rpm/fail2ban
SHA256
1
0
Fork 0
forked from pool/fail2ban
Code Pull Requests Activity

Accepting request 215524 from security

Browse Source 
Security note: The update to version 0.8.11 has fixed two additional security
issues: A remote unauthenticated attacker may cause arbitrary IP addresses to
be blocked by Fail2ban causing legitimate users to be blocked from accessing
services protected by Fail2ban. CVE-2013-7177 (cyrus-imap) and CVE-2013-7176
(postfix) (forwarded request 215523 from weberho)

OBS-URL: https://build.opensuse.org/request/show/215524
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/fail2ban?expand=0&rev=31
This commit is contained in:
Stephan Kulow 2014-01-30 13:54:36 +00:00 committed by Git OBS Bridge
commit b17e75956e
6 changed files with 185 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fail2ban-0.8.11.tar.bz2
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:d8fa2bd1b106b65ad2bffd41c191f80a97bc3e9456b192d1714c4ee023af5e32
size 156411

3
fail2ban-0.8.12.tar.bz2 Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:2cdd7cbbf8b770715ce0068aec9dd8857388cd4d690fd5211907d7f2f3bdcde4
size 169644

170
fail2ban.changes
View File

@ -1,3 +1,94 @@
-------------------------------------------------------------------
Wed Jan 29 13:48:38 UTC 2014 - jweberhofer@weberhofer.at
Security note: The update to version 0.8.11 has fixed two additional security
issues: A remote unauthenticated attacker may cause arbitrary IP addresses to
be blocked by Fail2ban causing legitimate users to be blocked from accessing
services protected by Fail2ban. CVE-2013-7177 (cyrus-imap) and CVE-2013-7176
(postfix)
-------------------------------------------------------------------
Thu Jan 23 21:35:27 UTC 2014 - jweberhofer@weberhofer.at
- action firewallcmd-ipset had non-working actioncheck. Removed. rh#1046816
- lsof was required for fail2ban's SysVinit scripts only. Not longer used for
newer versions of openSUSE
-------------------------------------------------------------------
Thu Jan 23 08:40:40 UTC 2014 - jweberhofer@weberhofer.at
- Reviewed and fixed github references in the changelog
-------------------------------------------------------------------
Wed Jan 22 09:27:43 UTC 2014 - jweberhofer@weberhofer.at
- Use new flushlogs syntax after logrotate
-------------------------------------------------------------------
Wed Jan 22 08:50:05 UTC 2014 - jweberhofer@weberhofer.at
- Update to version 0.8.12
* Log rotation can now occur with the command "flushlogs" rather than
reloading fail2ban or keeping the logtarget settings consistent in
jail.conf/local and /etc/logrotate.d/fail2ban. (dep#697333, rh#891798).
* Added ignorecommand option for allowing dynamic determination as to ignore
and IP or not.
* Remove indentation of name and loglevel while logging to SYSLOG to resolve
syslog(-ng) parsing problems. (dep#730202). Log lines now also
report "[PID]" after the name portion too.
* Epoch dates can now be enclosed within []
* New actions: badips, firewallcmd-ipset, ufw, blocklist_de
* New filters: solid-pop3d, nsd, openwebmail, horde, freeswitch, squid,
ejabberd, openwebmail, groupoffice
* Filter improvements:
- apache-noscript now includes php cgi scripts
- exim-spam filter to match spamassassin log entry for option SAdevnull.
- Added to sshd filter expression for
"Received disconnect from : 3: Auth fail"
- Improved ACL-handling for Asterisk
- Added improper command pipelining to postfix filter.
* General fixes:
- Added lots of jail.conf entries for missing filters that creaped in
over the last year.
- synchat changed to use push method which verifies whether all data was
send. This ensures that all data is sent before closing the connection.
