diff --git a/.etckeeper b/.etckeeper index 9e49ed68..ee304ef7 100755 --- a/.etckeeper +++ b/.etckeeper @@ -30,6 +30,7 @@ mkdir -p './kernel/install.d' mkdir -p './letsencrypt/renewal-hooks/deploy' mkdir -p './letsencrypt/renewal-hooks/post' mkdir -p './letsencrypt/renewal-hooks/pre' +mkdir -p './monit/conf-available' mkdir -p './network/interfaces.d' mkdir -p './nginx/conf.d' mkdir -p './nginx/modules-available' @@ -61,7 +62,9 @@ maybe chmod 0644 'apache2/conf-available/javascript-common.conf' maybe chmod 0755 'apparmor.d' maybe chmod 0755 'apparmor.d/force-complain' maybe chmod 0755 'apparmor.d/local' +maybe chmod 0644 'apparmor.d/local/usr.bin.man' maybe chmod 0644 'apparmor.d/local/usr.sbin.named' +maybe chmod 0644 'apparmor.d/usr.bin.man' maybe chmod 0644 'apparmor.d/usr.sbin.named' maybe chmod 0755 'apt' maybe chmod 0755 'apt/apt.conf.d' @@ -468,6 +471,7 @@ maybe chmod 0640 'exim4/passwd.client' maybe chmod 0644 'exim4/update-exim4.conf.conf' maybe chmod 0755 'fail2ban' maybe chmod 0755 'fail2ban/action.d' +maybe chmod 0644 'fail2ban/action.d/abuseipdb.conf' maybe chmod 0644 'fail2ban/action.d/apf.conf' maybe chmod 0644 'fail2ban/action.d/badips.conf' maybe chmod 0644 'fail2ban/action.d/badips.py' @@ -478,11 +482,13 @@ maybe chmod 0644 'fail2ban/action.d/complain.conf' maybe chmod 0644 'fail2ban/action.d/dshield.conf' maybe chmod 0644 'fail2ban/action.d/dummy.conf' maybe chmod 0644 'fail2ban/action.d/firewallcmd-allports.conf' +maybe chmod 0644 'fail2ban/action.d/firewallcmd-common.conf' maybe chmod 0644 'fail2ban/action.d/firewallcmd-ipset.conf' maybe chmod 0644 'fail2ban/action.d/firewallcmd-multiport.conf' maybe chmod 0644 'fail2ban/action.d/firewallcmd-new.conf' maybe chmod 0644 'fail2ban/action.d/firewallcmd-rich-logging.conf' maybe chmod 0644 'fail2ban/action.d/firewallcmd-rich-rules.conf' +maybe chmod 0644 'fail2ban/action.d/helpers-common.conf' maybe chmod 0644 'fail2ban/action.d/hostsdeny.conf' maybe chmod 0644 'fail2ban/action.d/ipfilter.conf' maybe chmod 0644 'fail2ban/action.d/ipfw.conf' @@ -506,6 +512,7 @@ maybe chmod 0644 'fail2ban/action.d/netscaler.conf' maybe chmod 0644 'fail2ban/action.d/nftables-allports.conf' maybe chmod 0644 'fail2ban/action.d/nftables-common.conf' maybe chmod 0644 'fail2ban/action.d/nftables-multiport.conf' +maybe chmod 0644 'fail2ban/action.d/nginx-block-map.conf' maybe chmod 0644 'fail2ban/action.d/npf.conf' maybe chmod 0644 'fail2ban/action.d/nsupdate.conf' maybe chmod 0644 'fail2ban/action.d/osx-afctl.conf' @@ -586,6 +593,7 @@ maybe chmod 0644 'fail2ban/filter.d/oracleims.conf' maybe chmod 0644 'fail2ban/filter.d/pam-generic.conf' maybe chmod 0644 'fail2ban/filter.d/perdition.conf' maybe chmod 0644 'fail2ban/filter.d/php-url-fopen.conf' +maybe chmod 0644 'fail2ban/filter.d/phpmyadmin-syslog.conf' maybe chmod 0644 'fail2ban/filter.d/portsentry.conf' maybe chmod 0644 'fail2ban/filter.d/postfix-rbl.conf' maybe chmod 0644 'fail2ban/filter.d/postfix-sasl.conf' @@ -617,9 +625,11 @@ maybe chmod 