committing changes in /etc after apt run
Package changes: -adduser 3.116 all +adduser 3.117 all -apt 1.6~alpha3 armhf -apt-listchanges 3.14 all -apt-utils 1.6~alpha3 armhf -aptitude 0.8.9-1 armhf -aptitude-common 0.8.9-1 all -avahi-daemon 0.7-3 armhf -base-files 10+rpi1 armhf +apt 1.6~beta1 armhf +apt-listchanges 3.16 all +apt-utils 1.6~beta1 armhf +aptitude 0.8.10-6 armhf +aptitude-common 0.8.10-6 all +avahi-daemon 0.7-3.1+b1 armhf +base-files 10.1+rpi1 armhf -bash 4.4-5 armhf -bash-completion 1:2.1-4.3 all -bind9 1:9.10.3.dfsg.P4-12.6 armhf -bind9-host 1:9.10.3.dfsg.P4-12.6 armhf -bind9utils 1:9.10.3.dfsg.P4-12.6 armhf -binutils 2.29.1-6+rpi1 armhf -binutils-arm-linux-gnueabihf 2.29.1-6+rpi1 armhf -binutils-common 2.29.1-6+rpi1 armhf +bash 4.4.18-1.1 armhf +bash-completion 1:2.7-1 all +bind9 1:9.11.2.P1-1 armhf +bind9-host 1:9.11.2.P1-1 armhf +bind9utils 1:9.11.2.P1-1 armhf +binutils 2.30-7+rpi1 armhf +binutils-arm-linux-gnueabihf 2.30-7+rpi1 armhf +binutils-common 2.30-7+rpi1 armhf -bluez 5.47-1 armhf -bluez-firmware 1.2-3+rpi2 all -bridge-utils 1.5-14 armhf +bluez 5.47-1+b3 armhf +bluez-firmware 1.2-3+rpt4.1 all +bridge-utils 1.5-15 armhf -bsdmainutils 9.0.14 armhf -bsdutils 1:2.30.2-0.1 armhf +bsdmainutils 11.1.2 armhf +bsdutils 1:2.31.1-0.4 armhf -certbot 0.19.0-1 all +certbot 0.21.1-1 all -console-setup 1.170 all -console-setup-linux 1.170 all -coreutils 8.26-3 armhf -cpio 2.11+dfsg-6 armhf +console-setup 1.178 all +console-setup-linux 1.178 all +coreutils 8.28-1 armhf +cpio 2.12+dfsg-6 armhf -cpp-6 6.4.0-6 armhf -cpp-7 7.2.0-12 armhf +cpp-6 6.4.0-12+rpi1 armhf +cpp-7 7.3.0-5 armhf -curl 7.56.1-1 armhf -dash 0.5.8-2.5 armhf -dbus 1.12.0-1 armhf -dc 1.06.95-9 armhf -debconf 1.5.64 all -debconf-i18n 1.5.64 all -debconf-utils 1.5.64 all -debianutils 4.8.2 armhf +curl 7.58.0-2 armhf +dash 0.5.8-2.10 armhf +dbus 1.12.6-2 armhf +dc 1.07.1-1 armhf +debconf 1.5.66 all +debconf-i18n 1.5.66 all +debconf-utils 1.5.66 all +debianutils 4.8.4 armhf -dhcpcd5 1:6.11.5-1+rpt2 armhf +dhcpcd5 1:6.11.5-1+rpt4 armhf -dirmngr 2.2.1-5 armhf +dirmngr 2.2.5-1 armhf -dmsetup 2:1.02.142-1 armhf -dnsutils 1:9.10.3.dfsg.P4-12.6 armhf +dmsetup 2:1.02.145-4.1 armhf +dnsutils 1:9.11.2.P1-1 armhf -dpkg 1.19.0.4 armhf -dpkg-dev 1.19.0.4 all -e2fslibs 1.43.7-1 armhf -e2fsprogs 1.43.7-1 armhf -e2fsprogs-l10n 1.43.7-1 all +dpkg 1.19.0.5 armhf +dpkg-dev 1.19.0.5 all +e2fslibs 1.44.0-1 armhf +e2fsprogs 1.44.0-1 armhf +e2fsprogs-l10n 1.44.0-1 all -elinks 0.12~pre6-12+b1 armhf -elinks-data 0.12~pre6-12 all -etckeeper 1.18.5-1 all -exim4-base 4.89-7 armhf -exim4-config 4.89-7 all -exim4-daemon-light 4.89-7 armhf -eyed3 0.8-1 all -fail2ban 0.9.7-2 all +elinks 0.12~pre6-13 armhf +elinks-data 0.12~pre6-13 all +etckeeper 1.18.7-1 all +exim4-base 4.90.1-1 armhf +exim4-config 4.90.1-1 all +exim4-daemon-light 4.90.1-1 armhf +eyed3 0.8.4-2 all +fail2ban 0.10.2-1 all -fakeroot 1.22-1 armhf -fbset 2.1-29 armhf -fdisk 2.30.2-0.1 armhf -file 1:5.32-1 armhf -findutils 4.6.0+git+20170729-2 armhf -firmware-atheros 1:20161130-3+rpi2 all -firmware-brcm80211 1:20161130-3+rpi2 all -firmware-libertas 1:20161130-3+rpi2 all -firmware-misc-nonfree 1:20161130-3+rpi2 all -firmware-realtek 1:20161130-3+rpi2 all -fontconfig-config 2.12.3-0.2 all +fakeroot 1.22-2 armhf +fbset 2.1-30 armhf +fdisk 2.31.1-0.4 armhf +file 1:5.32-2 armhf +findutils 4.6.0+git+20170828-2 armhf +firmware-atheros 1:20161130-3+rpt3 all +firmware-brcm80211 1:20161130-3+rpt3 all +firmware-libertas 1:20161130-3+rpt3 all +firmware-misc-nonfree 1:20161130-3+rpt3 all +firmware-realtek 1:20161130-3+rpt3 all +fontconfig-config 2.12.6-0.1 all -g++-7 7.2.0-12 armhf -gawk 1:4.1.4+dfsg-1 armhf +g++-7 7.3.0-5 armhf +gawk 1:4.1.4+dfsg-1+b1 armhf -gcc-4.9-base 4.9.3-14 armhf -gcc-5-base 5.4.1-4 armhf -gcc-6 6.4.0-6 armhf -gcc-6-base 6.4.0-6 armhf -gcc-7 7.2.0-12 armhf -gcc-7-base 7.2.0-12 armhf -gdb 7.12-6 armhf -geoip-database 20170928-1 all +gcc-4.9-base 4.9.4-2+rpi1 armhf +gcc-5-base 5.5.0-8 armhf +gcc-6 6.4.0-12+rpi1 armhf +gcc-6-base 6.4.0-12+rpi1 armhf +gcc-7 7.3.0-5 armhf +gcc-7-base 7.3.0-5 armhf +gcc-8-base 8-20180218-1+rpi1 armhf +gdb 7.12-6+b1 armhf +geoip-database 20180215-1 all -gir1.2-glib-2.0 1.54.1-2 armhf -git 1:2.14.2-1 armhf -git-man 1:2.14.2-1 all -gnupg 2.2.1-5 armhf -gnupg-agent 2.2.1-5 all -gnupg-l10n 2.2.1-5 all -gnupg-utils 2.2.1-5 armhf -gpg 2.2.1-5 armhf -gpg-agent 2.2.1-5 armhf -gpg-wks-client 2.2.1-5 armhf -gpg-wks-server 2.2.1-5 armhf -gpgconf 2.2.1-5 armhf -gpgsm 2.2.1-5 armhf -gpgv 2.2.1-5 armhf +gir1.2-glib-2.0 1.54.1-4 armhf +git 1:2.16.2-1 armhf +git-man 1:2.16.2-1 all +gnupg 2.2.5-1 armhf +gnupg-agent 2.2.5-1 all +gnupg-l10n 2.2.5-1 all +gnupg-utils 2.2.5-1 armhf +gpg 2.2.5-1 armhf +gpg-agent 2.2.5-1 armhf +gpg-wks-client 2.2.5-1 armhf +gpg-wks-server 2.2.5-1 armhf +gpgconf 2.2.5-1 armhf +gpgsm 2.2.5-1 armhf +gpgv 2.2.5-1 armhf -groff-base 1.22.3-9 armhf +groff-base 1.22.3-10 armhf -hostname 3.18 armhf -htop 2.0.2-1 armhf -i2c-tools 3.1.2-3+b1 armhf -id3tool 1.2a-7 armhf -id3v2 0.1.12-3 armhf -ifupdown 0.8.29 armhf -info 6.5.0.dfsg.1-1 armhf +hostname 3.20 armhf +htop 2.1.0-3 armhf +i2c-tools 4.0-2 armhf +id3tool 1.2a-8 armhf +id3v2 0.1.12+dfsg-1 armhf +ifupdown 0.8.31 armhf +info 6.5.0.dfsg.1-2 armhf -install-info 6.5.0.dfsg.1-1 armhf +install-info 6.5.0.dfsg.1-2 armhf -iproute2 4.9.0-2 armhf -iptables 1.6.1-2+b1 armhf +iproute2 4.15.0-2 armhf +iptables 1.6.2-1 armhf -isc-dhcp-client 4.3.5-3 armhf -isc-dhcp-common 4.3.5-3+b1 armhf -isc-dhcp-server 4.3.5-3 armhf -iso-codes 3.76-1 all -iw 4.9-0.1 armhf +isc-dhcp-client 4.3.5-3.1 armhf +isc-dhcp-common 4.3.5-3.1 armhf +isc-dhcp-server 4.3.5-3.1 armhf +iso-codes 3.79-1 all +iw 4.14-0.1 armhf -keyboard-configuration 1.170 all -keyutils 1.5.9-9 armhf -klibc-utils 2.0.4-9+rpi1 armhf -kmod 24-1 armhf -less 481-2.1 armhf +keyboard-configuration 1.178 all +keyutils 1.5.9-9.2 armhf +klibc-utils 2.0.4-11+rpi1 armhf +kmod 25-1 armhf +less 487-0.1 armhf -libalgorithm-diff-xs-perl 0.04-4+b3 armhf +libalgorithm-diff-xs-perl 0.04-5 armhf -libapparmor1 2.11.1-2 armhf -libapt-inst2.0 1.6~alpha3 armhf -libapt-pkg5.0 1.6~alpha3 armhf -libasan3 6.4.0-6 armhf -libasan4 7.2.0-12 armhf +libapparmor1 2.12-3 armhf +libapt-inst2.0 1.6~beta1 armhf +libapt-pkg5.0 1.6~beta1 armhf +libargon2-0 0~20161029-1.1 armhf +libasan3 6.4.0-12+rpi1 armhf +libasan4 7.3.0-5 armhf -libassuan0 2.4.3-3 armhf -libatomic1 7.2.0-12 armhf +libassuan0 2.5.1-2 armhf +libatomic1 8-20180218-1+rpi1 armhf -libaudit-common 1:2.8.1-1 all -libaudit1 1:2.8.1-1 armhf +libaudit-common 1:2.8.2-1 all +libaudit1 1:2.8.2-1 armhf -libavahi-common-data 0.7-3 armhf -libavahi-common3 0.7-3 armhf -libavahi-core7 0.7-3 armhf -libbabeltrace-ctf1 1.5.3-4 all -libbabeltrace1 1.5.3-4 armhf +libavahi-common-data 0.7-3.1+b1 armhf +libavahi-common3 0.7-3.1+b1 armhf +libavahi-core7 0.7-3.1+b1 armhf +libbabeltrace-ctf1 1.5.4-1 all +libbabeltrace1 1.5.4-1 armhf -libbinutils 2.29.1-6+rpi1 armhf +libbind9-160 1:9.11.2.P1-1 armhf +libbinutils 2.30-7+rpi1 armhf -libblkid1 2.30.2-0.1 armhf -libboost-filesystem1.62.0 1.62.0+dfsg-4+b2 armhf +libblkid1 2.31.1-0.4 armhf +libboost-filesystem1.62.0 1.62.0+dfsg-5 armhf -libboost-iostreams1.62.0 1.62.0+dfsg-4+b2 armhf -libboost-system1.62.0 1.62.0+dfsg-4+b2 armhf -libbsd0 0.8.6-2 armhf +libboost-iostreams1.62.0 1.62.0+dfsg-5 armhf +libboost-system1.62.0 1.62.0+dfsg-5 armhf +libbsd0 0.8.7-1 armhf -libc-bin 2.24-17 armhf -libc-dev-bin 2.24-17 armhf -libc-l10n 2.24-17 all -libc6 2.24-17 armhf -libc6-dbg 2.24-17 armhf -libc6-dev 2.24-17 armhf +libc-bin 2.27-1+rpi1 armhf +libc-dev-bin 2.27-1+rpi1 armhf +libc-l10n 2.27-1+rpi1 all +libc6 2.27-1+rpi1 armhf +libc6-dbg 2.27-1+rpi1 armhf +libc6-dev 2.27-1+rpi1 armhf -libcap2 1:2.25-1.1 armhf -libcap2-bin 1:2.25-1.1 armhf -libcc1-0 7.2.0-12 armhf -libcilkrts5 7.2.0-12 armhf -libcomerr2 1.43.7-1 armhf +libcap2 1:2.25-1.2 armhf +libcap2-bin 1:2.25-1.2 armhf +libcc1-0 8-20180218-1+rpi1 armhf +libcilkrts5 7.3.0-5 armhf +libcom-err2 1.44.0-1 armhf +libcomerr2 1.44.0-1 armhf +libcryptsetup12 2:2.0.1-1 armhf -libcurl3 7.56.1-1 armhf -libcurl3-gnutls 7.56.1-1 armhf -libcwidget3v5 0.5.17-6 