--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2020-fbdcb94857
2020-02-06 00:24:20.949998
--------------------------------------------------------------------------------
Name : fail2ban
Product : Fedora EPEL 7
Version : 0.10.5
Release : 2.el7
URL :
http://fail2ban.sourceforge.net/
Summary : Daemon to ban hosts that cause multiple authentication errors
Description :
Fail2Ban scans log files and bans IP addresses that makes too many password
failures. It updates firewall rules to reject the IP address. These rules can
be defined by the user. Fail2Ban can read multiple log files such as sshd or
Apache web server ones.
Fail2Ban is able to reduce the rate of incorrect authentications attempts
however it cannot eliminate the risk that weak authentication presents.
Configure services to use only two factor or public/private authentication
mechanisms if you really want to protect services.
This is a meta-package that will install the default configuration. Other
sub-packages are available to install support for other actions and
configurations.
--------------------------------------------------------------------------------
Update Information:
Move action.d/mail-whois-common.conf into fail2ban-server ---- ver. 0.10.5
(2020/01/10) - deserve-more-respect-a-jedis-weapon-must ----------- Yes,
Hrrrm... ### Fixes * [compatibility] systemd backend: default flags changed to
SYSTEM_ONLY(4), fixed in gh-2444 in order to ignore user session files per
default, so could prevent "Too many open files" errors on a lot of user
sessions
(see gh-2392) * [grave] fixed parsing of multi-line filters (`maxlines` > 1)
together with systemd backend, now systemd-filter replaces newlines in message
from systemd journal with `\n` (otherwise multi-line parsing may be broken,
because removal of matched string from multi-line buffer window is confused by
such extra new-lines, so they are retained and got matched on every followed
message, see gh-2431) * [stability] prevent race condition - no unban if the
bans occur continuously (gh-2410); now an unban-check will happen not later
than 10 tickets get banned regardless there are still active bans available
(precedence of ban over unban-check is 10 now) * fixed read of included config-
files (`.local` overwrites options of `.conf` for config-files included with
before/after) * `action.d/abuseipdb.conf`: switched to use AbuseIPDB API v2
(gh-2302) * `action.d/badips.py`: fixed start of banaction on demand (which may
be IP-family related), gh-2390 * `action.d/helpers-common.conf`: rewritten grep
arguments, now options `-wF` used to match only whole words and fixed string
(not as pattern), gh-2298 * `filter.d/apache-auth.conf`: - ignore errors from
mod_evasive in `normal` mode (mode-controlled now) (gh-2548); - extended with
option `mode` - `normal` (default) and `aggressive` * `filter.d/sshd.conf`: -
matches `Bad protocol version identification` in `ddos` and `aggressive` modes
(gh-2404). - captures `Disconnecting ...: Change of username or service not
allowed` (gh-2239, gh-2279) - captures `Disconnected from ... [preauth]`,
preauth phase only, different handling by `extra` (with supplied user only)
and `ddos`/`aggressive` mode (gh-2115, gh-2239, gh-2279) * `filter.d/mysqld-
auth.conf`: - MYSQL 8.0.13 compatibility (log-error-verbosity = 3), log-
format contains few additional words enclosed in brackets after "[Note]"
(gh-2314) * `filter.d/sendmail-reject.conf`: - `mode=extra` now captures port
IDs of `TLSMTA` and `MSA` (defaults for ports 465 and 587 on some distros) *
`files/fail2ban.service.in`: fixed systemd-unit template - missing nftables
dependency (gh-2313) * several `action.d/mail*`: fixed usage with multiple log
files (ultimate fix for gh-976, gh-2341) * `filter.d/sendmail-reject.conf`:
fixed journal usage for some systems (e. g. CentOS): if only identifier set
to `sm-mta` (no unit `sendmail`) for some messages (gh-2385) *
