# HG changeset patch
# User Pascal Bellard <pascal.bellard@slitaz.org>
# Date 1322318328 -3600
# Node ID 5d8d4ed26dc67208191fa7a984c46259af365291
# Parent  86a7edddf41255125430807d84881a9ee8ebbea4
fail2ban: enable ssh filter

diff -r 86a7edddf412 -r 5d8d4ed26dc6 fail2ban/receipt
--- a/fail2ban/receipt	Sat Nov 26 11:04:18 2011 +0100
+++ b/fail2ban/receipt	Sat Nov 26 15:38:48 2011 +0100
@@ -3,24 +3,50 @@
 PACKAGE="fail2ban"
 VERSION="0.8.4"
 CATEGORY="network"
-SHORT_DESC="Scans log files to bans IP that makes too many password failures.."
+SHORT_DESC="Scans log files to bans IP that makes too many password failures."
 MAINTAINER="pascal.bellard@slitaz.org"
 TARBALL="$PACKAGE-$VERSION.tar.bz2"
 WEB_SITE="http://www.fail2ban.org/wiki/index.php/Main_Page"
+DEPENDS="iptables"
 BUILD_DEPENDS="python"
 WGET_URL="$SF_MIRROR/$PACKAGE/$TARBALL"
 TAGS="monitor network"
+CONFIG_FILES="/etc/fail2ban"
 
 # Rules to configure and make the package.
 compile_rules()
 {
 	cd $src
-	python setup.py install --root=$PWD/_pkg
+	python setup.py install --root=$DESTDIR
 }
 
 # Rules to gen a SliTaz package suitable for Tazpkg.
 genpkg_rules()
 {
+	mkdir -p $fs/etc/logrotate.d
 	cp -a $_pkg/* $fs
+	sed -i -e 's|127.0.01|& 192.168.0.0/16|;s|sshd.log|messages|' \
+		-e '/ssh-iptables/{nn;s/false/true/}' $fs/etc/fail2ban/jail.conf
+	cat >> $fs/etc/fail2ban/jail.conf <<EOT
+[ssh-ddos]
+
+enabled  = true
+port     = ssh,sftp
+filter   = sshd-ddos
+action   = iptables-allports[name=SSHDDOS]
+logpath  = /var/log/messages
+maxretry = 2
+
+EOT
+	ln -s /usr/bin/fail2ban-client $fs/etc/init.d/fail2ban
+	cat > $fs/etc/logrotate.d/fail2ban <<EOT
+/var/log/fail2ban.log {
+	weekly
+	rotate 10
+	compress
+	postrotate
+	/etc/init.d/fail2ban reload >/dev/null || true
+	endscript
 }
-
+EOT
+}