROR: 'iptables -D INPUT -p tcp --dport http -j f= ail2ban-Apache 2006-05-08 14:22:58,965 ERROR: 'iptables -D INPUT -p tcp --dport http -j f= ail2ban-Apache 2006-05-08 14:22:59,011 ERROR: 'iptables -D INPUT -p tcp --dport http -j f= ail2ban-Apache 2006-05-08 14:22:59,059 ERROR: 'iptables -D INPUT -p tcp --dport http -j f= ail2ban-Apache 2006-05-08 14:22:59,107 ERROR: 'iptables -D INPUT -p tcp --dport http -j f= ail2ban-Apache 2006-05-08 14:22:59,247 ERROR: 'iptables -D INPUT -p tcp --dport http -j f= ail2ban-ApacheAttacksGB 2006-05-08 14:22:59,280 ERROR: 'iptables -D fail2ban-SSH -s '192.168.22.27= ' -j DROP' returned 256 2006-05-08 14:22:59,326 ERROR: 'iptables -D INPUT -p tcp --dport ssh -j fa= il2ban-SSH =20 1 fail2ban rules reinitialization(s)=20 ---------------------- fail2ban-messages End -------------------------=20 I hope this would be better ;-) Thank you in advance On Tue, 02 May 2006, Willi Mann wrote: > Yaroslav Halchenko schrieb: > >Hi Willi, > >Sorry for a slight delay. I reshaped the files a bit (corrected > >attributions and added licensing statement in both scripts, left config > >files without explicit licensing statements) > >I hope they are ok now > Yes, thanks. Available from > deb http://pkg-logwatch.alioth.debian.org/apt sid main > or http://pkg-logwatch.alioth.debian.org/apt/pool/main/l/logwatch/logwatc= h_7.3-0test2.2_all.deb > There are some unmatched entries, which should be ignored or reported: > 5 ERROR: Execution of command 'iptables -L INPUT | grep -q fail2ban-= SSH' failed > 5 ERROR: 'iptables -D fail2ban-SSH -s 'a.b.c.d' -j DROP' returned 2= 56 > 5 ERROR: 'iptables -D INPUT -p tcp --dport ssh -j fail2ban-SSH > 5 ERROR: 'iptables -L INPUT | grep -q fail2ban-SSH' returned 256 > 5 ERROR: SSH: a.b.c.d already in ban list > 4 WARNING: #1 reinitialization of firewalls > 1 WARNING: #2 reinitialization of firewalls > 5 WARNING: is not a valid IP address > 5 WARNING: SSH: ReBan a.b.c.d > (the first number is the number of occurences when I used range all on on= e machine.) > Can you add the code to handle them? I'm not which to ignore and which to= handle. > Willi --=20 .-. =3D------------------------------ /v\ ----------------------------=3D Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Yaroslav H. <li...@on...> - 2006-05-01 14:12:44
|
Before locale issue gets properly addressed see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=363391 On Sun, 30 Apr 2006, denis wrote: > Hi, > I use fail2ban on several servers but i have just installed the new > version from debian-testing and the backport > (http://itanix.rutgers.edu/rumba/) and even if it runs it does not > function at all. > Here 's the log: > 2006-04-30 22:07:28,538 ERROR: time data did not match format: data=Apr > 30 22:05:01 fmt=%b %d %H:%M:%S > 2006-04-30 22:07:28,538 ERROR: Please check the format and your locale > settings. > There is a way for solving this error? > Thanks > Denis > My version 0.6.1-2 > My locale: > LANG=fr_FR.UTF-8@euro > LC_CTYPE="fr_FR.UTF-8@euro" > LC_NUMERIC="fr_FR.UTF-8@euro" > LC_TIME="fr_FR.UTF-8@euro" > LC_COLLATE="fr_FR.UTF-8@euro" > LC_MONETARY="fr_FR.UTF-8@euro" > LC_MESSAGES="fr_FR.UTF-8@euro" > LC_PAPER="fr_FR.UTF-8@euro" > LC_NAME="fr_FR.UTF-8@euro" > LC_ADDRESS="fr_FR.UTF-8@euro" > LC_TELEPHONE="fr_FR.UTF-8@euro" > LC_MEASUREMENT="fr_FR.UTF-8@euro" > LC_IDENTIFICATION="fr_FR.UTF-8@euro" > LC_ALL= > ------------------------------------------------------- > Using Tomcat but need to do more? Need to support web services, security? > Get stuff done quickly with pre-integrated technology to make your job easier > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: denis <den...@al...> - 2006-04-30 20:18:09
|
Hi, I use fail2ban on several servers but i have just installed the new version from debian-testing and the backport (http://itanix.rutgers.edu/rumba/) and even if it runs it does not function at all. Here 's the log: 2006-04-30 22:07:28,538 ERROR: time data did not match format: data=Apr 30 22:05:01 fmt=%b %d %H:%M:%S 2006-04-30 22:07:28,538 ERROR: Please check the format and your locale settings. There is a way for solving this error? Thanks Denis My version 0.6.1-2 My locale: LANG=fr_FR.UTF-8@euro LC_CTYPE="fr_FR.UTF-8@euro" LC_NUMERIC="fr_FR.UTF-8@euro" LC_TIME="fr_FR.UTF-8@euro" LC_COLLATE="fr_FR.UTF-8@euro" LC_MONETARY="fr_FR.UTF-8@euro" LC_MESSAGES="fr_FR.UTF-8@euro" LC_PAPER="fr_FR.UTF-8@euro" LC_NAME="fr_FR.UTF-8@euro" LC_ADDRESS="fr_FR.UTF-8@euro" LC_TELEPHONE="fr_FR.UTF-8@euro" LC_MEASUREMENT="fr_FR.UTF-8@euro" LC_IDENTIFICATION="fr_FR.UTF-8@euro" LC_ALL= |