`filter.d/asterisk.conf`: asterisk can log additional timestamp if logs into
systemd-journal (regex extended with optional part matching this, gh-2383) *
`filter.d/postfix.conf`: - regexp's accept variable suffix code in status of
postfix for precise messages (gh-2442) - extended with new postfix filter
mode `errors` to match "too many errors" (gh-2439), also included within
modes `normal`, `more` (`extra` and `aggressive`), since postfix parameter
`smtpd_hard_error_limit` is default 20 (additionally consider `maxretry`) *
`filter.d/named-refused.conf`: - support BIND 9.11.0 log format (includes an
additional field @0xXXX..., gh-2406); - `prefregex` extended, more selective
now (denied/NOTAUTH suffix moved from failregex, so no catch-all there anymore)
* `filter.d/sendmail-auth.conf`, `filter.d/sendmail-reject.conf` : - ID in
prefix can be longer as 14 characters (gh-2563); * all filters would accept
square brackets around IPv4 addresses also (e. g. monit-filter, gh-2494) *
avoids unhandled exception during flush (gh-2588) * fixes pass2allow-ftp jail -
due to inverted handling, action should prohibit access per default for any IP,
therefore reset start on demand parameter for this action (it will be started
immediately by repair); * auto-detection of IPv6 subsystem availability
(important for not on-demand actions or jails, like pass2allow); ### New
Features * new replacement tags for failregex to match subnets in form of IP-
addresses with CIDR mask (gh-2559): - `<CIDR>` - helper regex to match CIDR
(simple integer form of net-mask); - `<SUBNET>` - regex to match sub-net
adresses (in form of IP/CIDR, also single IP is matched, so part /CIDR is
optional); * grouped tags (`<ADDR>`, `<HOST>`, `<SUBNET>`) recognize IP
addresses enclosed in square brackets * new failregex-flag tag `<F-MLFGAINED>`
for failregex, signaled that the access to service was gained (ATM used
similar to tag `<F-NOFAIL>`, but it does not add the log-line to matches,
gh-2279) * filters: introduced new configuration parameter `logtype` (default
`file` for file-backends, and `journal` for journal-backends, gh-2387); can
be also set to `rfc5424` to force filters (which include common.conf) to use
RFC 5424 conform prefix-line per default (gh-2467); * for better performance and
safety the option `logtype` can be also used to select short prefix-line for
file-backends too for all filters using `__prefix_line` (`common.conf`), if
message logged only with `hostname svc[nnnn]` prefix (often the case on several
systems): ```ini [jail] backend = auto filter = flt[logtype=short] ``` *
`filter.d/common.conf`: differentiate `__prefix_line` for file/journal logtype's
(speedup and fix parsing of systemd-journal); * `filter.d/traefik-auth.conf`:
used to ban hosts, that were failed through traefik * `filter.d/znc-
adminlog.conf`: new filter for ZNC (IRC bouncer); requires the adminlog module
to be loaded ### Enhancements * introduced new options: `dbmaxmatches`
(fail2ban.conf) and `maxmatches` (jail.conf) to contol how many matches per
ticket fail2ban can hold in memory and store in database (gh-2402, gh-2118); *
fail2ban.conf: introduced new section `[Thread]` and option `stacksize` to
configure default size of the stack for threads running in fail2ban (gh-2356),
it could be set in `fail2ban.local` to avoid runtime error "can't start new
thread" (see gh-969); * jail-reader extended (amend to gh-1622): actions support
multi-line options now (interpolations containing new-line); * fail2ban-
client: extended to ban/unban multiple tickets (see gh-2351, gh-2349); Syntax:
- `fail2ban-client set <jain> banip <ip1> ... <ipN>` -
`fail2ban-client set
<jain> unbanip [--report-absent] <ip1> ... <ipN>` * fail2ban-client:
extended
with new feature which allows to inform fail2ban about single or multiple
attempts (failure) for IP (resp. failure-ID), see gh-2351; Syntax: -
`fail2ban-client set <jail> attempt <ip> [<failure-message1> ...
