diff options
| author | sebres <serg.brester@sebres.de> | 2017-04-24 20:17:57 +0200 |
|---|---|---|
| committer | sebres <serg.brester@sebres.de> | 2017-04-24 21:17:55 +0200 |
| commit | 99344d28c8fe258de7fb72810ad5646ab62dbbc7 (patch) | |
| tree | 81f83575add8623031fe0b3c257f1911129a6da1 | |
| parent | 507034c5be77c7894e2eee8afc2ce4ea84002674 (diff) | |
| download | fail2ban-99344d28c8fe258de7fb72810ad5646ab62dbbc7.tar.gz | |
Introduces new tags with hostname:
- `<fq-hostname>` - fully-qualified name of host (the same as `$(hostname -f)`)
- `<sh-hostname>` - short hostname (the same as `$(uname -n)`)
Execution of `uname -n` replaced in all mail actions with most interesting fully-qualified `<fq-hostname>`.
| -rw-r--r-- | config/action.d/mail-buffered.conf | 6 | ||||
| -rw-r--r-- | config/action.d/mail-whois-lines.conf | 6 | ||||
| -rw-r--r-- | config/action.d/mail-whois.conf | 6 | ||||
| -rw-r--r-- | config/action.d/mail.conf | 6 | ||||
| -rw-r--r-- | config/action.d/sendmail-buffered.conf | 8 | ||||
| -rw-r--r-- | config/action.d/sendmail-common.conf | 4 | ||||
| -rw-r--r-- | config/action.d/sendmail-geoip-lines.conf | 2 | ||||
| -rw-r--r-- | config/action.d/sendmail-whois-ipjailmatches.conf | 2 | ||||
| -rw-r--r-- | config/action.d/sendmail-whois-ipmatches.conf | 2 | ||||
| -rw-r--r-- | config/action.d/sendmail-whois-lines.conf | 2 | ||||
| -rw-r--r-- | config/action.d/sendmail-whois-matches.conf | 2 | ||||
| -rw-r--r-- | config/action.d/sendmail-whois.conf | 2 | ||||
| -rw-r--r-- | config/action.d/sendmail.conf | 2 | ||||
| -rw-r--r-- | config/action.d/xarf-login-attack.conf | 4 | ||||
| -rw-r--r-- | config/jail.conf | 2 | ||||
| -rw-r--r-- | fail2ban/server/actions.py | 4 | ||||
| -rw-r--r-- | fail2ban/server/ipdns.py | 21 |
17 files changed, 53 insertions, 28 deletions
diff --git a/config/action.d/mail-buffered.conf b/config/action.d/mail-buffered.conf index e74db9cc..88cd623f 100644 --- a/config/action.d/mail-buffered.conf +++ b/config/action.d/mail-buffered.conf @@ -17,7 +17,7 @@ actionstart = printf %%b "Hi,\n The jail <name> has been started successfully.\n Output will be buffered until <lines> lines are available.\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] <name>: started on `uname -n`" <dest> + Fail2Ban"|mail -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest> # Option: actionstop # Notes.: command executed once at the end of Fail2Ban @@ -28,13 +28,13 @@ actionstop = if [ -f <tmpfile> ]; then These hosts have been banned by Fail2Ban.\n `cat <tmpfile>` Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary from `uname -n`" <dest> + Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary from <fq-hostname>" <dest> rm <tmpfile> fi printf %%b "Hi,\n The jail <name> has been stopped.\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest> + Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest> # Option: actioncheck # Notes.: command executed once before each actionban command diff --git a/config/action.d/mail-whois-lines.conf b/config/action.d/mail-whois-lines.conf index 7ebb8b9f..37e2d9b0 100644 --- a/config/action.d/mail-whois-lines.conf +++ b/config/action.d/mail-whois-lines.conf @@ -21,7 +21,7 @@ norestored = 1 actionstart = printf %%b "Hi,\n The jail <name> has been started successfully.\n Regards,\n - Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: started on `uname -n`" <dest> + Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: started on <fq-hostname>" <dest> # Option: actionstop # Notes.: command executed once at the end of Fail2Ban @@ -30,7 +30,7 @@ actionstart = printf %%b "Hi,\n actionstop = printf %%b "Hi,\n The jail <name> has been stopped.\n Regards,\n - Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: stopped on `uname -n`" <dest> + Fail2Ban" | <mailcmd> "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest> # Option: actioncheck # Notes.: command executed once before each actionban command @@ -56,7 +56,7 @@ _ban_mail_content = ( printf %%b "Hi,\n Regards,\n Fail2Ban" ) -actionban = %(_ban_mail_content)s | <mailcmd> "[Fail2Ban] <name>: banned <ip> from `uname -n`" <dest> +actionban = %(_ban_mail_content)s | <mailcmd> "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest> # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf index 553bfb69..1f69f4c6 100644 --- a/config/action.d/mail-whois.conf +++ b/config/action.d/mail-whois.conf @@ -20,7 +20,7 @@ norestored = 1 actionstart = printf %%b "Hi,\n The jail <name> has been started successfully.\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] <name>: started on `uname -n`" <dest> + Fail2Ban"|mail -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest> # Option: actionstop # Notes.: command executed once at the end of Fail2Ban @@ -29,7 +29,7 @@ actionstart = printf %%b "Hi,\n actionstop = printf %%b "Hi,\n The jail <name> has been stopped.