armhf +libcurl3 7.58.0-2 armhf +libcurl3-gnutls 7.58.0-2 armhf +libcwidget3v5 0.5.17-7 armhf -libdbus-1-3 1.12.0-1 armhf -libdbus-glib-1-2 0.108-2 armhf -libdebconfclient0 0.232 armhf -libdevmapper1.02.1 2:1.02.142-1 armhf +libdbus-1-3 1.12.6-2 armhf +libdbus-glib-1-2 0.110-2 armhf +libdebconfclient0 0.241 armhf +libdevmapper1.02.1 2:1.02.145-4.1 armhf +libdns-export169 1:9.11.2.P1-1 armhf -libdpkg-perl 1.19.0.4 all -libdrm-common 2.4.85-1+rpi1 all -libdrm2 2.4.85-1+rpi1 armhf -libdw1 0.170-0.1 armhf +libdns169 1:9.11.2.P1-1 armhf +libdpkg-perl 1.19.0.5 all +libdrm-common 2.4.90-1+rpi1 all +libdrm2 2.4.90-1+rpi1 armhf +libdw1 0.170-0.3 armhf -libelf1 0.170-0.1 armhf +libelf1 0.170-0.3 armhf -libexpat1 2.2.3-1 armhf -libexpat1-dev 2.2.3-1 armhf -libfakeroot 1.22-1 armhf -libfastjson4 0.99.7-1 armhf -libfdisk1 2.30.2-0.1 armhf -libffi6 3.2.1-6 armhf -libfftw3-single3 3.3.6p2-2 armhf +libexpat1 2.2.5-3 armhf +libexpat1-dev 2.2.5-3 armhf +libext2fs2 1.44.0-1 armhf +libfakeroot 1.22-2 armhf +libfastjson4 0.99.8-2 armhf +libfdisk1 2.31.1-0.4 armhf +libffi6 3.2.1-8 armhf +libfftw3-single3 3.3.7-1 armhf -libfontconfig1 2.12.3-0.2 armhf -libfreetype6 2.8.1-0.1 armhf -libfreetype6-dev 2.8.1-0.1 armhf +libfontconfig1 2.12.6-0.1 armhf +libfreetype6 2.8.1-2 armhf +libfreetype6-dev 2.8.1-2 armhf -libgcc-6-dev 6.4.0-6 armhf -libgcc-7-dev 7.2.0-12 armhf -libgcc1 1:7.2.0-12 armhf -libgcrypt20 1.7.9-1 armhf +libgcc-6-dev 6.4.0-12+rpi1 armhf +libgcc-7-dev 7.3.0-5 armhf +libgcc1 1:8-20180218-1+rpi1 armhf +libgcrypt20 1.8.1-4 armhf +libgdbm-compat4 1.14.1-4 armhf -libgeoip1 1.6.11-2 armhf -libgfortran4 7.2.0-12 armhf -libgirepository-1.0-1 1.54.1-2 armhf -libglib2.0-0 2.54.1-1 armhf -libglib2.0-data 2.54.1-1 all -libgmp10 2:6.1.2+dfsg-1.1 armhf -libgnutls30 3.5.16-1 armhf -libgomp1 7.2.0-12 armhf -libgpg-error0 1.27-4 armhf -libgpm2 1.20.4-6.2 armhf -libgssapi-krb5-2 1.15.2-2 armhf -libhogweed4 3.3-2 armhf +libgdbm5 1.14.1-4 armhf +libgeoip1 1.6.12-1 armhf +libgfortran4 7.3.0-5 armhf +libgirepository-1.0-1 1.54.1-4 armhf +libglib2.0-0 2.54.3-2 armhf +libglib2.0-data 2.54.3-2 all +libgmp10 2:6.1.2+dfsg-3 armhf +libgnutls30 3.5.18-1 armhf +libgomp1 8-20180218-1+rpi1 armhf +libgpg-error0 1.27-6 armhf +libgpm2 1.20.7-5 armhf +libgssapi-krb5-2 1.16-2 armhf +libhogweed4 3.4-1 armhf -libhtml-tree-perl 5.03-2 all -libhttp-cookies-perl 6.01-1 all +libhtml-tree-perl 5.07-1 all +libhttp-cookies-perl 6.04-1 all -libhttp-message-perl 6.13-1 all +libhttp-message-perl 6.14-1 all +libi2c0 4.0-2 armhf -libidn11 1.33-2 armhf -libidn2-0 2.0.2-5 armhf +libidn11 1.33-2.1 armhf +libidn2-0 2.0.4-1.1 armhf -libio-socket-ssl-perl 2.052-1 all -libip4tc0 1.6.1-2+b1 armhf -libip6tc0 1.6.1-2+b1 armhf -libiptc0 1.6.1-2+b1 armhf +libio-socket-ssl-perl 2.056-1 all +libip4tc0 1.6.2-1 armhf +libip6tc0 1.6.2-1 armhf +libiptc0 1.6.2-1 armhf +libirs-export160 1:9.11.2.P1-1 armhf +libirs160 1:9.11.2.P1-1 armhf +libisc-export166 1:9.11.2.P1-1 armhf +libisc166 1:9.11.2.P1-1 armhf +libisccc160 1:9.11.2.P1-1 armhf +libisccfg-export160 1:9.11.2.P1-1 armhf +libisccfg160 1:9.11.2.P1-1 armhf -libjim0.77 0.77-2 armhf -libjpeg62-turbo 1:1.5.2-2 armhf +libjim0.77 0.77+dfsg0-2 armhf +libjpeg62-turbo 1:1.5.2-2+b1 armhf -libjs-sphinxdoc 1.6.5-2 all +libjs-sphinxdoc 1.6.7-1 all -libk5crypto3 1.15.2-2 armhf -libkeyutils1 1.5.9-9 armhf -libklibc 2.0.4-9+rpi1 armhf -libkmod2 24-1 armhf -libkrb5-3 1.15.2-2 armhf -libkrb5support0 1.15.2-2 armhf +libjson-c3 0.12.1-1.3 armhf +libk5crypto3 1.16-2 armhf +libkeyutils1 1.5.9-9.2 armhf +libklibc 2.0.4-11+rpi1 armhf +libkmod2 25-1 armhf +libkrb5-3 1.16-2 armhf +libkrb5support0 1.16-2 armhf +liblmdb0 0.9.21-1 armhf -liblockfile-bin 1.14-1 armhf -liblockfile1 1.14-1 armhf -liblogging-stdlog0 1.0.6-1 armhf +liblockfile-bin 1.14-1.1 armhf +liblockfile1 1.14-1.1 armhf +liblogging-stdlog0 1.0.6-3 armhf +liblwres160 1:9.11.2.P1-1 armhf -libmagic-mgc 1:5.32-1 armhf -libmagic1 1:5.32-1 armhf +libmagic-mgc 1:5.32-2 armhf +libmagic1 1:5.32-2 armhf -libmount1 2.30.2-0.1 armhf -libmpc3 1.0.3-2 armhf +libmount1 2.31.1-0.4 armhf +libmpc3 1.1.0-1 armhf +libmpfr6 4.0.0-7 armhf -libncurses5 6.0+20170902-1 armhf -libncursesw5 6.0+20170902-1 armhf +libncurses5 6.1-1 armhf +libncursesw5 6.1-1 armhf -libnet-ssleay-perl 1.80-1+b1 armhf +libnet-ssleay-perl 1.84-1 armhf -libnettle6 3.3-2 armhf -libnewt0.52 0.52.20-1+b1 armhf +libnettle6 3.4-1 armhf +libnewt0.52 0.52.20-3 armhf -libnghttp2-14 1.27.0-1 armhf -libnginx-mod-http-auth-pam 1.13.6-2 armhf -libnginx-mod-http-dav-ext 1.13.6-2 armhf -libnginx-mod-http-echo 1.13.6-2 armhf -libnginx-mod-http-geoip 1.13.6-2 armhf -libnginx-mod-http-image-filter 1.13.6-2 armhf -libnginx-mod-http-subs-filter 1.13.6-2 armhf -libnginx-mod-http-upstream-fair 1.13.6-2 armhf -libnginx-mod-http-xslt-filter 1.13.6-2 armhf -libnginx-mod-mail 1.13.6-2 armhf -libnginx-mod-stream 1.13.6-2 armhf -libnih-dbus1 1.0.3-8 armhf -libnih1 1.0.3-8 armhf +libnghttp2-14 1.31.0-1 armhf +libnginx-mod-http-auth-pam 1.13.9-1 armhf +libnginx-mod-http-dav-ext 1.13.9-1 armhf +libnginx-mod-http-echo 1.13.9-1 armhf +libnginx-mod-http-geoip 1.13.9-1 armhf +libnginx-mod-http-image-filter 1.13.9-1 armhf +libnginx-mod-http-subs-filter 1.13.9-1 armhf +libnginx-mod-http-upstream-fair 1.13.9-1 armhf +libnginx-mod-http-xslt-filter 1.13.9-1 armhf +libnginx-mod-mail 1.13.9-1 armhf +libnginx-mod-stream 1.13.9-1 armhf +libnih-dbus1 1.0.3-10+b9 armhf +libnih1 1.0.3-10+b9 armhf -libnpth0 1.5-2 armhf +libnpth0 1.5-3 armhf +libnss-systemd 237-3+b1 armhf -libpam-modules 1.1.8-3.6+rpi1 armhf -libpam-modules-bin 1.1.8-3.6+rpi1 armhf -libpam-runtime 1.1.8-3.6+rpi1 all -libpam-systemd 235-2 armhf -libpam0g 1.1.8-3.6+rpi1 armhf -libparted2 3.2-18 armhf -libpcap0.8 1.8.1-5 armhf -libpcre2-8-0 10.22-3 armhf -libpcre3 2:8.39-4 armhf -libpcsclite1 1.8.22-1 armhf -libperl5.26 5.26.1-2 armhf -libpipeline1 1.4.2-1 armhf -libplymouth4 0.9.3-1 armhf +libpam-modules 1.1.8-3.7 armhf +libpam-modules-bin 1.1.8-3.7 armhf +libpam-runtime 1.1.8-3.7 all +libpam-systemd 237-3+b1 armhf +libpam0g 1.1.8-3.7 armhf +libparted2 3.2-20 armhf +libpcap0.8 1.8.1-6 armhf +libpcre2-8-0 10.31-3 armhf +libpcre3 2:8.39-9 armhf +libpcsclite1 1.8.23-1 armhf +libperl5.26 5.26.1-5 armhf +libpipeline1 1.5.0-1 armhf +libplymouth4 0.9.3-2 armhf -libprocps6 2:3.3.12-3 armhf -libpsl5 0.18.0-4 armhf -libpython-stdlib 2.7.14-1 armhf -libpython2.7-minimal 2.7.14-2 armhf -libpython2.7-stdlib 2.7.14-2 armhf -libpython3-dev 3.6.3-2 armhf -libpython3-stdlib 3.6.3-2 armhf +libprocps6 2:3.3.12-4 armhf +libpsl5 0.19.1-5 armhf +libpython-stdlib 2.7.14-4 armhf +libpython2.7-minimal 2.7.14-6 armhf +libpython2.7-stdlib 2.7.14-6 armhf +libpython3-dev 3.6.4-1 armhf +libpython3-stdlib 3.6.4-1 armhf -libpython3.6 3.6.3-1 armhf -libpython3.6-dev 3.6.3-1 armhf -libpython3.6-minimal 3.6.3-1 armhf -libpython3.6-stdlib 3.6.3-1 armhf -libraspberrypi-bin 1.20170811-1 armhf -libraspberrypi-dev 1.20170811-1 armhf -libraspberrypi-doc 1.20170811-1 armhf -libraspberrypi0 1.20170811-1 armhf +libpython3.6 3.6.4-4 armhf +libpython3.6-dev 3.6.4-4 armhf +libpython3.6-minimal 3.6.4-4 armhf +libpython3.6-stdlib 3.6.4-4 armhf +libraspberrypi-bin 1.20180313-1 armhf +libraspberrypi-dev 1.20180313-1 armhf +libraspberrypi-doc 1.20180313-1 armhf +libraspberrypi0 1.20180313-1 armhf -libruby2.3 2.3.3-1+deb9u1+rpi1 armhf -libsamplerate0 0.1.9-1 armhf +libruby2.3 2.3.6-2+rpi1 armhf +libruby2.5 2.5.0-6+rpi1 armhf +libsamplerate0 0.1.9-2 armhf -libsigsegv2 2.11-1 armhf -libslang2 2.3.1a-1 armhf -libsmartcols1 2.30.2-0.1 armhf -libsqlite3-0 3.20.1-2 armhf -libss2 1.43.7-1 armhf +libsigsegv2 2.12-1 armhf +libslang2 2.3.2-1 armhf +libsmartcols1 2.31.1-0.4 armhf +libsqlite3-0 3.22.0-1 armhf +libss2 1.44.0-1 armhf -libssl1.0.2 1.0.2l-2 armhf +libssl1.0.2 1.0.2n-1 armhf -libstdc++-7-dev 7.2.0-12 armhf -libstdc++6 7.2.0-12 armhf +libstdc++-7-dev 7.3.0-5 armhf +libstdc++6 8-20180218-1+rpi1 armhf -libsystemd0 235-2 armhf +libsystemd0 237-3+b1 armhf -libtasn1-6 4.12-2.1 armhf -libtcl8.6 8.6.7+dfsg-1 armhf +libtasn1-6 4.13-2 armhf +libtcl8.6 8.6.8+dfsg-3 armhf -libtiff5 4.0.8-6 armhf +libtiff5 4.0.9-4 armhf -libtinfo5 6.0+20170902-1 