<failure-
messageN>]` * `action.d/nftables.conf`: - isolate fail2ban rules into a
dedicated table and chain (gh-2254) - `nftables-allports` supports multiple
protocols in single rule now - combined nftables actions to single action
`nftables`: * `nftables-common` is removed (replaced with single action
`nftables` now) * `nftables-allports` is obsolete, superseded by
`nftables[type=allports]` * `nftables-multiport` is obsolete, superseded by
`nftables[type=multiport]` - allowed multiple protocols in
`nftables[type=multiport]` action (single set with multiple rules in chain),
following configuration in jail would replace 3 separate actions, see
https://github.com/fail2ban/fail2ban/pull/2254#issuecomment-534684675 *
`action.d/badips.py`: option `loglevel` extended with level of summary message,
following example configuration logging summary with NOTICE and rest with DEBUG
log-levels: `action = badips.py[loglevel="debug, notice"]` *
samplestestcase.py (testSampleRegexsFactory) extended: - allow coverage of
journal logtype; - new option `fileOptions` to set common filter/test options
for whole test-file; * large enhancement: auto-reban, improved invariant check
and conditional operations (gh-2588): - improves invariant check and repair
(avoid unhandled exception, consider family on conditional operations, etc),
prepared for bulk re-ban in repair case (if bulk-ban becomes implemented); -
automatic reban (repeat banning action) after repair/restore sane environment,
if already logged ticket causes new failures (via new action operation
`actionreban` or `actionban` if still not defined in action); * introduces
banning epoch for actions and tickets (to distinguish or recognize removed set
of the tickets); * invariant check avoids repair by unban/stop (unless
parameter `actionrepair_on_unban` set to `true`); * better handling for all
conditional operations (distinguish families for certain operations like
repair/flush/stop, prepared for other families, e. g. if different handling for
subnets expected, etc); * partially implements gh-980 (more breakdown safe
handling); * closes gh-1680 (better as large-scale banning implementation with
on-demand reban by failure, at least unless a bulk-ban gets implemented); *
fail2ban-regex - several enhancements and fixes: - improved usage output
(don't put a long help if an error occurs); - new option `--no-check-all` to
avoid check of all regex's (first matched only); - new option `-o`, `--out` to
set token only provided in output (disables check-all and outputs only expected
data).
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 21 2020 Orion Poplawski <orion(a)nwra.com> - 0.10.5-2
- Move action.d/mail-whois-common.conf into fail2ban-server
* Tue Jan 14 2020 Orion Poplawski <orion(a)nwra.com> - 0.10.5-1
- Update to 0.10.5
* Sat Nov 23 2019 Orion Poplawski <orion(a)nwra.com> - 0.10.4-1
- Update to 0.10.4
- Define banaction_allports for firewalld, update banaction (bz#1775175)
- Update sendmail-reject with TLSMTA & MSA port IDs (bz#1722625)
- Remove config files for other distros (bz#1533113)
* Wed Jul 12 2017 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.7-1
- Update to 0.9.7
* Wed Feb 15 2017 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.6-3
- Properly handle /run/fail2ban (bug #1422500)
* Tue Jan 10 2017 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.6-2
- Add upstream patch to fix fail2ban-regex with journal
* Fri Jan 6 2017 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.6-1
- Update to 0.9.6
- Fix sendmail-auth filter (bug #1329919)
* Mon Dec 19 2016 Miro Hron��ok <mhroncok(a)redhat.com> - 0.9.5-5
- Rebuild for Python 3.6
* Fri Oct 7 2016 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.5-4
- %ghost /run/fail2ban
- Fix typo in shorewall description
- Move tests to -tests sub-package
* Mon Oct 3 2016 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.5-3
- Add journalmatch entries for sendmail (bug #1329919)
* Mon Oct 3 2016 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.5-2
- Give up being PartOf iptables to allow firewalld restarts to work
(bug #1379141)
* Mon Oct 3 2016 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.5-1
- Add patch to fix failing test
* Sun Sep 25 2016 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.5-1
- Update to 0.9.5
- Drop mysql patch applied upstream
* Sun Mar 27 2016 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.4-4
- Use %{_tmpfilesdir} for systemd tmpfile config
* Wed Mar 9 2016 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.4-3