\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest> + Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest> # Option: actioncheck # Notes.: command executed once before each actionban command @@ -49,7 +49,7 @@ actionban = printf %%b "Hi,\n Here is more information about <ip> :\n `%(_whois_command)s`\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from `uname -n`" <dest> + Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest> # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf index 4715ecc5..cfc1cf65 100644 --- a/config/action.d/mail.conf +++ b/config/action.d/mail.conf @@ -16,7 +16,7 @@ norestored = 1 actionstart = printf %%b "Hi,\n The jail <name> has been started successfully.\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] <name>: started on `uname -n`" <dest> + Fail2Ban"|mail -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest> # Option: actionstop # Notes.: command executed once at the end of Fail2Ban @@ -25,7 +25,7 @@ actionstart = printf %%b "Hi,\n actionstop = printf %%b "Hi,\n The jail <name> has been stopped.\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest> + Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest> # Option: actioncheck # Notes.: command executed once before each actionban command @@ -43,7 +43,7 @@ actionban = printf %%b "Hi,\n The IP <ip> has just been banned by Fail2Ban after <failures> attempts against <name>.\n Regards,\n - Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from `uname -n`" <dest> + Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest> # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the diff --git a/config/action.d/sendmail-buffered.conf b/config/action.d/sendmail-buffered.conf index a91a6957..37bc642d 100644 --- a/config/action.d/sendmail-buffered.conf +++ b/config/action.d/sendmail-buffered.conf @@ -17,7 +17,7 @@ norestored = 1 # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n` +actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on <fq-hostname> From: <sendername> <<sender>> To: <dest>\n Hi,\n @@ -31,7 +31,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n` # Values: CMD # actionstop = if [ -f <tmpfile> ]; then - printf %%b "Subject: [Fail2Ban] <name>: summary from `uname -n` + printf %%b "Subject: [Fail2Ban] <name>: summary from <fq-hostname> From: <sendername> <<sender>> To: <dest>\n Hi,\n @@ -41,7 +41,7 @@ actionstop = if [ -f <tmpfile> ]; then Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest> rm <tmpfile> fi - printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n` + printf %%b "Subject: [Fail2Ban] <name>: stopped on <fq-hostname> From: Fail2Ban <<sender>> To: <dest>\n Hi,\n @@ -64,7 +64,7 @@ actioncheck = actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile> LINE=$( wc -l <tmpfile> | awk '{ print $1 }' ) if [ $LINE -ge <lines> ]; then - printf %%b "Subject: [Fail2Ban] <name>: summary from `uname -n` + printf %%b "Subject: [Fail2Ban] <name>: summary from <fq-hostname> From: <sendername> <<sender>> To: <dest>\n Hi,\n diff --git a/config/action.d/sendmail-common.conf b/config/action.d/sendmail-common.conf index 1475dedb..46eca9ca 100644 --- a/config/action.d/sendmail-common.conf +++ b/config/action.d/sendmail-common.conf @@ -14,7 +14,7 @@ after = sendmail-common.local # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n` +actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on <fq-hostname> Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <sendername> <<sender>> To: <dest>\n @@ -27,7 +27,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n` # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n` +actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on <fq-hostname> Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <sendername> <<sender>> To: <dest>\n diff --git a/config/action.d/sendmail-geoip-lines.conf b/config/action.d/sendmail-geoip-lines.conf index decf2c05..b7c1bf36 100644 --- a/config/action.d/sendmail-geoip-lines.conf +++ b/config/action.d/sendmail-geoip-lines.conf @@ -23,7 +23,7 @@ norestored = 1 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = ( printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n` +actionban = ( printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname> Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <sendername> <<sender>> To: <dest>\n diff --git a/config/action.d/sendmail-whois-ipjailmatches.conf b/config/action.d/sendmail-whois-ipjailmatches.conf index 5bcefe89..06ea3a3e 100644 --- a/config/action.d/sendmail-whois-ipjailmatches.conf +++ b/config/action.d/sendmail-whois-ipjailmatches.conf @@ -19,7 +19,7 @@ norestored = 1 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n` +actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname> Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <sendername> <<sender>> To: <dest>\n diff --git a/config/action.d/sendmail-whois-ipmatches.conf b/config/action.d/sendmail-whois-ipmatches.conf index 4a8edcb7..83bff1b4 100644 --- a/config/action.d/sendmail-whois-ipmatches.conf +++ b/config/action.d/sendmail-whois-ipmatches.conf @@ -19,7 +19,7 @@ norestored = 1 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n` +actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname> Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <sendername> <<sender>> To: <dest>\n diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf index e3a1c974..4b947cb2 100644 --- a/config/action.d/sendmail-whois-lines.conf +++ b/config/action.d/sendmail-whois-lines.conf @@ -20,7 +20,7 @@ norestored = 1 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = ( printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n` +actionban = ( printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname> Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <sendername> <<sender>> To: <dest>\n diff --git a/config/action.d/sendmail-whois-matches.conf b/config/action.d/sendmail-whois-matches.conf index fc4ba061..01520135 100644 --- a/config/action.d/sendmail-whois-matches.conf +++ b/config/action.d/sendmail-whois-matches.conf @@ -19,7 +19,7 @@ norestored = 1 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n` +actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname> Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <sendername> <<sender>> To: <dest>\n diff --git a/config/action.d/sendmail-whois.conf b/config/action.d/sendmail-whois.conf index b8d99423..2fb01ed3 100644 --- a/config/action.d/sendmail-whois.conf +++ b/config/action.d/sendmail-whois.conf @@ -19,7 +19,7 @@ norestored = 1 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n` +actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname> Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <sendername> <<sender>> To: <dest>\n diff --git a/config/action.d/sendmail.conf b/config/action.d/sendmail.conf index 62c94439..cf420915 100644 --- a/config/action.d/sendmail.conf +++ b/config/action.d/sendmail.conf @@ -19,7 +19,7 @@ norestored = 1 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n` +actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from <fq-hostname> Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` From: <sendername> <<sender>> To: <dest>\n diff --git a/config/action.d/xarf-login-attack.conf b/config/action.d/xarf-login-attack.conf index 5274cdaf..9d441aa3 100644 --- a/config/action.d/xarf-login-attack.conf +++ b/config/action.d/xarf-login-attack.conf @@ -46,7 +46,7 @@ actionban = oifs=${IFS}; IFS=.;SEP_IP=( <ip> ); set -- ${SEP_IP}; ADDRESSES=$(di FROM=<sender> SERVICE=<service> FAILURES=<failures> - REPORTID=<time>@`uname -n` + REPORTID=<time>@<fq-hostname> TLP=<tlp> PORT=<port> DATE=`LC_ALL=C date --date=@<time> +"%%a, %%d %%h %%Y %%T %%z"` @@ -119,7 +119,7 @@ logpath = /dev/null # Option: sender # Notes.: This is the sender that is included in the XARF report -sender = fail2ban@`uname -n` +sender = fail2ban@<fq-hostname> # Option: port # Notes.: This is the port number that received the login-attack diff --git a/config/jail.conf b/config/jail.conf index 7e5cc9b7..135c9a2b 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -134,7 +134,7 @@ filter = %(__name__)s destemail = root@localhost # Sender email address used solely for some actions -sender = root@localhost +sender = root@<fq-hostname> # E-mail action. Since 0.8.1 Fail2Ban uses sendmail MTA for the # mailing. Change mta configuration parameter to mail if you want to diff --git a/fail2ban/server/actions.py b/fail2ban/server/actions.py index c33359c9..f8f8d4e1 100644 --- a/fail2ban/server/actions.py +++ b/fail2ban/server/actions.py @@ -35,6 +35,7 @@ except ImportError: OrderedDict = dict from .banmanager import BanManager +from .ipdns import DNSUtils from .jailthread import JailThread from .action import ActionBase, CommandAction, CallingMap from .mytime import MyTime @@ -306,6 +307,9 @@ class Actions(JailThread, Mapping): "ipjailmatches": lambda self: "\n".join(self._mi4ip().getMatches()), "ipfailures": lambda self: self._mi4ip(True).getAttempt(), "ipjailfailures": lambda self: self._mi4ip().getAttempt(), + # system-information: + "fq-hostname": lambda self: DNSUtils.getHostname(fqdn=True), + "sh-hostname": lambda self: DNSUtils.getHostname(fqdn=False) } __slots__ = CallingMap.__slots__ + ('__ticket', '__jail', '__mi4ip') diff --git a/fail2ban/server/ipdns.py b/fail2ban/server/ipdns.py index bda32ae8..e1aa1920 100644 --- a/fail2ban/server/ipdns.py +++ b/fail2ban/server/ipdns.py @@ -119,6 +119,27 @@ class DNSUtils: return ipList @staticmethod + def getHostname(fqdn=True): + """Get short hostname or fully-qualified hostname of host self""" + # try find cached own hostnames (this tuple-key cannot be used elsewhere): + key = ('self','hostname', fqdn) + name = DNSUtils.CACHE_ipToName.get(key) + # get it using different ways (hostname, fully-qualified or vice versa): + if name is None: + name = '' + for hostname in ( + (socket.getfqdn, socket.gethostname) if fqdn else (socket.gethostname, socket.getfqdn) + ): + try: + name = hostname() + break + except Exception as e: # pragma: no cover + logSys.warning("Retrieving own hostnames failed: %s", e) + # cache and return : + DNSUtils.CACHE_ipToName.set(key, name) + return name + + @staticmethod def getSelfNames(): """Get own host names of self""" # try find cached own hostnames (this tuple-key cannot be used elsewhere): |