armhf +libtinfo5 6.1-1 armhf -libtry-tiny-perl 0.28-1 all -libubsan0 7.2.0-12 armhf +libtry-tiny-perl 0.30-1 all +libubsan0 7.3.0-5 armhf -libudev1 235-2 armhf +libudev1 237-3+b1 armhf -libunistring2 0.9.7-2 armhf -liburi-perl 1.72-2 all +libunistring2 0.9.8-1 armhf +liburi-perl 1.73-1 all -libuuid1 2.30.2-0.1 armhf -libv4l-0 1.12.5-1 armhf -libv4l2rds0 1.12.5-1 armhf -libv4lconvert0 1.12.5-1 armhf -libwbclient0 2:4.7.0+dfsg-2 armhf -libwebp6 0.6.0-3 armhf +libuuid1 2.31.1-0.4 armhf +libv4l-0 1.14.2-1 armhf +libv4l2rds0 1.14.2-1 armhf +libv4lconvert0 1.14.2-1 armhf +libwbclient0 2:4.7.4+dfsg-2 armhf +libwebp6 0.6.1-2 armhf -libwww-perl 6.27-1 all +libwww-perl 6.31-1 all -libxcb1 1.12-1 armhf +libxcb1 1.13-1 armhf -libxml2 2.9.4+dfsg1-5 armhf +libxml2 2.9.4+dfsg1-6.1 armhf -libxslt1.1 1.1.29-2.2 armhf -libxtables12 1.6.1-2+b1 armhf +libxslt1.1 1.1.29-5 armhf +libxtables12 1.6.2-1 armhf -linux-libc-dev 4.9.51-1+rpi3+b1 armhf -locales 2.24-17 all +linux-libc-dev 4.15.4-1+rpi1 armhf +locales 2.27-1+rpi1 all -man-db 2.7.6.1-2 armhf -manpages 4.13-3 all -manpages-dev 4.13-3 all +man-db 2.8.2-1 armhf +manpages 4.15-1 all +manpages-dev 4.15-1 all -mount 2.30.2-0.1 armhf +mount 2.31.1-0.4 armhf -multiarch-support 2.24-17 armhf +multiarch-support 2.27-1+rpi1 armhf -nano 2.8.7-1 armhf +nano 2.9.3-2 armhf -ncurses-base 6.0+20170902-1 all -ncurses-bin 6.0+20170902-1 armhf -ncurses-term 6.0+20170902-1 all +ncurses-base 6.1-1 all +ncurses-bin 6.1-1 armhf +ncurses-term 6.1-1 all -net-tools 1.60+git20161116.90da8a0-1 armhf +net-tools 1.60+git20161116.90da8a0-2 armhf -netcat-openbsd 1.178-3 armhf +netcat-openbsd 1.187-1 armhf -nfs-common 1:1.3.4-2.1+b1 armhf -nginx 1.13.6-2 all -nginx-common 1.13.6-2 all -nginx-full 1.13.6-2 armhf +nfs-common 1:1.3.4-2.2 armhf +nginx-common 1.13.9-1 all -openssh-client 1:7.6p1-2 armhf -openssh-server 1:7.6p1-2 armhf -openssh-sftp-server 1:7.6p1-2 armhf +openssh-client 1:7.6p1-4 armhf +openssh-server 1:7.6p1-4 armhf +openssh-sftp-server 1:7.6p1-4 armhf -parted 3.2-18 armhf +parted 3.2-20 armhf -patch 2.7.5-1 armhf +patch 2.7.6-1 armhf -perl 5.26.1-2 armhf -perl-base 5.26.1-2 armhf -perl-modules-5.26 5.26.1-2 all +perl 5.26.1-5 armhf +perl-base 5.26.1-5 armhf +perl-modules-5.26 5.26.1-5 all -pi-bluetooth 0.1.6 armhf -pinentry-curses 1.0.0-3 armhf +pi-bluetooth 0.1.7 all +pinentry-curses 1.1.0-1 armhf -plymouth 0.9.3-1 armhf +plymouth 0.9.3-2 armhf -procps 2:3.3.12-3 armhf +procps 2:3.3.12-4 armhf -python 2.7.14-1 armhf -python-acme 0.19.0-1 all +python 2.7.14-4 armhf +python-acme 0.21.1-1 all -python-asn1crypto 0.22.0-1 all +python-asn1crypto 0.24.0-1 all -python-certbot 0.19.0-1 all -python-certifi 2017.7.27.1-2 all -python-cffi-backend 1.9.1-2+b1 armhf +python-certifi 2018.1.18-2 all +python-cffi-backend 1.11.5-1 armhf -python-cryptography 1.9-1 armhf -python-enum34 1.1.6-1 all -python-eyed3 0.8-1 all -python-funcsigs 1.0.2-3 all +python-cryptography 2.1.4-1 armhf +python-enum34 1.1.6-2 all +python-eyed3 0.8.4-2 all +python-funcsigs 1.0.2-4 all -python-idna 2.5-1 all +python-idna 2.6-1 all +python-josepy 1.0.1-1 all -python-minimal 2.7.14-1 armhf +python-magic 2:0.4.15-1 all +python-minimal 2.7.14-4 armhf -python-newt 0.52.20-1+b1 armhf -python-openssl 16.2.0-1 all +python-newt 0.52.20-3 armhf +python-openssl 17.5.0-1 all -python-pbr 3.1.1-2 all -python-pip-whl 9.0.1-2+rpt1 all -python-pkg-resources 36.6.0-1 all +python-pbr 3.1.1-4 all +python-pip-whl 9.0.1-2+rpt2 all +python-pkg-resources 38.5.2-1 all -python-requests 2.18.1-1 all +python-requests 2.18.4-2 all -python-setuptools 36.6.0-1 all -python-six 1.11.0-1 all -python-tz 2017.2-2 all -python-urllib3 1.21.1-1 all +python-setuptools 38.5.2-1 all +python-six 1.11.0-2 all +python-tz 2018.3-2 all +python-urllib3 1.22-1 all -python2.7 2.7.14-2 armhf -python2.7-minimal 2.7.14-2 armhf -python3 3.6.3-2 armhf +python2.7 2.7.14-6 armhf +python2.7-minimal 2.7.14-6 armhf +python3 3.6.4-1 armhf +python3-acme 0.21.1-1 all -python3-asn1crypto 0.22.0-1 all -python3-cffi-backend 1.9.1-2+b1 armhf -python3-crypto 2.6.1-7+b1 