@yarikoptic yarikoptic released this Oct 28, 2014 · 2042 commits to 0.11 since this release

Assets 2

ver. 0.9.1 (2014/10/29) - better, faster, stronger

  • Refactoring (IMPORTANT -- Please review your setup and configuration):
    • iptables-common.conf replaced iptables-blocktype.conf
      (iptables-blocktype.local should still be read) and now also
      provides defaults for the chain, port, protocol and name tags
  • Fixes:
    • start of file2ban aborted (on slow hosts, systemd considers the server has
      been timed out and kills him), see gh-824
    • UTF-8 fixes in pure-ftp thanks to Johannes Weberhofer. Closes gh-806.
    • systemd backend error on bad utf-8 in python3
    • badips.py action error when logging HTTP error raised with badips request
    • fail2ban-regex failed to work in python3 due to space/tab mix
    • recidive regex samples incorrect log level
    • journalmatch for recidive incorrect PRIORITY
    • loglevel couldn't be changed in fail2ban.conf
    • Handle case when no sqlite library is available for persistent database
    • Only reban once per IP from database on fail2ban restart
    • Nginx filter to support missing server_name. Closes gh-676
    • fail2ban-regex assertion error caused by miscount missed lines with
      multiline regex
    • Fix actions failing to execute for Python 3.4.0. Workaround for
      http://bugs.python.org/issue21207
    • Database now returns persistent bans on restart (bantime < 0)
    • Recursive action tags now fully processed. Fixes issue with bsd-ipfw
      action
    • Fixed TypeError with "ipfailures" and "ipjailfailures" action tags.
      Thanks Serg G. Brester
    • Correct times for non-timezone date times formats during DST
    • Pass a copy of, not original, aInfo into actions to avoid side-effects
    • Per-distribution paths to the exim's main log
    • Ignored IPs are no longer banned when being restored from persistent
      database
    • Manually unbanned IPs are now removed from persistent database, such they
      wont be banned again when Fail2Ban is restarted
    • Pass "bantime" parameter to the actions in default jail's action
      definition(s)
    • filters.d/sieve.conf - fixed typo in _daemon. Thanks Jisoo Park
    • cyrus-imap -- also catch also failed logins via secured (imaps/pop3s).
      Regression was introduced while strengthening failregex in 0.8.11 (bd175f)
      Debian bug #755173
    • postfix-sasl - added journalmatch. Thanks Luc Maisonobe
    • postfix* - match with a new daemon string (postfix/submission/smtpd).
      Closes gh-804 . Thanks Paul Traina
    • apache - added filter for AH01630 client denied by server configuration.
  • New features:
    • New filters:
      • monit Thanks Jason H Martin
      • directadmin Thanks niorg
      • apache-shellshock Thanks Eugene Hopkinson (SlowRiot)
    • New actions:
      • symbiosis-blacklist-allports for Bytemark symbiosis firewall
    • fail2ban-client can fetch the running server version
    • Added Cloudflare API action
  • Enhancements
    • Start performance of fail2ban-client (and tests) increased, start time
      and cpu usage rapidly reduced. Introduced a shared storage logic, to
      bypass reading lots of config files (see gh-824).
      Thanks to Joost Molenaar for good catch (reported gh-820).
    • Fail2ban-regex - add print-all-matched option. Closes gh-652
    • Suppress fail2ban-client warnings for non-critical config options
    • Match non "Bye Bye" disconnect messages for sshd locked account regex
    • courier-smtp filter:
      • match lines with user names
      • match lines containing "535 Authentication failed" attempts
    • Add tag to iptables-ipsets
    • Realign fail2ban log output with white space to improve readability. Does
      not affect SYSLOG output
    • Log unhandled exceptions
    • cyrus-imap: catch "user not found" attempts
    • Add support for Portsentry