Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log
and bans IP that makes too many password failures. It updates firewall rules
to reject the IP address.
NOTE: If this package has multiple flavors (see below), then use one of them instead of the name specified above. NOTE: This is a Python port. Instead of py312-fail2ban listed in the above command, you can pick from the names under the Packages section.
===> The following configuration options are available for py312-fail2ban-1.1.1:
DOCS=on: Build and/or install documentation
INOTIFY=on: Support for (lib)inotify to monitor filesystem changes
===> Use 'make config' to modify these settings
Please do not edit the fail2ban.conf, jail.conf, or any other
files in the distribution as they will be overwritten upon each
upgrade of the port. Instead, create new files named *.local e.g.
fail2ban.local or jail.local.
For more information, see the official manual:
http://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Configuration
If you have custom filters or actions and you are upgrading from
0.9.x please check them.
Users of pf: please read the notes in action.d/pf.conf and the
discussion at https://github.com/fail2ban/fail2ban/pull/1925
Please note that fail2ban will put curly braces '{}' around the
ports in the action so you shouldn't do it yourself.
security/py-fail2ban: Remove redundant 2to3 invocation
As of upstream 9c5f6eea fail2ban is Python 3.x based. We no longer need
2to3 anymore.
PR: 9c5f6eea
MFH: 2026Q1
Revert "security/py-fail2ban: Remove unneeded filter.d files"
While some users want the upstream sshd filters to have the
contents the BSD sshd filters, others use them as is. Revert
this change. Let users decide which to use.
PR: 288849
This reverts commit d906503fb22992a7a92d46365b9f2af31454dee6.
security/py-fail2ban: Remove unneeded filter.d files
There is some confusion whether to use the sshd.conf, bsd-sshd.conf.
or the bsd-sshd-session.conf filters. bsd-sshd-session.conf is the
correct and only filter to use on FreeBSD systems. Using the others
will result in incorrect operation on a FreeBSD system with a supported
sshd installed.
PR: 288849
security/py-fail2ban: Add support for sshd-session
Now that sshd has been split into sshd and sshd-session, sshd-session
is now the producer of syslog messages. We cannot replace the existing
*sshd.conf files because this port must also run on older systems with
older OpenSSH. Therefore we add new filters to support both.
Reported by: sef (private email)
MFH: 2025Q1
python: bump all USE_PYTHON=distutils consumers after RUN_DEPENDS removal
Any missed ports, feel free to bump.
Any ports that need setuptools at runtime can have the devel/py-setuptools
manually added back to RUN_DEPENDS, but understand that this practice
is deprecated; see CHANGES for details.
all: remove explicit versions in USES=python for "3.x+"
The logic in USES=python will automatically convert this to 3.8+ by
itself.
Adjust two ports that only had Python 3.7 mentioned but build fine
on Python 3.8 too.
finance/quickfix: mark BROKEN with PYTHON
libtool: compile: c++ -DHAVE_CONFIG_H -I. -I../.. -I -I. -I.. -I../.. -I../C++
-DLIBICONV_PLUG -DPYTHON_MAJOR_VERSION=3 -Wno-unused-variable
-Wno-maybe-uninitialized -O2 -pipe -DLIBICONV_PLUG -fstack-protector-strong
-fno-strict-aliasing -DLIBICONV_PLUG -Wall -ansi
-Wno-unused-command-line-argument -Wpointer-arith -Wwrite-strings
-Wno-overloaded-virtual -Wno-deprecated-declarations -Wno-deprecated -std=c++0x
-MT _quickfix_la-QuickfixPython.lo -MD -MP -MF
.deps/_quickfix_la-QuickfixPython.Tpo -c QuickfixPython.cpp -fPIC -DPIC -o
.libs/_quickfix_la-QuickfixPython.o
warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean
'-Wno-uninitialized'? [-Wunknown-warning-option]
QuickfixPython.cpp:175:11: fatal error: 'Python.h' file not found
^~~~~~~~~~
1 warning and 1 error generated.
Reviewed by: portmgr, vishwin, yuri
Differential Revision: <https://reviews.freebsd.org/D40568>
security/py-fail2ban: Fix FAIL2BAN_DBDIR
FAIL2BAN_DBDIR is a user set option. Unfortunately plist is not updated
resulting in plist errors.
PR: 271972
MFH: 2023Q2
security/py-fail2ban: Update to 1.0.2
Update to 1.0.2. This update includes the fix for upstream gh-issue-3370,
which is now removed from our patches.
Reported by: Ken <mayhem30@gmail.com>
security/py-fail2ban: Add ipfilter ippool action
Rather than add a block rule for each banned IP, add a blanket block rule
that references an ipfilter ippool named fail2ban. Maintain the IPs in
the ippool reducing the need to search a large list of rules. An ipfilter
tree pool is used.
security/py-fail2ban: Update to 1.0.1
This major release of fail2ban includes many bugfixes and features.
See https://github.com/fail2ban/fail2ban/releases for more information.
Add comment about "build" being performed in post-patch.
Assume maintainership.
PR: 266810
Approved by: MAINTAINER (theis@gmx.at)
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/py-fail2ban: Create required start dir
Reported at https://github.com/fail2ban/fail2ban/issues/2634
fail2ban should check and, if necessary create, the required directory.
It is still up to the user to ensure that configuration in fail2ban's
conf files and FreeBSD's /etc/rc.conf are in sync and that both, pidfile
and socket reside in the same directory.