armhf -python3-cryptography 1.9-1 armhf -python3-dbus 1.2.4-1+b1 armhf -python3-debconf 1.5.64 all -python3-dev 3.6.3-2 armhf -python3-gi 3.24.1-3+rpi1 armhf -python3-idna 2.5-1 all -python3-keyring 10.4.0-1 all -python3-keyrings.alt 2.2-2 all -python3-minimal 3.6.3-2 armhf -python3-pip 9.0.1-2+rpt1 all -python3-pkg-resources 36.6.0-1 all +python3-asn1crypto 0.24.0-1 all +python3-certbot 0.21.1-1 all +python3-certifi 2018.1.18-2 all +python3-cffi-backend 1.11.5-1 armhf +python3-chardet 3.0.4-1 all +python3-configargparse 0.11.0-1 all +python3-configobj 5.0.6-2 all +python3-crypto 2.6.1-8 armhf +python3-cryptography 2.1.4-1 armhf +python3-dbus 1.2.6-1 armhf +python3-debconf 1.5.66 all +python3-dev 3.6.4-1 armhf +python3-distutils 3.6.4-4 all +python3-eyed3 0.8.4-2 all +python3-future 0.15.2-4 all +python3-gi 3.26.1-2 armhf +python3-idna 2.6-1 all +python3-josepy 1.0.1-1 all +python3-keyring 10.6.0-1 all +python3-keyrings.alt 3.0-1 all +python3-lib2to3 3.6.4-4 all +python3-magic 2:0.4.15-1 all +python3-minimal 3.6.4-1 armhf +python3-mock 2.0.0-3 all +python3-openssl 17.5.0-1 all +python3-parsedatetime 2.4-2 all +python3-pbr 3.1.1-4 all +python3-pip 9.0.1-2+rpt2 all +python3-pkg-resources 38.5.2-1 all +python3-requests 2.18.4-2 all +python3-rfc3339 1.0-4 all -python3-setuptools 36.6.0-1 all -python3-six 1.11.0-1 all +python3-setuptools 38.5.2-1 all +python3-six 1.11.0-2 all -python3-wheel 0.29.0-2 all +python3-tz 2018.3-2 all +python3-urllib3 1.22-1 all +python3-wheel 0.30.0-0.2 all +python3-zope.component 4.3.0-1 all +python3-zope.event 4.2.0-1 all +python3-zope.hookable 4.0.4-4+b2 armhf +python3-zope.interface 4.3.2-1+b1 armhf -python3.6 3.6.3-1 armhf -python3.6-dev 3.6.3-1 armhf -python3.6-minimal 3.6.3-1 armhf -rake 12.0.0-1 all -raspberrypi-bootloader 1.20170811-1 armhf -raspberrypi-kernel 1.20170811-1 armhf +python3.6 3.6.4-4 armhf +python3.6-dev 3.6.4-4 armhf +python3.6-minimal 3.6.4-4 armhf +rake 12.3.0-1 all +raspberrypi-bootloader 1.20180313-1 armhf +raspberrypi-kernel 1.20180313-1 armhf -raspberrypi-sys-mods 20170717 armhf +raspberrypi-sys-mods 20180315 armhf -raspi-config 20170926 all +raspi-config 20180228 all +rfkill 2.31.1-0.4 armhf -rsync 3.1.2-2 armhf -rsyslog 8.29.0-2 armhf -ruby 1:2.3.3 armhf +rsync 3.1.2-2.1 armhf +rsyslog 8.33.1-1 armhf +ruby 1:2.5.0 armhf -ruby2.3 2.3.3-1+deb9u1+rpi1 armhf +ruby2.3 2.3.6-2+rpi1 armhf +ruby2.5 2.5.0-6+rpi1 armhf -samba-common 2:4.7.0+dfsg-2 all +samba-common 2:4.7.4+dfsg-2 all -sed 4.4-1 armhf +sed 4.4-2 armhf -sensible-utils 0.0.10 all +sensible-utils 0.0.11 all -ssh 1:7.6p1-2 all -strace 4.19-1 armhf -sudo 1.8.21p2-2 armhf -systemd 235-2 armhf -systemd-sysv 235-2 armhf +ssh 1:7.6p1-4 all +strace 4.21-1 armhf +sudo 1.8.21p2-3 armhf +systemd 237-3+b1 armhf +systemd-sysv 237-3+b1 armhf -tasksel 3.42 all -tasksel-data 3.42 all +tasksel 3.43 all +tasksel-data 3.43 all -tmux 2.6-1 armhf +tmux 2.6-3 armhf -tzdata 2017c-1 all -ucf 3.0036 all -udev 235-2 armhf +tzdata 2018c-1 all +ucf 3.0038 all +udev 237-3+b1 armhf -usb-modeswitch 2.5.1+repack0-1+b1 armhf -usb-modeswitch-data 20170806-1 all +usb-modeswitch 2.5.2+repack0-2 armhf +usb-modeswitch-data 20170806-2 all -util-linux 2.30.2-0.1 armhf -v4l-utils 1.12.5-1 armhf +util-linux 2.31.1-0.4 armhf +v4l-utils 1.14.2-1 armhf -vim-common 2:8.0.1144-1 all -vim-nox 2:8.0.1144-1 armhf -vim-runtime 2:8.0.1144-1 all -vim-tiny 2:8.0.1144-1 armhf -vnstat 1.15-2 armhf -wget 1.19.2-1 armhf -whiptail 0.52.20-1+b1 armhf -whois 5.2.18 armhf +vim-common 2:8.0.1453-1 all +vim-nox 2:8.0.1453-1 armhf +vim-runtime 2:8.0.1453-1 all +vim-tiny 2:8.0.1453-1 armhf +vnstat 1.17-1 armhf +wget 1.19.4-1 armhf +whiptail 0.52.20-3 armhf +whois 5.3.0 armhf -wpasupplicant 2:2.4-1.1 armhf -xauth 1:1.0.9-1 armhf -xdg-user-dirs 0.15-3 armhf -xkb-data 2.19-1.1 all +wpasupplicant 2:2.6-15 armhf +xauth 1:1.0.10-1 armhf +xdg-user-dirs 0.16-1 armhf +xkb-data 2.23.1-1 all -xxd 2:8.0.1144-1 armhf +xxd 2:8.0.1453-1 armhf -zsh 5.4.2-1 armhf -zsh-common 5.4.2-1 all +zsh 5.4.2-3 armhf +zsh-common 5.4.2-3 allremotes/origin/may2018
