From: mhoellein Date: Tue, 24 Sep 2019 10:36:21 +0000 (+0200) Subject: saving uncommitted changes in /etc prior to apt run X-Git-Url: https://git.hoellein.online/?a=commitdiff_plain;h=aaa56ac6cdccf9b56957d29fa20463e793e7e7f7;p=homeserver saving uncommitted changes in /etc prior to apt run --- diff --git a/.etckeeper b/.etckeeper index 342c9e61..04c31e34 100755 --- a/.etckeeper +++ b/.etckeeper @@ -2369,174 +2369,6 @@ maybe chmod 0755 'etckeeper/update-ignore.d/01update-ignore' maybe chmod 0644 'etckeeper/update-ignore.d/README' maybe chmod 0755 'etckeeper/vcs.d' maybe chmod 0755 'etckeeper/vcs.d/50vcs-cmd' -maybe chmod 0755 'fail2ban' -maybe chmod 0755 'fail2ban/action.d' -maybe chmod 0644 'fail2ban/action.d/abuseipdb.conf' -maybe chmod 0664 'fail2ban/action.d/apf.conf' -maybe chmod 0664 'fail2ban/action.d/badips.conf' -maybe chmod 0664 'fail2ban/action.d/badips.py' -maybe chmod 0664 'fail2ban/action.d/blocklist_de.conf' -maybe chmod 0664 'fail2ban/action.d/bsd-ipfw.conf' -maybe chmod 0664 'fail2ban/action.d/cloudflare.conf' -maybe chmod 0664 'fail2ban/action.d/complain.conf' -maybe chmod 0664 'fail2ban/action.d/dshield.conf' -maybe chmod 0664 'fail2ban/action.d/dummy.conf' -maybe chmod 0664 'fail2ban/action.d/firewallcmd-allports.conf' -maybe chmod 0644 'fail2ban/action.d/firewallcmd-common.conf' -maybe chmod 0664 'fail2ban/action.d/firewallcmd-ipset.conf' -maybe chmod 0664 'fail2ban/action.d/firewallcmd-multiport.conf' -maybe chmod 0664 'fail2ban/action.d/firewallcmd-new.conf' -maybe chmod 0644 'fail2ban/action.d/firewallcmd-rich-logging.conf' -maybe chmod 0644 'fail2ban/action.d/firewallcmd-rich-rules.conf' -maybe chmod 0644 'fail2ban/action.d/helpers-common.conf' -maybe chmod 0664 'fail2ban/action.d/hostsdeny.conf' -maybe chmod 0664 'fail2ban/action.d/ipfilter.conf' -maybe chmod 0664 'fail2ban/action.d/ipfw.conf' -maybe chmod 0664 'fail2ban/action.d/iptables-allports.conf' -maybe chmod 0664 'fail2ban/action.d/iptables-common.conf' -maybe chmod 0664 'fail2ban/action.d/iptables-ipset-proto4.conf' -maybe chmod 0664 'fail2ban/action.d/iptables-ipset-proto6-allports.conf' -maybe chmod 0664 'fail2ban/action.d/iptables-ipset-proto6.conf' -maybe chmod 0664 'fail2ban/action.d/iptables-multiport-log.conf' -maybe chmod 0664 'fail2ban/action.d/iptables-multiport.conf' -maybe chmod 0664 'fail2ban/action.d/iptables-new.conf' -maybe chmod 0664 'fail2ban/action.d/iptables-xt_recent-echo.conf' -maybe chmod 0664 'fail2ban/action.d/iptables.conf' -maybe chmod 0664 'fail2ban/action.d/mail-buffered.conf' -maybe chmod 0664 'fail2ban/action.d/mail-whois-common.conf' -maybe chmod 0664 'fail2ban/action.d/mail-whois-lines.conf' -maybe chmod 0664 'fail2ban/action.d/mail-whois.conf' -maybe chmod 0664 'fail2ban/action.d/mail.conf' -maybe chmod 0664 'fail2ban/action.d/mynetwatchman.conf' -maybe chmod 0644 'fail2ban/action.d/netscaler.conf' -maybe chmod 0664 'fail2ban/action.d/nftables-allports.conf' -maybe chmod 0664 'fail2ban/action.d/nftables-common.conf' -maybe chmod 0664 'fail2ban/action.d/nftables-multiport.conf' -maybe chmod 0644 'fail2ban/action.d/nginx-block-map.conf' -maybe chmod 0644 'fail2ban/action.d/npf.conf' -maybe chmod 0664 'fail2ban/action.d/nsupdate.conf' -maybe chmod 0664 'fail2ban/action.d/osx-afctl.conf' -maybe chmod 0664 'fail2ban/action.d/osx-ipfw.conf' -maybe chmod 0664 'fail2ban/action.d/pf.conf' -maybe chmod 0664 'fail2ban/action.d/route.conf' -maybe chmod 0664 'fail2ban/action.d/sendmail-buffered.conf' -maybe chmod 0664 'fail2ban/action.d/sendmail-common.conf' -maybe chmod 0664 'fail2ban/action.d/sendmail-geoip-lines.conf' -maybe chmod 0664 'fail2ban/action.d/sendmail-whois-ipjailmatches.conf' -maybe chmod 0664 'fail2ban/action.d/sendmail-whois-ipmatches.conf' -maybe chmod 0664 'fail2ban/action.d/sendmail-whois-lines.conf' -maybe chmod 0664 'fail2ban/action.d/sendmail-whois-matches.conf' -maybe chmod 0664 'fail2ban/action.d/sendmail-whois.conf' -maybe chmod 0664 'fail2ban/action.d/sendmail.conf' -maybe chmod 0664 'fail2ban/action.d/shorewall-ipset-proto6.conf' -maybe