--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-96a2030c7d
2020-02-01 01:30:01.330363
--------------------------------------------------------------------------------
Name : fail2ban
Product : Fedora 31
Version : 0.10.5
Release : 2.fc31
URL :
http://fail2ban.sourceforge.net/
Summary : Daemon to ban hosts that cause multiple authentication errors
Description :
Fail2Ban scans log files and bans IP addresses that makes too many password
failures. It updates firewall rules to reject the IP address. These rules can
be defined by the user. Fail2Ban can read multiple log files such as sshd or
Apache web server ones.
Fail2Ban is able to reduce the rate of incorrect authentications attempts
however it cannot eliminate the risk that weak authentication presents.
Configure services to use only two factor or public/private authentication
mechanisms if you really want to protect services.
This is a meta-package that will install the default configuration. Other
sub-packages are available to install support for other actions and
configurations.
--------------------------------------------------------------------------------
Update Information:
Move action.d/mail-whois-common.conf into fail2ban-server ---- ver. 0.10.5
(2020/01/10) - deserve-more-respect-a-jedis-weapon-must ----------- Yes,
Hrrrm... ### Fixes * [compatibility] systemd backend: default flags changed to
SYSTEM_ONLY(4), fixed in gh-2444 in order to ignore user session files per
default, so could prevent "Too many open files" errors on a lot of user
sessions
(see gh-2392) * [grave] fixed parsing of multi-line filters (`maxlines` > 1)
together with systemd backend, now systemd-filter replaces newlines in message
from systemd journal with `\n` (otherwise multi-line parsing may be broken,
because removal of matched string from multi-line buffer window is confused by
such extra new-lines, so they are retained and got matched on every followed
message, see gh-2431) * [stability] prevent race condition - no unban if the
bans occur continuously (gh-2410); now an unban-check will happen not later
than 10 tickets get banned regardless there are still active bans available
(precedence of ban over unban-check is 10 now) * fixed read of included config-
files (`.local` overwrites options of `.conf` for config-files included with
before/after) * `action.d/abuseipdb.conf`: switched to use AbuseIPDB API v2
(gh-2302) * `action.d/badips.py`: fixed start of banaction on demand (which may
be IP-family related), gh-2390 * `action.d/helpers-common.conf`: rewritten grep
arguments, now options `-wF` used to match only whole words and fixed string
(not as pattern), gh-2298 * `filter.d/apache-auth.conf`: - ignore errors from
mod_evasive in `normal` mode (mode-controlled now) (gh-2548); - extended with
option `mode` - `normal` (default) and `aggressive` * `filter.d/sshd.conf`: -
matches `Bad protocol version identification` in `ddos` and `aggressive` modes
(gh-2404). - captures `Disconnecting ...: Change of username or service not
allowed` (gh-2239, gh-2279) - captures `Disconnected from ... [preauth]`,
preauth phase only, different handling by `extra` (with supplied user only)
and `ddos`/`aggressive` mode (gh-2115, gh-2239, gh-2279) * `filter.d/mysqld-
auth.conf`: - MYSQL 8.0.13 compatibility (log-error-verbosity = 3), log-
format contains few additional words enclosed in brackets after "[Note]"
(gh-2314) * `filter.d/sendmail-reject.conf`: - `mode=extra` now captures port
IDs of `TLSMTA` and `MSA` (defaults for ports 465 and 587 on some distros) *
`files/fail2ban.service.in`: fixed systemd-unit template - missing nftables
dependency (gh-2313) * several `action.d/mail*`: fixed usage with multiple log
files (ultimate fix for gh-976, gh-2341) * `filter.d/sendmail-reject.conf`:
fixed journal usage for some systems (e. g. CentOS): if only identifier set
to `sm-mta` (no unit `sendmail`) for some messages (gh-2385) *
`filter.d/asterisk.conf`: asterisk can log additional timestamp if logs into
systemd-journal (regex extended with optional part matching this, gh-2383) *
`filter.d/postfix.conf`: - regexp's accept variable suffix code in status of
postfix for precise messages (gh-2442) - extended with new postfix filter
mode `errors` to match "too many errors" (gh-2439), also included within
modes `normal`, `more` (`extra` and `aggressive`), since postfix parameter
`smtpd_hard_error_limit` is default 20 (additionally consider `maxretry`) *
`filter.d/named-refused.conf`: - support BIND 9.11.0 log format (includes an
additional field @0xXXX..., gh-2406); - `prefregex` extended, more selective
now (denied/NOTAUTH suffix moved from failregex, so no catch-all there anymore)
* `filter.d/sendmail-auth.conf`, `filter.d/sendmail-reject.conf` : - ID in
prefix can be longer as 14 characters (gh-2563); * all filters would accept
square brackets around IPv4 addresses also (e. g. monit-filter, gh-2494) *
avoids unhandled exception during flush (gh-2588) * fixes pass2allow-ftp jail -
due to inverted handling, action should prohibit access per default for any IP,
therefore reset start on demand parameter for this action (it will be started
immediately by repair); * auto-detection of IPv6 subsystem availability
(important for not on-demand actions or jails, like pass2allow); ### New
Features * new replacement tags for failregex to match subnets in form of IP-
addresses with CIDR mask (gh-2559): - `<CIDR>` - helper regex to match CIDR
(simple integer form of net-mask); - `<SUBNET>` - regex to match sub-net
adresses (in form of IP/CIDR, also single IP is matched, so part /CIDR is
optional); * grouped tags (`<ADDR>`, `<HOST>`, `<SUBNET>`) recognize IP
