package/fail2ban: new package
PATCH v3 1/1 package/fail2ban: new package
Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show malicious behaviours.
---
Changes:v1->v2:
* Adding sha256 for license file
* getting service file for systemd from source directory
v2->v3:
* Fixing suggestions made by Thomas Petazzoni
DEVELOPERS | 1 + package/Config.in | 1 + package/fail2ban/Config.in | 15 +++++++++++++++ package/fail2ban/S60fail2ban | 23 +++++++++++++++++++++++ package/fail2ban/fail2ban.hash | 3 +++ package/fail2ban/fail2ban.mk | 27 +++++++++++++++++++++++++++ 6 files changed, 70 insertions(+) create mode 100644 package/fail2ban/Config.in create mode 100644 package/fail2ban/S60fail2ban create mode 100644 package/fail2ban/fail2ban.hash create mode 100644 package/fail2ban/fail2ban.mk
DEVELOPERS +1 -0
@@ -146,6 +146,7 @@ F: package/libunwind/ N: Angelo Compagnucci <[email protected]> F: package/corkscrew/ +F: package/fail2ban/ F: package/i2c-tools/ F: package/mender/ F: package/mono/
package/Config.in +1 -0
@@ -1826,6 +1826,7 @@ menu "Networking applications" source "package/ejabberd/Config.in" source "package/ethtool/Config.in" source "package/faifa/Config.in" + source "package/fail2ban/Config.in" source "package/fastd/Config.in" source "package/fcgiwrap/Config.in" source "package/flannel/Config.in"
package/fail2ban/Config.in new file +15 -0
@@ -0,0 +1,15 @@ +config BR2_PACKAGE_FAIL2BAN + bool "fail2ban" + depends on BR2_PACKAGE_PYTHON + help + Fail2ban scans log files (e.g. /var/log/apache/error_log) and + bans IPs that show the malicious signs -- too many password + failures, seeking for exploits, etc. Out of the box Fail2Ban + comes with filters for various services (apache, courier, + ssh, etc). + + Fail2Ban is able to reduce the rate of incorrect + authentications attempts however it cannot eliminate the risk + that weak authentication presents. + + https://www.fail2ban.org
package/fail2ban/S60fail2ban new file +23 -0
@@ -0,0 +1,23 @@ +#!/bin/sh + +case "$1" in + start) + printf "Starting fail2ban: " + start-stop-daemon -S -q -m -p /var/run/fail2ban.pid \ + -b -x fail2ban-server -- -xf start + [ $? = 0 ] && echo "OK" || echo "FAIL" + ;; + stop) + printf "Stopping fail2ban: " + start-stop-daemon -K -q -p /var/run/fail2ban.pid + [ $? = 0 ] && echo "OK" || echo "FAIL" + ;; + restart) + "$0" stop + sleep 1 + "$0" start + ;; + *) + echo "Usage: $0 {start|stop|restart}" + ;; +esac
package/fail2ban/fail2ban.hash new file +3 -0
@@ -0,0 +1,3 @@ +# sha256 locally computed +sha256 d6ca1bbc7e7944f7acb2ba7c1065953cd9837680bc4d175f30ed155c6a372449 fail2ban-0.10.4.tar.gz +sha256 a75fec0260742fe6275d63ff6a5d97b924b28766558306b3fa4069763096929b COPYING
package/fail2ban/fail2ban.mk new file +27 -0
@@ -0,0 +1,27 @@ +################################################################################ +# +# fail2ban +# +################################################################################ + +FAIL2BAN_VERSION = 0.10.4 +FAIL2BAN_SITE = $(call github,fail2ban,fail2ban,$(FAIL2BAN_VERSION)) +FAIL2BAN_LICENSE = GPL-2.0+ +FAIL2BAN_LICENSE_FILES = COPYING +FAIL2BAN_SETUP_TYPE = distutils + +define FAIL2BAN_INSTALL_INIT_SYSV + $(INSTALL) -D -m 755 package/fail2ban/S60fail2ban \ + $(TARGET_DIR)/etc/init.d/S60fail2ban +endef + +define FAIL2BAN_INSTALL_INIT_SYSTEMD + $(INSTALL) -D -m 0644 $(@D)/files/fail2ban.service.in \ + $(TARGET_DIR)/usr/lib/systemd/system/fail2ban.service + mkdir -p $(TARGET_DIR)/etc/systemd/system/multi-user.target.wants + ln -fs ../../../../usr/lib//systemd/system/fail2ban.service \ + $(TARGET_DIR)/etc/systemd/system/multi-user.target.wants/fail2ban.service + $(SED) 's/@BINDIR@/\/usr\/bin/g' $(TARGET_DIR)/usr/lib/systemd/system/fail2ban.service +endef + +$(eval $(python-package))
Signature · 1 line
2.17.1
PATCH v3 1/1 package/fail2ban: new package
Hello,
Quoted 4 lines · Angelo Compagnucci
Fail2ban scans log files (e.g.
/var/log/apache/error_log) and bans IPs that show malicious behaviours.Signed-off-by Angelo Compagnucci <[email protected]>
Thanks, I've applied to next. See two comments below.
package/fail2ban/fail2ban.mk line 24
Quoted 7 lines
package/fail2ban/fail2ban.mk new file +7
-0+define FAIL2BAN_INSTALL_INIT_SYSTEMD + $(INSTALL) -D -m 0644 $(@D)/files/fail2ban.service.in \ + $(TARGET_DIR)/usr/lib/systemd/system/fail2ban.service + mkdir -p $(TARGET_DIR)/etc/systemd/system/multi-user.target.wants + ln -fs ../../../../usr/lib//systemd/system/fail2ban.service \ + $(TARGET_DIR)/etc/systemd/system/multi-user.target.wants/fail2ban.service + $(SED) 's/@BINDIR@/\/usr\/bin/g' $(TARGET_DIR)/usr/lib/systemd/system/fail2ban.service
I've simplified a bit the sed expression by using a comma as a separator instead of slash. This allows to avoid having to escape the slashes in /usr/bin.
Also, I see that in the setup.py of fail2ban, there is some logic to actually generate the fail2ban.service, doing the replacement of @BINDIR at . However, it requires calling the install_scripts target, which our Python infrastructure doesn't do, and doesn't easily allow to override today. So I've applied as-is, but if we have more package that have custom targets like this, we may want to extend a bit the python-package infrastructure.
Thanks!
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Bootlin Embedded Linux and Kernel engineering https://bootlin.com