chmod 0664 'fail2ban/action.d/shorewall.conf' -maybe chmod 0664 'fail2ban/action.d/smtp.py' -maybe chmod 0664 'fail2ban/action.d/symbiosis-blacklist-allports.conf' -maybe chmod 0664 'fail2ban/action.d/ufw.conf' -maybe chmod 0664 'fail2ban/action.d/xarf-login-attack.conf' -maybe chmod 0664 'fail2ban/fail2ban.conf' -maybe chmod 0755 'fail2ban/filter.d' -maybe chmod 0664 'fail2ban/filter.d/3proxy.conf' -maybe chmod 0664 'fail2ban/filter.d/apache-auth.conf' -maybe chmod 0664 'fail2ban/filter.d/apache-badbots.conf' -maybe chmod 0664 'fail2ban/filter.d/apache-botsearch.conf' -maybe chmod 0664 'fail2ban/filter.d/apache-common.conf' -maybe chmod 0664 'fail2ban/filter.d/apache-fakegooglebot.conf' -maybe chmod 0664 'fail2ban/filter.d/apache-modsecurity.conf' -maybe chmod 0664 'fail2ban/filter.d/apache-nohome.conf' -maybe chmod 0664 'fail2ban/filter.d/apache-noscript.conf' -maybe chmod 0664 'fail2ban/filter.d/apache-overflows.conf' -maybe chmod 0664 'fail2ban/filter.d/apache-pass.conf' -maybe chmod 0664 'fail2ban/filter.d/apache-shellshock.conf' -maybe chmod 0664 'fail2ban/filter.d/assp.conf' -maybe chmod 0664 'fail2ban/filter.d/asterisk.conf' -maybe chmod 0664 'fail2ban/filter.d/botsearch-common.conf' -maybe chmod 0664 'fail2ban/filter.d/common.conf' -maybe chmod 0664 'fail2ban/filter.d/counter-strike.conf' -maybe chmod 0664 'fail2ban/filter.d/courier-auth.conf' -maybe chmod 0664 'fail2ban/filter.d/courier-smtp.conf' -maybe chmod 0664 'fail2ban/filter.d/cyrus-imap.conf' -maybe chmod 0664 'fail2ban/filter.d/directadmin.conf' -maybe chmod 0644 'fail2ban/filter.d/domino-smtp.conf' -maybe chmod 0664 'fail2ban/filter.d/dovecot.conf' -maybe chmod 0664 'fail2ban/filter.d/dropbear.conf' -maybe chmod 0664 'fail2ban/filter.d/drupal-auth.conf' -maybe chmod 0664 'fail2ban/filter.d/ejabberd-auth.conf' -maybe chmod 0664 'fail2ban/filter.d/exim-common.conf' -maybe chmod 0664 'fail2ban/filter.d/exim-spam.conf' -maybe chmod 0664 'fail2ban/filter.d/exim.conf' -maybe chmod 0664 'fail2ban/filter.d/freeswitch.conf' -maybe chmod 0664 'fail2ban/filter.d/froxlor-auth.conf' -maybe chmod 0664 'fail2ban/filter.d/groupoffice.conf' -maybe chmod 0664 'fail2ban/filter.d/gssftpd.conf' -maybe chmod 0664 'fail2ban/filter.d/guacamole.conf' -maybe chmod 0664 'fail2ban/filter.d/haproxy-http-auth.conf' -maybe chmod 0664 'fail2ban/filter.d/horde.conf' -maybe chmod 0755 'fail2ban/filter.d/ignorecommands' -maybe chmod 0775 'fail2ban/filter.d/ignorecommands/apache-fakegooglebot' -maybe chmod 0664 'fail2ban/filter.d/kerio.conf' -maybe chmod 0664 'fail2ban/filter.d/lighttpd-auth.conf' -maybe chmod 0644 'fail2ban/filter.d/mongodb-auth.conf' -maybe chmod 0664 'fail2ban/filter.d/monit.conf' -maybe chmod 0664 'fail2ban/filter.d/murmur.conf' -maybe chmod 0664 'fail2ban/filter.d/mysqld-auth.conf' -maybe chmod 0664 'fail2ban/filter.d/nagios.conf' -maybe chmod 0664 'fail2ban/filter.d/named-refused.conf' -maybe chmod 0664 'fail2ban/filter.d/nginx-botsearch.conf' -maybe chmod 0664 'fail2ban/filter.d/nginx-http-auth.conf' -maybe chmod 0664 'fail2ban/filter.d/nginx-limit-req.conf' -maybe chmod 0664 'fail2ban/filter.d/nsd.conf' -maybe chmod 0664 'fail2ban/filter.d/openhab.conf' -maybe chmod 0644 'fail2ban/filter.d/openvpn.conf' -maybe chmod 0664 'fail2ban/filter.d/openwebmail.conf' -maybe chmod 0664 'fail2ban/filter.d/oracleims.conf' -maybe chmod 0664 'fail2ban/filter.d/pam-generic.conf' -maybe chmod 0664 'fail2ban/filter.d/perdition.conf' -maybe chmod 0664 'fail2ban/filter.d/php-url-fopen.conf' -maybe chmod 0644 'fail2ban/filter.d/phpmyadmin-syslog.conf' -maybe chmod 0664 'fail2ban/filter.d/portsentry.conf' -maybe chmod 0664 'fail2ban/filter.d/postfix-rbl.conf' -maybe chmod 0664 'fail2ban/filter.d/postfix-sasl.conf' -maybe chmod 0664 'fail2ban/filter.d/postfix.conf' -maybe chmod 0664 'fail2ban/filter.d/proftpd.conf' -maybe chmod 0664 'fail2ban/filter.d/pure-ftpd.conf' -maybe chmod 0664 'fail2ban/filter.d/qmail.conf' -maybe chmod 0664 'fail2ban/filter.d/recidive.conf' -maybe chmod 0664 'fail2ban/filter.d/roundcube-auth.conf' -maybe