parent
bc08959028
commit
2dd500797c
@ -0,0 +1,83 @@
|
||||
# vim:syntax=apparmor
|
||||
|
||||
#include <tunables/global>
|
||||
|
||||
/usr/bin/man {
|
||||
#include <abstractions/base>
|
||||
|
||||
# Use a special profile when man calls anything groff-related. We only
|
||||
# include the programs that actually parse input data in a non-trivial
|
||||
# way, not wrappers such as groff and nroff, since the latter would need a
|
||||
# broader profile.
|
||||
/usr/bin/eqn rmCx -> &man_groff,
|
||||
/usr/bin/grap rmCx -> &man_groff,
|
||||
/usr/bin/pic rmCx -> &man_groff,
|
||||
/usr/bin/preconv rmCx -> &man_groff,
|
||||
/usr/bin/refer rmCx -> &man_groff,
|
||||
/usr/bin/tbl rmCx -> &man_groff,
|
||||
/usr/bin/troff rmCx -> &man_groff,
|
||||
/usr/bin/vgrind rmCx -> &man_groff,
|
||||
|
||||
# Similarly, use a special profile when man calls decompressors and other
|
||||
# simple filters.
|
||||
/bin/bzip2 rmCx -> &man_filter,
|
||||
/bin/gzip rmCx -> &man_filter,
|
||||
/usr/bin/col rmCx -> &man_filter,
|
||||
/usr/bin/compress rmCx -> &man_filter,
|
||||
/usr/bin/iconv rmCx -> &man_filter,
|
||||
/usr/bin/lzip.lzip rmCx -> &man_filter,
|
||||
/usr/bin/tr rmCx -> &man_filter,
|
||||
/usr/bin/xz rmCx -> &man_filter,
|
||||
|
||||
# Allow basically anything in terms of file system access, subject to DAC.
|
||||
# The purpose of this profile isn't to confine man itself (that might be
|
||||
# nice in the future, but is tricky since it's quite configurable), but to
|
||||
# confine the processes it calls that parse untrusted data.
|
||||
/** mrixwlk,
|
||||
|
||||
capability setuid,
|
||||
capability setgid,
|
||||
|
||||
# Site-specific additions and overrides. See local/README for details.
|
||||
#include <local/usr.bin.man>
|
||||
}
|
||||
|
||||
profile man_groff {
|
||||
#include <abstractions/base>
|
||||
# Recent kernels revalidate open FDs, and there are often some still
|
||||
# open on TTYs. This is temporary until man learns to close irrelevant
|
||||
# open FDs before execve.
|
||||
#include <abstractions/consoles>
|
||||
# man always runs its groff pipeline with the input file open on stdin,
|
||||
# so we can skip <abstractions/user-manpages>.
|
||||
|
||||
/usr/bin/eqn rm,
|
||||
/usr/bin/grap rm,
|
||||
/usr/bin/pic rm,
|
||||
/usr/bin/preconv rm,
|
||||
/usr/bin/refer rm,
|
||||
/usr/bin/tbl rm,
|
||||
/usr/bin/troff rm,
|
||||
/usr/bin/vgrind rm,
|
||||
|
||||
/etc/groff/** r,
|
||||
/usr/lib/groff/site-tmac/** r,
|
||||
/usr/share/groff/** r,
|
||||
}
|
||||
|
||||
profile man_filter {
|
||||
#include <abstractions/base>
|
||||
# Recent kernels revalidate open FDs, and there are often some still
|
||||
# open on TTYs. This is temporary until man learns to close irrelevant
|
||||
# open FDs before execve.
|
||||
#include <abstractions/consoles>
|
||||
|
||||
/bin/bzip2 rm,
|
||||
/bin/gzip rm,
|
||||
/usr/bin/col rm,
|
||||
/usr/bin/compress rm,
|
||||
/usr/bin/iconv rm,
|
||||
/usr/bin/lzip.lzip rm,
|
||||
/usr/bin/tr rm,
|
||||
/usr/bin/xz rm,
|
||||
}
|
||||
@ -0,0 +1,105 @@
|
||||
# Fail2ban configuration file
|
||||
#
|
||||
# Action to report IP address to abuseipdb.com
|
||||
# You must sign up to obtain an API key from abuseipdb.com.
|
||||
#
|
||||
# NOTE: These reports may include sensitive Info.
|
||||
# If you want cleaner reports that ensure no user data see the helper script at the below website.
|
||||
#
|
||||
# IMPORTANT:
|
||||
#
|
||||
# Reporting an IP of abuse is a serious complaint. Make sure that it is
|
||||
# serious. Fail2ban developers and network owners recommend you only use this
|
||||
# action for:
|
||||
# * The recidive where the IP has been banned multiple times
|
||||
# * Where maxretry has been set quite high, beyond the normal user typing
|
||||
# password incorrectly.
|
||||
# * For filters that have a low likelihood of receiving human errors
|
||||
#
|
||||
# This action relies on a api_key being added to the above action conf,
|
||||
# and the appropriate categories set.
|
||||
#
|
||||
# Example, for ssh bruteforce (in section [sshd] of `jail.local`):
|
||||
# action = %(known/action)s
|
||||
# %(action_abuseipdb)s[abuseipdb_apikey="my-api-key", abuseipdb_category="18,22"]
|
||||
#
|
||||
# See below for catagories.
|
||||
#
|
||||
# Original Ref: https://wiki.shaunc.com/wikka.php?wakka=ReportingToAbuseIPDBWithFail2Ban
|
||||
# Added to fail2ban by Andrew James Collett (ajcollett)
|
||||
|
||||
## abuseIPDB Catagories, `the abuseipdb_category` MUST be set in the jail.conf action call.
|
||||
# Example, for ssh bruteforce: action = %(action_abuseipdb)s[abuseipdb_category="18,22"]
|
||||
# ID Title Description
|
||||
# 3 Fraud Orders
|
||||
# 4 DDoS Attack
|
||||
# 9 Open Proxy
|
||||
# 10 Web Spam
|
||||
# 11 Email Spam
|
||||
# 14 Port Scan
|
||||
# 18 Brute-Force
|
||||
# 19 Bad Web Bot
|
||||
# 20 Exploited Host
|
||||
# 21 Web App Attack
|
||||
# 22 SSH Secure Shell (SSH) abuse. Use this category in combination with more specific categories.
|
||||
# 23 IoT Targeted
|
||||
# See https://abuseipdb.com/categories for more descriptions
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed once at the start of Fail2Ban.
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart =
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed once at the end of Fail2Ban
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop =
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck =
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
#
|
||||
# ** IMPORTANT! **
|
||||
#
|
||||
# By default, this posts directly to AbuseIPDB's API, unfortunately
|
||||
# this results in a lot of backslashes/escapes appearing in the
|
||||
# reports. This also may include info like your hostname.
|
||||
# If you have your own web server with PHP available, you can
|
||||
# use my (Shaun's) helper PHP script by commenting out the first #actionban
|
||||
# line below, uncommenting the second one, and pointing the URL at
|
||||
# wherever you install the helper script. For the PHP helper script, see
|
||||
# <https://wiki.shaunc.com/wikka.php?wakka=ReportingToAbuseIPDBWithFail2Ban>
|
||||
#
|
||||
# --ciphers ecdhe_ecdsa_aes_256_sha is used to workaround a
|
||||
# "NSS error -12286" from curl as it attempts to connect using
|
||||
# SSLv3. See https://www.centos.org/forums/viewtopic.php?t=52732
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = curl --fail --ciphers ecdhe_ecdsa_aes_256_sha --data 'key=<abuseipdb_apikey>' --data-urlencode 'comment=<matches>' --data 'ip=<ip>' --data 'category=<abuseipdb_category>' "https://www.abuseipdb.com/report/json"
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban =
|
||||
|
||||
[Init]
|
||||
# Option: abuseipdb_apikey
|
||||
# Notes Your API key from abuseipdb.com
|
||||
# Values: STRING Default: None
|
||||
# Register for abuseipdb [https://www.abuseipdb.com], get api key and set below.
|
||||
# You will need to set the catagory in the action call.
|
||||
abuseipdb_apikey =
|
||||
@ -0,0 +1,76 @@
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Donald Yandt
|
||||
#
|
||||
|
||||
[Init]
|
||||
|
||||
# Option: name
|
||||
# Notes Default name of the chain
|
||||
# Values: STRING
|
||||
name = default
|
||||
|
||||
# Option port
|
||||
# Notes Can also use port numbers separated by a comma and in rich-rules comma and/or space.
|
||||
# Value STRING Default: 1:65535
|
||||
port = 1:65535
|
||||
|
||||
# Option: protocol
|
||||
# Notes [ tcp | udp | icmp | all ]
|
||||
# Values: STRING Default: tcp
|
||||
protocol = tcp
|
||||
|
||||
# Option: family(ipv4)
|
||||
# Notes specifies the socket address family type
|
||||
# Values: STRING
|
||||
family = ipv4
|
||||
|
||||
# Option: chain
|
||||
# Notes specifies the firewalld chain to which the Fail2Ban rules should be
|
||||
# added
|
||||
# Values: STRING Default: INPUT_direct
|
||||
chain = INPUT_direct
|
||||
|
||||
# Option: zone
|
||||
# Notes use command firewall-cmd --get-active-zones to see a list of all active zones. See firewalld man pages for more information on zones
