6309 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Sergey G. Brester	bbf16043a2	Merge pull request #4269 from hakarrr/fail2ban-2716-reload-actions ... actions: retain and start actions added during reload	2026-11-10 20:19:01 +01:00
sebres	069f8ccaf5	simplify code a bit (eliminate unneeded _reload_start_actions)	2026-11-10 20:12:10 +01:00
generaltony007	df6654cd34	changelog: record reload action retention fix ... Co-authored-by: GeneralTony007 <144252170+GeneralTony007@users.noreply.github.com>	2026-11-10 04:32:58 +05:30
generaltony007	bdee83d10f	tests: cover new and existing action reload lifecycle ... Co-authored-by: GeneralTony007 <144252170+GeneralTony007@users.noreply.github.com>	2026-11-10 04:32:06 +05:30
generaltony007	0aab4396c6	actions: retain and start actions added during reload ... Co-authored-by: GeneralTony007 <144252170+GeneralTony007@users.noreply.github.com>	2026-11-10 04:31:20 +05:30
Sergey G. Brester	d0f70eba16	Merge pull request #4267 from henricop/fix/statistic-alias-formatting ... fix(client): format the statistic command alias	2026-11-07 15:18:52 +01:00
Henrico Piubello	9dd5ffed4a	fix(client): format the statistic command alias	2026-11-07 06:30:44 -03:00
Sergey G. Brester	44e0beb2e3	Merge pull request #4264 from karolyi/fix-pyinotify-freebsd ... pyinotify: fix directory monitoring on systems with native inotify other than Linux (gh-4250)	2026-11-06 22:46:43 +01:00
László Károlyi	da0fbbcd8b	pyinotify: fix directory monitoring on systems with native inotify other than Linux (gh-4250) ... The parent directory watch was added with the mask containing IN_ISDIR, which is an output-only flag (set by the kernel in events). Linux ignores it, but FreeBSD 15+ (native kernel inotify) rejects the whole add_watch with EINVAL, so the directory was not monitored at all: add_watch: cannot watch /var/log WD=-1, Errno=Invalid argument (EINVAL) The file watch itself kept working, so new lines were found, but after a log rotation (move + create) the new file was never noticed and the jail silently stopped to find failures. This became visible with 1.1.1, since pyinotify was unusable on python 3.12+ before (missing asyncore) and the jails fell back to polling. Additionally, the directory watch now includes IN_DELETE and IN_MOVED_FROM, so removal of a watched log file is detected without relying on IN_IGNORED for the file watch, which FreeBSD does not send in this case (test_del_file failed there). Verified on FreeBSD 15.1 (monitorfailures_FilterPyinotify passes, writes after rotation detected) and on Linux. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 18:19:11 +01:00
Sergey G. Brester	fd09a9dcd2	Merge pull request #4262 from rafaelsoje/add-authelia-filter ... support systemd-journal log prefix in authelia filter	2026-11-03 20:23:22 +01:00
sebres	81f3c37914	datepattern is optional for journal, but expected for short logtype (line starts with some default date format)	2026-11-03 20:20:21 +01:00
Rafael Soje	a5d479a44e	support systemd-journal log prefix in authelia filter	2026-11-03 20:20:21 +01:00
Sergey G. Brester	fe34bcf09f	Merge pull request #4259 from rafaelsoje/add-authelia-filter ... filter.d/authelia: add new filter and jail for Authelia	2026-11-02 18:48:49 +01:00
sebres	533bbd93f7	remove unneeded (default) include, improved grp-regex (with negative lookahead for msg and remote_ip tokens)	2026-11-02 16:52:48 +01:00
Rafael Soje	e5fdceffae	filter.d/authelia: add new filter and jail for Authelia ... Add filter and jail configuration for Authelia 2FA/SSO portal, supporting standard key-value (file) and structured JSON logging formats with respective unit test samples. Closes gh-4005	2026-11-02 10:58:03 -03:00
Sergey G. Brester	fefc62a6d1	GHA: fix flow for 3.8/3.9, unavailable on ubuntu 26.04	2026-11-02 13:31:27 +01:00
Sergey G. Brester	b3b0dc4641	Merge pull request #4251 from omrzk/fix/postfix-instance-journal-match ... Monitor all Postfix instances with the systemd backend	2026-10-27 19:42:55 +01:00
omrzk	839fb632b3	BF: monitor secondary Postfix instances in the journal	2026-10-18 09:04:57 -05:00
Sergey G. Brester	6c88de71d2	CI: update python versions (3.15 is released)	2026-10-11 01:27:08 +02:00
sebres	544aff5dda	amend to gh-4196: matches auth-worker message (one line per attempt, <pid><session> in prefix, etc)	2026-10-09 20:39:52 +02:00
sebres	789571aa44	filter.d/pam-generic.conf: correctly consider attempt to inject on username for right and both sides; ... unless proven otherwise, we will prefer injection on the `ruser` field over the `user` field; normally by invalid user field `user` not logged at all, see for example logging from `pam_syslog(pamh, LOG_NOTICE, "authentication failure; " ...` in pam_unix-module source code: 52b33a56a9/modules/pam_unix/support.c (L822)	2026-10-09 00:06:14 +02:00
sebres	ddd879d226	'filter.d/sshd.conf': properly consider further attempt to inject on username (__on_port_opt and __suff adjusted and don't match on \S+ anymore)	2026-10-08 18:48:26 +02:00
sebres	2cc5bed3dc	filter.d/common.conf - improved RE for logtype rfc5424 (better compliant to RFC 5424); ... - fixed prefix-line for malformed RFC 5424, vulnerable against ReDoS (catastrophic backtracking) by non-conform logger or artificial "injection" attempt on STRUCTURED-DATA, unescaped new-line in PARAM-VALUE, etc (GHSA-c2mg-2r7g-c3wp)	2026-09-28 22:20:27 +02:00
sebres	7212404e8f	amend to 5cbe4b8b01 (systemd RC-fix): lock by closing of journal too (in afterStop, since _closeJournal used in _reopenJournal in lock, and lock is not reentrant)	2026-09-11 22:05:03 +02:00
sebres	f51ad5a5fb	CI: update Python version to 3.15.0-rc.2 in workflow	2026-09-11 21:44:15 +02:00
sebres	5cbe4b8b01	prevent possible race condition accessing journal from 2 threads in parallel (sporadic "OSError: [Errno 22] Invalid argument" in test_delJournalMatch by addJournalMatch), protect journal handle with lock	2026-09-11 21:26:11 +02:00
sebres	12e94859b8	remove redundant set exclusion (glob for ../system.journal can never contain ../system*@*.journal)	2026-09-11 20:49:22 +02:00
Sergey G. Brester	86e415a76a	Merge pull request #4230 from ChrisJr404/gitlab-json-mode ... gitlab: add json mode for application_json.log	2026-08-26 16:06:17 +02:00
Sergey G. Brester	0e2ad0360d	update changelog (mode -> logtype, added PR number)	2026-08-26 16:05:01 +02:00
Chris (ChrisJr404)	7924c55682	gitlab: switch mode parameter to standard logtype (file/json)	2026-08-25 23:47:36 -04:00
Chris (ChrisJr404)	050e0b3460	gitlab: add json mode for application_json.log ... Gitlab deprecated application.log in 15.10 in favour of the structured application_json.log. Add a mode option so the filter can read either format; text stays the default so existing setups keep working. Closes #3566	2026-08-24 18:00:21 -04:00
sebres	deffcbcd17	add default banactions for several paths-*.conf depending on default net-filter for distribution; ... closes gh-4224, gh-4229	2026-08-22 13:32:00 +02:00
sebres	46d2acd451	ChangeLog	2026-08-22 13:30:47 +02:00
sebres	63c0a46826	add default banactions for several paths-*.conf depending on default net-filter for distribution; ... closes gh-4224, gh-4229	2026-08-22 13:26:02 +02:00