From: Yaroslav H. <li...@on...> - 2006-04-18 18:42:45
|
sorry for not reading your previous email careful enough ;-) indeed, even with apt-get update there are some spurious problems on the first run - fails to obtain Packages file properly or smth like that. enjoy fail2ban On Tue, 18 Apr 2006, Chris Withers wrote: > Yaroslav Halchenko wrote: > >so what is the output of running aptitude update? > That, sadly, is the problem. > It only did it until I ran "apt-get update", and doing that obliterated the error messages :-( > After running "apt-get update", "aptitude update" worked fine :-S > Oh well, chalk it down to another unreproducible bug :-/ > Chris -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Chris W. <ch...@si...> - 2006-04-18 17:19:14
|
Yaroslav Halchenko wrote: > > so what is the output of running aptitude update? That, sadly, is the problem. It only did it until I ran "apt-get update", and doing that obliterated the error messages :-( After running "apt-get update", "aptitude update" worked fine :-S Oh well, chalk it down to another unreproducible bug :-/ Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk |
From: Yaroslav H. <li...@on...> - 2006-04-18 15:38:57
|
> Yaroslav Halchenko wrote: > >to tell the truth can't help much since you didn't provide with what > >aptitude complained about. > Well, it was specifically the "aptitude update" that was erroring. "apt-get update" worked, and once it had run, "aptitude update" > also worked. I dunno whether it's a problem with the .deb's you made available or a problem with aptitude itself... so what "aptitude update" says?? in my case it has no complains: zaza:/home/yoh# aptitude update > /tmp/aptitude.update zaza:/home/yoh# grep backport /tmp/aptitude.update Hit http://itanix.rutgers.edu sarge/backport Packages Hit http://itanix.rutgers.edu sarge/backport Release so what is the output of running aptitude update? -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Chris W. <ch...@si...> - 2006-04-18 08:51:40
|
Yaroslav Halchenko wrote: > to tell the truth can't help much since you didn't provide with what > aptitude complained about. Well, it was specifically the "aptitude update" that was erroring. "apt-get update" worked, and once it had run, "aptitude update" also worked. I dunno whether it's a problem with the .deb's you made available or a problem with aptitude itself... > As for logwatch scripts -- just grab tarball which is somewhere in the > mailing list archive... or what a heck -- just run: > > > wget -O- http://www.onerussian.com/tmp/fail2ban.logwatch.5x.tgz | tar -xzvf- > > That would install scripts for the version of logwatch within sarge Thanks! cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk |
From: Yaroslav H. <li...@on...> - 2006-04-17 22:37:25
|
to tell the truth can't help much since you didn't provide with what aptitude complained about. for the sake of testing did next things on available sarge (i686 box) and everything worked fine removed fail2ban zaza:/etc/apt# grep backport sources.list deb http://itanix.rutgers.edu/rumba/ sarge backport zaza:/etc/apt# apt-cache policy fail2ban fail2ban: Installed: (none) Candidate: 0.6.1-2 Version Table: 0.6.1-2 0 990 http://itanix.rutgers.edu sarge/backport Packages 100 /var/lib/dpkg/status zaza:/etc/apt# aptitude install fail2ban Reading Package Lists... Done Building Dependency Tree Reading extended state information Initializing package states... Done Reading task descriptions... Done The following packages have been kept back: acroread acroread-plugins clamav-base curl dia dia-common dia-libs evolution flashplayer-mozilla flex gnome-vlc gnupg gpdf i2c-source kamera karbon kcoloredit kdegraphics kdegraphics-dev kdegraphics-kfile-plugins kdvi kfax kformula kgamma kghostview kiconedit kmrml koffice-data koffice-libs kolourpaint kooka kpdf kpovmodeler kruler ksnapshot ksvg kuickshow kview kviewshell libclamav1 libcurl3 libgnutls11 libkscan1 libnetpbm10 libnetpbm9 libquicktime-dev libquicktime0 libraw1394-8 libraw1394-dev libsensors3 libtasn1-2 libxine1 lm-sensors metamail mozilla-acroread mozilla-plugin-vlc mplayer-586 netpbm pdftohtml qvlc sudo tar unzip vlc vlc-gnome vlc-plugin-alsa vlc-plugin-esd vlc-qt w32codecs wxvlc xpdf xpdf-common xpdf-reader xpdf-utils zoo The following NEW packages will be installed: fail2ban 0 packages upgraded, 1 newly installed, 0 to remove and 75 not upgraded. Need to get 0B/48.6kB of archives. After unpacking 270kB will be used. Writing extended state information... Done Selecting previously deselected package fail2ban. (Reading database ... 243709 files and directories currently installed.) Unpacking fail2ban (from .../fail2ban_0.6.1-2_all.deb) ... Setting up fail2ban (0.6.1-2) ... Starting fail2ban: .done Reading Package Lists... Done Building Dependency Tree Reading extended state information Initializing package states... Done Reading task descriptions... Done As for logwatch scripts -- just grab tarball which is somewhere in the mailing list archive... or what a heck -- just run: wget -O- http://www.onerussian.com/tmp/fail2ban.logwatch.5x.tgz | tar -xzvf- That would install scripts for the version of logwatch within sarge On Mon, 17 Apr 2006, Chris Withers wrote: > Hi, > Yaroslav Halchenko wrote: > >deb http://itanix.rutgers.edu/rumba/ sarge backport > >to your /etc/apt/sources.list > >apt-get update > Okay, this worked, but I tried "aptitude update" first and got errors. > Sadly, they got overwritten in my shell buffer so I can't tell you what they were other than a vague "sarge/backport does > not exist" type error. > Maybe you can find the errors in your web server logs? > Anyway, using apt-get worked, and then after that "aptitude update" worked too... > >apt-get install fail2ban > I used: > aptitude install fail2ban > Do I need to do anything else now or will fail2ban be working? > Do I need to do anything to get a fail2ban section in my daily logwatch mail? > cheers, > Chris -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Chris W. <ch...@si...> - 2006-04-17 14:41:31
|
Hi, Yaroslav Halchenko wrote: > deb http://itanix.rutgers.edu/rumba/ sarge backport > > to your /etc/apt/sources.list > > apt-get update Okay, this worked, but I tried "aptitude update" first and got errors. Sadly, they got overwritten in my shell buffer so I can't tell you what they were other than a vague "sarge/backport does not exist" type error. Maybe you can find the errors in your web server logs? Anyway, using apt-get worked, and then after that "aptitude update" worked too... > apt-get install fail2ban I used: aptitude install fail2ban Do I need to do anything else now or will fail2ban be working? Do I need to do anything to get a fail2ban section in my daily logwatch mail? cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk |
From: Chris W. <ch...@si...> - 2006-04-12 07:51:37
|
Yaroslav Halchenko wrote: > On Tue, 11 Apr 2006, Chris Withers wrote: >> Will you be keeping that build up to date? >> (I guess I mainly care about security problems..) > well -- it will follow stable upstream. To be more precise it will be > mainly backport from etch into sarge -- so if fail2ban makes it way to > etch - I will update it in backport as well. I might (but no guarantee) > create a branch and patch security updates more rapidly. Excellent, thanks :-) Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk |
From: Yaroslav H. <li...@on...> - 2006-04-11 20:42:11
|
yikes -- I just now realized that I didn't bother my sponsor yet to upload -2 revision (will do that some time this week). So unstable and testing have only 0.6.1-1. But I think you would be only in better situation with -2 since it fixes a tiny bug :-) On Tue, 11 Apr 2006, Yaroslav Halchenko wrote: > On Tue, 11 Apr 2006, Chris Withers wrote: > > Will you be keeping that build up to date? > > (I guess I mainly care about security problems..) > well -- it will follow stable upstream. To be more precise it will be > mainly backport from etch into sarge -- so if fail2ban makes it way to > etch - I will update it in backport as well. I might (but no guarantee) > create a branch and patch security updates more rapidly. > > Also, what will I have to do if/when fail2ban makes it into stable? > nothing -- I will remove it from local backport and I bet that etch > version will be at least as new as the one I provide for backports ;-) > but I am not sure when they are going to release etch -- so I think you > can sleep calm for the next 1/2 year at least ;-) -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Yaroslav H. <li...@on...> - 2006-04-11 20:17:24