chmod 0664 'fail2ban/filter.d/screensharingd.conf' -maybe chmod 0664 'fail2ban/filter.d/selinux-common.conf' -maybe chmod 0664 'fail2ban/filter.d/selinux-ssh.conf' -maybe chmod 0664 'fail2ban/filter.d/sendmail-auth.conf' -maybe chmod 0664 'fail2ban/filter.d/sendmail-reject.conf' -maybe chmod 0664 'fail2ban/filter.d/sieve.conf' -maybe chmod 0644 'fail2ban/filter.d/slapd.conf' -maybe chmod 0664 'fail2ban/filter.d/sogo-auth.conf' -maybe chmod 0664 'fail2ban/filter.d/solid-pop3d.conf' -maybe chmod 0664 'fail2ban/filter.d/squid.conf' -maybe chmod 0664 'fail2ban/filter.d/squirrelmail.conf' -maybe chmod 0664 'fail2ban/filter.d/sshd-ddos.conf' -maybe chmod 0664 'fail2ban/filter.d/sshd.conf' -maybe chmod 0664 'fail2ban/filter.d/stunnel.conf' -maybe chmod 0664 'fail2ban/filter.d/suhosin.conf' -maybe chmod 0664 'fail2ban/filter.d/tine20.conf' -maybe chmod 0664 'fail2ban/filter.d/uwimap-auth.conf' -maybe chmod 0664 'fail2ban/filter.d/vsftpd.conf' -maybe chmod 0664 'fail2ban/filter.d/webmin-auth.conf' -maybe chmod 0664 'fail2ban/filter.d/wuftpd.conf' -maybe chmod 0664 'fail2ban/filter.d/xinetd-fail.conf' -maybe chmod 0644 'fail2ban/filter.d/zoneminder.conf' -maybe chmod 0664 'fail2ban/jail.conf' -maybe chmod 0755 'fail2ban/jail.d' -maybe chmod 0644 'fail2ban/jail.d/defaults-debian.conf' -maybe chmod 0644 'fail2ban/jail.local' -maybe chmod 0644 'fail2ban/jail.local.save' -maybe chmod 0644 'fail2ban/paths-arch.conf' -maybe chmod 0664 'fail2ban/paths-common.conf' -maybe chmod 0664 'fail2ban/paths-debian.conf' -maybe chmod 0664 'fail2ban/paths-fedora.conf' -maybe chmod 0664 'fail2ban/paths-freebsd.conf' -maybe chmod 0664 'fail2ban/paths-opensuse.conf' -maybe chmod 0664 'fail2ban/paths-osx.conf' maybe chown 'fetchmail' 'fetchmailrc' maybe chmod 0600 'fetchmailrc' maybe chmod 0644 'ffserver.conf' diff --git a/fail2ban/action.d/abuseipdb.conf b/fail2ban/action.d/abuseipdb.conf deleted file mode 100644 index 15e41fbe..00000000 --- a/fail2ban/action.d/abuseipdb.conf +++ /dev/null @@ -1,105 +0,0 @@ -# Fail2ban configuration file -# -# Action to report IP address to abuseipdb.com -# You must sign up to obtain an API key from abuseipdb.com. -# -# NOTE: These reports may include sensitive Info. -# If you want cleaner reports that ensure no user data see the helper script at the below website. -# -# IMPORTANT: -# -# Reporting an IP of abuse is a serious complaint. Make sure that it is -# serious. Fail2ban developers and network owners recommend you only use this -# action for: -# * The recidive where the IP has been banned multiple times -# * Where maxretry has been set quite high, beyond the normal user typing -# password incorrectly. -# * For filters that have a low likelihood of receiving human errors -# -# This action relies on a api_key being added to the above action conf, -# and the appropriate categories set. -# -# Example, for ssh bruteforce (in section [sshd] of `jail.local`): -# action = %(known/action)s -# %(action_abuseipdb)s[abuseipdb_apikey="my-api-key", abuseipdb_category="18,22"] -# -# See below for catagories. -# -# Original Ref: https://wiki.shaunc.com/wikka.php?wakka=ReportingToAbuseIPDBWithFail2Ban -# Added to fail2ban by Andrew James Collett (ajcollett) - -## abuseIPDB Catagories, `the abuseipdb_category` MUST be set in the jail.conf action call. -# Example, for ssh bruteforce: action = %(action_abuseipdb)s[abuseipdb_category="18,22"] -# ID Title Description -# 3 Fraud Orders -# 4 DDoS Attack -# 9 Open Proxy -# 10 Web Spam -# 11 Email Spam -# 14 Port Scan -# 18 Brute-Force -# 19 Bad Web Bot -# 20 Exploited Host -# 21 Web App Attack -# 22 SSH Secure Shell (SSH) abuse. Use this category in combination with more specific categories. -# 23 IoT Targeted -# See https://abuseipdb.com/categories for more descriptions - -[Definition] - -# Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. -# Values: CMD -# -actionstart = - -# Option: actionstop -# Notes.: command executed once at the end of Fail2Ban -# Values: CMD -# -actionstop = - -# Option: actioncheck -# Notes.: command executed once before each actionban command -# Values: CMD -# -actioncheck = - -# Option: actionban -# Notes.: command executed when banning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# -# ** IMPORTANT! ** -# -# By default, this posts directly to AbuseIPDB's API, unfortunately -# this results in a lot of backslashes/escapes appearing in the -# reports. This also may include info like your hostname. -# If you have your own web server with PHP available, you can -# use my (Shaun's) helper PHP script by commenting out the first #actionban -# line below, uncommenting the second one, and pointing the URL at -# wherever you install the helper script. For the PHP helper script, see -# -# -# --ciphers ecdhe_ecdsa_aes_256_sha is used to workaround a -# "NSS error -12286" from curl as it attempts to connect using -# SSLv3. See https://www.centos.org/forums/viewtopic.php?t=52732 -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionban = curl --fail --ciphers ecdhe_ecdsa_aes_256_sha --data 'key=' --data-urlencode 'comment=' --data 'ip=' --data 'category=' "https://www.abuseipdb.com/report/json" - -# Option: actionunban -# Notes.: command executed when unbanning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionunban = - -[Init] -# Option: abuseipdb_apikey -# Notes Your API key from abuseipdb.com -# Values: STRING Default: None -# Register for abuseipdb [https://www.abuseipdb.com], get api key and set below. -# You will need to set the catagory in the action call. -abuseipdb_apikey = diff --git a/fail2ban/action.d/apf.conf b/fail2ban/action.d/apf.conf deleted file mode 100644 index 5c4a2614..00000000 --- a/fail2ban/action.d/apf.conf +++ /dev/null @@ -1,25 +0,0 @@ -# Fail2Ban configuration file -# https://www.rfxn.com/projects/advanced-policy-firewall/ -# -# Note: APF doesn't play nicely with other actions. It has been observed to -# remove bans created by other iptables based actions. If you are going to use -# this action, use it for all of your jails. -# -# DON'T MIX APF and other IPTABLES based actions -[Definition] - -actionstart = -actionstop = -actioncheck = -actionban = apf --deny "banned by Fail2Ban " -actionunban = apf --remove - -[Init] - -# Name used in APF configuration -# -name = default - -# DEV NOTES: -# -# Author: Mark McKinstry diff --git a/fail2ban/action.d/badips.conf b/fail2ban/action.d/badips.conf deleted file mode 100644 index 70b46546..00000000 --- a/fail2ban/action.d/badips.conf +++ /dev/null @@ -1,19 +0,0 @@ -# Fail2ban reporting to badips.com -# -# Note: This reports and IP only and does not actually ban traffic. Use -# another action in the same jail if you want bans to occur. -# -# Set the category to the appropriate value before use. -# -# To get see register and optional key to get personalised graphs see: -# http://www.badips.com/blog/personalized-statistics-track-the-attackers-of-all-your-servers-with-one-key - -[Definition] - -actionban = curl --fail --user-agent "" http://www.badips.com/add// - -[Init] - -# Option: category -# Notes.: Values are from the list here: http://www.badips.com/get/categories -category = diff --git a/fail2ban/action.d/badips.py b/fail2ban/action.d/badips.py deleted file mode 100644 index 473fbf33..00000000 --- a/fail2ban/action.d/badips.py +++ /dev/null @@ -1,387 +0,0 @@ -# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*- -# vi: set ft=python sts=4 ts=4 sw=4 noet : - -# This file is part of Fail2Ban. -# -# Fail2Ban is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. -# -# Fail2Ban is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with Fail2Ban; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - -import sys -if sys.version_info < (2, 7): - raise ImportError("badips.py action requires Python >= 2.7") -import json -import threading -import logging -if sys.version_info >= (3, ): - from urllib.request import Request, urlopen - from urllib.parse import urlencode - from urllib.error import HTTPError -else: - from urllib2 import Request, urlopen, HTTPError - from