0644 'fail2ban/filter.d/vsftpd.conf' maybe chmod 0644 'fail2ban/filter.d/webmin-auth.conf' maybe chmod 0644 'fail2ban/filter.d/wuftpd.conf' maybe chmod 0644 'fail2ban/filter.d/xinetd-fail.conf' +maybe chmod 0644 'fail2ban/filter.d/zoneminder.conf' maybe chmod 0644 'fail2ban/jail.conf' maybe chmod 0755 'fail2ban/jail.d' maybe chmod 0644 'fail2ban/jail.d/defaults-debian.conf' +maybe chmod 0644 'fail2ban/paths-arch.conf' maybe chmod 0644 'fail2ban/paths-common.conf' maybe chmod 0644 'fail2ban/paths-debian.conf' maybe chmod 0644 'fail2ban/paths-opensuse.conf' @@ -746,6 +756,7 @@ maybe chmod 0755 'initramfs-tools/scripts/panic' maybe chmod 0644 'initramfs-tools/update-initramfs.conf' maybe chmod 0644 'inputrc' maybe chmod 0755 'insserv.conf.d' +maybe chmod 0644 'insserv.conf.d/bind9' maybe chmod 0644 'insserv.conf.d/rpcbind' maybe chmod 0755 'iproute2' maybe chmod 0644 'iproute2/bpf_pinning' @@ -754,6 +765,8 @@ maybe chmod 0644 'iproute2/group' maybe chmod 0644 'iproute2/nl_protos' maybe chmod 0644 'iproute2/rt_dsfield' maybe chmod 0644 'iproute2/rt_protos' +maybe chmod 0755 'iproute2/rt_protos.d' +maybe chmod 0644 'iproute2/rt_protos.d/README' maybe chmod 0644 'iproute2/rt_realms' maybe chmod 0644 'iproute2/rt_scopes' maybe chmod 0644 'iproute2/rt_tables' @@ -846,6 +859,7 @@ maybe chmod 0644 'letsencrypt/archive/wifi2.natalieandjoshua.com/fullchain1.pem' maybe chmod 0644 'letsencrypt/archive/wifi2.natalieandjoshua.com/fullchain2.pem' maybe chmod 0644 'letsencrypt/archive/wifi2.natalieandjoshua.com/privkey1.pem' maybe chmod 0644 'letsencrypt/archive/wifi2.natalieandjoshua.com/privkey2.pem' +maybe chmod 0644 'letsencrypt/cli.ini' maybe chmod 0755 'letsencrypt/csr' maybe chmod 0644 'letsencrypt/csr/0000_csr-certbot.pem' maybe chmod 0644 'letsencrypt/csr/0001_csr-certbot.pem' @@ -925,6 +939,7 @@ maybe chmod 0755 'logrotate.d' maybe chmod 0644 'logrotate.d/alternatives' maybe chmod 0644 'logrotate.d/apt' maybe chmod 0644 'logrotate.d/aptitude' +maybe chmod 0644 'logrotate.d/certbot' maybe chmod 0644 'logrotate.d/dpkg' maybe chmod 0644 'logrotate.d/exim4-base' maybe chmod 0644 'logrotate.d/exim4-paniclog' @@ -949,6 +964,7 @@ maybe chmod 0644 'modprobe.d/raspi-blacklist.conf' maybe chmod 0644 'modules' maybe chmod 0755 'modules-load.d' maybe chmod 0755 'monit' +maybe chmod 0755 'monit/conf-available' maybe chmod 0755 'monit/monitrc.d' maybe chmod 0644 'monit/monitrc.d/fail2ban' maybe chmod 0644 'motd' @@ -1045,6 +1061,7 @@ maybe chmod 0755 'profile.d' maybe chmod 0644 'profile.d/Z97-byobu.sh' maybe chmod 0644 'profile.d/bash_completion.sh' maybe chmod 0644 'profile.d/sshpwd.sh' +maybe chmod 0644 'profile.d/wifi-country.sh' maybe chmod 0644 'protocols' maybe chmod 0755 'python' maybe chmod 0644 'python/debian_config' @@ -1144,6 +1161,7 @@ maybe chmod 0644 'sysctl.conf' maybe chmod 0755 'sysctl.d' maybe chmod 0644 'sysctl.d/98-rpi.conf' maybe chmod 0644 'sysctl.d/README.sysctl' +maybe chmod 0644 'sysctl.d/protect-links.conf' maybe chmod 0755 'systemd' maybe