|
On Tue, 11 Apr 2006, Chris Withers wrote: > Will you be keeping that build up to date? > (I guess I mainly care about security problems..) well -- it will follow stable upstream. To be more precise it will be mainly backport from etch into sarge -- so if fail2ban makes it way to etch - I will update it in backport as well. I might (but no guarantee) create a branch and patch security updates more rapidly. > Also, what will I have to do if/when fail2ban makes it into stable? nothing -- I will remove it from local backport and I bet that etch version will be at least as new as the one I provide for backports ;-) but I am not sure when they are going to release etch -- so I think you can sleep calm for the next 1/2 year at least ;-) -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Chris W. <ch...@si...> - 2006-04-11 19:37:52
|
Yaroslav Halchenko wrote: > it seems that the most recent version is stable enough , so I built most > recent version of it for sarge (probably you could just grab it from > unstable but decided to do it right way -- pbuilder in sarge chroot) > > add > > deb http://itanix.rutgers.edu/rumba/ sarge backport > > to your /etc/apt/sources.list > > apt-get update > apt-get install fail2ban That looks great, thanks :-) Will you be keeping that build up to date? (I guess I mainly care about security problems..) Also, what will I have to do if/when fail2ban makes it into stable? cheers, Chris |
From: Yaroslav H. <li...@on...> - 2006-04-11 19:23:38
|
it seems that the most recent version is stable enough , so I built most recent version of it for sarge (probably you could just grab it from unstable but decided to do it right way -- pbuilder in sarge chroot) add deb http://itanix.rutgers.edu/rumba/ sarge backport to your /etc/apt/sources.list apt-get update apt-get install fail2ban enjoy On Tue, 11 Apr 2006, Chris Withers wrote: > Hi All, > What's the best way to install fail2ban on a debian stable box? > I'm a simpleton, so I'll need step-by-step instructions if possible. > cheers, > Chris -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Chris W. <ch...@si...> - 2006-04-11 08:59:39
|
Hi All, What's the best way to install fail2ban on a debian stable box? I'm a simpleton, so I'll need step-by-step instructions if possible. cheers, Chris |
From: Rarig, H. <hr...@so...> - 2006-04-03 18:06:46
|
Good catch! It worked for me on Fedora Core 3, using logwatch-7.2.1-2, but maybe Debian is a little more fussy about this. Go Figure! ;>) Harry -----Original Message----- From: Yaroslav Halchenko [mailto:li...@on...] Sent: Monday, April 03, 2006 1:44 PM To: Rarig, Harry Cc: Cyril Jaquier; Nils Breunese (Lemonbit Internet); fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report 1. v5 didn't work for me (and someone else) with logwatch shipped with Debian -- due to a bug? it didn't read fail2ban.conf from /etc/logwatch/... 2. applyeurodate shipped with v7 tarball uses provided by logwatch logic to process the dates, thus making it uniform with the rest of logwatch and would not need any changes to accomodate any new date specificaion logwatch comes up with, thus it is preferable for >v7 of logwatch On Mon, 03 Apr 2006, Rarig, Harry wrote: > FYI, > The script that works with logwatch-5.2.2 also works with = logwatch-7.2.1, if it would make your life easier to issue just one = script that works with both releases of logwatch. > Your call! > Harry > -----Original Message----- > From: Cyril Jaquier [mailto:cyr...@bl...] > Sent: Sunday, April 02, 2006 10:47 AM > To: Rarig, Harry; Nils Breunese (Lemonbit Internet); > fai...