NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
d17e856364
kumquat-buildroot/package/fail2ban/fail2ban.mk

55 lines
2.0 KiB
Makefile
Raw Normal View History

package/fail2ban: new package Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show malicious behaviours. Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com> [Thomas: simplify $(SED) expression by using comma as a separator instead of slash.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-11-25 00:24:22 +01:00
################################################################################
#
# fail2ban
#
################################################################################
package/fail2ban: bump to version 0.11.2 https://github.com/fail2ban/fail2ban/blob/0.11.2/ChangeLog Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-04-06 22:09:10 +02:00
FAIL2BAN_VERSION = 0.11.2
package/fail2ban: new package Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show malicious behaviours. Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com> [Thomas: simplify $(SED) expression by using comma as a separator instead of slash.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-11-25 00:24:22 +01:00
FAIL2BAN_SITE = $(call github,fail2ban,fail2ban,$(FAIL2BAN_VERSION))
FAIL2BAN_LICENSE = GPL-2.0+
FAIL2BAN_LICENSE_FILES = COPYING
package/fail2ban: add FAIL2BAN_CPE_ID_VENDOR cpe:2.3:a:fail2ban:fail2ban is a valid CPE identifier for this package: https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Afail2ban%3Afail2ban Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-02-12 22:39:02 +01:00
FAIL2BAN_CPE_ID_VENDOR = fail2ban
package/fail2ban: add SELinux module Support for fail2ban is added by the services/fail2ban module in the SELinux refpolicy. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-07-26 10:25:53 +02:00
FAIL2BAN_SELINUX_MODULES = fail2ban
package/fail2ban: new package Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show malicious behaviours. Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com> [Thomas: simplify $(SED) expression by using comma as a separator instead of slash.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-11-25 00:24:22 +01:00
FAIL2BAN_SETUP_TYPE = distutils
package/fail2ban: fix CVE-2021-32749 fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, there is a vulnerability that leads to possible remote code execution in the mailing action mail-whois. Command `mail` from mailutils package used in mail actions like `mail-whois` can execute command if unescaped sequences (`\n~`) are available in "foreign" input (for instance in whois output). To exploit the vulnerability, an attacker would need to insert malicious characters into the response sent by the whois server, either via a MITM attack or by taking over a whois server. The issue is patched in versions 0.10.7 and 0.11.3. As a workaround, one may avoid the usage of action `mail-whois` or patch the vulnerability manually. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-07-30 14:56:11 +02:00
# 0001-fixed-possible-RCE-vulnerability-unset-escape-variable.patch
FAIL2BAN_IGNORE_CVES += CVE-2021-32749
package/fail2ban: add python3 support The fail2ban codebase is still native python2, but 2to3 is supported upstream. Signed-off-by: Pascal de Bruijn <p.debruijn@unilogic.nl> [Peter: ensure host-python3 is available] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-01-22 14:15:14 +01:00
ifeq ($(BR2_PACKAGE_PYTHON3),y)
define FAIL2BAN_PYTHON_2TO3
$(HOST_DIR)/bin/2to3 --write --nobackups --no-diffs $(@D)/bin/* $(@D)/fail2ban
endef
FAIL2BAN_DEPENDENCIES += host-python3
package/fail2ban: The (host-python3) 2to3 utility needs to be present During _POST_PATCH_HOOKS _DEPENDANCIES aren't guaranteed to be built, however during _PRE_CONFIGURE_HOOKS they should be built. Should fix: http://autobuild.buildroot.net/results/dd8e225e2a49cfa6735bed11459007003a37c137/ http://autobuild.buildroot.net/results/e688c3652bd474ac682984e2e5947701942f0f57/ Cc: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Pascal de Bruijn <p.debruijn@unilogic.nl> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-02-26 09:28:18 +01:00
# We can't use _POST_PATCH_HOOKS because dependencies are not guaranteed
# to build and install before _POST_PATCH_HOOKS run.
FAIL2BAN_PRE_CONFIGURE_HOOKS += FAIL2BAN_PYTHON_2TO3
package/fail2ban: add python3 support The fail2ban codebase is still native python2, but 2to3 is supported upstream. Signed-off-by: Pascal de Bruijn <p.debruijn@unilogic.nl> [Peter: ensure host-python3 is available] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-01-22 14:15:14 +01:00
endif
package/fail2ban: add fixup for default configuration fail2ban default configuration is not compatible with buildroot as is. In order to not force the user to overwrite it in an overlay and having a fail2ban service running out of the box, this patch adds a fixup step to adapt the default configuration to running on buildroot. The dbfile is None to not add a dependency on BR2_PACKAGE_PYTHON_SQLITE. Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-03-28 14:41:00 +01:00
define FAIL2BAN_FIX_DEFAULT_CONFIG
$(SED) '/^socket/c\socket = /run/fail2ban.sock' $(TARGET_DIR)/etc/fail2ban/fail2ban.conf
$(SED) '/^pidfile/c\pidfile = /run/fail2ban.pid' $(TARGET_DIR)/etc/fail2ban/fail2ban.conf
$(SED) '/^dbfile/c\dbfile = None' $(TARGET_DIR)/etc/fail2ban/fail2ban.conf
endef
FAIL2BAN_POST_INSTALL_TARGET_HOOKS += FAIL2BAN_FIX_DEFAULT_CONFIG
package/fail2ban: fix fail2ban-python symlink Fixes (reproducible): http://autobuild.buildroot.net/results/50f/50f199bfe06d054cc6770760e73ac0de594a0670/diffoscope-results.txt Fail2ban installs the fail2ban-python symlink pointing to the host python intepreter used to run setup.py, which is naturally not valid at runtime and breaks the reproducible tests as shown in the diffoscope results: │ -lrwxrwxrwx 0 0 0 0 2020-10-04 10:50:38.000000 ./usr/bin/fail2ban-python -> /home/naourr/work/instance-0/output-1/host/bin/python │ +lrwxrwxrwx 0 0 0 0 2020-10-04 10:50:38.000000 ./usr/bin/fail2ban-python -> /home/naourr/work/instance-0/output-2/host/bin/python As a workaround, update the symlink after installation to point to the correct target python. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-10-05 07:58:08 +02:00
# fail2ban-python points to host python
define FAIL2BAN_FIX_FAIL2BAN_PYTHON_SYMLINK
ln -snf $(if $(BR2_PACKAGE_PYTHON),python,python3) \
$(TARGET_DIR)/usr/bin/fail2ban-python
endef
FAIL2BAN_POST_INSTALL_TARGET_HOOKS += FAIL2BAN_FIX_FAIL2BAN_PYTHON_SYMLINK
package/fail2ban: new package Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show malicious behaviours. Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com> [Thomas: simplify $(SED) expression by using comma as a separator instead of slash.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-11-25 00:24:22 +01:00
define FAIL2BAN_INSTALL_INIT_SYSV
$(INSTALL) -D -m 755 package/fail2ban/S60fail2ban \
$(TARGET_DIR)/etc/init.d/S60fail2ban
endef
define FAIL2BAN_INSTALL_INIT_SYSTEMD
$(INSTALL) -D -m 0644 $(@D)/files/fail2ban.service.in \
$(TARGET_DIR)/usr/lib/systemd/system/fail2ban.service
$(SED) 's,@BINDIR@,/usr/bin,g' $(TARGET_DIR)/usr/lib/systemd/system/fail2ban.service
package/fail2ban: add fixup for default configuration fail2ban default configuration is not compatible with buildroot as is. In order to not force the user to overwrite it in an overlay and having a fail2ban service running out of the box, this patch adds a fixup step to adapt the default configuration to running on buildroot. The dbfile is None to not add a dependency on BR2_PACKAGE_PYTHON_SQLITE. Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-03-28 14:41:00 +01:00
$(SED) '/^PIDFile/c\PIDFile=/run/fail2ban.pid' $(TARGET_DIR)/usr/lib/systemd/system/fail2ban.service
package/fail2ban: new package Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show malicious behaviours. Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com> [Thomas: simplify $(SED) expression by using comma as a separator instead of slash.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-11-25 00:24:22 +01:00
endef
$(eval $(python-package))
Reference in New Issue Copy Permalink