Sergey G. Brester
0e2ad0360d
update changelog (mode -> logtype, added PR number)
2026-08-26 16:05:01 +02:00
Chris (ChrisJr404)
050e0b3460
gitlab: add json mode for application_json.log
...
Gitlab deprecated application.log in 15.10 in favour of the structured
application_json.log. Add a mode option so the filter can read either
format; text stays the default so existing setups keep working.
Closes #3566
2026-08-24 18:00:21 -04:00
sebres
46d2acd451
ChangeLog
2026-08-22 13:30:47 +02:00
Sergey G. Brester
6185bc3ea2
Update ChangeLog entry (added reference to PR)
2026-08-20 13:45:02 +02:00
Eric Wolf
cbdeee8d81
Fix systemd runtime directory containing persistent socket being removed
...
This resulted in a fail2ban being passed an unreachable socket after being stopped.
2026-08-20 04:03:15 +02:00
Eric Wolf
d574daf22e
Fix sockets passed via socket activation being shut down
...
Doing so results in systemd encountering errors after stopping fail2ban.
2026-08-20 02:33:06 +02:00
Sergey G. Brester
1e12c5a7c7
Merge pull request #4216 from jarihu/add-cowrie-filter
...
Add Cowrie honeypot JSON log filter
2026-08-18 15:28:22 +02:00
Jari Huttunen
b552116f4f
Renamed filter to cowrie
2026-08-18 14:55:18 +02:00
Jari Huttunen
dfb8a58d17
Fixed the CI failure by adding a stock [cowrie] jail entry to config/jail.conf.
2026-08-18 14:54:35 +02:00
VXNCXNX
17196db9c9
ChangeLog: entry for the apache-noscript cgi-bin fix
2026-08-18 14:35:33 +02:00
VXNCXNX
203202cdb4
filter.d/nginx-botsearch: support the journal log format
...
The error-log regex hardcoded the file-format prefix, so lines carrying a
systemd journal prefix were missed. Use __prefix_line from
nginx-error-common.conf, as the other nginx error-log filters already do.
Closes gh-3732
2026-08-16 08:40:42 +00:00
sebres
3a7a6ac415
version bump (back to .dev)
2026-08-15 17:48:38 +02:00
sebres
f60978618a
release 1.1.1 -- triple-one-win
2026-08-15 14:25:41 +02:00
Sergey G. Brester
6c7a52e65f
Merge pull request #4221 from sebres/GHSA-33wh-ccjc-p397
...
fixes GHSA-33wh-ccjc-p397: avoid catastrophic backtracking explosion for REs in domino-smtp and dovecot filter
2026-08-15 13:29:06 +02:00
Sergey G. Brester
a2694a1ec1
update ChangeLog with recent fixes
...
Fix catastrophic backtracking in REs for domino-smtp and dovecot filters.
2026-08-15 13:25:05 +02:00
Sergey G. Brester
d5d0f23d48
Merge pull request #4220 from h7x4/systemd-socket-activation
...
Add support for systemd socket activation
2026-08-15 12:50:05 +02:00
Sergey G. Brester
6afc074591
Update ChangeLog with new aggressive mode matching
...
Extended modes 'aggressive' to match hostname resolution errors.
2026-08-15 12:33:16 +02:00
h7x4
d5d81242cf
Add support for systemd socket activation
2026-08-15 19:06:17 +09:00
sebres
8d3f5048ef
filter.d/postfix.conf - extended prefregex to capture username in postfix SASL failures;
...
closes gh-4165
2026-04-11 14:42:57 +02:00
sebres
c03a6204c1
ChangeLog update
2026-02-12 14:03:07 +01:00
Sergey G. Brester
f457cf8131
ChangeLog adjusted
...
move from compat to enhancement section
2026-02-02 02:31:19 +01:00
Chris Caron
8afd0c8956
updated ChangeLog to reflect Apprise updates
2026-01-28 21:55:04 -05:00
sebres
8506e4a41d
action.d/nftables.conf - fixed for SELinux without execmem permission, rewrite capturing with grep -P using grep -E or sed;
...
(PCRE-JIT by `grep -P` may cause SELinux denial for execmem), closes gh-4137
2026-01-23 21:23:58 +01:00
Sergey G. Brester
2f0e05a0d7
Merge branch 'master' into master
2025-12-07 01:14:39 +01:00
sebres
ef65652671
filter.d/apache-badbots.conf, filter.d/apache-fakegooglebot.conf - regexs fixed to match lines with vhost in accesslog;
...
closes gh-1594
2025-11-28 22:27:06 +01:00
Sergey G. Brester
7bac839603
Merge pull request #4069 from sebres/init-param-to-cond-section
...
Setting of blocktype="DROP" via jail doesn't apply for IPv6 chain
2025-09-24 18:23:44 +02:00
Sergey G. Brester
d0b94c147e
Update ChangeLog
2025-09-24 18:22:06 +02:00
para-do-x
ad9aba5871
Update ChangeLog gh4075
2025-09-24 18:43:39 +04:00
sebres
65668b8ed8
filter.d/postfix.conf - modes ddos and aggressive extended to match rate limit exceeded for connection or message delivery request rates;
...
closes gh-3265;
closes gh-4073;
2025-09-23 12:18:45 +02:00
sebres
2856092709
filter.d/postfix.conf - use common prefix instead of NOQUEUE for all modes, outside of mdpr-<mode> in prefregex (amend to gh-4072)
2025-09-18 15:01:05 +02:00
Ulrich Müller
0fee8dbe92
filter.d/postfix.conf: Add optional "NOQUEUE:" to mdpr-ddos
...
The current regex doesn't match the following log entry, seen with
Postfix 3.10.2:
Sep 17 18:19:20 mxhost postfix/smtpd[12345]: NOQUEUE: lost connection after CONNECT from unknown[192.0.2.25]
Sep 17 18:19:20 mxhost postfix/smtpd[12345]: disconnect from unknown[192.0.2.25] commands=0/0
2025-09-18 08:23:45 +02:00
Sergey G. Brester
6c47bf6461
Merge pull request #4068 from billfor/xarf
...
fix `dig` to filter out warnings and prevent them from being injected as emails
2025-09-15 17:23:32 +02:00
sebres
9534bdac37
filter.d/nginx-http-auth.conf: filter rewritten and extended:
...
- with `prefregex` to capture content of error only (bypass common prefix and suffix, like server, request, host, referrer);
- to match PAM authentication failures (gh-4071)
2025-09-15 16:14:22 +02:00
Sergey G. Brester
4539e6719c
Update ChangeLog
2025-09-10 20:19:34 +02:00
bill
9e72e78f34
filter.d/sendmail-reject.conf: support BSD log format. match user unknown messages. add aggressive mode for lost input channel and relaying denied messages
2025-09-01 22:34:53 -04:00
sebres
002719dca4
ChangeLog update
2025-08-23 20:18:59 +02:00
Sergey G. Brester
bf4903538d
update ChangeLog (enhancement from #3291 )
2025-08-08 10:29:02 +02:00
Sergey G. Brester
e16e982a45
Merge pull request #4047 from billfor/nginx
...
Update nginx-limit-req filter (extended to ban hosts failed by limit connection in ngx_http_limit_conn_module);
closes gh-3674
2025-08-04 11:34:35 +02:00
Sergey G. Brester
dd58d440bc
Update ChangeLog
2025-08-04 11:32:10 +02:00
sebres
ff3eca1d61
* Merge pull request #3527 from vafgoettlich/master
...
(partial merge, only postfix-backend)
2025-07-24 11:17:05 +02:00
sebres
0b255a8723
Merge pull request #3527 from vafgoettlich/master
...
(partial merge, only postfix-backend)
2025-07-24 11:14:03 +02:00
Sergey G. Brester
7bb86822d0
Update ChangeLog
2025-07-20 15:15:38 +02:00
sebres
b710d5b6c7
filter.d/sendmail-reject.conf - also recognize "Domain of sender address ... does not resolve";
...
closes gh-4035
2025-07-13 01:03:53 +02:00
Nic Boet
646832d5bd
dovecot 2.4 into changelog
...
Signed-off-by: Nic Boet <nic@boet.cc>
2025-06-13 17:00:47 -05:00
sebres
4254d6bcd3
man and changelog
2025-06-03 22:19:54 +02:00
sebres
0d4a926029
ChangeLog (enhancement and compat entries)
2025-04-16 17:13:58 +02:00
sebres
c76e90fbb1
* Merge pull request #3940 from exim-pr-mode-more
...
`filter.d/exim.conf` - fewer REs by default, introduces mode `more`
2025-04-02 15:11:38 +02:00
Sergey G. Brester
6538d43a8e
Update ChangeLog
2025-04-02 14:57:03 +02:00
Sergey G. Brester
70ce1cef08
Update ChangeLog
2025-04-02 14:40:04 +02:00
sebres
767c89f863
satisfy spellcheck
2025-03-31 01:27:52 +02:00
