You can subscribe to this list here.
2005 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
(11) |
Oct
(8) |
Nov
(10) |
Dec
(8) |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2006 |
Jan
(6) |
Feb
(1) |
Mar
(43) |
Apr
(17) |
May
(2) |
Jun
(8) |
Jul
(9) |
Aug
(14) |
Sep
(15) |
Oct
(25) |
Nov
(20) |
Dec
(12) |
2007 |
Jan
(29) |
Feb
(19) |
Mar
(8) |
Apr
(12) |
May
(10) |
Jun
(9) |
Jul
(40) |
Aug
(33) |
Sep
(74) |
Oct
(19) |
Nov
(31) |
Dec
(13) |
2008 |
Jan
(50) |
Feb
(52) |
Mar
(43) |
Apr
(21) |
May
(68) |
Jun
(28) |
Jul
(6) |
Aug
(25) |
Sep
(14) |
Oct
(32) |
Nov
(7) |
Dec
(13) |
2009 |
Jan
(25) |
Feb
(1) |
Mar
(2) |
Apr
(8) |
May
(4) |
Jun
(6) |
Jul
(24) |
Aug
(40) |
Sep
(24) |
Oct
(15) |
Nov
(31) |
Dec
(35) |
2010 |
Jan
(6) |
Feb
(1) |
Mar
(23) |
Apr
(16) |
May
(4) |
Jun
(36) |
Jul
(20) |
Aug
(13) |
Sep
(36) |
Oct
(12) |
Nov
(9) |
Dec
(2) |
2011 |
Jan
(16) |
Feb
(9) |
Mar
(21) |
Apr
(33) |
May
(27) |
Jun
(31) |
Jul
(20) |
Aug
(7) |
Sep
(20) |
Oct
(41) |
Nov
(29) |
Dec
(52) |
2012 |
Jan
(127) |
Feb
(36) |
Mar
(15) |
Apr
(40) |
May
(23) |
Jun
(43) |
Jul
(84) |
Aug
(50) |
Sep
(31) |
Oct
(45) |
Nov
(43) |
Dec
(47) |
2013 |
Jan
(39) |
Feb
(83) |
Mar
(50) |
Apr
(50) |
May
(79) |
Jun
(87) |
Jul
(71) |
Aug
(41) |
Sep
(39) |
Oct
(81) |
Nov
(61) |
Dec
(74) |
2014 |
Jan
(76) |
Feb
(50) |
Mar
(45) |
Apr
(62) |
May
(59) |
Jun
(21) |
Jul
(93) |
Aug
(64) |
Sep
(53) |
Oct
(44) |
Nov
(37) |
Dec
(43) |
2015 |
Jan
(60) |
Feb
(72) |
Mar
(35) |
Apr
(50) |
May
(52) |
Jun
(89) |
Jul
(110) |
Aug
(94) |
Sep
(77) |
Oct
(82) |
Nov
(41) |
Dec
(26) |
2016 |
Jan
(42) |
Feb
(44) |
Mar
(26) |
Apr
(55) |
May
(26) |
Jun
(17) |
Jul
(63) |
Aug
(38) |
Sep
(43) |
Oct
(50) |
Nov
(45) |
Dec
(55) |
2017 |
Jan
(26) |
Feb
(29) |
Mar
(28) |
Apr
(40) |
May
(2) |
Jun
(16) |
Jul
(22) |
Aug
(21) |
Sep
(35) |
Oct
(47) |
Nov
(10) |
Dec
(15) |
2018 |
Jan
(18) |
Feb
(35) |
Mar
(71) |
Apr
(9) |
May
(39) |
Jun
(19) |
Jul
(14) |
Aug
(108) |
Sep
(5) |
Oct
(34) |
Nov
(24) |
Dec
(13) |
2019 |
Jan
(13) |
Feb
(19) |
Mar
(33) |
Apr
(11) |
May
(21) |
Jun
(61) |
Jul
(21) |
Aug
(80) |
Sep
(26) |
Oct
(10) |
Nov
(8) |
Dec
(4) |
2020 |
Jan
(26) |
Feb
(81) |
Mar
(31) |
Apr
(37) |
May
(52) |
Jun
(10) |
Jul
(47) |
Aug
(25) |
Sep
(63) |
Oct
(36) |
Nov
(19) |
Dec
(18) |
2021 |
Jan
(49) |
Feb
(11) |
Mar
(18) |
Apr
(21) |
May
(66) |
Jun
(8) |
Jul
(35) |
Aug
(30) |
Sep
(10) |
Oct
(31) |
Nov
(4) |
Dec
(23) |
2022 |
Jan
(1) |
Feb
(16) |
Mar
(34) |
Apr
(6) |
May
(2) |
Jun
|
Jul
(1) |
Aug
(17) |
Sep
(1) |
Oct
(2) |
Nov
(4) |
Dec
(16) |
2023 |
Jan
(10) |
Feb
(39) |
Mar
(7) |
Apr
(44) |
May
(17) |
Jun
(20) |
Jul
|
Aug
(2) |
Sep
(10) |
Oct
(7) |
Nov
(3) |
Dec
(3) |
2024 |
Jan
(1) |
Feb
(10) |
Mar
(8) |
Apr
(1) |
May
(19) |
Jun
(15) |
Jul
(3) |
Aug
(5) |
Sep
|
Oct
|
Nov
|
Dec
|
From: Peter C. N. <spa...@le...> - 2005-09-28 16:11:03
|
On Wed, Sep 28, 2005 at 12:58:09AM -0400, Yaroslav Halchenko wrote: > Hi Peter, > > I just subscribed to this list and because you didn't report the "bug" to > the Debian BTS, I didn't see your report before. > > And it is not a bug really, but more of a wish because it just doesn't > work for your introduced section. > > As the answer: did you try > failregex = 550 User unknown > instead of your > failregex = 550 User Unknown > ? > :-))) Thanks, that's what I get for thinking I did a literal cut-n-paste. > In the other words: check all your regexps manually in python on a > target string. This way you make sure that whatever "bug" is really a > bug :-) I would have, but I was out chasing butterflies or some other form of harmless bugs that aren't. > P.S. If it works -- could you please wrap your config for courier > consistently with the rest of the config (not that I like duplicating > comment lines, but just to be consistent) and submit it to the list or > to debian BTS. Then me (or Cyril) will include it in some upcoming > release :-) Thank you in advance Will do. Thanks, -Peter -- The 5 year plan: In five years we'll make up another plan. Or just re-use this one. |
