fail2ban versions and changelog

Compatibility#

• action.d/iptables.conf rewritten due to support of multiple chains (gh-3909), therefore user-level derivations (action including iptables-based action) may become incompatible, e. g. some tags if used need to be replaced, e. g. <chain> with $chain or <_ipt_for_proto-iter> with <_ipt-iter>;
• filter.d/exim.conf - several rules of mode normal moved to new mode more, because of too risky handling (see gh-3940), to use it as before set mode = more for exim jail, but be aware of the consequences.

Fixes#

• fixes catastrophic backtracking explosion for REs in domino-smtp and dovecot filters (GHSA-33wh-ccjc-p397, gh-4221)
• fixes systemd bug with missing journal descriptor after rotation by reopening of journal if it is recognized as not alive (gh-3929)
• improve threaded clean-up of all filters, new thread functions afterStop (to force clean-up after stop) and done, invoking afterStop once
• ensure journal-reader is always closed (additional prevention against leaks and "too many open files"), thereby avoid sporadic segfault in systemd module (see https://github.com/systemd/python-systemd/issues/143)
• fixes systemd causing "too many open files" error for a lot of journal files and large amount of systemd jails (see new parameter rotated below, gh-3391);
• passing of arguments from jails to action or filter will affect conditional section too (gh-4069), e. g. setting blocktype="DROP" via jail for action would now apply for IPv4 and IPv6 chains, to submit different blocktype for IPv4 and IPv6 from jail, one can pass them like in this example: banaction = iptables-ipset[blocktype="...", blocktype?family=inet6="..."]
• jail.conf:
• default banactions need to be specified in paths-*.conf (maintainer level) now
• since stock fail2ban includes paths-debian.conf by default, banactions are nftables (can be overwritten in jail.local by user)
• paths-common.conf:
• changed default mysql_log path (default logpath of mysqld-auth jail without maintainer overrides, gh-3932)
• paths-debian.conf:
• default banactions are nftables
• sshd backend switched to systemd (gh-3292)
• postfix backend switched to systemd (gh-3527)
• action.d/firewallcmd-ipset.conf:
• rename ipsettype to ipsetbackend (gh-2620), parameter ipsettype will be used now to the real set type (gh-3760)
• action.d/nftables.conf:
• action fixed for SELinux without execmem permission, rewrite capturing with grep -P using grep -E or sed (PCRE-JIT by grep -P may cause SELinux denial for execmem, see gh-4137)
• action.d/xarf-login-attack.conf - ignore errors or warnings in output of dig provided as comment (gh-4068)
• filter.d/apache-badbots.conf, filter.d/apache-fakegooglebot.conf:
• regexs rewritten more strict (removed catch-alls, etc);
• regexs fixed to match lines with vhost in accesslog (gh-1594)
• filter.d/apache-noscript.conf - consider new log-format with "AH02811: stderr from /..." (gh-3900)
• filter.d/apache-overflows.conf - consider AH10244: invalid URI path (gh-3778, gh-3900)
• filter.d/asterisk.conf - fixed RE for "no matching endpoint" with retry info (like after X tries in Y ms) at end, loosening of end anchor (ignore any simple text tokens at end if no single quote found), gh-4037
• filter.d/exim.conf:
• several rules of mode normal moved to new mode more, because of too risky handling (gh-3940), thereby mode aggressive is not affected, because it fully includes mode more now;
• mode aggressive extended to catch dropped by ACL failures, e.g. "ACL: Country is banned"
• filter.d/freeswitch.conf - bypass some new info in prefix before [WARNING] (changed default _pref_line), FreeSWITCH log line prefix has changed in newer versions (gh-3143)
• filter.d/lighttpd-auth.conf - fixed regex (if failures generated by systemd-journal), bypass several prefixes now (gh-3955)
• filter.d/postfix.conf:
• extended prefregex to capture username in postfix SASL failures (gh-4165)
• consider CONNECT and other rejected commands as a valid _pref (gh-3800)
• default _daemon in prefix-line is loosened - can match everything starting with word postfix, like postfix-example.com/smtpd (gh-3297)
• add optional NOQUEUE: prefix to ddos regex (gh-4072)
• internal parameter _pref is renamed to _cmd, _pref matches now optional prefix like NOQUEUE: etc
• modes ddos and aggressive extended to match rate limit exceeded for connection or message delivery request rates (gh-3265, gh-4073)
• modes aggressive extended to match hostname does not resolve to address (gh-4218, gh-4078)
• filter.d/dropbear.conf:
• recognizes extra pid/timestamp if logged into stdout/journal, added journalmatch (gh-3597)
• failregex extended to match different format of "Exit before auth" message (gh-3791)
• filter.d/recidive.conf - restore possibility to set jail name in the filter, _jailname is positive now (gh-3769)
• filter.d/roundcube-auth.conf - improved RE better matching log format of roundcube version 1.4+ (gh-3816)
• filter.d/sendmail-reject.conf: (gh-4020)
• support <F-MLFID> for BSD-style logfiles
• add match for User unknown to default
• the relay field may not always have a hostname before the ip address
• mode aggressive enables match for lost input channel and Cannot resolve PTR record
• filter.d/sshd.conf:
• adapted to conform possible new daemon name sshd-session, since OpenSSH 9.8 several log messages will be tagged with as originating from a process named "sshd-session" rather than "sshd" (gh-3782)
• ddos and aggressive modes: regex extended for timeout before authentication (optional connection from part, gh-3907)
• filter.d/vsftpd.conf - fixed regex (if failures generated by systemd-journal, gh-3954)
• filter.d/froxlor-auth.conf - updated the regex to the new logging situation for froxlor and changed logpath in jail.conf (gh-4075).

New Features and Enhancements#

• fail2ban-server supports systemd socket activation (sd_listen_fds(3)); optional fail2ban.socket unit provided
• backend systemd extended with new parameter rotated (default false, as prevention against "too many open files"), that allows to monitor only actual journals and ignore now a lot of rotated files by default; so can drastically reduce amount of used file descriptors, normally to 1 or 2 descriptors per jail (gh-3391)
• new jail option skip_if_nologs to ignore jail if no logpath matches found, fail2ban continue to start with warnings/errors, thus other jails become running (gh-2756)
• implements automatic switch backend = auto to backend systemd, when the following is true (RFE gh-3768):
• no files matching logpath found for this jail;
• no systemd_if_nologs = false is specified for the jail (true by default);
• option journalmatch is set for the jail or its filter (otherwise it'd be too heavy to allow all auto-jails, even if they have never been foreseen for journal monitoring); (option skip_if_nologs will be ignored if we could switch backend to systemd)
• configuration ignoreip and fail2ban-client commands addignoreip/delignoreip extended with file:... syntax to ignore IPs from file-ip-set (containing IP, subnet, dns/fqdn or raw strings); the file would be read lazy on demand, by first ban (and automatically reloaded by update after small latency to avoid expensive stats check on every compare); the entries inside the file can be separated by comma, space or new line with optional comments (text following chars # or ; after space or newline would be ignored up to next newline)
• action.d/apprise.conf - updated to support tagging and other command line args (gh-4141)
• action.d/*-ipset.conf:
• parameter ipsettype to set type of ipset, e. g. hash:ip, hash:net, etc (gh-3760)
• action.d/iptables.conf - action and few derivatives of it extended to handle multiple chains, e. g. would also accept chain = INPUT,FORWARD (gh-3909)
• action.d/nftables.conf (gh-3291):
• new parameter addr_options for addr-set (default flags interval\;, allows to store CIDR or address ranges); can be set to empty value to create simple addresses set (restore previous behavior).
• action.d/firewallcmd-rich-*.conf - fixed incorrect quoting, disabling port variable expansion by substitution of rich rule (gh-3815)
• filter.d/dovecot.conf:
• add support for latest Dovecot 2.4 release (gh-4016)
• mode aggressive covered new variant for no auth attempts in X secs with Login aborted and (no_auth_attempts)
• mode aggressive extended to match disconnected during TLS handshake with no application protocol and no shared cipher
• filter.d/nginx-http-auth.conf:
• extended with prefregex to capture content of error only (bypass common prefix and suffix, like server, request, host, referrer);
• extended to match PAM authentication failures (gh-4071)
• modes fallback and aggressive extended to match more SSL failures by SSL_do_handshake or SSL_read (gh-4142, gh-2881)
• filter.d/nginx-limit-req.conf - extended to ban hosts failed by limit connection in ngx_http_limit_conn_module (gh-3674, gh-4047)
• filter.d/proxmox.conf - add support to Proxmox Web GUI (gh-2966)
• filter.d/openvpn.conf - new filter and jail for openvpn recognizing failed TLS handshakes (gh-2702)
• filter.d/sendmail-reject.conf - also recognize "Domain of sender address ... does not resolve" (gh-4035)
• filter.d/vaultwarden.conf - new filter and jail for Vaultwarden (gh-3979)
• filter.d/xrdp.conf - new filter for XRDP, an open source RDP server (gh-3254)
• fail2ban-regex extended with new option -i or --invert to output not-matched lines by -o or --out (gh-4001)