sebres
f60978618a
release 1.1.1 -- triple-one-win
2026-08-15 14:25:41 +02:00
Sergey G. Brester
f0fe7a57ff
CI: update actions/checkout from v3 to v7
...
silence deprecation warning (Node.js 20)
2026-08-15 13:33:10 +02:00
Sergey G. Brester
6c7a52e65f
Merge pull request #4221 from sebres/GHSA-33wh-ccjc-p397
...
fixes GHSA-33wh-ccjc-p397: avoid catastrophic backtracking explosion for REs in domino-smtp and dovecot filter
2026-08-15 13:29:06 +02:00
Sergey G. Brester
a2694a1ec1
update ChangeLog with recent fixes
...
Fix catastrophic backtracking in REs for domino-smtp and dovecot filters.
2026-08-15 13:25:05 +02:00
Sergey G. Brester
153751d40c
CI: upgrade Python setup action to version 7
...
try to silence deprecation warning (Node.js 20)
2026-08-15 13:18:30 +02:00
Sergey G. Brester
5684996a94
CI: update checkout action version to v7
...
try to silence deprecation warning (Node.js 20)
2026-08-15 13:14:33 +02:00
Sergey G. Brester
fbfeecd0b1
CI: update Python version to 3.15.0-rc.1 in workflow
2026-08-15 13:10:02 +02:00
Sergey G. Brester
d5d0f23d48
Merge pull request #4220 from h7x4/systemd-socket-activation
...
Add support for systemd socket activation
2026-08-15 12:50:05 +02:00
Sergey G. Brester
7f6280dab6
Merge pull request #4218 from VXNCXNX/fix/postfix-resolve-aggressive
...
filter.d/postfix: catch "hostname ... does not resolve to address" in aggressive mode
2026-08-15 12:35:34 +02:00
Sergey G. Brester
6afc074591
Update ChangeLog with new aggressive mode matching
...
Extended modes 'aggressive' to match hostname resolution errors.
2026-08-15 12:33:16 +02:00
h7x4
ef15ac46a8
Add fail2ban.socket unit
2026-08-15 19:07:44 +09:00
h7x4
d5d81242cf
Add support for systemd socket activation
2026-08-15 19:06:17 +09:00
VXNCXNX
d97eac50b9
filter.d/postfix: move the new sample into the existing aggressive section
...
review feedback from sebres, the file already has a filterOptions aggressive section, so the sample belongs there rather than in a second one at the end.
2026-08-15 06:37:47 +00:00
sebres
3a133f8aa4
filter.d/dovecot.conf: amend to GHSA-33wh-ccjc-p397 - improve vulnerable RE part to avoid catastrophic backtracking;
...
added more (artificial) tests covering that (shall no hang)
2026-08-14 23:38:49 +02:00
VXNCXNX
2b46485c7a
filter.d/postfix: catch "hostname ... does not resolve to address" in aggressive mode
...
Postfix logs this warning when a client's reverse DNS does not resolve
back to its address. Bots trip it constantly, but so does a legitimate
sender with broken rDNS, so it only belongs in aggressive mode.
Regex as given by sebres in gh-4078 and confirmed working by the
reporter.
Closes gh-4078
2026-08-14 16:02:39 +00:00
sebres
189da87824
filter.d/domino-smtp.conf: fixes GHSA-33wh-ccjc-p397 - improve vulnerable RE so it'd not cause hangs
2026-08-14 12:20:27 +02:00
sebres
27552eb190
domino-smtp: added test cases illustrating GHSA-33wh-ccjc-p397 - hang injecting user name
2026-08-14 12:19:42 +02:00
sebres
f127e6e6f0
action.d\nftables.conf: allows protocol all for multi- and allports type;
...
see https://github.com/fail2ban/fail2ban/discussions/4211#discussioncomment-17863040
2026-08-01 15:51:26 +02:00
sebres
1ebc369b05
fixes #4196 : adjusted REs considering password mismatch from sql backend/driver of dovecot 2.4
Codespell / Check for spelling errors (push) Has been cancelled
CI / build (3.10) (push) Has been cancelled
CI / build (3.11) (push) Has been cancelled
CI / build (3.12) (push) Has been cancelled
CI / build (3.13) (push) Has been cancelled
CI / build (3.14) (push) Has been cancelled
CI / build (3.15.0-alpha.5) (push) Has been cancelled
CI / build (3.8) (push) Has been cancelled
CI / build (3.9) (push) Has been cancelled
CI / build (pypy3.11) (push) Has been cancelled
2026-06-24 01:29:06 +02:00
sebres
2c1eb69381
adjust IPs in tests (fail2ban.org resolves another IPs)
Codespell / Check for spelling errors (push) Has been cancelled
CI / build (3.10) (push) Has been cancelled
CI / build (3.11) (push) Has been cancelled
CI / build (3.12) (push) Has been cancelled
CI / build (3.13) (push) Has been cancelled
CI / build (3.14) (push) Has been cancelled
CI / build (3.15.0-alpha.5) (push) Has been cancelled
CI / build (3.8) (push) Has been cancelled
CI / build (3.9) (push) Has been cancelled
CI / build (pypy3.11) (push) Has been cancelled
2026-06-24 01:16:05 +02:00
sebres
38c2537e8b
don't overwrite tags matched by prefregex with optional tags from failregex;
...
if RE matched, but not the tag in optional group, see testFrmtOutputAddrInHeadOrBody
2026-06-23 23:18:58 +02:00
Sergey G. Brester
333f105675
Merge pull request #4184 from wolfc/rich-rules-zone
...
Codespell / Check for spelling errors (push) Has been cancelled
CI / build (3.10) (push) Has been cancelled
CI / build (3.11) (push) Has been cancelled
CI / build (3.12) (push) Has been cancelled
CI / build (3.13) (push) Has been cancelled
CI / build (3.14) (push) Has been cancelled
CI / build (3.15.0-alpha.5) (push) Has been cancelled
CI / build (3.8) (push) Has been cancelled
CI / build (3.9) (push) Has been cancelled
CI / build (pypy3.11) (push) Has been cancelled
As per example noted in the firewallcmd-rich-rules.conf file, properly specify the zone
2026-06-08 17:16:16 +02:00
Sergey G. Brester
8488d82488
Merge pull request #4189 from orlitzky/supervise-daemon
...
Codespell / Check for spelling errors (push) Waiting to run
OpenRC: support supervise-daemon
2026-06-07 13:49:16 +02:00
Michael Orlitzky
6c5bc69c84
files/fail2ban-openrc.conf: default to supervise-daemon
...
Gentoo recently started doing this, and it will (very likely) be the
default in the next major version of OpenRC, as communicated to me by
its maintainer.
2026-06-05 13:27:05 -04:00
Michael Orlitzky
11e7d4f8c5
files/fail2ban-openrc.init.in: support supervise-daemon
...
OpenRC is leaning towards changing its default supervisor in v2.0. The
choice is controlled by the $supervisor variable, but the
"supervise-daemon" supervisor requires the daemon to run in the
foreground, so some minor changes are required to support it.
Here we add a case statement to provide the appropriate arguments to
fail2ban-server, depending on the $supervisor.
2026-06-05 13:27:05 -04:00
Carlo de Wolf
ac96f984d8
As per example noted in the file, properly specify the zone
2026-05-18 16:06:41 +02:00
Sergey G. Brester
557e7eecf9
Merge pull request #4133 from B1gG/master
...
