Mailinglist Archive: opensuse-updates (124 mails)

< Previous Next >
openSUSE-RU-2017:1779-1: moderate: Recommended update for fail2ban
openSUSE Recommended Update: Recommended update for fail2ban
______________________________________________________________________________

Announcement ID: openSUSE-RU-2017:1779-1
Rating: moderate
References: #1036928
Affected Products:
openSUSE Leap 42.2
______________________________________________________________________________

An update that has one recommended fix can now be installed.

Description:

This update for fail2ban fixes the following issues:

Fail2Ban was updated to version 0.9.7.

Additional fixes included:

- Updated roundcube authentication filter
- Postfix RBL: 554 & SMTP fixes boo#1036928 " fail2ban-rbl regex
incorrect, takes no action as a result".

Version changes on 0.9.7:

* Fixed a systemd-journal handling in fail2ban-regex
(gh#fail2ban/fail2ban#1657)
* filter.d/sshd.conf
- Fixed non-anchored part of failregex (misleading match of colon
inside IPv6 address instead of `: ` in the reason-part by missing
space, gh#fail2ban/fail2ban#1658) (0.10th resp. IPv6 relevant only,
amend for gh#fail2ban/fail2ban#1479)
* config/pathes-freebsd.conf
- Fixed filenames for apache and nginx log files
(gh#fail2ban/fail2ban#1667)
* filter.d/exim.conf
- optional part `(...)` after host-name before `[IP]`
(gh#fail2ban/fail2ban#1751)
- new reason "Unrouteable address" for "rejected RCPT" regex
(gh#fail2ban/fail2ban#1762)
- match of complex time like `D=2m42s` in regex "no MAIL in SMTP
connection" (gh#fail2ban/fail2ban#1766)
* filter.d/sshd.conf
- new aggressive rules (gh#fail2ban/fail2ban#864):
- Connection reset by peer (multi-line rule during authorization
process)
- No supported authentication methods available
- single line and multi-line expression optimized, added optional
prefixes and suffix (logged from several ssh versions), according to
gh#fail2ban/fail2ban#1206;
- fixed expression received disconnect auth fail (optional space after
port part, gh#fail2ban/fail2ban#1652) and suffix (logged from
several ssh versions), according to gh#fail2ban/fail2ban#1206;
* filter.d/suhosin.conf
- greedy catch-all before `<HOST>` fixed (potential vulnerability)
* filter.d/cyrus-imap.conf
- accept entries without login-info resp. hostname before IP address
(#fail2ban/fail2ban#707)
* Filter tests extended with check of all config-regexp, that contains
greedy catch-all before `<HOST>`, that is hard-anchored at end or
precise sub expression after `<HOST>`

* New Actions:
- action.d/netscaler: Block IPs on a Citrix Netscaler ADC
(gh#fail2ban/fail2ban#1663)

* New Filters:
- filter.d/domino-smtp: IBM Domino SMTP task (gh#fail2ban/fail2ban#1603)
* Introduced new log-level `MSG` (as INFO-2, equivalent to 18)

- rename nagios-plugins-fail2ban to monitoring-plugins-fail2ban

fail2ban version update to 0.9.6 (2016/12/10) included:

Fixes:

* Misleading add resp. enable of (already available) jail in database,
that induced a subsequent error: last position of log file will be never
retrieved (gh-795)
* Fixed a distribution related bug within
testReadStockJailConfForceEnabled (e.g. test-cases faults on Fedora, see
gh-1353)
* Fixed pythonic filters and test scripts (running via wrong python
version, uses "fail2ban-python" now);
* Fixed test case "testSetupInstallRoot" for not default python version
(also using direct call, out of virtualenv);
* Fixed ambiguous wrong recognized date pattern resp. its optional parts
(see gh-1512);
* FIPS compliant, use sha1 instead of md5 if it not allowed (see gh-1540)
* Monit config: scripting is not supported in path (gh-1556)
* `filter.d/apache-modsecurity.conf`
- Fixed for newer version (one space, gh-1626), optimized: non-greedy
catch-all replaced for safer match, unneeded catch-all anchoring
removed, non-capturing
* `filter.d/asterisk.conf`
- Fixed to match different asterisk log prefix (source file: method:)
* `filter.d/dovecot.conf`
- Fixed failregex ignores failures through some not relevant info
(gh-1623)
* `filter.d/ignorecommands/apache-fakegooglebot`
- Fixed error within apache-fakegooglebot, that will be called with
wrong python version (gh-1506)
* `filter.d/assp.conf`
- Extended failregex and test cases to handle ASSP V1 and V2 (gh-1494)
* `filter.d/postfix-sasl.conf`
- Allow for having no trailing space after 'failed:' (gh-1497)
* `filter.d/vsftpd.conf`
- Optional reason part in message after FAIL LOGIN (gh-1543)
* `filter.d/sendmail-reject.conf`
- removed mandatory double space (if dns-host available, gh-1579)
* filter.d/sshd.conf
- recognized "Failed publickey for" (gh-1477);
- optimized failregex to match all of "Failed any-method for ... from
<HOST>" (gh-1479)
- eliminated possible complex injections (on user-name resp.
auth-info, see gh-1479)
- optional port part after host (see gh-1533, gh-1581)

New Features:

* New Actions:
- `action.d/npf.conf` for NPF, the latest packet filter for NetBSD
* New Filters:
- `filter.d/mongodb-auth.conf` for MongoDB (document-oriented NoSQL
database engine) (gh-1586, gh-1606 and gh-1607)

Enhancements:

* DateTemplate regexp extended with the word-end boundary, additionally to
word-start boundary
* Introduces new command "fail2ban-python", as automatically created
symlink to python executable, where fail2ban currently installed (resp.
its modules are located):
- allows to use the same version, fail2ban currently running, e.g. in
external scripts just via replace python with fail2ban-python:
```diff
-#!/usr/bin/env python
+#!/usr/bin/env fail2ban-python ```
- always the same pickle protocol
- the same (and also guaranteed available) fail2ban modules
- simplified stand-alone install, resp. stand-alone installation
possibility via setup (like gh-1487) is getting closer
* Several test cases rewritten using new methods assertIn, assertNotIn
* New forward compatibility method assertRaisesRegexp (normally python >=
2.7). Methods assertIn, assertNotIn, assertRaisesRegexp, assertLogged,
assertNotLogged are test covered now
* Jail configuration extended with new syntax to pass options to the
backend (see gh-1408), examples:
- `backend = systemd[journalpath=/run/log/journal/machine-1]`
- `backend =
systemd[journalfiles="/run/log/journal/machine-1/system.journal,
/run/log/journal/machine-1/user.journal"]`
- `backend = systemd[journalflags=2]`


Patch Instructions:

To install this openSUSE Recommended Update use YaST online_update.
Alternatively you can run the command listed for your product:

- openSUSE Leap 42.2:

zypper in -t patch openSUSE-2017-772=1

To bring your system up-to-date, use "zypper patch".


Package List:

- openSUSE Leap 42.2 (noarch):

SuSEfirewall2-fail2ban-0.9.7-2.3.1
fail2ban-0.9.7-2.3.1
monitoring-plugins-fail2ban-0.9.7-2.3.1


References:

https://bugzilla.suse.com/1036928


< Previous Next >
This Thread
  • No further messages