Bug 697223

Summary:	SELinux is preventing /usr/bin/python from 'write' accesses on the directory /dev/shm.
Product:	[Fedora] Fedora	Reporter:	Filipe Rosset <rosset.filipe>
Component:	fail2ban	Assignee:	Axel Thimm <axel.thimm>
Status:	CLOSED WONTFIX	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	14	CC:	adam.hough, ADent123, ageszo, axel.thimm, dafrito, dwalsh, eric, goeran, igeorgex, jonathan.underwood, justin.brown1.1, marco.guazzone, mgrepl, randyn3lrx, robin.bowes
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:	setroubleshoot_trace_hash:d25332e516e20d955ead41434a2219bb659dca6e2b4734090927b4ce3e9afff1
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-08-16 16:44:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Filipe Rosset 2011-04-17 00:45:49 UTC

SELinux is preventing /usr/bin/python from 'write' accesses on the directory /dev/shm.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that python should be allowed write access on the shm directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep fail2ban-server /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:fail2ban_t:s0
Target Context                system_u:object_r:tmpfs_t:s0
Target Objects                /dev/shm [ dir ]
Source                        fail2ban-server
Source Path                   /usr/bin/python
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           python-2.7-8.fc14.1
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-37.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.12-88.fc14.x86_64 #1
                              SMP Thu Mar 31 21:21:57 UTC 2011 x86_64 x86_64
Alert Count                   4
First Seen                    Wed 13 Apr 2011 07:31:13 AM BRT
Last Seen                     Sat 16 Apr 2011 12:04:17 PM BRT
Local ID                      20ae58cb-0b92-44e8-8df3-e587461a2b68

Raw Audit Messages
type=AVC msg=audit(1302966257.978:17): avc:  denied  { write } for  pid=1854 comm="fail2ban-server" name="/" dev=tmpfs ino=5836 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir


type=SYSCALL msg=audit(1302966257.978:17): arch=x86_64 syscall=open success=no exit=EACCES a0=7fff8577d2c0 a1=c2 a2=180 a3=0 items=0 ppid=1 pid=1854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=fail2ban-server exe=/usr/bin/python subj=system_u:system_r:fail2ban_t:s0 key=(null)

Hash: fail2ban-server,fail2ban_t,tmpfs_t,dir,write

audit2allow

#============= fail2ban_t ==============
#!!!! The source type 'fail2ban_t' can write to a 'dir' of the following types:
# fail2ban_log_t, var_lib_t, var_run_t, var_log_t, fail2ban_var_lib_t, fail2ban_var_run_t, root_t

allow fail2ban_t tmpfs_t:dir write;

audit2allow -R

#============= fail2ban_t ==============
#!!!! The source type 'fail2ban_t' can write to a 'dir' of the following types:
# fail2ban_log_t, var_lib_t, var_run_t, var_log_t, fail2ban_var_lib_t, fail2ban_var_run_t, root_t

allow fail2ban_t tmpfs_t:dir write;

Comment 1 Miroslav Grepl 2011-04-18 06:21:56 UTC

Filipe,
what were you doing when this happened? I am not able to reproduce it.

Could you try to execute

# semanage permissive -a fail2ban_t

and try to reproduce it.

Comment 2 Filipe Rosset 2011-04-18 20:03:06 UTC

Actually, I only restarted the fail2ban service and I got 6 (six) SELinux messages. I'm pasting below:

SELinux is preventing /usr/bin/python from 'remove_name' accesses on the directory ffizUyBek.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that python should be allowed remove_name access on the ffizUyBek directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep fail2ban-server /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:fail2ban_t:s0
Target Context                system_u:object_r:tmp_t:s0
Target Objects                ffizUyBek [ dir ]
Source                        fail2ban-server
Source Path                   /usr/bin/python
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           python-2.7-8.fc14.1
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-37.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.12-88.fc14.x86_64 #1
                              SMP Thu Mar 31 21:21:57 UTC 2011 x86_64 x86_64
Alert Count                   2
First Seen                    Mon 18 Apr 2011 04:56:29 PM BRT
Last Seen                     Mon 18 Apr 2011 04:58:15 PM BRT
Local ID                      5ab9a885-6425-4d7c-b7b3-a1ec7cf34046

Raw Audit Messages
type=AVC msg=audit(1303156695.374:41695): avc:  denied  { remove_name } for  pid=8974 comm="fail2ban-server" name="ffizUyBek" dev=sda1 ino=6295 scontext=unconfined_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir


type=AVC msg=audit(1303156695.374:41695): avc:  denied  { unlink } for  pid=8974 comm="fail2ban-server" name="ffizUyBek" dev=sda1 ino=6295 scontext=unconfined_u:system_r:fail2ban_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file


type=SYSCALL msg=audit(1303156695.374:41695): arch=x86_64 syscall=unlink success=yes exit=0 a0=7fff860e0ca0 a1=c2 a2=ffffffffffffff80 a3=0 items=0 ppid=1 pid=8974 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm=fail2ban-server exe=/usr/bin/python subj=unconfined_u:system_r:fail2ban_t:s0 key=(null)

Hash: fail2ban-server,fail2ban_t,tmp_t,dir,remove_name

audit2allow

#============= fail2ban_t ==============
allow fail2ban_t tmp_t:dir remove_name;
allow fail2ban_t tmp_t:file unlink;

audit2allow -R

#============= fail2ban_t ==============
allow fail2ban_t tmp_t:dir remove_name;
allow fail2ban_t tmp_t:file unlink;



SELinux is preventing /sbin/iptables-multi from read, write access on the file /tmp/ffizUyBek (deleted).