- No longer need to add After=firewalld.service (bug #1301910)
* Wed Mar 9 2016 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.4-2
- Fix mariadb/mysql log handling
* Wed Mar 9 2016 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.4-1
- Update to 0.9.4
- Use mariadb log path by default
* Wed Feb 3 2016 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.9.3-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
* Sat Sep 12 2015 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.3-1
- Update to 0.9.3
- Cleanup spec, use new python macros
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
0.9.2-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
* Thu Apr 30 2015 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.2-1
- Update to 0.9.2
* Mon Mar 16 2015 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.1-4
- Do not load user paths for fail2ban-{client,server} (bug #1202151)
* Sun Feb 22 2015 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.1-3
- Do not use systemd by default
* Fri Nov 28 2014 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.1-2
- Fix php-url-fopen logpath (bug #1169026)
* Tue Oct 28 2014 Orion Poplawski <orion(a)cora.nwra.com> - 0.9.1-1
- Update to 0.9.1
* Fri Aug 15 2014 Orion Poplawski <orion(a)cora.nwra.com> - 0.9-8
- Add patch to fix tests
* Fri Aug 8 2014 Orion Poplawski <orion(a)cora.nwra.com> - 0.9-8
- Fix log paths for some jails (bug #1128152)
* Mon Jul 21 2014 Orion Poplawski <orion(a)cora.nwra.com> - 0.9-7
- Use systemd for EL7
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
0.9-6
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Thu Mar 20 2014 Orion Poplawski <orion(a)cora.nwra.com> - 0.9-5
- Require mailx for /usr/bin/mail
* Thu Mar 20 2014 Orion Poplawski <orion(a)cora.nwra.com> - 0.9-4
- Need empty %files to produce main and -all package
* Wed Mar 19 2014 Orion Poplawski <orion(a)cora.nwra.com> - 0.9-3
- Split into sub-packages for different components
- Enable journal filter by default (bug #985567)
- Enable firewalld action by default (bug #1046816)
- Add upstream patch to fix setting loglevel in fail2ban.conf
- Add upstream patches to fix tests in mock, run tests
* Tue Mar 18 2014 Orion Poplawski <orion(a)cora.nwra.com> - 0.9-2
- Use Fedora paths
- Start after firewalld (bug #1067147)
* Mon Mar 17 2014 Orion Poplawski <orion(a)cora.nwra.com> - 0.9-1
- Update to 0.9
* Tue Sep 24 2013 Orion Poplawski <orion(a)cora.nwra.com> - 0.9-0.3.git1f1a561
- Update to current 0.9 git branch
- Rebase init patch, drop jail.d and notmp patch applied upstream
* Fri Aug 9 2013 Orion Poplawski <orion(a)cora.nwra.com> - 0.9-0.2.gitd529151
- Ship jail.conf(5) man page
- Ship empty /etc/fail2ban/jail.d directory
* Thu Aug 8 2013 Orion Poplawski <orion(a)cora.nwra.com> - 0.9-0.1.gitd529151
- Update to 0.9 git branch
- Rebase patches
- Require systemd-python for journal support
* Sat Aug 3 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
0.8.10-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
* Wed Jun 12 2013 Orion Poplawski <orion(a)cora.nwra.com> - 0.8.10-1
- Update to 0.8.10 security release
- Use upstream provided systemd files
- Drop upstreamed patches, rebase log2syslog and notmp patches
* Fri Mar 15 2013 Orion Poplawski <orion(a)cora.nwra.com> - 0.8.8-4
- Use systemd init for Fedora 19+ (bug #883158)
* Thu Feb 14 2013 Orion Poplawski <orion(a)cora.nwra.com> - 0.8.8-3
- Add patch from upstream to fix module imports (Bug #892365)
- Add patch from upstream to UTF-8 characters in syslog (Bug #905097)
- Drop Requires: tcp_wrappers and shorewall (Bug #781341)
* Fri Jan 18 2013 Orion Poplawski <orion(a)cora.nwra.com> - 0.8.8-2
- Add patch to prevent sshd blocks of successful logins for systems that use
sssd or ldap
* Mon Dec 17 2012 Orion Poplawski <orion(a)cora.nwra.com> - 0.8.8-1
- Update to 0.8.8 (CVE-2012-5642 Bug #887914)
* Thu Oct 11 2012 Orion Poplawski <orion(a)cora.nwra.com> - 0.8.7.1-1
- Update to 0.8.7.1
- Drop fd_cloexec, pyinotify, and examplemail patches fixed upstream
- Rebase sshd and notmp patches
- Use _initddir macro
* Thu Jul 19 2012 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
0.8.4-29
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Fri Jan 13 2012 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
0.8.4-28
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
* Sat Apr 9 2011 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.4-27
- Move tmp files to /var/lib (suggested by Phil Anderson).