chmod 0644 'systemd/journald.conf' maybe chmod 0644 'systemd/logind.conf' diff --git a/apparmor.d/local/usr.bin.man b/apparmor.d/local/usr.bin.man new file mode 100644 index 00000000..e69de29b diff --git a/apparmor.d/usr.bin.man b/apparmor.d/usr.bin.man new file mode 100644 index 00000000..d604a9cb --- /dev/null +++ b/apparmor.d/usr.bin.man @@ -0,0 +1,83 @@ +# vim:syntax=apparmor + +#include + +/usr/bin/man { + #include + + # Use a special profile when man calls anything groff-related. We only + # include the programs that actually parse input data in a non-trivial + # way, not wrappers such as groff and nroff, since the latter would need a + # broader profile. + /usr/bin/eqn rmCx -> &man_groff, + /usr/bin/grap rmCx -> &man_groff, + /usr/bin/pic rmCx -> &man_groff, + /usr/bin/preconv rmCx -> &man_groff, + /usr/bin/refer rmCx -> &man_groff, + /usr/bin/tbl rmCx -> &man_groff, + /usr/bin/troff rmCx -> &man_groff, + /usr/bin/vgrind rmCx -> &man_groff, + + # Similarly, use a special profile when man calls decompressors and other + # simple filters. + /bin/bzip2 rmCx -> &man_filter, + /bin/gzip rmCx -> &man_filter, + /usr/bin/col rmCx -> &man_filter, + /usr/bin/compress rmCx -> &man_filter, + /usr/bin/iconv rmCx -> &man_filter, + /usr/bin/lzip.lzip rmCx -> &man_filter, + /usr/bin/tr rmCx -> &man_filter, + /usr/bin/xz rmCx -> &man_filter, + + # Allow basically anything in terms of file system access, subject to DAC. + # The purpose of this profile isn't to confine man itself (that might be + # nice in the future, but is tricky since it's quite configurable), but to + # confine the processes it calls that parse untrusted data. + /** mrixwlk, + + capability setuid, + capability setgid, + + # Site-specific additions and overrides. See local/README for details. + #include +} + +profile man_groff { + #include + # Recent kernels revalidate open FDs, and there are often some still + # open on TTYs. This is temporary until man learns to close irrelevant + # open FDs before execve. + #include + # man always runs its groff pipeline with the input file open on stdin, + # so we can skip . + + /usr/bin/eqn rm, + /usr/bin/grap rm, + /usr/bin/pic rm, + /usr/bin/preconv rm, + /usr/bin/refer rm, + /usr/bin/tbl rm, + /usr/bin/troff rm, + /usr/bin/vgrind rm, + + /etc/groff/** r, + /usr/lib/groff/site-tmac/** r, + /usr/share/groff/** r, +} + +profile man_filter { + #include + # Recent kernels revalidate open FDs, and there are often some still + # open on TTYs. This is temporary until man learns to close irrelevant + # open FDs before execve. + #include + + /bin/bzip2 rm, + /bin/gzip rm, + /usr/bin/col rm, + /usr/bin/compress rm, + /usr/bin/iconv rm, + /usr/bin/lzip.lzip rm, + /usr/bin/tr rm, + /usr/bin/xz rm, +} diff --git a/apparmor.d/usr.sbin.named b/apparmor.d/usr.sbin.named index 43e27c0f..fc6fea5c 100644 --- a/apparmor.d/usr.sbin.named +++ b/apparmor.d/usr.sbin.named @@ -35,6 +35,9 @@ # dnscvsutil package /var/lib/dnscvsutil/compiled/** rw, + # Allow changing worker thread names + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + @{PROC}/net/if_inet6 r, @{PROC}/*/net/if_inet6 r, @{PROC}/sys/net/ipv4/ip_local_port_range r, diff --git a/apt/apt.conf.d/01autoremove b/apt/apt.conf.d/01autoremove index 3609ca49..7031df55 100644 --- a/apt/apt.conf.d/01autoremove +++ b/apt/apt.conf.d/01autoremove @@ -24,6 +24,7 @@ APT "linux-backports-modules-.