*****  Plugin leaks (50.5 confidence) suggests  ******************************

If you want to ignore iptables-multi trying to read write access the ffizUyBek (deleted) file, because you believe it should not need this access.
Then you should report this as a bug.  
You can generate a local policy module to dontaudit this access.
Do
# grep /sbin/iptables-multi /var/log/audit/audit.log | audit2allow -D -M mypol
# semodule -i mypol.pp

*****  Plugin catchall (50.5 confidence) suggests  ***************************
a
If you believe that iptables-multi should be allowed read write access on the ffizUyBek (deleted) file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep iptables /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:iptables_t:s0
Target Context                unconfined_u:object_r:tmp_t:s0
Target Objects                /tmp/ffizUyBek (deleted) [ file ]
Source                        iptables
Source Path                   /sbin/iptables-multi
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           iptables-1.4.9-1.fc14
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-37.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.12-88.fc14.x86_64 #1
                              SMP Thu Mar 31 21:21:57 UTC 2011 x86_64 x86_64
Alert Count                   6
First Seen                    Mon 18 Apr 2011 04:58:07 PM BRT
Last Seen                     Mon 18 Apr 2011 04:58:16 PM BRT
Local ID                      789ec3a9-b5a4-4a82-9b88-b5450a5b5739

Raw Audit Messages
type=AVC msg=audit(1303156696.91:41700): avc:  denied  { read write } for  pid=8981 comm="iptables" path=2F746D702F6666697A557942656B202864656C6574656429 dev=sda1 ino=6295 scontext=unconfined_u:system_r:iptables_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file


type=SYSCALL msg=audit(1303156696.91:41700): arch=x86_64 syscall=execve success=yes exit=0 a0=1093990 a1=1093a10 a2=1091a70 a3=1 items=0 ppid=8974 pid=8981 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm=iptables exe=/sbin/iptables-multi subj=unconfined_u:system_r:iptables_t:s0 key=(null)

Hash: iptables,iptables_t,tmp_t,file,read,write

audit2allow

#============= iptables_t ==============
allow iptables_t tmp_t:file { read write };

audit2allow -R

#============= iptables_t ==============
allow iptables_t tmp_t:file { read write };




SELinux is preventing /usr/sbin/sendmail.sendmail from read, write access on the file /tmp/ffizUyBek (deleted).

*****  Plugin leaks (50.5 confidence) suggests  ******************************

If you want to ignore sendmail.sendmail trying to read write access the ffizUyBek (deleted) file, because you believe it should not need this access.
Then you should report this as a bug.  
You can generate a local policy module to dontaudit this access.
Do
# grep /usr/sbin/sendmail.sendmail /var/log/audit/audit.log | audit2allow -D -M mypol
# semodule -i mypol.pp

*****  Plugin catchall (50.5 confidence) suggests  ***************************

If you believe that sendmail.sendmail should be allowed read write access on the ffizUyBek (deleted) file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep sendmail /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:system_mail_t:s0
Target Context                unconfined_u:object_r:tmp_t:s0
Target Objects                /tmp/ffizUyBek (deleted) [ file ]
Source                        sendmail
Source Path                   /usr/sbin/sendmail.sendmail
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           sendmail-8.14.4-10.fc14
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-37.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.12-88.fc14.x86_64 #1
                              SMP Thu Mar 31 21:21:57 UTC 2011 x86_64 x86_64
Alert Count                   2
First Seen                    Mon 18 Apr 2011 04:58:07 PM BRT
Last Seen                     Mon 18 Apr 2011 04:58:16 PM BRT
Local ID                      2328d626-a2e4-432d-9f5e-8b9bc70ccdf2

Raw Audit Messages
type=AVC msg=audit(1303156696.105:41701): avc:  denied  { read write } for  pid=8987 comm="sendmail" path=2F746D702F6666697A557942656B202864656C6574656429 dev=sda1 ino=6295 scontext=unconfined_u:system_r:system_mail_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file


type=SYSCALL msg=audit(1303156696.105:41701): arch=x86_64 syscall=execve success=yes exit=0 a0=fd0660 a1=fd0700 a2=fd0ad0 a3=8 items=0 ppid=8985 pida=8987 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=51 sgid=51 fsgid=51 tty=(none) ses=1 comm=sendmail exe=/usr/sbin/sendmail.sendmail subj=unconfined_u:system_r:system_mail_t:s0 key=(null)

Hash: sendmail,system_mail_t,tmp_t,file,read,write

audit2allow

#============= system_mail_t ==============
allow system_mail_t tmp_t:file { read write };

audit2allow -R

#============= system_mail_t ==============
allow system_mail_t tmp_t:file { read write };



SELinux is preventing /usr/bin/python from 'write' accesses on the directory /tmp.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that python should be allowed write access on the tmp directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep fail2ban-server /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:fail2ban_t:s0
Target Context                system_u:object_r:tmp_t:s0
Target Objects                /tmp [ dir ]
Source                        fail2ban-server
Source Path                   /usr/bin/python
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           python-2.7-8.fc14.1
Target RPM Packages           filesystem-2.4.35-1.fc14
Policy RPM                    selinux-policy-3.9.7-37.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.12-88.fc14.x86_64 #1
                              SMP Thu Mar 31 21:21:57 UTC 2011 x86_64 x86_64
Alert Count                   1
First Seen                    Mon 18 Apr 2011 04:58:15 PM BRT
Last Seen                     Mon 18 Apr 2011 04:58:15 PM BRT
Local ID                      840f2bb9-02df-4490-b0ca-1a63e44f79db

Raw Audit Messages
type=AVC msg=audit(1303156695.372:41694): avc:  denied  { write } for  pid=8974 comm="fail2ban-server" name="tmp" dev=sda1 ino=793 scontext=unconfined_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir


type=AVC msg=audit(1303156695.372:41694): avc:  denied  { add_name } for  pid=8974 comm="fail2ban-server" name="ffizUyBek" scontext=unconfined_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir


type=AVC msg=audit(1303156695.372:41694): avc:  denied  { create } for  pid=8974 comm="fail2ban-server" name="ffizUyBek" scontext=unconfined_u:system_r:fail2ban_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file


type=AVC msg=audit(1303156695.372:41694): avc:  denied  { read write open } for  pid=8974 comm="fail2ban-server" name="ffizUyBek" dev=sda1 ino=6295 scontext=unconfined_u:system_r:fail2ban_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file


type=SYSCALL msg=audit(1303156695.372:41694): arch=x86_64 syscall=open success=yes exit=ENOEXEC a0=7fff860e0ca0 a1=c2 a2=180 a3=0 items=0 ppid=1 pid=8974 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm=fail2ban-server exe=/usr/bin/python subj=unconfined_u:system_r:fail2ban_t:s0 key=(null)