urllib import urlencode - -from fail2ban.server.actions import ActionBase - - -class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable - """Fail2Ban action which reports bans to badips.com, and also - blacklist bad IPs listed on badips.com by using another action's - ban method. - - Parameters - ---------- - jail : Jail - The jail which the action belongs to. - name : str - Name assigned to the action. - category : str - Valid badips.com category for reporting failures. - score : int, optional - Minimum score for bad IPs. Default 3. - age : str, optional - Age of last report for bad IPs, per badips.com syntax. - Default "24h" (24 hours) - key : str, optional - Key issued by badips.com to report bans, for later retrieval - of personalised content. - banaction : str, optional - Name of banaction to use for blacklisting bad IPs. If `None`, - no blacklist of IPs will take place. - Default `None`. - bancategory : str, optional - Name of category to use for blacklisting, which can differ - from category used for reporting. e.g. may want to report - "postfix", but want to use whole "mail" category for blacklist. - Default `category`. - bankey : str, optional - Key issued by badips.com to blacklist IPs reported with the - associated key. - updateperiod : int, optional - Time in seconds between updating bad IPs blacklist. - Default 900 (15 minutes) - agent : str, optional - User agent transmitted to server. - Default `Fail2Ban/ver.` - - Raises - ------ - ValueError - If invalid `category`, `score`, `banaction` or `updateperiod`. - """ - - TIMEOUT = 10 - _badips = "http://www.badips.com" - def _Request(self, url, **argv): - return Request(url, headers={'User-Agent': self.agent}, **argv) - - def __init__(self, jail, name, category, score=3, age="24h", key=None, - banaction=None, bancategory=None, bankey=None, updateperiod=900, agent="Fail2Ban", - timeout=TIMEOUT): - super(BadIPsAction, self).__init__(jail, name) - - self.timeout = timeout - self.agent = agent - self.category = category - self.score = score - self.age = age - self.key = key - self.banaction = banaction - self.bancategory = bancategory or category - self.bankey = bankey - self.updateperiod = updateperiod - - self._bannedips = set() - # Used later for threading.Timer for updating badips - self._timer = None - - @staticmethod - def isAvailable(timeout=1): - try: - response = urlopen(Request("/".join([BadIPsAction._badips]), - headers={'User-Agent': "Fail2Ban"}), timeout=timeout) - return True, '' - except Exception as e: # pragma: no cover - return False, e - - - def getCategories(self, incParents=False): - """Get badips.com categories. - - Returns - ------- - set - Set of categories. - - Raises - ------ - HTTPError - Any issues with badips.com request. - ValueError - If badips.com response didn't contain necessary information - """ - try: - response = urlopen( - self._Request("/".join([self._badips, "get", "categories"])), timeout=self.timeout) - except HTTPError as response: - messages = json.loads(response.read().decode('utf-8')) - self._logSys.error( - "Failed to fetch categories. badips.com response: '%s'", - messages['err']) - raise - else: - response_json = json.loads(response.read().decode('utf-8')) - if not 'categories' in response_json: - err = "badips.com response lacked categories specification. Response was: %s" \ - % (response_json,) - self._logSys.error(err) - raise ValueError(err) - categories = response_json['categories'] - categories_names = set( - value['Name'] for value in categories) - if incParents: - categories_names.update(set( - value['Parent'] for value in categories - if "Parent" in value)) - return categories_names - - def getList(self, category, score, age, key=None): - """Get badips.com list of bad IPs. - - Parameters - ---------- - category : str - Valid badips.com category. - score : int - Minimum score for bad IPs. - age : str - Age of last report for bad IPs, per badips.com syntax. - key : str, optional - Key issued by badips.com to fetch IPs reported with the - associated key. - - Returns - ------- - set - Set of bad IPs. - - Raises - ------ - HTTPError - Any issues with badips.com request. - """ - try: - url = "?".join([ - "/".join([self._badips, "get", "list", category, str(score)]), - urlencode({'age': age})]) - if key: - url = "&".join([url, urlencode({'key': key})]) - response = urlopen(self._Request(url), timeout=self.timeout) - except HTTPError as response: - messages = json.loads(response.read().decode('utf-8')) - self._logSys.error( - "Failed to fetch bad IP list. badips.com response: '%s'", - messages['err']) - raise - else: - return set(response.read().decode('utf-8').split()) - - @property - def category(self): - """badips.com category for reporting IPs. - """ - return self._category - - @category.setter - def category(self, category): - if category not in self.getCategories(): - self._logSys.error("Category name '%s' not valid. " - "see badips.com for list of valid categories", - category) - raise ValueError("Invalid category: %s" % category) - self._category = category - - @property - def bancategory(self): - """badips.com bancategory for fetching IPs. - """ - return self._bancategory - - @bancategory.setter - def bancategory(self, bancategory): - if bancategory not in self.getCategories(incParents=True): - self._logSys.error("Category name '%s' not valid. " - "see badips.com for list of valid categories", - bancategory) - raise ValueError("Invalid bancategory: %s" % bancategory) - self._bancategory = bancategory - - @property - def score(self): - """badips.com minimum score for fetching IPs. - """ - return self._score - - @score.setter - def score(self, score): - score = int(score) - if 0 <= score <= 5: - self._score = score - else: - raise ValueError("Score must be 0-5") - - @property - def banaction(self): - """Jail action to use for banning/unbanning. - """ - return self._banaction - - @banaction.setter - def banaction(self, banaction): - if banaction is not None and banaction not in self._jail.actions: - self._logSys.error("Action name '%s' not in jail '%s'", - banaction, self._jail.name) - raise ValueError("Invalid banaction") - self._banaction = banaction - - @property - def updateperiod(self): - """Period in seconds between banned bad IPs will be updated. - """ - return self._updateperiod - - @updateperiod.setter - def updateperiod(self, updateperiod): - updateperiod = int(updateperiod) - if updateperiod > 0: - self._updateperiod = updateperiod - else: - raise ValueError("Update period must be integer greater than 0") - - def _banIPs(self, ips): - for ip in ips: - try: - self._jail.actions[self.banaction].ban({ - 'ip': ip, - 'failures': 0, - 'matches': "", - 'ipmatches': "", - 'ipjailmatches': "", - }) - except Exception as e: - self._logSys.error( - "Error banning IP %s for jail '%s' with action '%s': %s", - ip, self._jail.name, self.banaction, e, - exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG) - else: - self._bannedips.add(ip) - self._logSys.info( - "Banned IP %s for jail '%s' with action '%s'", - ip, self._jail.name, self.banaction) - - def _unbanIPs(self, ips): - for ip in ips: - try: - self._jail.actions[self.banaction].unban({ - 'ip': ip, - 'failures': 0, - 'matches': "", - 'ipmatches': "", - 'ipjailmatches': "", - }) - except Exception as e: - self._logSys.info( - "Error unbanning IP %s for jail '%s' with action '%s': %s", - ip, self._jail.name, self.banaction, e, - exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG) - else: - self._logSys.info( - "Unbanned IP %s for jail '%s' with action '%s'", - ip, self._jail.name, self.banaction) - finally: - self._bannedips.remove(ip) - - def start(self): - """If `banaction` set, blacklists bad IPs. - """ - if self.banaction is not None: - self.update() - - def update(self): - """If `banaction` set, updates blacklisted IPs. - - Queries badips.com for list of bad IPs, removing IPs from the - blacklist if no longer present, and adds new bad IPs to the - blacklist. - """ - if self.banaction is not None: - if self._timer: - self._timer.cancel() - self._timer = None - - try: - ips = self.getList( - self.bancategory, self.score, self.age, self.bankey) - # Remove old IPs no longer listed - self._unbanIPs(self._bannedips - ips) - # Add new IPs which are now listed - self._banIPs(ips - self._bannedips) - - self._logSys.info( - "Updated IPs for jail '%s'. Update again in %i seconds", - self._jail.name, self.updateperiod) - finally: - self._timer = threading.Timer(self.updateperiod, self.update) - self._timer.start() - - def stop(self): - """If `banaction` set, clears blacklisted IPs. - """ - if self.banaction is not None: - if self._timer: - self._timer.cancel() - self._timer = None - self._unbanIPs(self._bannedips.copy()) - - def ban(self, aInfo): - """Reports banned IP to badips.com. - - Parameters - ---------- - aInfo : dict - Dictionary which includes information in relation to - the ban. - - Raises - ------ - HTTPError - Any issues with badips.com request. - """ - try: - url = "/".join([self._badips, "add", self.category, aInfo['ip']]) - if self.key: - url = "?".join([url, urlencode({'key': self.key})]) - response = urlopen(self._Request(url), timeout=self.timeout) - except HTTPError as response: - messages = json.loads(response.read().decode('utf-8')) - self._logSys.error( - "Response from badips.com report: '%s'", - messages['err']) - raise - else: - messages = json.loads(response.read().decode('utf-8')) - self._logSys.info( - "Response from badips.com report: '%s'", - messages['suc']) - -Action = BadIPsAction diff --git a/fail2ban/action.d/blocklist_de.conf b/fail2ban/action.d/blocklist_de.conf deleted file mode 100644 index 2f31d8b9..00000000 --- a/fail2ban/action.d/blocklist_de.conf +++ /dev/null @@ -1,86 +0,0 @@ -# Fail2Ban configuration file -# -# Author: Steven Hiscocks -# -# - -# Action to report IP address to blocklist.de -# Blocklist.de must be signed up to at www.blocklist.de -# Once registered, one or more servers can be added. -# This action requires the server 'email address' and the associated apikey. -# -# From blocklist.de: -# www.blocklist.de is a free and voluntary service provided by a -# Fraud/Abuse-specialist, whose servers are often attacked on SSH-, -# Mail-Login-, FTP-, Webserver- and other services. -# The mission is to report all attacks to the abuse departments of the -# infected PCs/servers to ensure that the responsible provider can inform -# the customer about the infection and disable them -# -# IMPORTANT: -# -# Reporting an IP of abuse is a serious complaint. Make sure that it is -# serious. Fail2ban developers and network owners recommend you only use this -# action for: -# * The recidive where the IP has been banned multiple times -# * Where maxretry has been set quite high, beyond the normal user typing -# password incorrectly. -# * For filters that have a low likelihood of receiving human errors -# - -[Definition] - -# Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. -# Values: CMD -# -actionstart = - -# Option: actionstop -# Notes.: command executed once at the end of Fail2Ban -# Values: CMD -# -actionstop = - -# Option: actioncheck -# Notes.: command executed once before each actionban command -# Values: CMD -# -actioncheck = - -# Option: actionban -# Notes.: command executed when banning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionban = curl --fail --data-urlencode 'server=' --data 'apikey=' --data 'service=' --data 'ip=' --data-urlencode 'logs=' --data 'format=text' --user-agent "" "https://www.blocklist.de/en/httpreports.html" - -# Option: actionunban -# Notes.: command executed when unbanning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionunban = - -[Init] - -# Option: email -# Notes server email address, as per blocklise.de account -# Values: STRING Default: None -# -#email = - -# Option: apikey -# Notes your user blocklist.de user account apikey -# Values: STRING Default: None -# -#apikey = - -# Option: service -# Notes service name you are reporting on, typically aligns with filter name -# see http://www.blocklist.de/en/httpreports.html