From: Jakob C. <jc...@in...> - 2005-09-28 06:55:54
|
Resolved ! Just now I tried to start fail2ban from the source directory and it worked. After copying fail2ban and fail2ban.py to /usr/bin and adjusting the fail2ban.conf, no more problems were encountered. No idea what happened. MfG, Jakob Curdes iS information Systems oHG |
From: Yaroslav H. <li...@on...> - 2005-09-28 04:58:29
|
Hi Peter, I just subscribed to this list and because you didn't report the "bug" to the Debian BTS, I didn't see your report before. And it is not a bug really, but more of a wish because it just doesn't work for your introduced section. As the answer: did you try failregex = 550 User unknown instead of your failregex = 550 User Unknown ? :-))) In the other words: check all your regexps manually in python on a target string. This way you make sure that whatever "bug" is really a bug :-) P.S. If it works -- could you please wrap your config for courier consistently with the rest of the config (not that I like duplicating comment lines, but just to be consistent) and submit it to the list or to debian BTS. Then me (or Cyril) will include it in some upcoming release :-) Thank you in advance cheers -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Peter C. N. <spa...@le...> - 2005-09-28 03:14:46
|
On Tue, Sep 27, 2005 at 10:37:09PM -0400, Yaroslav Halchenko wrote: > I'm not a RH guru though... I am a Debian person that is why my support > might be limited and always will end with a statement: "do yourself a > favor, try Debian" :-) Yaroslav, Did you see my issue with debian and courier failure logs? Let me know, I can help set up a reproducer for you. Thanks, -Peter -- The 5 year plan: In five years we'll make up another plan. Or just re-use this one. |
From: Yaroslav H. <li...@on...> - 2005-09-28 02:37:52
|
Hi Jakob, While Cyril is away, I will try to do my best to help you. I'm not a RH guru though... I am a Debian person that is why my support might be limited and always will end with a statement: "do yourself a favor, try Debian" :-) could you please tell me what version of python RH uses? (python -V) did you install it from source of rpms? > I have upgraded python to the current version before installing and have installed log4py-1.3 and tried both the stable and development > version of fail2ban; with identical result. What am I doing wrong ? since some old version, fail2ban doesn't use log4py but uses standard python's logger - so do not bother about that. Please try the latest 0.5.4 version and report the result -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Jakob C. <jc...@in...> - 2005-09-27 21:00:27
|
Hi, I have looked for a script that doas exactly what fail2ban does - superb. But alas, I am no python guru. I treid to install it on a RH 9.x system and got the following : [root@insegni fail2ban-0.4.1]# /usr/bin/fail2ban.py 09/27/05 22:47:16.572 [0.015 (0.015)] DEBUG main [createPID (194)] Created PID lock (12071) in /var/run/fail2ban.pid 09/27/05 22:47:16.589 [0.032 (0.017)] DEBUG main [Main (450)] ConfFile is /etc/fail2ban.conf 09/27/05 22:47:16.591 [0.034 (0.002)] DEBUG main [Main (451)] BanTime is 60 09/27/05 22:47:16.593 [0.036 (0.002)] DEBUG main [Main (452)] retryAllowed is 3 Traceback (most recent call last): File "/usr/bin/fail2ban.py", line 456, in ? confReader = ConfigReader(logSys, conf["conffile"]); TypeError: __init__() takes exactly 2 arguments (3 given) I have upgraded python to the current version before installing and have installed log4py-1.3 and tried both the stable and development version of fail2ban; with identical result. What am I doing wrong ? Yours, Jakob Curdes |