addresses enclosed in square brackets * new failregex-flag tag `<F-MLFGAINED>`
for failregex, signaled that the access to service was gained (ATM used
similar to tag `<F-NOFAIL>`, but it does not add the log-line to matches,
gh-2279) * filters: introduced new configuration parameter `logtype` (default
`file` for file-backends, and `journal` for journal-backends, gh-2387); can
be also set to `rfc5424` to force filters (which include common.conf) to use
RFC 5424 conform prefix-line per default (gh-2467); * for better performance and
safety the option `logtype` can be also used to select short prefix-line for
file-backends too for all filters using `__prefix_line` (`common.conf`), if
message logged only with `hostname svc[nnnn]` prefix (often the case on several
systems): ```ini [jail] backend = auto filter = flt[logtype=short] ``` *
`filter.d/common.conf`: differentiate `__prefix_line` for file/journal logtype's
(speedup and fix parsing of systemd-journal); * `filter.d/traefik-auth.conf`:
used to ban hosts, that were failed through traefik * `filter.d/znc-
adminlog.conf`: new filter for ZNC (IRC bouncer); requires the adminlog module
to be loaded ### Enhancements * introduced new options: `dbmaxmatches`
(fail2ban.conf) and `maxmatches` (jail.conf) to contol how many matches per
ticket fail2ban can hold in memory and store in database (gh-2402, gh-2118); *
fail2ban.conf: introduced new section `[Thread]` and option `stacksize` to
configure default size of the stack for threads running in fail2ban (gh-2356),
it could be set in `fail2ban.local` to avoid runtime error "can't start new
thread" (see gh-969); * jail-reader extended (amend to gh-1622): actions support
multi-line options now (interpolations containing new-line); * fail2ban-
client: extended to ban/unban multiple tickets (see gh-2351, gh-2349); Syntax:
- `fail2ban-client set <jain> banip <ip1> ... <ipN>` -
`fail2ban-client set
<jain> unbanip [--report-absent] <ip1> ... <ipN>` * fail2ban-client:
extended
with new feature which allows to inform fail2ban about single or multiple
attempts (failure) for IP (resp. failure-ID), see gh-2351; Syntax: -
`fail2ban-client set <jail> attempt <ip> [<failure-message1> ...
<failure-
messageN>]` * `action.d/nftables.conf`: - isolate fail2ban rules into a
dedicated table and chain (gh-2254) - `nftables-allports` supports multiple
protocols in single rule now - combined nftables actions to single action
`nftables`: * `nftables-common` is removed (replaced with single action
`nftables` now) * `nftables-allports` is obsolete, superseded by
`nftables[type=allports]` * `nftables-multiport` is obsolete, superseded by
`nftables[type=multiport]` - allowed multiple protocols in
`nftables[type=multiport]` action (single set with multiple rules in chain),
following configuration in jail would replace 3 separate actions, see
https://github.com/fail2ban/fail2ban/pull/2254#issuecomment-534684675 *
`action.d/badips.py`: option `loglevel` extended with level of summary message,
following example configuration logging summary with NOTICE and rest with DEBUG
log-levels: `action = badips.py[loglevel="debug, notice"]` *
samplestestcase.py (testSampleRegexsFactory) extended: - allow coverage of
journal logtype; - new option `fileOptions` to set common filter/test options
for whole test-file; * large enhancement: auto-reban, improved invariant check
and conditional operations (gh-2588): - improves invariant check and repair
(avoid unhandled exception, consider family on conditional operations, etc),
prepared for bulk re-ban in repair case (if bulk-ban becomes implemented); -
automatic reban (repeat banning action) after repair/restore sane environment,
if already logged ticket causes new failures (via new action operation
`actionreban` or `actionban` if still not defined in action); * introduces
banning epoch for actions and tickets (to distinguish or recognize removed set
of the tickets); * invariant check avoids repair by unban/stop (unless
parameter `actionrepair_on_unban` set to `true`); * better handling for all
conditional operations (distinguish families for certain operations like
repair/flush/stop, prepared for other families, e. g. if different handling for
subnets expected, etc); * partially implements gh-980 (more breakdown safe
handling); * closes gh-1680 (better as large-scale banning implementation with
on-demand reban by failure, at least unless a bulk-ban gets implemented); *
fail2ban-regex - several enhancements and fixes: - improved usage output
(don't put a long help if an error occurs); - new option `--no-check-all` to
avoid check of all regex's (first matched only); - new option `-o`, `--out` to
set token only provided in output (disables check-all and outputs only expected
data).
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 21 2020 Orion Poplawski <orion(a)nwra.com> - 0.10.5-2
- Move action.d/mail-whois-common.conf into fail2ban-server
* Tue Jan 14 2020 Orion Poplawski <orion(a)nwra.com> - 0.10.5-1
- Update to 0.10.5
* Thu Nov 21 2019 Orion Poplawski <orion(a)nwra.com> - 0.10.4-8
- Define banaction_allports for firewalld, update banaction (bz#1775175)
- Update sendmail-reject with TLSMTA & MSA port IDs (bz#1722625)
* Thu Oct 31 2019 Orion Poplawski <orion(a)nwra.com> - 0.10.4-7
- Remove config files for other distros (bz#1533113)
* Thu Oct 3 2019 Miro Hron��ok <mhroncok(a)redhat.com> - 0.10.4-6
- Rebuilt for Python 3.8.0rc1 (#1748018)
* Mon Aug 19 2019 Miro Hron��ok <mhroncok(a)redhat.com> - 0.10.4-5
- Rebuilt for Python 3.8
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-96a2030c7d' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------