*"; # tools "linux-tools"; + "linux-cloud-tools"; }; Never-MarkAuto-Sections diff --git a/apt/apt.conf.d/01autoremove-kernels b/apt/apt.conf.d/01autoremove-kernels index c956b58a..6a964fdf 100644 --- a/apt/apt.conf.d/01autoremove-kernels +++ b/apt/apt.conf.d/01autoremove-kernels @@ -1,28 +1,30 @@ // DO NOT EDIT! File autogenerated by /etc/kernel/postinst.d/apt-auto-removal APT::NeverAutoRemove { - "^linux-image-4\.9\.0-3-amd64$"; "^linux-image-4\.9\.41-v7\+$"; - "^linux-headers-4\.9\.0-3-amd64$"; + "^linux-image-4\.9\.80-v7\+$"; "^linux-headers-4\.9\.41-v7\+$"; - "^linux-image-extra-4\.9\.0-3-amd64$"; + "^linux-headers-4\.9\.80-v7\+$"; "^linux-image-extra-4\.9\.41-v7\+$"; - "^linux-signed-image-4\.9\.0-3-amd64$"; + "^linux-image-extra-4\.9\.80-v7\+$"; "^linux-signed-image-4\.9\.41-v7\+$"; - "^kfreebsd-image-4\.9\.0-3-amd64$"; + "^linux-signed-image-4\.9\.80-v7\+$"; "^kfreebsd-image-4\.9\.41-v7\+$"; - "^kfreebsd-headers-4\.9\.0-3-amd64$"; + "^kfreebsd-image-4\.9\.80-v7\+$"; "^kfreebsd-headers-4\.9\.41-v7\+$"; - "^gnumach-image-4\.9\.0-3-amd64$"; + "^kfreebsd-headers-4\.9\.80-v7\+$"; "^gnumach-image-4\.9\.41-v7\+$"; - "^.*-modules-4\.9\.0-3-amd64$"; + "^gnumach-image-4\.9\.80-v7\+$"; "^.*-modules-4\.9\.41-v7\+$"; - "^.*-kernel-4\.9\.0-3-amd64$"; + "^.*-modules-4\.9\.80-v7\+$"; "^.*-kernel-4\.9\.41-v7\+$"; - "^linux-backports-modules-.*-4\.9\.0-3-amd64$"; + "^.*-kernel-4\.9\.80-v7\+$"; "^linux-backports-modules-.*-4\.9\.41-v7\+$"; - "^linux-tools-4\.9\.0-3-amd64$"; + "^linux-backports-modules-.*-4\.9\.80-v7\+$"; "^linux-tools-4\.9\.41-v7\+$"; + "^linux-tools-4\.9\.80-v7\+$"; + "^linux-cloud-tools-4\.9\.41-v7\+$"; + "^linux-cloud-tools-4\.9\.80-v7\+$"; }; /* Debug information: # dpkg list: @@ -30,13 +32,13 @@ APT::NeverAutoRemove # list of different kernel versions: -# Installing kernel: (4.9.41-v7+) -# Running kernel: ignored (4.9.0-3-amd64) +# Installing kernel: (4.9.80-v7+) +# Running kernel: ignored (4.9.41-v7+) # Last kernel: # Previous kernel: # Kernel versions list to keep: # Kernel packages (version part) to protect: -4\.9\.0-3-amd64 4\.9\.41-v7\+ +4\.9\.80-v7\+ */ diff --git a/bash.bashrc b/bash.bashrc index 54687b1d..7fabe82a 100644 --- a/bash.bashrc +++ b/bash.bashrc @@ -16,7 +16,10 @@ if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then fi # set a fancy prompt (non-color, overwrite the one in /etc/profile) -PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ ' +# but only if not SUDOing and have SUDO_PS1 set; then assume smart user. +if ! [ -n "${SUDO_USER}" -a -n "${SUDO_PS1}" ]; then + PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ ' +fi # Commented out, don't overwrite xterm -T "title" -n "icontitle" by default. # If this is an xterm set the title to user@host:dir diff --git a/bash_completion.d/fail2ban b/bash_completion.d/fail2ban index 36e0cbba..b8887001 100644 --- a/bash_completion.d/fail2ban +++ b/bash_completion.d/fail2ban @@ -108,7 +108,7 @@ _fail2ban () { ;; logtarget) if [[ "$cmd" == "set" ]];then - COMPREPLY=( $( compgen -W "STDOUT STDERR SYSLOG" -- "$cur" ) ) + COMPREPLY=( $( compgen -W "STDOUT STDERR SYSLOG SYSOUT" -- "$cur" ) ) _filedir # And files fi return 0 diff --git a/cron.daily/apt-compat b/cron.daily/apt-compat index 095a44c4..b0b55376 100755 --- a/cron.daily/apt-compat +++ b/cron.daily/apt-compat @@ -19,9 +19,9 @@ check_power() # 255 (false) Power status could not be determined # Desktop systems always return 255 it seems if which on_ac_power >/dev/null 2>&1; then - on_ac_power - POWER=$? - if [ $POWER -eq 1 ]; then + if on_ac_power; then + : + elif [ $? -eq 1 ]; then return 1 fi fi diff --git a/dbus-1/system.d/wpa_supplicant.conf b/dbus-1/system.d/wpa_supplicant.conf index e1fb010b..e375cdc2 100644 --- a/dbus-1/system.d/wpa_supplicant.conf +++ b/dbus-1/system.d/wpa_supplicant.conf @@ -25,11 +25,9 @@ - - diff --git a/etckeeper/etckeeper.conf b/etckeeper/etckeeper.conf index 0fb660bd..f13de1c5 100644 --- a/etckeeper/etckeeper.conf +++ b/etckeeper/etckeeper.conf @@ -32,11 +32,11 @@ DARCS_COMMIT_OPTIONS="-a" #AVOID_COMMIT_BEFORE_INSTALL=1 # The high-level package manager that's being used. -# (apt, pacman, pacman-g2, yum, dnf, zypper etc) +# (apt, pacman, pacman-g2, yum, dnf, zypper, apk etc) HIGHLEVEL_PACKAGE_MANAGER=apt # The low-level package manager that's being used. -# (dpkg, rpm, pacman, pacmatic, pacman-g2, etc) +# (dpkg, rpm, pacman, pacmatic, pacman-g2, apk etc) LOWLEVEL_PACKAGE_MANAGER=dpkg # To push each commit to a remote, put the name of the remote here. diff --git a/etckeeper/list-installed.d/50list-installed b/etckeeper/list-installed.d/50list-installed index 129447f9..d89b8cee 100755 --- a/etckeeper/list-installed.d/50list-installed +++ b/etckeeper/list-installed.d/50list-installed @@ -21,5 +21,7 @@ else pacmatic -Q elif [ "$LOWLEVEL_PACKAGE_MANAGER" = pkgng ]; then pkg info -E "*" + elif [ "$LOWLEVEL_PACKAGE_MANAGER" = apk ]; then + apk info -v | sort fi fi diff --git a/etckeeper/pre-commit.d/20warn-problem-files b/etckeeper/pre-commit.d/20warn-problem-files index 4ffbfd18..6bd5c2bc 100755 --- a/etckeeper/pre-commit.d/20warn-problem-files +++ b/etckeeper/pre-commit.d/20warn-problem-files @@ -2,7 +2,7 @@ set -e exclude_internal () { - egrep -v '(^|/)(.git|.hg|.bzr|_darcs)/' + egrep -v '(^|/)(\.git|\.hg|\.bzr|_darcs)/' } if [ "$VCS" = bzr ] || [ "$VCS" = darcs ]; then diff --git a/etckeeper/pre-commit.d/30store-metadata b/etckeeper/pre-commit.d/30store-metadata index 2b77c8ed..ce014d12 100755 --- a/etckeeper/pre-commit.d/30store-metadata +++ b/etckeeper/pre-commit.d/30store-metadata @@ -1,6 +1,10 @@ #!