PR: 244092
Approved by: maintainer
MFH: 2021Q2
- Update fail2ban to 0.11.2
- Remove patches now included in the upstream code
- Adapt option to not install test files
PR: 251341
Submitted by: theis@gmx.at (maintainer)
Add new regexp to match invalid users to bsd-ssh filter.
I have observed a regression where the old expression was not
working. Looks like the regression was caused by the migration to
python 3.
As far as I can see the quarterly branch is not affected.
PR: 245097
Approved by: portmgr (blanket: run-time bugfix)
security/py-fail2ban: Add support for devel/py-pyinotify
* Enable support for devel/py-pyinotify that itself uses devel/libinotify to
monitor changes in the filesystem. [1]
* Also introduce the new dependency as an additional default option INOTIFY
while I'm here because it's not a hard requirement for runtime. [2]
PR: 238427
Submitted by: Dmitry Wagin <dmitry.wagin@ya.ru> [1]
Approved by: theis@gmx.at (maintainer) [1] [2]
security/py-fail2ban: Fix rc script
The rc.d script evaluates fail2ban_pidfile before rc.conf is read.
This change moves those evaluations to the corect place allowing
users to override the values via /etc/rc.conf as expected.
PR: 236017
Reported by: <epopen gmail com>, Dmitry Wagin <dmitry.wagin ya ru>
Submitted by: <theis gmx at> (maintainer)
MFH: 2019Q2
Convert Python ports to FLAVORS.
Ports using USE_PYTHON=distutils are now flavored. They will
automatically get flavors (py27, py34, py35, py36) depending on what
versions they support.
There is also a USE_PYTHON=flavors for ports that do not use distutils
but need FLAVORS to be set. A USE_PYTHON=noflavors can be set if
using distutils but flavors are not wanted.
A new USE_PYTHON=optsuffix that will add PYTHON_PKGNAMESUFFIX has been
added to cope with Python ports that did not have the Python
PKGNAMEPREFIX but are flavored.
USES=python now also exports a PY_FLAVOR variable that contains the
(Only the first 15 lines of the commit message are shown above )
- Patch a script to use the right syslogd socket (/var/run/log)
- Remove .keep_me files because pkg can handle empty directories
PR: 193621
Submitted by: theis@gmx.at (maintainer)
Minor enhancements:
1) Add a fix for https://github.com/fail2ban/fail2ban/issues/91 (Spurious
UTF8 in SYSLOG is not fully fixed)
2) Add a filter for sendmail, the default mailer on FreeBSD
3) Make the ipfw table used in the action bsd-ipfw configurable
PR: ports/173956
Submitted by: Christoph Theis <theis@gmx.at> (maintainer)
- correct displaying of pkg-message
while here:
- use one space in Created by:
- some whitespace aligning
- correct python versions in USE_PYTHON
- use PYDISTUTILS_PKGVERSION to set correct package version instead of crafting
full PYDISTUTILS_EGGINFO
- remove trailin whitespace in pkg-descr and unneded newlines in pkg-message
PR: 174044
Submitted by: Sayetsky Anton <vsjcfm@gmail.com>
Approved by: Christoph Theis <theis@gmx.at> (maintainer)
Feature safe: yes
- Update to 0.8.7.1
- Fix installation so it doesn't overwrite your config files every time you
upgrade the port
- Fix some space/tab issues to make portlint happy
- Use dirrmtry in a few places because some people have their own custom
filters, actions, etc.
PR: ports/171708
Submitted by: Mark Felder <feld@feld.me>
Approved by: Christoph Theis <theis@gmx.at> (maintainer)
Feature safe: yes
In the rc.d scripts, change assignments to rcvar to use the
literal name_enable wherever possible, and ${name}_enable
when it's not, to prepare for the demise of set_rcvar().
In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
- fix reg. expression in filter.d/common.conf
- over to new maintainer
PR: ports/157979
Submitted by: Christoph Theis <theis _at_ gmx.at> (new maintainer)
- rc.d fix [2]
- broken on 2.6, 2.3 is gone, and 2.4 is gone soon, so only 2.5 [1]
PR: ports/142849 [2]
Submitted by: Krzysztof Stryjek <admin@bsdserwis.com> [1], miwi [2]
- Update to 0.84
- Install sample jail.conf and fail2ban.conf files so that when users
modify the fail2ban.conf and jail.conf files they are not removed.
- Add an IPFW example using IPFW tables
- Created freebsd sshd and ftp example conf files.
Submitted by: Ken Menzel <kmenzel@whisolutions.com> (via e-mail)
Fix a few "bad example" problems in the rc.d scripts that have been
propogated by copy and paste.
1. Primarily the "empty variable" default assignment, which is mostly
${name}_flags="", but fix a few others as well.
2. Where they are not already documented, add the existence of the _flags
(or other deleted empties) option to the comments, and in some cases add
comments from scratch.
3. Replace things that look like:
prefix=%%PREFIX%%
command=${prefix}/sbin/foo
to just use %%PREFIX%%. In many cases the $prefix variable is only used
once, and in some cases it is not used at all.
4. In a few cases remove ${name}_flags from command_args
5. Remove a long-stale comment about putting the port's rc.d script in
/etc/rc.d (which is no longer necessary).
No PORTREVISION bumps because all of these changes are noops.
Number of commits found: 103 (showing only 100 on this page)