- Enable inotify support (by Jonathan Underwood).
- Fixes RH bugs #669966, #669965, #551895, #552947, #658849, #656584.
* Sun Feb 14 2010 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.4-24
- Patch by Jonathan G. Underwood <jonathan.underwood(a)gmail.com> to
cloexec another fd leak.
* Fri Sep 11 2009 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.4-23
- update to 0.8.4.
* Wed Sep 2 2009 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.3-22
- Update to a newer svn snapshot to fix python 2.6 issue.
* Thu Aug 27 2009 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.3-21
- Log to syslog (RH bug #491983). Also deals with RH bug #515116.
- Check inodes of log files (RH bug #503852).
* Sat Feb 14 2009 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.3-18
- Fix CVE-2009-0362 (Fedora bugs #485461, #485464, #485465, #485466).
* Mon Dec 1 2008 Ignacio Vazquez-Abrams <ivazqueznet+rpm(a)gmail.com> - 0.8.3-17
- Rebuild for Python 2.6
* Sun Aug 24 2008 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.3-16
- Update to 0.8.3.
* Wed May 21 2008 Tom "spot" Callaway <tcallawa(a)redhat.com> - 0.8.2-15
- fix license tag
* Thu Mar 27 2008 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.2-14
- Close on exec fixes by Jonathan Underwood.
* Sun Mar 16 2008 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.2-13
- Add %{_localstatedir}/run/fail2ban (David Rees).
* Fri Mar 14 2008 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.2-12
- Update to 0.8.2.
* Thu Jan 31 2008 Jonathan G. Underwood <jonathan.underwood(a)gmail.com> - 0.8.1-11
- Move socket file from /tmp to /var/run to prevent SElinux from stopping
fail2ban from starting (BZ #429281)
- Change logic in init file to start with -x to remove the socket file in case
of unclean shutdown
* Wed Aug 15 2007 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.1-10
- Update to 0.8.1.
- Remove patch fixing CVE-2007-4321 (upstream).
- Remove AllowUsers patch (upstream).
- Add dependency to gamin-python.
* Thu Jun 21 2007 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.0-9
- Fix remote log injection (no CVE assignment yet).
* Sun Jun 3 2007 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.0-8
- Also trigger on non-AllowUsers failures (Jonathan Underwood
<jonathan.underwood(a)gmail.com>).
* Wed May 23 2007 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.0-7
- logrotate should restart fail2ban (Zing <zing(a)fastmail.fm>).
- send mail to root; logrotate (Jonathan Underwood
<jonathan.underwood(a)gmail.com>)
* Sat May 19 2007 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.8.0-4
- Update to 0.8.0.
- enable ssh by default, fix log file for ssh scanning, adjust python
dependency (Jonathan Underwood <jonathan.underwood(a)gmail.com>)
* Sat Dec 30 2006 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.6.2-3
- Remove forgotten condrestart.
* Fri Dec 29 2006 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.6.2-2
- Move /usr/lib/fail2ban to %{_datadir}/fail2ban.
- Don't default chkconfig to enabled.
- Add dependencies on service/chkconfig.
- Use example iptables/ssh config as default config.
* Mon Dec 25 2006 Axel Thimm <Axel.Thimm(a)ATrpms.net> - 0.6.2-1
- Initial build.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update fail2ban' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------