Arjen de Korte	c6b20f225c	paths-opensuse.conf: specify default banactions ... Since 1.1.1 default banactions need to be specified. Take the opportunity to also synchronize the paths with current Factory settings.	2026-08-21 17:53:28 +02:00
Sergey G. Brester	403df4a91c	Merge pull request #4225 from Deric-W/socket-shutdown ... Fix systemd socket activation being broken	2026-08-20 13:46:36 +02:00
Sergey G. Brester	6185bc3ea2	Update ChangeLog entry (added reference to PR)	2026-08-20 13:45:02 +02:00
Eric Wolf	cbdeee8d81	Fix systemd runtime directory containing persistent socket being removed ... This resulted in a fail2ban being passed an unreachable socket after being stopped.	2026-08-20 04:03:15 +02:00
Eric Wolf	d574daf22e	Fix sockets passed via socket activation being shut down ... Doing so results in systemd encountering errors after stopping fail2ban.	2026-08-20 02:33:06 +02:00
Sergey G. Brester	1e12c5a7c7	Merge pull request #4216 from jarihu/add-cowrie-filter ... Add Cowrie honeypot JSON log filter	2026-08-18 15:28:22 +02:00
sebres	5ecbe89c80	try to optimize RE (skipping tags, no full match and right anchor needed), added datepattern, etc	2026-08-18 15:25:19 +02:00
Jari Huttunen	b552116f4f	Renamed filter to cowrie	2026-08-18 14:55:18 +02:00
Jari Huttunen	dfb8a58d17	Fixed the CI failure by adding a stock [cowrie] jail entry to config/jail.conf.	2026-08-18 14:54:35 +02:00
Jari Huttunen	9584c78bb6	Fix cowrie_json filter against real Cowrie log output ... The previous regex was written against an assumed field order/spacing that doesn't match what Cowrie actually emits: no space after ":", and "eventid" is not the first key (order is session, protocol, src_ip, ..., eventid, ..., message). Rework the failregex to match real-world json output, and correct the datepattern to wrap only the timestamp value (not the "timestamp": key) in the capture group, since fail2ban excises the whole captured group from the line before failregex is applied - wrapping the key too left a broken ",," gap in the JSON that never matched. Verified against real Cowrie honeypot log samples (session.connect, client.version, client.kex, login.success, log.closed) and the existing test-suite (101 filter sample-regex tests pass).	2026-08-18 14:51:33 +02:00
Jari Huttunen	763a1c7f0c	Fix cowrie honeypot filter per review (PR #4216) ... Replace the custom Python Filter/backend hack with a plain regex filter, per sebres's review: fail2ban filters shouldn't ship a custom backend-style parser under config/filter.d, and the previous prefregex/failregex pair was a no-op catch-all that didn't actually filter anything. - Drop cowrie_json.py entirely; parse the JSON log line directly with a bounded, anchored failregex (no unbounded .* catch-alls) using <ADDR> instead of <HOST> since only an IP is expected. - Add the required sample log test file (fail2ban/tests/files/logs/cowrie_json) covering matched, non-matching event, and malformed lines.	2026-08-18 14:51:33 +02:00
Jari Huttunen	ae4be51e16	typo fix	2026-08-18 14:51:32 +02:00
Jari Huttunen	4120682a95	Added cowrie honeypot json log filter	2026-08-18 14:51:32 +02:00
Sergey G. Brester	847abb4b2b	Merge pull request #4217 from VXNCXNX/fix/apache-noscript-cgi-bin-dir ... filter.d/apache-noscript: match a cgi-bin directory with no script name	2026-08-18 14:39:22 +02:00
VXNCXNX	17196db9c9	ChangeLog: entry for the apache-noscript cgi-bin fix	2026-08-18 14:35:33 +02:00
VXNCXNX	a511f9e3eb	filter.d/apache-noscript: no trailing slash for cgi-bin pattern + word boundary after <script> in 2nd failregex	2026-08-18 14:34:20 +02:00