for full list -# Values: STRING Default: None -# -#service = diff --git a/fail2ban/action.d/bsd-ipfw.conf b/fail2ban/action.d/bsd-ipfw.conf deleted file mode 100644 index cbd6a15d..00000000 --- a/fail2ban/action.d/bsd-ipfw.conf +++ /dev/null @@ -1,91 +0,0 @@ -# Fail2Ban configuration file -# -# Author: Nick Munger -# Modified by: Ken Menzel -# Daniel Black (start/stop) -# Fabian Wenk (many ideas as per fail2ban users list) -# -# Ensure firewall_enable="YES" in the top of /etc/rc.conf -# - -[Definition] - -# Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. -# Values: CMD -# -actionstart = ipfw show | fgrep -c -m 1 -s 'table()' > /dev/null 2>&1 || ( ipfw show | awk 'BEGIN { b = } { if ($1 < b) {} else if ($1 == b) { b = $1 + 1 } else { e = b } } END { if (e) exit e
else exit b }'; num=$?; ipfw -q add $num from table\(
\) to me ; echo $num > "" ) - - -# Option: actionstop -# Notes.: command executed once at the end of Fail2Ban -# Values: CMD -# -actionstop = [ ! -f ] || ( read num < ""
ipfw -q delete $num
rm "" ) - - -# Option: actioncheck -# Notes.: command executed once before each actionban command -# Values: CMD -# -actioncheck = - - -# Option: actionban -# Notes.: command executed when banning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -# requires an ipfw rule like "deny ip from table(1) to me" -actionban = e=`ipfw table
add 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || { echo "$e" 1>&2; exit $x; } - - -# Option: actionunban -# Notes.: command executed when unbanning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionunban = e=`ipfw table
delete 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || { echo "$e" 1>&2; exit $x; } - -[Init] -# Option: table -# Notes: The ipfw table to use. If a ipfw rule using this table already exists, -# this action will not create a ipfw rule to block it and the following -# options will have no effect. -# Values: NUM -table = 1 - -# Option: port -# Notes.: Specifies port to monitor. Blank indicate block all ports. -# Values: [ NUM | STRING ] -# -port = - -# Option: startstatefile -# Notes: A file to indicate that the table rule that was added. Ensure it is unique per table. -# Values: STRING -startstatefile = /var/run/fail2ban/ipfw-started-table_
- -# Option: block -# Notes: This is how much to block. -# Can be "ip", "tcp", "udp" or various other options. -# Values: STRING -block = ip - -# Option: blocktype -# Notes.: How to block the traffic. Use a action from man 5 ipfw -# Common values: deny, unreach port, reset -# ACTION defination at the top of man ipfw for allowed values. -# Values: STRING -# -blocktype = unreach port - -# Option: lowest_rule_num -# Notes: When fail2ban starts with action and there is no rule for the given table yet -# then fail2ban will start looking for an empty slot starting with this rule number. -# Values: NUM -lowest_rule_num = 111 - - diff --git a/fail2ban/action.d/cloudflare.conf b/fail2ban/action.d/cloudflare.conf deleted file mode 100644 index 89df5b9e..00000000 --- a/fail2ban/action.d/cloudflare.conf +++ /dev/null @@ -1,78 +0,0 @@ -# -# Author: Mike Rushton -# -# IMPORTANT -# -# Please set jail.local's permission to 640 because it contains your CF API key. -# -# This action depends on curl. -# Referenced from http://www.normyee.net/blog/2012/02/02/adding-cloudflare-support-to-fail2ban by NORM YEE -# -# To get your CloudFlare API Key: https://www.cloudflare.com/a/account/my-account -# -# CloudFlare API error codes: https://www.cloudflare.com/docs/host-api.html#s4.2 - -[Definition] - -# Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. -# Values: CMD -# -actionstart = - -# Option: actionstop -# Notes.: command executed once at the end of Fail2Ban -# Values: CMD -# -actionstop = - -# Option: actioncheck -# Notes.: command executed once before each actionban command -# Values: CMD -# -actioncheck = - -# Option: actionban -# Notes.: command executed when banning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: IP address -# number of failures -#