- Fixed python 2.4 compatibility (as sub-second in date patterns weren't
2.4 compatible)
- Complain/email actions fixed to only include relevant IPs to reporting
* Filter fixes:
- Added HTTP referrer bit of the apache access log to the apache filters.
- Apache 2.4 perfork regexes fixed
- Kernel syslog expression can have leading spaces
- allow for ",milliseconds" in the custom date format of proftpd.log
- recidive jail to block all protocols
- smtps not a IANA standard so may be missing from /etc/services. Due to
(still) common use 465 has been used as the explicit port number
- Filter dovecot reordered session and TLS items in regex with wider scope
for session characters
* Ugly Fixes (Potentially incompatible changes):
- Unfortunately at the end of last release when the action
firewall-cmd-direct-new was added it was too long and had a broken action
check. The action was renamed to firewallcmd-new to fit within jail name
name length. (gh#fail2ban/fail2ban#395).
- Last release added mysqld-syslog-iptables as a jail configuration. This
jailname was too long and it has been renamed to mysqld-syslog.
- Fixed formating of github references in changelog
- reformatted spec-file
-------------------------------------------------------------------
Thu Nov 14 05:14:35 UTC 2013 - jweberhofer@weberhofer.at
@ -32,17 +123,19 @@ Thu Jun 13 08:58:53 UTC 2013 - jweberhofer@weberhofer.at
- Fixes
* [6ccd5781] filter.d/apache-{auth,nohome,noscript,overflows} - anchor
failregex at the beginning (and where applicable at the end).
Addresses a possible DoS. Closes gh-248, bnc#824710
Addresses a possible DoS. Closes gh#fail2ban/fail2ban#248, bnc#824710
* action.d/{route,shorewall}.conf - blocktype must be defined
within [Init]. Closes gh-232
within [Init]. Closes gh#fail2ban/fail2ban#232
- Enhancements
* jail.conf -- assure all jails have actions and remove unused
ports specifications
* config/filter.d/roundcube-auth.conf -- support roundcube 0.9+
* files/suse-initd -- update to the copy from stock SUSE
* Updates to asterisk filter. Closes gh-227/gh-230.
* Updates to asterisk to include AUTH_UNKNOWN_DOMAIN. Closes gh-244.
* Updates to asterisk filter. Closes gh#fail2ban/fail2ban#227,
gh#fail2ban/fail2ban#230.
* Updates to asterisk to include AUTH_UNKNOWN_DOMAIN. Closes
gh#fail2ban/fail2ban#244.
------------------------------------------------------------------
Tue May 28 06:46:54 UTC 2013 - jweberhofer@weberhofer.at
@ -60,59 +153,61 @@ Tue May 14 10:06:35 UTC 2013 - jweberhofer@weberhofer.at
- Fixes: Yaroslav Halchenko
* [6f4dad46] python-2.4 is the minimal version.
* [1eb23cf8] do not rely on scripts being under /usr -- might differ e.g.
on Fedora. Closes gh-112. Thanks to Camusensei for the bug report.
on Fedora. Closes gh#fail2ban/fail2ban#112. Thanks to Camusensei for the
bug report.
* [bf4d4af1] Changes for atomic writes. Thanks to Steven Hiscocks for
insight. Closes gh-103.
insight. Closes gh#fail2ban/fail2ban#103.
* [ab044b75] delay check for the existence of config directory until read.
* [3b4084d4] fixing up for handling of TAI64N timestamps.
* [154aa38e] do not shutdown logging until all jails stop.
* [f2156604] pyinotify -- monitor IN_MOVED_TO events. Closes gh-184.
Thanks to Jon Foster for report and troubleshooting.
Orion Poplawski
* [f2156604] pyinotify -- monitor IN_MOVED_TO events. Closes
gh#fail2ban/fail2ban#184. Thanks to Jon Foster for report and
troubleshooting. Orion Poplawski
* [e4aedfdc00] pyinotify - use bitwise op on masks and do not try tracking
newly created directories.
Nicolas Collignon
* [39667ff6] Avoid leaking file descriptors. Closes gh-167.
* [39667ff6] Avoid leaking file descriptors. Closes gh#fail2ban/fail2ban#167.
Sergey Brester
* [b6bb2f88 and d17b4153] invalid date recognition, irregular because of
sorting template list.
Steven Hiscocks
* [7a442f07] When changing log target with python2.{4,5} handle KeyError.
Closes gh-147, gh-148.
* [b6a68f51] Fix delaction on server side. Closes gh-124.
Closes gh#fail2ban/fail2ban#147, gh#fail2ban/fail2ban#148.
* [b6a68f51] Fix delaction on server side. Closes gh#fail2ban/fail2ban#124.
Daniel Black
* [f0610c01] Allow more that a one word command when changing and Action via
the fail2ban-client. Closes gh-134.
the fail2ban-client. Closes gh#fail2ban/fail2ban#134.
* [945ad3d9] Fix dates on email actions to work in different locals. Closes
gh-70. Thanks to iGeorgeX for the idea.
gh#fail2ban/fail2ban#70. Thanks to iGeorgeX for the idea.
blotus
* [96eb8986] ' and " should also be escaped in action tags Closes gh-109
* [96eb8986] ' and " should also be escaped in action tags Closes
gh#fail2ban/fail2ban#109
Christoph Theis, Nick Hilliard, Daniel Black
* [b3bd877d,cde71080] Make syslog -v and syslog -vv formats work on FreeBSD
- New features:
Yaroslav Halchenko
* [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile}
to provide additional flexibility to system adminstrators. Thanks to
beilber for the idea. Closes gh-114.
beilber for the idea. Closes gh#fail2ban/fail2ban#114.
* [3ce53e87] Add exim filter.
Erwan Ben Souiden
* [d7d5228] add nagios integration documentation and script to ensure
fail2ban is running. Closes gh-166.
fail2ban is running. Closes gh#fail2ban/fail2ban#166.
Artur Penttinen
* [29d0df5] Add mysqld filter. Closes gh-152.
* [29d0df5] Add mysqld filter. Closes gh#fail2ban/fail2ban#152.
ArndRaphael Brandes
* [bba3fd8] Add Sogo filter. Closes gh-117.
* [bba3fd8] Add Sogo filter. Closes gh#fail2ban/fail2ban#117.
Michael Gebetsriother
* [f9b78ba] Add action route to block at routing level.
Teodor Micu & Yaroslav Halchenko
* [5f2d383] Add roundcube auth filter. Closes Debian bug #699442.
Daniel Black
* [be06b1b] Add action for iptables-ipsets. Closes gh-102.
* [be06b1b] Add action for iptables-ipsets. Closes gh#fail2ban/fail2ban#102.
Nick Munger, Ken Menzel, Daniel Black, Christoph Theis & Fabian Wenk
* [b6d0e8a] Add and enhance the bsd-ipfw action from
FreeBSD ports.
Soulard Morgan
* [f336d9f] Add filter for webmin. Closes gh-99.
* [f336d9f] Add filter for webmin. Closes gh#fail2ban/fail2ban#99.
Steven Hiscocks
* [..746c7d9] bash interactive shell completions for fail2ban-*'s
Nick Hilliard
@ -122,23 +217,23 @@ Tue May 14 10:06:35 UTC 2013 - jweberhofer@weberhofer.at
* [24a8d07] Added new date format for ASSP SMTP Proxy.
Steven Hiscocks
* [3d6791f] Ensure restart of Actions after a check fails occurs
consistently. Closes gh-172.
consistently. Closes gh#fail2ban/fail2ban#172.
* [MANY] Improvements to test cases, travis, and code coverage (coveralls).
* [b36835f] Add get cinfo to fail2ban-client. Closes gh-124.
* [b36835f] Add get cinfo to fail2ban-client. Closes gh#fail2ban/fail2ban#124.
* [ce3ab34] Added ability to specify PID file.
Orion Poplawski
* [ddebcab] Enhance fail2ban.service definition dependencies and Pidfile.
Closes gh-142.
Closes gh#fail2ban/fail2ban#142.
Yaroslav Halchenko
* [MANY] Lots of improvements to log messages, man pages and test cases.
* [91d5736] Postfix filter improvements - empty helo, from and rcpt to.
Closes gh-126. Bug report by Michael Heuberger.
Closes gh#fail2ban/fail2ban#126. Bug report by Michael Heuberger.
* [40c5a2d] adding more of diagnostic messages into -client while starting
the daemon.
* [8e63d4c] Compare against None with 'is' instead of '=='.
* [6fef85f] Strip CR and LF while analyzing the log line
Daniel Black
* [3aeb1a9] Add jail.conf manual page. Closes gh-143.
* [3aeb1a9] Add jail.conf manual page. Closes gh#fail2ban/fail2ban#143.
* [MANY] man page edits.
* [7cd6dab] Added help command to fail2ban-client.
* [c8c7b0b,23bbc60] Better logging of log file read errors.
@ -171,21 +266,23 @@ would be at a significant security risk.
- Fixes:
Alan Jenkins
* [8c38907] Removed 'POSSIBLE BREAK-IN ATTEMPT' from sshd filter to avoid
banning due to misconfigured DNS. Close gh-64
banning due to misconfigured DNS. Close gh#fail2ban/fail2ban#64
Yaroslav Halchenko
* [83109bc] IMPORTANT: escape the content of <matches> (if used in
custom action files) since its value could contain arbitrary
symbols. Thanks for discovery go to the NBS System security
team
* [0935566,5becaf8] Various python 2.4 and 2.5 compatibility fixes. Close gh-83
* [0935566,5becaf8] Various python 2.4 and 2.5 compatibility fixes.
Close gh#fail2ban/fail2ban#83
* [b159eab] do not enable pyinotify backend if pyinotify < 0.8.3
* [37a2e59] store IP as a base, non-unicode str to avoid spurious messages
in the console. Close gh-91
in the console. Close gh#fail2ban/fail2ban#91
- New features:
David Engeset
* [2d672d1,6288ec2] 'unbanip' command for the client + avoidance of touching
the log file to take 'banip' or 'unbanip' in effect. Close gh-81, gh-86
the log file to take 'banip' or 'unbanip' in effect.
Close gh#fail2ban/fail2ban#81, gh#fail2ban/fail2ban#86
- Enhancements:
* [2d66f31] replaced uninformative "Invalid command" message with warning log
@ -193,9 +290,10 @@ would be at a significant security risk.
* [958a1b0] improved failregex to "support" auth.backend = "htdigest"
* [9e7a3b7] until we make it proper module -- adjusted sys.path only if
system-wide run
* [f52ba99] downgraded "already banned" from WARN to INFO level. Closes gh-79
* [f52ba99] downgraded "already banned" from WARN to INFO level.
Closes gh#fail2ban/fail2ban#79
* [f105379] added hints into the log on some failure return codes (e.g. 0x7f00
for this gh-87)
for this gh#fail2ban/fail2ban#87)
* Various others: travis-ci integration, script to run tests
against all available Python versions, etc
@ -237,11 +335,11 @@ Tue Oct 2 08:09:20 UTC 2012 - jweberhofer@weberhofer.at
* [4c76fb3] allow trailing white-spaces in lighttpd-auth.conf
* [25f1e8d] allow trailing whitespace in few missing it regexes for sshd.conf
* [ed16ecc] enforce "ip" field returned as str, not unicode so that log
message stays non-unicode. Close gh-32
message stays non-unicode. Close gh#fail2ban/fail2ban#32
* [b257be4] added %m-%d-%Y pattern + do not add %Y for Feb 29 fix if
already present in the pattern
* [47e956b] replace "|" with "_" in ipmasq-ZZZzzz|fail2ban.rul to be
friend to developers stuck with Windows (Closes gh-66)
friend to developers stuck with Windows (Closes gh#fail2ban/fail2ban#66)
* [80b191c] anchor grep regexp in actioncheck to not match partial names
of the jails (Closes: #672228) (Thanks Szépe Viktor for the report)
- New features:
@ -254,7 +352,7 @@ Tue Oct 2 08:09:20 UTC 2012 - jweberhofer@weberhofer.at
use of DNS
- Tom Hendrikx
* [f94a121..] 'recidive' filter/jail to monitor fail2ban.conf to ban
repeated offenders. Close gh-19
repeated offenders. Close gh#fail2ban/fail2ban#19
- Xavier Devlamynck
* [7d465f9..] Add asterisk support
- Zbigniew Jedrzejewski-Szmek
@ -274,7 +372,7 @@ Tue Oct 2 08:09:20 UTC 2012 - jweberhofer@weberhofer.at
* [a7d47e8] Update Free Software Foundation's address
- Petr Voralek
* [4007751] catch failed ssh logins due to being listed in DenyUsers.
Close gh-47 (Closes: #669063)
Close gh#fail2ban/fail2ban#47 (Closes: #669063)
- Yaroslav Halchenko
* [MANY] extended and robustified unittests: test different backends
* [d9248a6] refactored Filter's to avoid duplicate functionality

2
fail2ban.logrotate
View File

@ -8,6 +8,6 @@
missingok
create 644 root root
postrotate
fail2ban-client set logtarget /var/log/fail2ban.log 1>/dev/null || true
fail2ban-client flushlogs 1>/dev/null || true
endscript
}

45
fail2ban.spec
View File

@ -1,7 +1,7 @@
#
# spec file for package fail2ban
#
# Copyright (c) 2013 SUSE LINUX Products GmbH, Nuernberg, Germany.
# Copyright (c) 2014 SUSE LINUX Products GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@ -17,10 +17,31 @@
Name: fail2ban
Version: 0.8.12
Release: 0
Url: http://www.fail2ban.org/
BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildArch: noarch
Summary: Bans IP addresses that make too many authentication failures
License: GPL-2.0+
Group: Productivity/Networking/Security
Source0: https://github.com/%{name}/%{name}/releases/download/%{version}/%{name}-%{version}.tar.bz2
%if 0%{?suse_version} < 1230
# the init-script requires lsof
Requires: lsof
Source1: %{name}.init
%endif
Source2: %{name}.sysconfig
Source3: %{name}.logrotate
%if 0%{?suse_version} >= 1230
Source4: %{name}.service
Source5: %{name}.tmpfiles
%endif
# PATCH-FIX-UPSTREAM fix-for-upstream-firewallcmd-ipset.conf.patch rh#1046816
Patch0: fix-for-upstream-firewallcmd-ipset.conf.patch
Requires: cron
Requires: iptables
Requires: logrotate
Requires: lsof
Requires: python >= 2.5
%if 0%{?suse_version} >= 1140 && 0%{?sles_version} == 0
Requires: python-pyinotify
@ -34,25 +55,6 @@ BuildRequires: systemd
%endif
BuildRequires: logrotate
BuildRequires: python-devel
PreReq: %fillup_prereq
Version: 0.8.11
Release: 0
Url: http://www.fail2ban.org/
BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildArch: noarch
Summary: Bans IP addresses that make too many authentication failures
License: GPL-2.0+
Group: Productivity/Networking/Security
Source0: https://github.com/%{name}/%{name}/releases/download/%{version}/%{name}-%{version}.tar.bz2
%if 0%{?suse_version} < 1230
Source1: %{name}.init
%endif
Source2: %{name}.sysconfig
Source3: %{name}.logrotate
%if 0%{?suse_version} >= 1230
Source4: %{name}.service
Source5: %{name}.tmpfiles
%endif
%description
Fail2ban scans log files like /var/log/messages and bans IP addresses
@ -63,6 +65,7 @@ files such as sshd or Apache web server ones.
%prep
%setup
%patch0 -p1
# correct doc-path
sed -i -e 's|/usr/share/doc/fail2ban|%{_docdir}/%{name}|' setup.py

23
fix-for-upstream-firewallcmd-ipset.conf.patch Normal file
View File

@ -0,0 +1,23 @@
diff -ur fail2ban-0.8.12.orig/config/action.d/firewallcmd-ipset.conf fail2ban-0.8.12/config/action.d/firewallcmd-ipset.conf
--- fail2ban-0.8.12.orig/config/action.d/firewallcmd-ipset.conf 2014-01-16 09:20:14.000000000 +0100
+++ fail2ban-0.8.12/config/action.d/firewallcmd-ipset.conf 2014-01-23 22:43:53.115263616 +0100
@@ -25,8 +25,6 @@
ipset flush fail2ban-<name>
ipset destroy fail2ban-<name>
-actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q '^fail2ban-<name>$'
-
actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist
actionunban = ipset del fail2ban-<name> <ip> -exist
diff -ur fail2ban-0.8.12.orig/THANKS fail2ban-0.8.12/THANKS
--- fail2ban-0.8.12.orig/THANKS 2014-01-21 21:59:49.000000000 +0100
+++ fail2ban-0.8.12/THANKS 2014-01-23 22:43:53.115263616 +0100
@@ -30,6 +30,7 @@
Daniel B.
Daniel Black
David Nutter
+Derek Atkins
Eric Gerbier
Enrico Labedzki
ftoppi