/bin/sh set -e +# Make sure sort always sorts in same order. +LANG=C +export LANG + filter_ignore() { case "$VCS" in darcs) ignorefile=.darcsignore ;; @@ -16,7 +20,11 @@ filter_ignore() { ;; git) (git ls-files -oi --exclude-standard; git ls-files -oi --exclude-standard --directory) | sort | uniq > "$listfile" || true - sed 's/^\.\///' | grep -xFvf "$listfile" + if [ -s "$listfile" ]; then + sed 's/^\.\///' | grep -xFvf "$listfile" + else + cat - + fi ;; esac rm -f "$listfile" @@ -51,6 +59,7 @@ generate_metadata() { # Keep the sort order the same at all times. LC_COLLATE=C export LC_COLLATE + unset LC_ALL if [ "$VCS" = git ] || [ "$VCS" = hg ]; then # These version control systems do not track directories, @@ -70,45 +79,71 @@ generate_metadata() { # Store things that don't have the default user or group. # Store all file modes, in case the user has an unusual umask. - find $NOVCS \( -type f -or -type d \) -print | filter_ignore | sort | perl -ne ' - BEGIN { $q=chr(39) } - sub uidname { - my $want=shift; - if (exists $uidcache{$want}) { - return $uidcache{$want}; - } - my $name=scalar getpwuid($want); - return $uidcache{$want}=defined $name ? $name : $want; - } - sub gidname { - my $want=shift; - if (exists $gidcache{$want}) { - return $gidcache{$want}; - } - my $name=scalar getgrgid($want); - return $gidcache{$want}=defined $name ? $name : $want; - } - chomp; - my @stat=stat($_); - my $mode = $stat[2]; - my $uid = $stat[4]; - my $gid = $stat[5]; - s/$q/$q"$q"$q/g; # escape single quotes - s/^/$q/; - s/$/$q/; - if ($uid != $>) { - printf "maybe chown $q%s$q %s\n", uidname($uid), $_; - } - if ($gid != $)) { - printf "maybe chgrp $q%s$q %s\n", gidname($gid), $_; - } - printf "maybe chmod %04o %s\n", $mode & 07777, $_; - ' + find $NOVCS \( -type f -or -type d \) -print | filter_ignore | sort | maybe_chmod_chown # We don't handle xattrs. # Maybe check for getfattr/setfattr and use them if they're available? } +maybe_chmod_chown() { + if [ "$(which perl 2>/dev/null)" != "" ]; then + perl -ne ' + BEGIN { $q=chr(39) } + sub uidname { + my $want=shift; + if (exists $uidcache{$want}) { + return $uidcache{$want}; + } + my $name=scalar getpwuid($want); + return $uidcache{$want}=defined $name ? $name : $want; + } + sub gidname { + my $want=shift; + if (exists $gidcache{$want}) { + return $gidcache{$want}; + } + my $name=scalar getgrgid($want); + return $gidcache{$want}=defined $name ? $name : $want; + } + chomp; + my @stat=stat($_); + my $mode = $stat[2]; + my $uid = $stat[4]; + my $gid = $stat[5]; + s/$q/$q"$q"$q/g; # escape single quotes + s/^/$q/; + s/$/$q/; + if ($uid != $>) { + printf "maybe chown $q%s$q %s\n", uidname($uid), $_; + } + if ($gid != $)) { + printf "maybe chgrp $q%s$q %s\n", gidname($gid), $_; + } + printf "maybe chmod %04o %s\n", $mode & 07777, $_; + ' + return $? + else + # fallback if perl isn't present + euid=$(id -u) + egid=$(id -g) + q="'" + while read x; do + stat=$(stat -c "%f:%u:%g:%a:%U:%G" $x) + IFS=":" read mode uid gid perm uname gname < +# +# --ciphers ecdhe_ecdsa_aes_256_sha is used to workaround a +# "NSS error -12286" from curl as it attempts to connect using +# SSLv3. See https://www.centos.org/forums/viewtopic.php?t=52732 +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = curl --fail --ciphers ecdhe_ecdsa_aes_256_sha --data 'key=' --data-urlencode 'comment=' --data 'ip=' --data 'category=' "https://www.abuseipdb.com/report/json" + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = + +[Init] +# Option: abuseipdb_apikey +# Notes Your API key from abuseipdb.com +# Values: STRING Default: None +# Register for abuseipdb [https://www.abuseipdb.com], get api key and set below. +# You will need to set the catagory in the action call. +abuseipdb_apikey = diff --git a/fail2ban/action.d/badips.py b/fail2ban/action.d/badips.py index 4bc879a1..473fbf33 100644 --- a/fail2ban/action.d/badips.py +++ b/fail2ban/action.d/badips.py @@ -34,7 +34,7 @@ else: from fail2ban.server.actions import ActionBase -class BadIPsAction(ActionBase): +class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable """Fail2Ban action which reports bans to badips.com, and also blacklist bad IPs listed on badips.com by using another action's ban method. @@ -105,6 +105,16 @@ class BadIPsAction(ActionBase): # Used later for threading.Timer for updating badips self._timer = None + @staticmethod + def isAvailable(timeout=1): + try: + response = urlopen(Request("/".join([BadIPsAction._badips]), + headers={'User-Agent': "Fail2Ban"}), timeout=timeout) + return True, '' + except Exception as e: # pragma: no cover + return False, e + + def getCategories(self, incParents=False): """Get badips.com categories. diff --git a/fail2ban/action.d/bsd-ipfw.conf b/fail2ban/action.d/bsd-ipfw.conf index 8b0a51aa..cbd6a15d 100644 --- a/fail2ban/action.d/bsd-ipfw.conf +++ b/fail2ban/action.d/bsd-ipfw.conf @@ -14,7 +14,7 @@ # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = ipfw show | fgrep -q 'table()' || ( ipfw show | awk 'BEGIN { b = 1 } { if ($1 <= b) { b = $1 + 1 } else { e = b } } END { if (e) exit e
else exit b }'; num=$?; ipfw -q add $num from table\(
\) to me ; echo $num > "" ) +actionstart = ipfw show | fgrep -c -m 1 -s 'table(
)' > /dev/null 2>&1 || ( ipfw show | awk 'BEGIN { b = } { if ($1 < b) {} else if ($1 == b) { b = $1 + 1 } else { e = b } } END { if (e) exit e
else exit b }'; num=$?; ipfw -q add $num from table\(
\) to me ; echo $num > "" ) # Option: actionstop @@ -81,3 +81,11 @@ block = ip # Values: STRING # blocktype = unreach port + +# Option: lowest_rule_num +# Notes: When fail2ban starts with action and there is no rule for the given table yet +# then fail2ban will start looking for an empty slot starting with this rule number. +# Values: NUM +lowest_rule_num = 111 + + diff --git a/fail2ban/action.d/cloudflare.conf b/fail2ban/action.d/cloudflare.conf index aa87163c..89df5b9e 100644 --- a/fail2ban/action.d/cloudflare.conf +++ b/fail2ban/action.d/cloudflare.conf @@ -40,7 +40,12 @@ actioncheck = #