From: Cyril J. <cyr...@bl...> - 2005-09-24 13:06:10
|
Hi, > 2005-09-23 14:19:55,355 DEBUG: [logreader.py (134)] /var/log/auth.log > 2005-09-23 14:19:55,357 DEBUG: [logreader.py (122)] Setting file > position to 828016L for /var/log/auth.log > 2005-09-23 14:22:19,558 DEBUG: [logreader.py (106)] /var/log/auth.log > has been modified > 2005-09-23 14:22:19,591 DEBUG: [logreader.py (134)] /var/log/auth.log > 2005-09-23 14:22:19,662 DEBUG: [logreader.py (122)] Setting file > position to 828091L for /var/log/auth.log > 2005-09-23 14:25:10,233 DEBUG: [logreader.py (106)] /var/log/auth.log > has been modified > 2005-09-23 14:25:10,647 DEBUG: [logreader.py (134)] /var/log/auth.log > 2005-09-23 14:25:10,650 DEBUG: [logreader.py (122)] Setting file > position to 828185L for /var/log/auth.log > 2005-09-23 14:27:18,961 DEBUG: [logreader.py (106)] /var/log/auth.log > has been modified > 2005-09-23 14:27:18,965 DEBUG: [logreader.py (134)] /var/log/auth.log > 2005-09-23 14:27:18,969 DEBUG: [logreader.py (122)] Setting file > position to 828279L for /var/log/auth.log > > Is this similar to the bug that's currently open about spurious > log-rotation? No, I don't think it is the same bug. The message "Setting file position to ####L for /var/log/auth.log" should appear only when "/var/log/auth.log" is modified. You can do a "tail -f /var/log/fail2ban.log" and try to log from another computer and look if Fail2ban detects a modification in "auth.log". > Or have I just misconfigured something. Could you post an example of a login failure available in "auth.log" please? Could you post your "/etc/fail2ban.conf" file too? I won't be online for the next 2 weeks. Sorry :( Maybe Yaroslav could help you. Regards, Cyril Jaquier |
From: Peter C. N. <spa...@le...> - 2005-09-23 19:35:35
|
has anyone here tried using fail2ban to deny smtp connections with the format that courier-smtpd uses? As far as I can tell from a reading of the source code it should work, but I'm having issues. I've posted my config onthe fail2ban sourceforge bug tracker. Any help appreciated. I've got a billion automated bots trying to probe users for a friend's domain I'm hosting. Thanks, -Peter -- The 5 year plan: In five years we'll make up another plan. Or just re-use this one. |
From: Alex P. <al...@er...> - 2005-09-23 13:30:16
|
Hi I've installed fail2ban on debian unstable (fail2ban 0.5.3-1), and i'm having a problem getting fail2ban to ban anything, even when I deliberately flood the log from a test host. I've enabled debug and it gives me: 2005-09-23 14:19:55,355 DEBUG: [logreader.py (134)] /var/log/auth.log 2005-09-23 14:19:55,357 DEBUG: [logreader.py (122)] Setting file position to 828016L for /var/log/auth.log 2005-09-23 14:22:19,558 DEBUG: [logreader.py (106)] /var/log/auth.log has been modified 2005-09-23 14:22:19,591 DEBUG: [logreader.py (134)] /var/log/auth.log 2005-09-23 14:22:19,662 DEBUG: [logreader.py (122)] Setting file position to 828091L for /var/log/auth.log 2005-09-23 14:25:10,233 DEBUG: [logreader.py (106)] /var/log/auth.log has been modified 2005-09-23 14:25:10,647 DEBUG: [logreader.py (134)] /var/log/auth.log 2005-09-23 14:25:10,650 DEBUG: [logreader.py (122)] Setting file position to 828185L for /var/log/auth.log 2005-09-23 14:27:18,961 DEBUG: [logreader.py (106)] /var/log/auth.log has been modified 2005-09-23 14:27:18,965 DEBUG: [logreader.py (134)] /var/log/auth.log 2005-09-23 14:27:18,969 DEBUG: [logreader.py (122)] Setting file position to 828279L for /var/log/auth.log Is this similar to the bug that's currently open about spurious log-rotation? Or have I just misconfigured something. Regards Alex |