fail2ban: better, faster, stronger

ver. 0.9.1 (2014/10/29) - better, faster, stronger

• Refactoring (IMPORTANT -- Please review your setup and configuration):

  • iptables-common.conf replaced iptables-blocktype.conf (iptables-blocktype.local should still be read) and now also provides defaults for the chain, port, protocol and name tags

• Fixes:

  • start of file2ban aborted (on slow hosts, systemd considers the server has been timed out and kills him), see gh-824
  • UTF-8 fixes in pure-ftp thanks to Johannes Weberhofer. Closes gh-806.
  • systemd backend error on bad utf-8 in python3
  • badips.py action error when logging HTTP error raised with badips request
  • fail2ban-regex failed to work in python3 due to space/tab mix
  • recidive regex samples incorrect log level
  • journalmatch for recidive incorrect PRIORITY
  • loglevel couldn't be changed in fail2ban.conf
  • Handle case when no sqlite library is available for persistent database
  • Only reban once per IP from database on fail2ban restart
  • Nginx filter to support missing server_name. Closes gh-676
  • fail2ban-regex assertion error caused by miscount missed lines with multiline regex
  • Fix actions failing to execute for Python 3.4.0. Workaround for http://bugs.python.org/issue21207
  • Database now returns persistent bans on restart (bantime < 0)
  • Recursive action tags now fully processed. Fixes issue with bsd-ipfw action
  • Fixed TypeError with "ipfailures" and "ipjailfailures" action tags. Thanks Serg G. Brester
  • Correct times for non-timezone date times formats during DST
  • Pass a copy of, not original, aInfo into actions to avoid side-effects
  • Per-distribution paths to the exim's main log
  • Ignored IPs are no longer banned when being restored from persistent database
  • Manually unbanned IPs are now removed from persistent database, such they wont be banned again when Fail2Ban is restarted
  • Pass "bantime" parameter to the actions in default jail's action definition(s)
  • filters.d/sieve.conf - fixed typo in _daemon. Thanks Jisoo Park
  • cyrus-imap -- also catch also failed logins via secured (imaps/pop3s). Regression was introduced while strengthening failregex in 0.8.11 (bd175f) Debian bug #755173
  • postfix-sasl - added journalmatch. Thanks Luc Maisonobe
  • postfix* - match with a new daemon string (postfix/submission/smtpd). Closes gh-804 . Thanks Paul Traina
  • apache - added filter for AH01630 client denied by server configuration.

• New features:

  • New filters:
    • monit Thanks Jason H Martin
    • directadmin Thanks niorg
    • apache-shellshock Thanks Eugene Hopkinson (SlowRiot)
  • New actions:
    • symbiosis-blacklist-allports for Bytemark symbiosis firewall
  • fail2ban-client can fetch the running server version
  • Added Cloudflare API action

• Enhancements

  • Start performance of fail2ban-client (and tests) increased, start time and cpu usage rapidly reduced. Introduced a shared storage logic, to bypass reading lots of config files (see gh-824). Thanks to Joost Molenaar for good catch (reported gh-820).
  • Fail2ban-regex - add print-all-matched option. Closes gh-652
  • Suppress fail2ban-client warnings for non-critical config options
  • Match non "Bye Bye" disconnect messages for sshd locked account regex
  • courier-smtp filter:
    • match lines with user names
    • match lines containing "535 Authentication failed" attempts
  • Add tag to iptables-ipsets
  • Realign fail2ban log output with white space to improve readability. Does not affect SYSLOG output
  • Log unhandled exceptions
  • cyrus-imap: catch "user not found" attempts
  • Add support for Portsentry