Update jail.conf.5 documentation for action tags
2026-05-11 10:29:15 +02:00
sebres
adfffe5267
merge gh-4164: new tag <jail.name> available in ignorecommand or actions (same as <name> there)
2026-04-11 14:49:13 +02:00
sebres
8d3f5048ef
filter.d/postfix.conf - extended prefregex to capture username in postfix SASL failures;
...
closes gh-4165
2026-04-11 14:42:57 +02:00
sebres
507d0468cd
implements RFE #4164 : new tag <jail.name> available in ignorecommand or actions (same as <name> there)
2026-04-11 14:25:12 +02:00
Sergey G. Brester
732dc86ef3
simplify timestamp conversion in systemd journal reader;
...
also handle DST flag correct, so doesn't mistakenly consider the UTC timestamp as local timestamp, see #2882
2026-04-10 16:44:43 +02:00
Sergey G. Brester
0a8356dd31
jail.conf: removed dead link in warning comment
...
removed dead URL (reference to 690-fail2ban-+-dns-fail.html in blog) from the warning comment about UDP spoofing;
closes gh-4162.
2026-03-26 21:03:29 +01:00
sebres
8be17b0981
Merge branch 'gh-4142--nginx-ssl-aggressive': extends filter.d/nginx-http-auth.conf - modes fallback and aggressive match more SSL failures by SSL_do_handshake or SSL_read (gh-4142, gh-2881)
2026-02-12 14:04:55 +01:00
sebres
c03a6204c1
ChangeLog update
2026-02-12 14:03:07 +01:00
sebres
eb7ed973ef
filter.d/nginx-http-auth.conf: modes fallback and aggressive extended to match more SSL failures, see gh-4142 (amend to gh-2881)
2026-02-12 13:53:57 +01:00
Sergey G. Brester
3b8033b337
Merge pull request #2537 from viiru-/improve-systemd-service
...
Improve systemd service
2026-02-11 15:08:35 +01:00
Sergey G. Brester
243876e60a
Merge pull request #4143 from caronc/apprise-tag-support-v2
...
Small amend to #4141 , adjust Apprise URL doc source and action comments
2026-02-02 03:07:01 +01:00
Sergey G. Brester
3bead7c011
Update comments in action
...
jail.conf shall be unmodified (jails are ideally in jail.local or jail.d/*.conf)
2026-02-02 03:04:25 +01:00
Chris Caron
05f6ad4fcc
small fix to url for Apprise doc source
2026-02-01 20:52:06 -05:00
Sergey G. Brester
81b906303c
Merge pull request #4141 from caronc/apprise-tag-support
...
Improved Apprise integration (support tagging)
2026-02-02 02:44:46 +01:00
Sergey G. Brester
025adbf485
fixes apprise action configuration examples
2026-02-02 02:37:26 +01:00
Sergey G. Brester
f457cf8131
ChangeLog adjusted
...
move from compat to enhancement section
2026-02-02 02:31:19 +01:00
Chris Caron
1a802bee93
further feedback from PR
2026-02-01 20:18:07 -05:00
Chris Caron
36e28359ed
fixed spelling
2026-02-01 19:51:26 -05:00
Chris Caron
8a8afefd70
applied updates based on PR feedback
2026-02-01 19:45:44 -05:00
Chris Caron
8afd0c8956
updated ChangeLog to reflect Apprise updates
2026-01-28 21:55:04 -05:00
Chris Caron
6cdb5738ec
improved apprise fail2ban integration (support tagging)
2026-01-28 21:49:42 -05:00
sebres
9887ee4412
CI: bump python version (3.15.0-alpha.5)
2026-01-23 21:28:52 +01:00
sebres
8506e4a41d
action.d/nftables.conf - fixed for SELinux without execmem permission, rewrite capturing with grep -P using grep -E or sed;
...
(PCRE-JIT by `grep -P` may cause SELinux denial for execmem), closes gh-4137
2026-01-23 21:23:58 +01:00
Gerardo Gonzalez
481be8790a
Update jail.conf.5 documentation for action tags
...
Missing tags added:
family - IP address family string
ip-rev - Reverse DNS PTR record
ip-host - Hostname of the IP
fid - Failure/ticket ID
bantime - Effective ban duration
bancount - Number of times IP has been banned
restored - Flag for restored tickets (0 or 1)
F-* - Free-form filter match tags
raw-ticket - Raw ticket representation
jail.banned - Currently banned count
jail.banned_total - Total ban count
jail.found - Current failure count
jail.found_total - Total failure count
2026-01-07 19:31:21 +01:00