Hash: fail2ban-server,fail2ban_t,tmp_t,dir,write

audit2allow

#============= fail2ban_t ==============
#!!!! The source type 'fail2ban_t' can write to a 'dir' of the following types:
# fail2ban_log_t, var_lib_t, var_run_t, var_log_t, fail2ban_var_lib_t, fail2ban_var_run_t, root_t

allow fail2ban_t tmp_t:dir { write add_name };
#!!!! The source type 'fail2ban_t' can write to a 'file' of the following types:
# fail2ban_log_t, fail2ban_var_lib_t, fail2ban_var_run_t, root_t

allow fail2ban_t tmp_t:file { read write create open };

audit2allow -R

#============= fail2ban_t ==============
#!!!! The source type 'fail2ban_t' can write to a 'dir' of the following types:
# fail2ban_log_t, var_lib_t, var_run_t, var_log_t, fail2ban_var_lib_t, fail2ban_var_run_t, root_t

allow fail2ban_t tmp_t:dir { write add_name };
#!!!! The source type 'fail2ban_t' can write to a 'file' of the following types:
# fail2ban_log_t, fail2ban_var_lib_t, fail2ban_var_run_t, root_t

allow fail2ban_t tmp_t:file { read write create open };


SELinux is preventing /usr/bin/python from 'execute' accesses on the file /tmp/ffizUyBek (deleted).

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that python should be allowed execute access on the ffizUyBek (deleted) file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep fail2ban-server /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:fail2ban_t:s0
Target Context                unconfined_u:object_r:tmp_t:s0
Target Objects                /tmp/ffizUyBek (deleted) [ file ]
Source                        fail2ban-server
Source Path                   /usr/bin/python
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           python-2.7-8.fc14.1
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-37.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.12-88.fc14.x86_64 #1
                              SMP Thu Mar 31 21:21:57 UTC 2011 x86_64 x86_64
Alert Count                   1
First Seen                    Mon 18 Apr 2011 04:58:15 PM BRT
Last Seen                     Mon 18 Apr 2011 04:58:15 PM BRT
Local ID                      21d69ebe-b0e3-4133-8a5c-2a05543044dc

Raw Audit Messages
type=AVC msg=audit(1303156695.374:41696): avc:  denied  { execute } for  pid=8974 comm="fail2ban-server" path=2F746D702F6666697A557942656B202864656C6574656429 dev=sda1 ino=6295 scontext=unconfined_u:system_r:fail2ban_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file


type=SYSCALL msg=audit(1303156695.374:41696): arch=x86_64 syscall=mmap success=yes exit=139650871750656 a0=0 a1=1000 a2=5 a3=1 items=0 ppid=1 pid=8974 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm=fail2ban-server exe=/usr/bin/python subj=unconfined_u:system_r:fail2ban_t:s0 key=(null)

Hash: fail2ban-server,fail2ban_t,tmp_t,file,execute

audit2allow

#============= fail2ban_t ==============
allow fail2ban_t tmp_t:file execute;

audit2allow -R

#============= fail2ban_t ==============
allow fail2ban_t tmp_t:file execute;




SELinux is preventing /sbin/ldconfig from 'execute' accesses on the file /sbin/ldconfig.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that ldconfig should be allowed execute access on the ldconfig file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep ldconfig /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:fail2ban_t:s0
Target Context                system_u:object_r:ldconfig_exec_t:s0
Target Objects                /sbin/ldconfig [ file ]
Source                        ldconfig
Source Path                   /sbin/ldconfig
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           glibc-2.13-1
Target RPM Packages           glibc-2.13-1
Policy RPM                    selinux-policy-3.9.7-37.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.12-88.fc14.x86_64 #1
                              SMP Thu Mar 31 21:21:57 UTC 2011 x86_64 x86_64
Alert Count                   1
First Seen                    Mon 18 Apr 2011 04:58:15 PM BRT
Last Seen                     Mon 18 Apr 2011 04:58:15 PM BRT
Local ID                      feff8766-4d6b-4d70-9b1c-a3527324b9b9

Raw Audit Messages
type=AVC msg=audit(1303156695.384:41697): avc:  denied  { execute } for  pid=8976 comm="sh" name="ldconfig" dev=sda1 ino=61580 scontext=unconfined_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file


type=AVC msg=audit(1303156695.384:41697): avc:  denied  { read open } for  pid=8976 comm="sh" name="ldconfig" dev=sda1 ino=61580 scontext=unconfined_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file


type=AVC msg=audit(1303156695.384:41697): avc:  denied  { execute_no_trans } for  pid=8976 comm="sh" path="/sbin/ldconfig" dev=sda1 ino=61580 scontext=unconfined_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file


type=SYSCALL msg=audit(1303156695.384:41697): arch=x86_64 syscall=execve success=yes exit=0 a0=16f1bc0 a1=16f1c90 a2=16f0470 a3=65 items=0 ppid=8975 pid=8976 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm=ldconfig exe=/sbin/ldconfig subj=unconfined_u:system_r:fail2ban_t:s0 key=(null)

Hash: ldconfig,fail2ban_t,ldconfig_exec_t,file,execute

audit2allow

#============= fail2ban_t ==============
allow fail2ban_t ldconfig_exec_t:file { read execute open execute_no_trans };

audit2allow -R

#============= fail2ban_t ==============
allow fail2ban_t ldconfig_exec_t:file { read execute open execute_no_trans };

Comment 3 Daniel Walsh 2011-04-18 21:05:37 UTC

I think a new fail2ban just shipped that did not use the /tmp directory.  I do know know why it is executing ldconfig.

Comment 4 Randy Berry 2011-04-25 23:34:26 UTC

Allowing this access by executing:

# grep fail2ban-server /var/log/audit/audit.log | audit2allow -M fail2ban
# semodule -i fail2ban.pp

The new policy is generated however, I get the following error trying to apply the new policy.

libsepol.print_missing_requirements: fail2ban's global requirements were not met: type/attribute fail2ban_t (No such file or directory).
libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory).
semodule:  Failed!

# semanage permissive -a fail2ban_t

Did not prevent this AVC from occurring on service startup.

