--- - branch: MAIN date: Sat Nov 27 14:28:11 UTC 2021 files: - new: '1.23' old: '1.22' path: pkgsrc/security/py-denyhosts/Makefile pathrev: pkgsrc/security/py-denyhosts/Makefile@1.23 type: modified - new: '1.4' old: '1.3' path: pkgsrc/security/py-denyhosts/PLIST pathrev: pkgsrc/security/py-denyhosts/PLIST@1.4 type: modified - new: '1.10' old: '1.9' path: pkgsrc/security/py-denyhosts/distinfo pathrev: pkgsrc/security/py-denyhosts/distinfo@1.10 type: modified - new: '0' old: 1.1.1.1 path: pkgsrc/security/py-denyhosts/patches/patch-aa pathrev: pkgsrc/security/py-denyhosts/patches/patch-aa@0 type: deleted - new: '0' old: 1.1.1.1 path: pkgsrc/security/py-denyhosts/patches/patch-ab pathrev: pkgsrc/security/py-denyhosts/patches/patch-ab@0 type: deleted - new: '0' old: 1.1.1.1 path: pkgsrc/security/py-denyhosts/patches/patch-ad pathrev: pkgsrc/security/py-denyhosts/patches/patch-ad@0 type: deleted - new: '0' old: 1.1.1.1 path: pkgsrc/security/py-denyhosts/patches/patch-ae pathrev: pkgsrc/security/py-denyhosts/patches/patch-ae@0 type: deleted - new: '0' old: '1.2' path: pkgsrc/security/py-denyhosts/patches/patch-ac pathrev: pkgsrc/security/py-denyhosts/patches/patch-ac@0 type: deleted - new: '0' old: '1.3' path: pkgsrc/security/py-denyhosts/patches/patch-af pathrev: pkgsrc/security/py-denyhosts/patches/patch-af@0 type: deleted - new: '1.1' old: '0' path: pkgsrc/security/py-denyhosts/patches/patch-daemon-control-dist pathrev: pkgsrc/security/py-denyhosts/patches/patch-daemon-control-dist@1.1 type: added - new: '1.1' old: '0' path: pkgsrc/security/py-denyhosts/patches/patch-denyhosts.conf pathrev: pkgsrc/security/py-denyhosts/patches/patch-denyhosts.conf@1.1 type: added - new: '1.1' old: '0' path: pkgsrc/security/py-denyhosts/patches/patch-setup.py pathrev: pkgsrc/security/py-denyhosts/patches/patch-setup.py@1.1 type: added id: 20211127T142811Z.b199b86f877361a555b596043f691f4fd58fe9d0 log: | Update py-denyhosts to version 3.0. Pkgsrc changes: * Change naming style for patches * Adapt patches to new version * Relinquish maintainership to indicate others can update * Add dependency on py-expat Upstream changes: 3.0 ====================== Initial translation of code from Python 2 to Python 3. DenyHosts can now be run as either a Python 2 or a Python 3 program. Added patch from Fedora to fix initial sync issue and insure info logging stream is active. (Provided by Jason Tibbitts.) Added "import logging" to denyhosts.py to avoid errors when setting up logging. (See above change.) Added option PF_TABLE_FILE to the configuration file. When this option is enabled it causes DenyHosts to write blocked IP addresses to a text file. The default location is /etc/blacklist. This text file should correspond to a PF firewall table. At start-up, try to create the file specified by HOSTS_DENY. That way we avoid errors later if the file does not exists. Can be a problem on operating systems where /etc/hosts.deny does not exist in the default configuration. Added regex pattern to detect invalid user accounts. This blocks connections from remote hosts who are attempting to login with accounts not found on the local system. While these connections to non-existent accounts are relatively harmless, they are usually used as part of a brute force attack and filtering them before they reach OpenSSH is a good idea. 2.10 ====================== - Updated example rule for PF in configuration file to make black listing attacking IPs more effective. - Added debugging info in case we cannot create a new PF table entry. - Fixed syntax for comparing suspecious logins. Avoids always testing true/false depending on Python version. - No longer require ETC_DIR in the configuration file. Use a default value "/etc" if ETC_DIR is not manually specified. - Make sure DenyHosts logs when running in foreground mode. When in foreground, warnings are logged to a file rather than outputted to terminal. Keeps things clean. - Add --unlock command line arguement to remove old lock files. - Updated README, version and Makefile with new version/maintainer information. - Added check for PAM failures on FreeBSD. This should block both failed user logins that are reported by PAM and also block repteated attempts at accessing the root account when root logins are disabled by OpenSSH. The latter does not really add more practical protection, but can prevent the connection \ attempts at the firewall level before the OpenSSH service is contacted. - Add systemd unit file, denyhosts.service 2.9 (November 3, 2014) ====================== - DenyHost now supports working with the PF packet filter, a popular firewall for FreeBSD, OpenBSD, TrueOS, PC-BSD and NetBSD. To enable PF support in DenyHost, comment out the IPTABLES option in the denyhosts.conf file and enable the PFCTL_PATH and PF_TABLE options. DenyHost will add misbehaving IP addresses to the PF table specified by "PF_TABLE". This table should be blocked using the pf.conf file. Please see the denyhosts.conf file for more information and example PF rules for blocking incoming traffic. Please note that even if /etc/hosts.deny is not used to block incoming connectins, the file should still exists or DenyHosts may throw an error. (This should be fixed in the next release.) 2.8 (June 12, 2014) =================== - Use standard errno instead of hardcoded errno value. Patch provided by Pino Toscano. - Make sure PLUGIN_DENY is called for each host we receive from the sync server. Patch provided by Sean M. Collins. - Made sure only new hosts in hosts.deny are reported as new, not all hosts. This prevents the PLUGIN_DENY plugin from getting old entries repeatedly. Patch provided by Chris Erdle. - We now check user defined regular expression filters, even if we already found a match with an existing filter. This allows the user to filter more services without using a plugin. Patch provided by Ben. - Added --purge-all command line flag to allow us to remove all old entries from the deny file without waiting. Patch provided by 9MediaCenterGUI on SourceForge. - Updated copyright information and some documentation. - Added manual page from Debian and fixed typo. Added additional command line options to man page. - Added --purgeip option to allow us to remove specific IP addresses from the blocked list at start time. Patch provided by Nelson Howell. Should close Debian bug 529089. - Updated FAILED_ENTRY_REGEX7 to be more flexible. - Added ability to use Linux iptables to block incoming connections. See IPTABLES option in the configuration file. - Made it possible to block specific ports, allowing remote hosts to conenct to some services while being blocked on others by the iptables firewall. See the BLOCKPORT option in the configuration file. 2.7 (May 18, 2014) ================== - Forked code from DenyHosts (denyhosts.sf.net) New project now maintained at denyhost.sf.net - Added private moduls patch from Marco Bertorello. Loads modules from /usr/share/denyhosts - Place config, lock and executable file in more standard locations. Patch provided by Marco Bertorello. - Fixed configuration (denyhosts.cfg-dist) to better support Debian and Ubuntu. Patch supplied by Marco Nenciarini. - Added warning to migrate switch. Patch provided by Marco Bertorello. - Avoid installing unwanted files (extra scripts and changelog). Patch provided by Marco Nenciarini. - Fix bug which would not recognize an attack on the root user account. Patch provided by Kyle Willmon. - Fix pattern matching bug (CVE-2007-4323). Patch provided by Nico Golde. - Added foreground mode for debugging. Patch supplied by Marco Bertorello. - Applied patch to fix plugin execution. Patched provided by Marco Bertorello. - Added patch to prevent DenyHosts from running with a double --config switch. Patch provided by Maro Bertorello. - Convert path of "env" from /bin/env to /usr/bin/env Patch provided by Kyle Willmon. - Added patch to perform missing bounds check in Purge action. Provided by Kyle Willmon. - Added patch to include SYNC_PROXY_SERVER configuration option. Provided by Kyle Willmon. - Change HOSTNAME_LOOKUP to default to "NO". Will save time. Also brings us into closer alignment with FreeBSD patches. - Added /usr/sbin/nologin to restricted_from_passwd script. Requirement from FreeBSD patch set. - Added variable "ETC_DIR" which dictates the location of configuration files. This should usually be set to /etc or /usr/local/etc - The restricted-usernames file is now loaded from the "ETC_DIR" directory, rather than from "WORK_DIR" to avoid this human-made configuration file from being over-writeen. Closes Ubuntu bug #675034 - Confirm setting timestamp over-writes old tiemstamp file. Closes Ubuntu bug #564476 - Applied advanced pattern check for authentication file which takes into account alternative port numbers. Patch provided by Helmut Grohne. - Updated license and readme files. - Updated help output from DenyHost script to include --config tip. module: pkgsrc subject: 'CVS commit: pkgsrc/security/py-denyhosts' unixtime: '1638023291' user: he