@li... > Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily = report > Hi, > > P.S. Cyril -- would you mind making both versions of logwatch = scripts > > available on fail2ban site --=20 > Logwatch scripts are now available on the project website. > = http://sourceforge.net/project/showfiles.php?group_id=3D121032&package_id= =3D185995 > Sorry for the delay but I've a lot of work these days :( > Regards, > Cyril Jaquier > ------------------------------------------------------- > This SF.Net email is sponsored by xPML, a groundbreaking scripting = language > that extends applications into web and mobile media. Attend the live = webcast > and join the prime developer group breaking into this new coding = territory! > = http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=110944&bid$1720&dat=121642 > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users --=20 .-. =3D------------------------------ /v\ ----------------------------=3D Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Yaroslav H. <li...@on...> - 2006-04-03 17:45:22
|
1. v5 didn't work for me (and someone else) with logwatch shipped with Debian -- due to a bug? it didn't read fail2ban.conf from /etc/logwatch/... 2. applyeurodate shipped with v7 tarball uses provided by logwatch logic to process the dates, thus making it uniform with the rest of logwatch and would not need any changes to accomodate any new date specificaion logwatch comes up with, thus it is preferable for >v7 of logwatch On Mon, 03 Apr 2006, Rarig, Harry wrote: > FYI, > The script that works with logwatch-5.2.2 also works with logwatch-7.2.1,= if it would make your life easier to issue just one script that works with= both releases of logwatch. > Your call! > Harry > -----Original Message----- > From: Cyril Jaquier [mailto:cyr...@bl...] > Sent: Sunday, April 02, 2006 10:47 AM > To: Rarig, Harry; Nils Breunese (Lemonbit Internet); > fai...@li... > Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report > Hi, > > P.S. Cyril -- would you mind making both versions of logwatch scripts > > available on fail2ban site --=20 > Logwatch scripts are now available on the project website. > http://sourceforge.net/project/showfiles.php?group_id=3D121032&package_id= =3D185995 > Sorry for the delay but I've a lot of work these days :( > Regards, > Cyril Jaquier > ------------------------------------------------------- > This SF.Net email is sponsored by xPML, a groundbreaking scripting langua= ge > that extends applications into web and mobile media. Attend the live webc= ast > and join the prime developer group breaking into this new coding territor= y! > http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=110944&bid$1720&dat=121642 > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users --=20 .-. =3D------------------------------ /v\ ----------------------------=3D Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Rarig, H. <hr...@so...> - 2006-04-03 14:26:56
|
FYI, The script that works with logwatch-5.2.2 also works with = logwatch-7.2.1, if it would make your life easier to issue just one = script that works with both releases of logwatch. Your call! Harry -----Original Message----- From: Cyril Jaquier [mailto:cyr...@bl...] Sent: Sunday, April 02, 2006 10:47 AM To: Rarig, Harry; Nils Breunese (Lemonbit Internet); fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report Hi, > P.S. Cyril -- would you mind making both versions of logwatch scripts > available on fail2ban site --=20 Logwatch scripts are now available on the project website. http://sourceforge.net/project/showfiles.php?group_id=3D121032&package_id= =3D185995 Sorry for the delay but I've a lot of work these days :( Regards, Cyril Jaquier |
From: Cyril J. <cyr...@bl...> - 2006-04-02 14:47:40
|
Hi, > P.S. Cyril -- would you mind making both versions of logwatch scripts > available on fail2ban site -- Logwatch scripts are now available on the project website. http://sourceforge.net/project/showfiles.php?group_id=121032&package_id=185995 Sorry for the delay but I've a lot of work these days :( Regards, Cyril Jaquier |
From: Yaroslav H. <li...@on...> - 2006-03-31 06:52:04
|
Hi Benjamin! I bet you didn't get reply because your email got into everyone's spam box -- look below on why spamassassin decided to "ban" it. Please find files for older versions of logwatch www.onerussian.com/tmp/fail2ban.logwatch.5x.tgz and new version www.onerussian.com/tmp/fail2ban.logwatch.7x.tgz Cyril will place them on the official fail2ban website some time soon Enjoy On Sat, 18 Mar 2006, Benjamin Donnachie wrote: > Spam detection software, running on the system "washoe.rutgers.edu", has > identified this incoming email as possible spam. The original message > has been attached to this so you can view it (if it isn't spam) or label > similar future email. If you have any questions, see > the administrator of that system for details. > Content preview: [...] > Content analysis details: (5.3 points, 4.0 required) > pts rule name description > ---- ---------------------- -------------------------------------------------- > -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1% > [score: 0.0000] > 2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address > [80.3.112.69 listed in dnsbl.sorbs.net] > 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net > [Blocked - see <http://www.spamcop.net/bl.shtml?66.35.250.225>] > 1.9 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did non-local SMTP > [80.3.112.69 listed in combined.njabl.org] > 2.3 EMPTY_MESSAGE Message appears to be empty with no Subject: text > The original message was not completely plain text, and may be unsafe to > open with some email clients; in particular, it may contain a virus, > or confirm that your address can receive spam. If you wish to view > it, it may be safer to save it to a file and open it with an editor. Content-Description: original message before SpamAssassin > Date: Sat, 18 Mar 2006 16:38:14 +0000 > From: Benjamin Donnachie <ben...@py...> > To: fai...@li... > Subject: [Fail2ban-users] Request for logwatch files. > The archives for this list mention config files to add fail2ban to > logwatch reports. > I'd be very grateful if someone could please send the files to me, or > point me to where I can get them. > Many thanks, > Ben > ------------------------------------------------------- > This SF.Net email is sponsored by xPML, a groundbreaking scripting language > that extends applications into web and mobile media. Attend the live webcast > and join the prime developer group breaking into this new coding territory! > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Yaroslav H. <li...@on...> - 2006-03-28 17:31:38
|
I believe I've included your last version of it ;-) so no worries: ........................................:Tue Mar 28 12:29:48:. washoe[0] ~/tmp > tar -xzvf applyeurodate.tgz applyeurodate ........................................:Tue Mar 28 12:29:49:. washoe[0] ~/tmp > tar -xzvf fail2ban.logwatch.5x.tgz usr/share/logwatch/scripts/shared/applyeurodate usr/share/logwatch/scripts/services/fail2ban etc/logwatch/conf/logfiles/fail2ban.conf etc/logwatch/conf/services/fail2ban.conf ........................................:Tue Mar 28 12:29:55:. washoe[0] ~/tmp > diff applyeurodate usr/share/logwatch/scripts/shared/applyeurodate -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Rarig, H. <hr...@so...> - 2006-03-28 12:49:59
|
Yaroslav, Cyril:=20 Make sure you use the *last* "applyeurodate" script I sent out, the = original script did not work with the "--range all" option to the = logwatch command! Just to be safe, I've included the new script as an attachement to this = email. Cheers! Harry -----Original Message----- From: Yaroslav Halchenko [mailto:li...@on...] Sent: Monday, March 27, 2006 9:27 PM To: Rarig, Harry; Cyril Jaquier Cc: Nils Breunese (Lemonbit Internet); fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report Hi Rarig, I again hijack your thread ;-) Indeed, it should work with your script... or to say -- your original tar.gz with only my recent fail2ban script should work... I tar.gz-ipped all necessary files in a layout of old logwatch, tested on Debian sarge which shipped with 5.2.2 logwatch Everything seems to be smooth ;-) Enjoy P.S. Cyril -- would you mind making both versions of logwatch scripts available on fail2ban site --=20 fail2ban.logwatch.7x.tgz for recent versions of logwatch (probably 7.x) (who can pin point which? :-)=20 =20 fail2ban.logwatch.5x.tgz -- for older (5.x) versions --=20 .-. =3D------------------------------ /v\ ----------------------------=3D Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |