Fail2ban + Shorewall Question

[BJ Dierkes]

Hello all,

I originally posted this on the epel-devel-list, but was referred by  
the EPEL maintainer of fail2ban to bring the discussion upstream to  
Fedora in hopes of convincing the Fedora maintainer of fail2ban to  
make these changes.  The following was my original message:

---

I bring this to the list being that the issue isn't necessarily a bug,  
rather a concern about implementation.  Per the documentation
[http://www.fail2ban.org/wiki/index.php/MANUAL_0_8 
] fail2ban is _capable_ of supporting shorewall (among other things)  
and even states that "the following software is optional but  
recommended" with reference to shorewall.  However, fail2ban does not  
_require_ shorewall to function.

That said, having a 'Requires: shorewall' in the fail2ban spec seems  
unnecessary and in my opinion improper.  Breaking the package out into  
a sub package doesn't seem necessary either...  being that the only  
file(s) I see that could be split off would be:

]# rpm -ql fail2ban | grep shorewall
/etc/fail2ban/action.d/shorewall.conf


Regardless, for the sake of those that have no interest in shorewall  
(and in particular those that want to avoid having to support  
shorewall) I'd like to suggest that fail2ban-shorewall be broken off  
in a sub-package or simply drop the Requires: shorewall completely so  
that the dependency of shorewall is only enacted when desired (or not  
at all).

Thoughts?

Thank you for your time.

---
derks

[Jonathan Underwood]

2009/7/10 BJ Dierkes <wdierkes(a)5dollarwhitebox.org&gt;:
>  Hello all,
>  I originally posted this on the epel-devel-list, but was referred by the
>  EPEL maintainer of fail2ban to bring the discussion upstream to Fedora in
>  hopes of convincing the Fedora maintainer of fail2ban to make these changes.
>   The following was my original message:
>  ---
>  I bring this to the list being that the issue isn't necessarily a bug,
>  rather a concern about implementation.  Per the documentation
>  [http://www.fail2ban.org/wiki/index.php/MANUAL_0_8] fail2ban is _capable_ of
>  supporting shorewall (among other things) and even states that "the
>  following software is optional but recommended" with reference to shorewall.
>   However, fail2ban does not _require_ shorewall to function.
>
>  That said, having a 'Requires: shorewall' in the fail2ban spec seems
>  unnecessary and in my opinion improper.  Breaking the package out into a sub
>  package doesn't seem necessary either...  being that the only file(s) I see
>  that could be split off would be: 
https://bugzilla.redhat.com/show_bug.cgi?id=244275


>  ]# rpm -ql fail2ban | grep shorewall
>  /etc/fail2ban/action.d/shorewall.conf
>
>
>  Regardless, for the sake of those that have no interest in shorewall (and in
>  particular those that want to avoid having to support shorewall) I'd like to
>  suggest that fail2ban-shorewall be broken off in a sub-package or simply
>  drop the Requires: shorewall completely so that the dependency of shorewall
>  is only enacted when desired (or not at all).
>
>  Thoughts?
>
>  Thank you for your time.
>
>  ---
>  derks
>  --
>  fedora-devel-list mailing list
>  fedora-devel-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-devel-list
>

[Rahul Sundaram]

On 07/11/2009 03:32 AM, Jonathan Underwood wrote:

>  
>  https://bugzilla.redhat.com/show_bug.cgi?id=244275 
Wow. A simple spec file change and a rebuild has been waiting for 2
years now?

Rahul

[BJ Dierkes]

On Jul 11, 2009, at 9:04 AM, Rahul Sundaram wrote:

>  On 07/11/2009 03:32 AM, Jonathan Underwood wrote:
>
> >
> > https://bugzilla.redhat.com/show_bug.cgi?id=244275
>
>  Wow. A simple spec file change and a rebuild has been waiting for 2
>  years now?
>  
No kidding.  I've submitted two patches... one just removing the dep,  
and two adding a subpackage as an alternative route.  Hopefully this  
will help move it along.

---
derks

[Rahul Sundaram]

On 07/11/2009 10:01 PM, BJ Dierkes wrote:

>  No kidding.  I've submitted two patches... one just removing the
> dep,
>  and two adding a subpackage as an alternative route.  Hopefully this
>  will help move it along. 
Axel Thimm has only been sporadically active for a long time now. There
are a number of bugs against his packages that he has not responded to
but I didn't realize the situation was so bad. I think it is high time,
we orphan the packages and let more interested maintainers take over.

Rahul

[BJ Dierkes]

On Jul 11, 2009, at 1:50 PM, Rahul Sundaram wrote:

>  On 07/11/2009 10:01 PM, BJ Dierkes wrote:
>
> > No kidding.  I've submitted two patches... one just removing the dep,
> > and two adding a subpackage as an alternative route.  Hopefully this
> > will help move it along.
>
>  Axel Thimm has only been sporadically active for a long time now.  
>  There
>  are a number of bugs against his packages that he has not responded to
>  but I didn't realize the situation was so bad. I think it is high  
>  time,
>  we orphan the packages and let more interested maintainers take over.
>  
I'd be interested in taking over fail2ban though I'm just now learning  
the procedures involved in doing so... and researched everything  
online for Fedora/EPEL Package Maintainers.  Any pointers welcome.

---
derks

[Adam Miller]

I maintain fail2ban for EPEL, I can just take the Fedora package as
well unless someone else has a relatively high interest in doing so (I
purely maintain it for EPEL because we use it at work on our servers
and Axel said he had no interest in packaging it for EPEL). I've
needed to contact Axel in the past and he was very responsive so I
wasn't aware there were any issues with his participation in the
project.

-Adam

-- 
http://maxamillion.googlepages.com
---------------------------------------------------------
()  ascii ribbon campaign - against html e-mail
/\  www.asciiribbon.org   - against proprietary attachments