Comment 5 JM 2011-04-26 03:08:47 UTC

With the new fail2ban 'fail2ban-0.8.4-27.fc14.noarch' and 'selinux-policy-3.9.7-40.fc14.noarch' I get almost identical errors, actually fail2ban is now broken with SELinux enabled because it can't start the ssh-jail. I tried 

grep fail2ban-server /var/log/audit/audit.log | audit2allow -M fail2ban

which generates

----------------------------
module fail2ban 1.0;

require {
	type tmp_t;
	type tmpfs_t;
	type fail2ban_t;
	class dir { write add_name };
	class file { read create write open };
}

#============= fail2ban_t ==============
#!!!! The source type 'fail2ban_t' can write to a 'dir' of the following types:
# fail2ban_var_lib_t, fail2ban_var_run_t, fail2ban_log_t, var_lib_t, var_run_t, var_log_t, root_t

allow fail2ban_t tmp_t:dir { write add_name };
#!!!! The source type 'fail2ban_t' can write to a 'file' of the following types:
# fail2ban_var_lib_t, fail2ban_var_run_t, fail2ban_log_t, root_t

allow fail2ban_t tmp_t:file { read write create open };
#!!!! The source type 'fail2ban_t' can write to a 'dir' of the following types:
# fail2ban_var_lib_t, fail2ban_var_run_t, fail2ban_log_t, var_lib_t, var_run_t, var_log_t, root_t

allow fail2ban_t tmpfs_t:dir { write add_name };
#!!!! The source type 'fail2ban_t' can write to a 'file' of the following types:
# fail2ban_var_lib_t, fail2ban_var_run_t, fail2ban_log_t, root_t

allow fail2ban_t tmpfs_t:file { read write create open };
----------------------------

and activated the module with 

semodule -i fail2ban.pp

but still fail2ban doesn't work. 

Is this a fail2ban problem or a SELinux problem?

Comment 6 JM 2011-04-26 03:38:13 UTC

I switched back to 

fail2ban-0.8.4-25.fc14.noarch

and this version works. I can start the ssh-jail and have no problems with SELinux.

Comment 7 Daniel Walsh 2011-04-26 14:32:02 UTC

Do not install fail2ban policy using the same name as the system policy, this will attempt to replace the fail2ban policy and cause you problems.

If you use you myfail2ban you will add your policy to the system.

Comment 8 JM 2011-04-26 15:04:54 UTC

I did... the name was myfail2ban... and it does not work. The example above was just a quick description of what I did... the original fail2ban has still the version 1.4.0

fail2ban                 1.4.0

Comment 9 Daniel Walsh 2011-04-26 15:39:17 UTC

Comment #4 shows -M fail2ban, Your comment %5 shows you executing semodule -i fail2ban.pp

And naming the policy 
module fail2ban 1.0;

Which will conflict with the installed policy causing semodule -i fail2ban.pp to fail to install.

fail2ban-0.8.4-27.fc14                    dist-f14-updates      athimm

Seems to be released in updates and no longer uses /tmp for its files.

Comment 10 JM 2011-04-26 16:40:15 UTC

Okay... it was an example... my fault... here is the original policy, with the correct name:

grep fail2ban-server /var/log/audit/audit.log | audit2allow -M AgainBrokenFail2ban

which generates

----------------------------
module AgainBrokenFail2ban 1.0;

require {
 type tmp_t;
 type tmpfs_t;
 type fail2ban_t;
 class dir { write add_name };
 class file { read create write open };
}

#============= fail2ban_t ==============
#!!!! The source type 'fail2ban_t' can write to a 'dir' of the following types:
# fail2ban_var_lib_t, fail2ban_var_run_t, fail2ban_log_t, var_lib_t, var_run_t,
var_log_t, root_t

allow fail2ban_t tmp_t:dir { write add_name };
#!!!! The source type 'fail2ban_t' can write to a 'file' of the following
types:
# fail2ban_var_lib_t, fail2ban_var_run_t, fail2ban_log_t, root_t

allow fail2ban_t tmp_t:file { read write create open };
#!!!! The source type 'fail2ban_t' can write to a 'dir' of the following types:
# fail2ban_var_lib_t, fail2ban_var_run_t, fail2ban_log_t, var_lib_t, var_run_t,
var_log_t, root_t

allow fail2ban_t tmpfs_t:dir { write add_name };
#!!!! The source type 'fail2ban_t' can write to a 'file' of the following
types:
# fail2ban_var_lib_t, fail2ban_var_run_t, fail2ban_log_t, root_t

allow fail2ban_t tmpfs_t:file { read write create open };
----------------------------

and activated the module with 

semodule -i AgainBrokenFail2ban.pp
----------------------------

[root@foo ~]# semanage module -l | grep -i fail2ban
fail2ban                 1.4.0     
AgainBrokenFail2ban      1.0


I removed AgainBroken from the name... just because I thought it could be offensive...

The new fail2ban-0.8.4-27.fc14 is broken WITH SELinux enabled

the old fail2ban-0.8.4-25.fc14 works WITH SELinux enabled

Just try it on a fresh installation of FC14 with all updates.


I get SELinux message like this (with  the NEW fail2ban-0.8.4-27.fc14)

SELinux is preventing /usr/bin/python from write access on the directory /var/tmp.
SELinux is preventing /usr/bin/python from write access on the directory /tmp.
SELinux is preventing /usr/bin/python from write access on the directory /dev/shm.

I tried to fix this with a SELinux policy but then i get stuff like this:

SELinux is preventing /usr/bin/python from 'read, write, open' accesses on the file ffiUhfzXp.
SELinux is preventing /usr/bin/python from add_name access on the directory ffiLutMFi.
.... and so on.... The policy doesn't work

The OLD fail2ban-0.8.4-25.fc14 works out of the box without any modifications to SELinux.

I have the problem on more than one system.

Comment 11 Daniel Walsh 2011-04-26 16:48:17 UTC

Ok, Can you attach the new AVC messages?

Comment 12 Daniel Walsh 2011-04-26 16:50:11 UTC

 Apr 09 2011 Axel Thimm <Axel.Thimm> - 0.8.4-27
- Move tmp files to /var/lib (suggested by Phil Anderson).
- Enable inotify support (by Jonathan Underwood).
- Fixes RH bugs #669966, #669965, #551895, #552947, #658849, #656584.

It certainly looks like the goal of this update was to fix the problem.  You seem to be indicating you are seeing the exact opposite.

Comment 13 Robin Bowes 2011-04-27 08:02:18 UTC

I'm seeing the same issue.

On restarting fail2ban, I see these msgs in /var/log/messages:

Apr 27 08:58:06 hero setroubleshoot: SELinux is preventing /usr/bin/python from write access on the directory /tmp. For complete SELinux messages. run sealert -l 82386f1e-f70c-4441-b26c-579d355e7393
Apr 27 08:58:06 hero setroubleshoot: SELinux is preventing /usr/bin/python from write access on the directory /tmp. For complete SELinux messages. run sealert -l 82386f1e-f70c-4441-b26c-579d355e7393
Apr 27 08:58:06 hero setroubleshoot: SELinux is preventing /usr/bin/python from write access on the directory /tmp. For complete SELinux messages. run sealert -l 82386f1e-f70c-4441-b26c-579d355e7393
Apr 27 08:58:06 hero setroubleshoot: SELinux is preventing /usr/bin/python from write access on the directory /tmp. For complete SELinux messages. run sealert -l 82386f1e-f70c-4441-b26c-579d355e7393
Apr 27 08:58:07 hero setroubleshoot: SELinux is preventing /usr/bin/python from remove_name access on the directory ffiAvQeBf. For complete SELinux messages. run sealert -l 8b441533-e81d-4b7c-b5e8-bac54d61db4a
Apr 27 08:58:07 hero setroubleshoot: SELinux is preventing /usr/bin/python from remove_name access on the directory ffiAvQeBf. For complete SELinux messages. run sealert -l 8b441533-e81d-4b7c-b5e8-bac54d61db4a
Apr 27 08:58:07 hero setroubleshoot: SELinux is preventing /usr/bin/python from execute access on the file /tmp/ffiAvQeBf (deleted). For complete SELinux messages. run sealert -l 02ffef0e-b974-41e0-a998-719473ff0266
Apr 27 08:58:07 hero setroubleshoot: SELinux is preventing /sbin/ldconfig from execute access on the file /sbin/ldconfig. For complete SELinux messages. run sealert -l 7cfb3c37-7e09-4ba0-8f41-2f4aa948a4a2
Apr 27 08:58:07 hero setroubleshoot: SELinux is preventing /sbin/ldconfig from execute access on the file /sbin/ldconfig. For complete SELinux messages. run sealert -l 7cfb3c37-7e09-4ba0-8f41-2f4aa948a4a2
Apr 27 08:58:08 hero setroubleshoot: SELinux is preventing /sbin/ldconfig from execute access on the file /sbin/ldconfig. For complete SELinux messages. run sealert -l 7cfb3c37-7e09-4ba0-8f41-2f4aa948a4a2

A scan of the audit.log shows this:


# audit2allow -i /var/log/audit/audit.log -l


#============= fail2ban_t ==============
allow fail2ban_t ldconfig_exec_t:file { read execute open execute_no_trans };
#!!!! The source type 'fail2ban_t' can write to a 'dir' of the following types:
# fail2ban_var_lib_t, fail2ban_var_run_t, fail2ban_log_t, var_lib_t, var_run_t, var_log_t, root_t

allow fail2ban_t tmp_t:dir { write remove_name add_name };
allow fail2ban_t tmp_t:file { write execute read create unlink open };
#!!!! The source type 'fail2ban_t' can write to a 'dir' of the following types:
# fail2ban_var_lib_t, fail2ban_var_run_t, fail2ban_log_t, var_lib_t, var_run_t, var_log_t, root_t

allow fail2ban_t usr_t:dir { write remove_name add_name };
allow fail2ban_t usr_t:file { write create unlink };

#============= iptables_t ==============
allow iptables_t tmp_t:file { read write };

#============= system_mail_t ==============
allow system_mail_t tmp_t:file { read write };


I can't find where fail2ban is configured to use /tmp.

Comment 14 Robin Bowes 2011-04-27 09:22:58 UTC

I too have reverted to fail2ban-0.8.4-25 which continues to work OK (well, banip doesn't seem to work, but that's a different issue!)

Comment 15 Axel Thimm 2011-04-27 12:52:55 UTC

The main differences between 0.8.4-25 and 0.8.4-27 are moving some files/sockets out of /tmp and to switch from gamin to inotify.

I don't think the moving of the tmp files could have caused any regression, especially not accessing /tmp more often (!). But perhaps the inotify mechanism is doing so implicitely.

For separating out these two changes, please test 0.8.4-27 and set

backend = gamin

in /etc/fail2ban/jail.conf. This should mostly restore 0.8.4-25 behaviour, the only selinux relevant change visible would be the moved out /tmp files. Please compare the selinux audits, so we can see whether we should focus on pyinotify. Thanks!

Comment 16 JM 2011-04-27 18:29:23 UTC

Yes,

backend = gamin

solves the problem (for me). 

So it looks like inotify creates all the SELinux messages.

Comment 17 Robin Bowes 2011-04-27 19:47:32 UTC

Yes, that fixes things for me too.

There's another small omission that affects the "banip" command, but I'll create a separate bug for that.

R.

Comment 18 Robin Bowes 2011-04-27 19:57:52 UTC

For completeness: https://bugzilla.redhat.com/show_bug.cgi?id=700221

Comment 19 Aaron Faanes 2011-05-04 00:46:48 UTC

From what I found, the link from fail2ban to the temporary-file-writes looks like this:

    fail2ban -imports-> pyinotify -imports-> ctypes -uses-> libffi -writes-> /tmp/

There's no workarounds here, but I'm pretty confident I found the source of this problem. I admit that I've included a lot of information about this issue, but I wanted to be thorough since the dependencies is pretty complicated.

### MESSAGES IN /var/log/messages

The following are the denials I get in /var/log/messages. Note that they're interspersed with fail2ban error messages. I formatted them so they're a bit easier for me to read (they're similar to ones already listed here, as well):

May  3 18:40:15 fritocomp fail2ban.server : 
    INFO Changed logging target to SYSLOG for Fail2ban v0.8.4
May  3 18:40:15 fritocomp fail2ban.jail   :
    INFO Creating new jail 'ssh-iptables'
May  3 18:40:15 fritocomp kernel: [396828.096997]
     type=1400 audit(1304466015.835:87152): avc:  denied  { write } for
         pid=15871
         comm="fail2ban-server"
         name="site-packages"
         dev=dm-1
         ino=152067
         scontext=unconfined_u:system_r:fail2ban_t:s0
         tcontext=system_u:object_r:lib_t:s0
         tclass=dir
May  3 18:40:15 fritocomp kernel: [396828.110302]
     type=1400 audit(1304466015.848:87153): avc:  denied  { write } for
         pid=15871
         comm="fail2ban-server"
         name="/"
         dev=tmpfs
         ino=13081
         scontext=unconfined_u:system_r:fail2ban_t:s0
         tcontext=system_u:object_r:tmp_t:s0
         tclass=dir
May  3 18:40:15 fritocomp kernel: [396828.110355]
     type=1400 audit(1304466015.848:87154): avc:  denied  { write } for
         pid=15871
         comm="fail2ban-server"
         name="tmp"
         dev=dm-1
         ino=1558
         scontext=unconfined_u:system_r:fail2ban_t:s0
         tcontext=system_u:object_r:tmp_t:s0
         tclass=dir
May  3 18:40:15 fritocomp kernel: [396828.110438]
     type=1400 audit(1304466015.848:87155): avc:  denied  { write } for
         pid=15871
         comm="fail2ban-server"
         name="/"
         dev=tmpfs
         ino=6035
         scontext=unconfined_u:system_r:fail2ban_t:s0
         tcontext=system_u:object_r:tmpfs_t:s0
         tclass=dir
May  3 18:40:15 fritocomp fail2ban.comm   :
     WARNING Invalid command: ['add', 'ssh-iptables', 'inotify']

### STRACING service fail2ban start

Using "strace -f service fail2ban start 2>&1 | less", I searched for the string "tmp" and found these very telling messages:

[pid 15871] statfs("/selinux", {f_type=0xf97cff8c, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={0, 0}, f_namelen=255, f_frsize=4096}) = 0
[pid 15871] open("/tmp/ffiYCwG03", O_RDWR|O_CREAT|O_EXCL, 0600) = -1 EACCES (Permission denied)
[pid 15871] open("/var/tmp/ffiLEXXa0", O_RDWR|O_CREAT|O_EXCL, 0600) = -1 EACCES (Permission denied)
[pid 15871] open("/dev/shm/ffiGo2flW", O_RDWR|O_CREAT|O_EXCL, 0600) = -1 EACCES (Permission denied)

So first, /selinux is checked, then temporary files are written to. If I run with SElinux disabled, this series of messages is printed instead:

[pid 30737] open("/tmp/ffizbZ1RS", O_RDWR|O_CREAT|O_EXCL, 0600) = 8
[pid 30737] unlink("/tmp/ffizbZ1RS")    = 0
[pid 30737] ftruncate(8, 4096)          = 0

So it seems that the program tries a few different temporary directories before dying. If it succeeds, then it only tries the first one.

Note that in the first (enforcing) case, the PID of these accesses matches the PID in the denials.

In both cases, the "ctypes" library was loaded shortly before:

[pid 15871] open("/usr/lib64/python2.7/ctypes/_endian.py", O_RDONLY) = 8
[pid 15871] fstat(8, {st_mode=S_IFREG|0644, st_size=2041, ...}) = 0
[pid 15871] open("/usr/lib64/python2.7/ctypes/_endian.pyc", O_RDONLY) = 9
[pid 15871] fstat(9, {st_mode=S_IFREG|0644, st_size=2274, ...}) = 0

### VERIFYING CTYPES AS THE CULPRIT

I suspect that ctypes is the culprit. I strace a Python script that only imports ctypes:

strace -f python -c 'import ctypes' 2>&1 | less

Which again prints accesses to a temporary file:

statfs("/selinux", {f_type=0xf97cff8c, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsi
d={0, 0}, f_namelen=255, f_frsize=4096}) = 0
open("/tmp/ffig65O0h", O_RDWR|O_CREAT|O_EXCL, 0600) = 4
unlink("/tmp/ffig65O0h")                = 0
ftruncate(4, 4096)                      = 0

This open/unlink/truncate series matches fail2ban's output.

### GETTING A BACKTRACE

I run "gdb python" and put a backtrace on ftruncate. It only finds ftruncate once. The backtrace shows that it's during an import of ctypes:

(gdb) r -c 'import ctypes'
... snipped ..
(gdb) bt 20
#0  ftruncate64 () at ../sysdeps/unix/syscall-template.S:82
#1  0x000000327f40333b in dlmmap_locked (length=4096, offset=<value optimized out>, flags=34, prot=3, start=0x0)
    at src/closures.c:403
#2  0x000000327f4035f4 in dlmmap (length=4096, offset=0, fd=-1, flags=34, prot=3, start=0x0) at src/closures.c:474
#3  0x000000327f403d64 in sys_alloc (size=<value optimized out>, code=0x7ffff7ed1430) at src/dlmalloc.c:3453
#4  dlmalloc (size=<value optimized out>, code=0x7ffff7ed1430) at src/dlmalloc.c:4183
#5  ffi_closure_alloc (size=<value optimized out>, code=0x7ffff7ed1430) at src/closures.c:561
#6  0x00007ffff09833c2 in _ctypes_alloc_callback (callable=<function at remote 0x7ffff0ba4de8>, converters=(), 
    restype=<_ctypes.PyCSimpleType at remote 0x73a270>, flags=257)
    at /usr/src/debug/Python-2.7/Modules/_ctypes/callbacks.c:425
#7  0x00007ffff097d68b in PyCFuncPtr_new (type=0x74fdc0, args=(<function at remote 0x7ffff0ba4de8>,), kwds=0x0)
    at /usr/src/debug/Python-2.7/Modules/_ctypes/_ctypes.c:3449
--- I'm omitting some of the not-so-relevant frames ---
#15 0x0000003c0a8fbd02 in PyImport_ExecCodeModuleEx (name=0x7fffffffcb10 "ctypes", co=
    <code at remote 0x7ffff0baf030>, pathname=0x7fffffff9950 "ctypes/__init__.pyc")
    at /usr/src/debug/Python-2.7/Python/import.c:681
#16 0x0000003c0a8fc04e in load_source_module (name=0x7fffffffcb10 "ctypes", pathname=
    0x7fffffff9950 "ctypes/__init__.pyc", fp=<value optimized out>)
    at /usr/src/debug/Python-2.7/Python/import.c:1021

This backtrace shows the import of ctypes and the execution of functions in src/closures.c, a member of libffi.

Here's the snippet from the source file:

/* Map in a chunk of memory from the temporary exec file into separate
   locations in the virtual memory address space, one writable and one
   executable.  Returns the address of the writable portion, after
   storing an offset to the corresponding executable portion at the
   last word of the requested chunk.  */
static void *
dlmmap_locked (void *start, size_t length, int prot, int flags, off_t offset)
{
  void *ptr;

  if (execfd == -1)
    {
      open_temp_exec_file_opts_idx = 0;
    retry_open:
      execfd = open_temp_exec_file ();
      if (execfd == -1)
        return MFAIL;
    }

  offset = execsize;

  if (ftruncate (execfd, offset + length))
    return MFAIL;

  flags &= ~(MAP_PRIVATE | MAP_ANONYMOUS);
  flags |= MAP_SHARED;

  ptr = mmap (NULL, length, (prot & ~PROT_WRITE) | PROT_EXEC,
              flags, execfd, offset);
  if (ptr == MFAIL)
    {
      if (!offset)
        {
          close (execfd);
          goto retry_open;
        }
      ftruncate (execfd, offset);
      return MFAIL;
    }
  /* etc... */

dlmmap_locked is a fallback from another memory-mapping function, dlmmap. Remarkably, dlmmap_locked seems to be called specifically if SELinux is enabled!

Here's the source of dlmmap:

/* Map in a writable and executable chunk of memory if possible.
   Failing that, fall back to dlmmap_locked.  */
static void *
dlmmap (void *start, size_t length, int prot,
        int flags, int fd, off_t offset)
  void *ptr;

  /* snipped some assertions */


  if (execfd == -1 && !is_selinux_enabled ())
    {
      ptr = mmap (start, length, prot | PROT_EXEC, flags, fd, offset);

      if (ptr != MFAIL || (errno != EPERM && errno != EACCES))
        /* Cool, no need to mess with separate segments.  */
        return ptr;

      /* If MREMAP_DUP is ever introduced and implemented, try mmap
         with ((prot & ~PROT_WRITE) | PROT_EXEC) and mremap with
         MREMAP_DUP and prot at this point.  */
    }

  if (execsize == 0 || execfd == -1)
    {
      pthread_mutex_lock (&open_temp_exec_file_mutex);
      ptr = dlmmap_locked (start, length, prot, flags, offset);
      pthread_mutex_unlock (&open_temp_exec_file_mutex);

      return ptr;
    }

So there it is. This mmap stuff is beyond me, but hopefully this report helps solve this bug.

Thanks for reading!

Comment 20 Daniel Walsh 2011-05-31 18:23:02 UTC

*** Bug 706577 has been marked as a duplicate of this bug. ***

Comment 21 Daniel Walsh 2011-05-31 18:29:55 UTC

I guess we need to allow it,

Comment 22 Miroslav Grepl 2011-06-06 08:55:06 UTC

Yes, Fixed in selinux-policy-3.9.16-28.fc15

Comment 23 Marco Guazzone 2011-06-11 20:56:06 UTC

It seems the bug is still present in selinux-policy-3.9.16-29.fc15.
Just got a SELinux alert.

Comment 24 Daniel Walsh 2011-06-14 15:37:24 UTC

Please attach your current AVC's

Comment 25 Marco Guazzone 2011-06-14 19:36:41 UTC

Sure! Here it is:

--- [AVC] ---

SELinux is preventing /usr/bin/python from write access on the directory /dev/shm.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that python should be allowed write access on the shm directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep fail2ban-server /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:fail2ban_t:s0
Target Context                system_u:object_r:tmpfs_t:s0
Target Objects                /dev/shm [ dir ]
Source                        fail2ban-server
Source Path                   /usr/bin/python
Port                          <Unknown>
Host                          scramble
Source RPM Packages           python-2.7.1-7.fc15
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.16-26.fc15
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     scramble
Platform                      Linux scramble 2.6.38.7-30.fc15.x86_64 #1 SMP Fri
                              May 27 05:15:53 UTC 2011 x86_64 x86_64
Alert Count                   47
First Seen                    Sun 29 May 2011 10:16:34 AM CEST
Last Seen                     Sat 11 Jun 2011 10:04:11 PM CEST
Local ID                      d5fc1af6-04d1-4efc-85b7-8953d5a2c869

Raw Audit Messages
type=AVC msg=audit(1307822651.232:22): avc:  denied  { write } for  pid=1058 comm="fail2ban-server" name="/" dev=tmpfs ino=7169 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir


type=SYSCALL msg=audit(1307822651.232:22): arch=x86_64 syscall=open success=no exit=EACCES a0=7fff377699d0 a1=c2 a2=180 a3=396873f5b0 items=0 ppid=1 pid=1058 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=fail2ban-server exe=/usr/bin/python subj=system_u:system_r:fail2ban_t:s0 key=(null)

Hash: fail2ban-server,fail2ban_t,tmpfs_t,dir,write

audit2allow

#============= fail2ban_t ==============
#!!!! The source type 'fail2ban_t' can write to a 'dir' of the following types:
# fail2ban_tmp_t, var_lib_t, var_run_t, var_log_t, fail2ban_var_lib_t, fail2ban_var_run_t, tmp_t, fail2ban_log_t, root_t

allow fail2ban_t tmpfs_t:dir write;

audit2allow -R

#============= fail2ban_t ==============
#!!!! The source type 'fail2ban_t' can write to a 'dir' of the following types:
# fail2ban_tmp_t, var_lib_t, var_run_t, var_log_t, fail2ban_var_lib_t, fail2ban_var_run_t, tmp_t, fail2ban_log_t, root_t

allow fail2ban_t tmpfs_t:dir write;