|
||||
# Values: STRING Default: public
|
||||
zone = public
|
||||
|
||||
# Option: service
|
||||
# Notes use command firewall-cmd --get-services to see a list of services available
|
||||
# Examples services: amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps
|
||||
# freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos
|
||||
# kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s
|
||||
# postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy
|
||||
# telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
|
||||
# Values: STRING Default: ssh
|
||||
service = ssh
|
||||
|
||||
# Option: rejecttype (ipv4)
|
||||
# Notes See iptables/firewalld man pages for ipv4 reject types.
|
||||
# Values: STRING
|
||||
rejecttype = icmp-port-unreachable
|
||||
|
||||
# Option: blocktype (ipv4/ipv6)
|
||||
# Notes See iptables/firewalld man pages for jump targets. Common values are REJECT,
|
||||
# REJECT --reject-with icmp-port-unreachable, DROP
|
||||
# Values: STRING
|
||||
blocktype = REJECT --reject-with <rejecttype>
|
||||
|
||||
# Option: rich-blocktype (ipv4/ipv6)
|
||||
# Notes See firewalld man pages for jump targets. Common values are reject,
|
||||
# reject type="icmp-port-unreachable", drop
|
||||
# Values: STRING
|
||||
rich-blocktype = reject type='<rejecttype>'
|
||||
|
||||
[Init?family=inet6]
|
||||
|
||||
# Option: family(ipv6)
|
||||
# Notes specifies the socket address family type
|
||||
# Values: STRING
|
||||
family = ipv6
|
||||
|
||||
# Option: rejecttype (ipv6)
|
||||
# Note: See iptables/firewalld man pages for ipv6 reject types.
|
||||
# Values: STRING
|
||||
rejecttype = icmp6-port-unreachable
|
||||
@ -0,0 +1,16 @@
|
||||
[DEFAULT]
|
||||
|
||||
# Usage:
|
||||
# _grep_logs_args = 'test'
|
||||
# (printf %%b "Log-excerpt contains 'test':\n"; %(_grep_logs)s; printf %%b "Log-excerpt contains 'test':\n") | mail ...
|
||||
#
|
||||
_grep_logs = logpath="<logpath>"; grep <grepopts> -E %(_grep_logs_args)s $logpath | <greplimit>
|
||||
_grep_logs_args = "(^|[^0-9a-fA-F:])$(echo '<ip>' | sed 's/\./\\./g')([^0-9a-fA-F:]|$)"
|
||||
|
||||
# Used for actions, that should not by executed if ticket was restored:
|
||||
_bypass_if_restored = if [ '<restored>' = '1' ]; then exit 0; fi;
|
||||
|
||||
[Init]
|
||||
greplimit = tail -n <grepmax>
|
||||
grepmax = 1000
|
||||
grepopts = -m <grepmax>
|
||||
@ -0,0 +1,108 @@
|
||||
# Fail2Ban configuration file for black-listing via nginx
|
||||
#
|
||||
# Author: Serg G. Brester (aka sebres)
|
||||
#
|
||||
# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration,
|
||||
# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban).
|
||||
#
|
||||
# Example (argument "token_id" resp. cookie "session_id" used here as unique identifier for user):
|
||||
#
|
||||
# http {
|
||||
# ...
|
||||
# # maps to check user is blacklisted (banned in f2b):
|
||||
# #map $arg_token_id $blck_lst_tok { include blacklisted-tokens.map; }
|
||||
# map $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; }
|
||||
# ...
|
||||
# # special log-format to notify fail2ban about failures:
|
||||
# log_format f2b_session_errors '$msec failure "$cookie_session_id" - $remote_addr - $remote_user '
|
||||
# ;# '"$request" $status $bytes_sent '
|
||||
# # '"$http_referer" "$http_user_agent"';
|
||||
#
|
||||
# # location checking blacklisted values:
|
||||
# location ... {
|
||||
# # check banned sessionid:
|
||||
# if ($blck_lst_ses != "") {
|
||||
# try_files "" @f2b-banned;
|
||||
# }
|
||||
# ...
|
||||
# # notify fail2ban about a failure inside nginx:
|
||||
# error_page 401 = @notify-f2b;
|
||||
# ...
|
||||
# }
|
||||
# ...
|
||||
# # location for return with "403 Forbidden" if banned:
|
||||
# location @f2b-banned {
|
||||
# default_type text/html;
|
||||
# return 403 "<br/><center>
|
||||
# <b style=\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\">
|
||||
# You are banned!</b></center>";
|
||||
# }
|
||||
# ...
|
||||
# # location to notify fail2ban about a failure inside nginx:
|
||||
# location @notify-f2b {
|
||||
# access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;
|
||||
# }
|
||||
# }
|
||||
# ...
|
||||
#
|
||||
# Note that quote-character (and possibly other special characters) are not allowed currently as session-id.
|
||||
# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service),
|
||||
# like in example below:
|
||||
#
|
||||
# location ... {
|
||||
# if ($cookie_session_id !~ "^[\w\-]+$") {
|
||||
# return 403 "Wrong session-id"
|
||||
# }
|
||||
# ...
|
||||
# }
|
||||
#
|
||||
# The parameters for jail corresponding log-format (f2b_session_errors):
|
||||
#
|
||||
# [nginx-blck-lst]
|
||||
# filter =
|
||||
# datepattern = ^Epoch
|
||||
# failregex = ^ failure "<F-ID>[^"]+</F-ID>" - <ADDR>
|
||||
# usedns = no
|
||||
#
|
||||
# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs):
|
||||
#
|
||||
# [nginx-blck-ip]
|
||||
# maxretry = 100
|
||||
# filter =
|
||||
# datepattern = ^Epoch
|
||||
# failregex = ^ failure "[^"]+" - <ADDR>
|
||||
# usedns = no
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
# path to configuration of nginx (used to target nginx-instance in multi-instance system,
|
||||
# and as path for the blacklisted map):
|
||||
srv_cfg_path = /etc/nginx/
|
||||
|
||||
# cmd-line arguments to supply to test/reload nginx:
|
||||
#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf
|
||||
srv_cmd = nginx
|
||||
|
||||
# first test configuration is correct, hereafter send reload signal:
|
||||
blck_lst_reload = %(srv_cmd)s -qt; if [ $? -eq 0 ]; then
|
||||
%(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;
|
||||
fi;
|
||||
|
||||
# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file="/path/file.map"]`:
|
||||
blck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.map
|
||||
|
||||
# Action definition:
|
||||
|
||||
actionstart_on_demand = false
|
||||
actionstart = touch '%(blck_lst_file)s'
|
||||
|
||||
actionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s
|
||||
|
||||
actionstop = %(actionflush)s
|
||||
|
||||
actioncheck =
|
||||
|
||||
actionban = echo "\\\\<fid> 1;" >> '%(blck_lst_file)s'; %(blck_lst_reload)s
|
||||
|
||||
actionunban = id=$(echo "<fid>" | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/$id 1;/d" %(blck_lst_file)s; %(blck_lst_reload)s
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue