On 03/20/2014 01:12 PM, Matthew Miller wrote:
On Thu, Mar 20, 2014 at 12:17:46PM -0400, Przemek Klosowski wrote:
>>>> fail2ban-server - core components with minimal deps
>>>> fail2ban-firewalld - firewalld support/configuration - requires
firewalld
>>>> fail2ban-hostsdeny - tcp_wrappers hosts.deny support - requires
tcp_wrappers
>>>> fail2ban-mail - mail actions - requires
/usr/bin/mail
>>>> fail2ban-sendmail - sendmail actions - requires
/usr/sbin/sendmail
>>>> fail2ban-shorewall - shorewall support - requires
shorewall
>>>> fail2ban-systemd - systemd journal configuration
>>>>
>>>> fail2ban - default component - installs -firewalld,-sendmail,-systemd
>>>> fail2ban-all - installs everything - also requires /usr/bin/whois
> I am concerned that this looks like configuring the fail2ban package
> by installing more packages. If we started doing it everywhere
It looks like that, but the split is largely based on dependencies, and I
can see situations for each case where you might want to avoid pulling these
things in but still would want fail2ban. The systemd one is the exception,
because the journal isn't optional in Fedora. And I think I'd combine mail
and sendmail (because the /usr/sbin/sendmail command can be provided by a
lot of alternatives, including the very lightweight ssmtp).
Yeah, I probably should just add the systemd config file to the main
package.
The -mail actions explicitly depend on /usr/bin/mail command which is
only provided by mailx as far as I can tell.
And maybe hostsdeny should be part of the main server package, as it really
just manipulates /etc/hosts.deny, which is part of the mandatory 'setup'
package.
Yeah, but there's and entertaining thread about removing it...
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA/CoRA Division FAX: 303-415-9702
3380 Mitchell Lane orion(a)cora.nwra.com
Boulder, CO 80301
http://www.cora.nwra.com