--- [/AVC] ---

Comment 26 Eddie Lania 2011-06-15 06:43:35 UTC

----
time->Tue Jun 14 17:11:08 2011
type=SYSCALL msg=audit(1308064268.682:415974): arch=40000003 syscall=11 success=yes exit=0 a0=8dc24b8 a1=8dc2800 a2=8dc1858 a3=8dc2800 items=0 ppid=20568 pid=20570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=486 sgid=486 fsgid=486 tty=(none) ses=4294967295 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:system_mail_t:s0 key=(null)
type=AVC msg=audit(1308064268.682:415974): avc:  denied  { read write } for  pid=20570 comm="sendmail" path=2F746D702F666669494474633278202864656C6574656429 dev=dm-1 ino=3145732 scontext=system_u:system_r:system_mail_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file
----
time->Tue Jun 14 22:20:49 2011
type=SYSCALL msg=audit(1308082849.971:18): arch=40000003 syscall=5 success=yes exit=8 a0=bfce96a0 a1=c2 a2=180 a3=612b items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="fail2ban-server" exe="/usr/bin/python" subj=system_u:system_r:fail2ban_t:s0 key=(null)
type=AVC msg=audit(1308082849.971:18): avc:  denied  { read write open } for  pid=2090 comm="fail2ban-server" name="ffiyAeLnD" dev=dm-1 ino=3145732 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file
type=AVC msg=audit(1308082849.971:18): avc:  denied  { create } for  pid=2090 comm="fail2ban-server" name="ffiyAeLnD" scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file
type=AVC msg=audit(1308082849.971:18): avc:  denied  { add_name } for  pid=2090 comm="fail2ban-server" name="ffiyAeLnD" scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
type=AVC msg=audit(1308082849.971:18): avc:  denied  { write } for  pid=2090 comm="fail2ban-server" name="tmp" dev=dm-1 ino=3145729 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
----
time->Tue Jun 14 22:20:49 2011
type=SYSCALL msg=audit(1308082849.972:19): arch=40000003 syscall=10 success=yes exit=0 a0=bfce96a0 a1=2 a2=60c734 a3=bfce96a0 items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="fail2ban-server" exe="/usr/bin/python" subj=system_u:system_r:fail2ban_t:s0 key=(null)
type=AVC msg=audit(1308082849.972:19): avc:  denied  { unlink } for  pid=2090 comm="fail2ban-server" name="ffiyAeLnD" dev=dm-1 ino=3145732 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file
type=AVC msg=audit(1308082849.972:19): avc:  denied  { remove_name } for  pid=2090 comm="fail2ban-server" name="ffiyAeLnD" dev=dm-1 ino=3145732 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
----
time->Tue Jun 14 22:20:49 2011
type=SYSCALL msg=audit(1308082849.973:20): arch=40000003 syscall=192 success=yes exit=2990080 a0=0 a1=1000 a2=5 a3=1 items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="fail2ban-server" exe="/usr/bin/python" subj=system_u:system_r:fail2ban_t:s0 key=(null)
type=AVC msg=audit(1308082849.973:20): avc:  denied  { execute } for  pid=2090 comm="fail2ban-server" path=2F746D702F6666697941654C6E44202864656C6574656429 dev=dm-1 ino=3145732 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file
----
time->Tue Jun 14 22:20:49 2011
type=SYSCALL msg=audit(1308082849.994:21): arch=40000003 syscall=11 success=yes exit=0 a0=81b3228 a1=81b32a8 a2=81b27a8 a3=81b32a8 items=0 ppid=2091 pid=2094 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ldconfig" exe="/sbin/ldconfig" subj=system_u:system_r:fail2ban_t:s0 key=(null)
type=AVC msg=audit(1308082849.994:21): avc:  denied  { execute_no_trans } for  pid=2094 comm="sh" path="/sbin/ldconfig" dev=dm-1 ino=1572983 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
type=AVC msg=audit(1308082849.994:21): avc:  denied  { read open } for  pid=2094 comm="sh" name="ldconfig" dev=dm-1 ino=1572983 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
type=AVC msg=audit(1308082849.994:21): avc:  denied  { execute } for  pid=2094 comm="sh" name="ldconfig" dev=dm-1 ino=1572983 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
----
time->Tue Jun 14 22:20:50 2011
type=SYSCALL msg=audit(1308082850.375:22): arch=40000003 syscall=11 success=yes exit=0 a0=83424d8 a1=8342830 a2=8341868 a3=8342830 items=0 ppid=2099 pid=2101 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=486 sgid=486 fsgid=486 tty=(none) ses=4294967295 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:system_mail_t:s0 key=(null)
type=AVC msg=audit(1308082850.375:22): avc:  denied  { read write } for  pid=2101 comm="sendmail" path=2F746D702F6666697941654C6E44202864656C6574656429 dev=dm-1 ino=3145732 scontext=system_u:system_r:system_mail_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file
----
time->Wed Jun 15 07:33:29 2011
type=SYSCALL msg=audit(1308116009.624:18): arch=40000003 syscall=5 success=yes exit=8 a0=bf9ab9f0 a1=c2 a2=180 a3=5f67 items=0 ppid=1 pid=2078 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="fail2ban-server" exe="/usr/bin/python" subj=system_u:system_r:fail2ban_t:s0 key=(null)
type=AVC msg=audit(1308116009.624:18): avc:  denied  { read write open } for  pid=2078 comm="fail2ban-server" name="ffiljYo5v" dev=dm-1 ino=3145732 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file
type=AVC msg=audit(1308116009.624:18): avc:  denied  { create } for  pid=2078 comm="fail2ban-server" name="ffiljYo5v" scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file
type=AVC msg=audit(1308116009.624:18): avc:  denied  { add_name } for  pid=2078 comm="fail2ban-server" name="ffiljYo5v" scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
type=AVC msg=audit(1308116009.624:18): avc:  denied  { write } for  pid=2078 comm="fail2ban-server" name="tmp" dev=dm-1 ino=3145729 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
----
time->Wed Jun 15 07:33:29 2011
type=SYSCALL msg=audit(1308116009.625:19): arch=40000003 syscall=10 success=yes exit=0 a0=bf9ab9f0 a1=2 a2=60c734 a3=bf9ab9f0 items=0 ppid=1 pid=2078 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="fail2ban-server" exe="/usr/bin/python" subj=system_u:system_r:fail2ban_t:s0 key=(null)
type=AVC msg=audit(1308116009.625:19): avc:  denied  { unlink } for  pid=2078 comm="fail2ban-server" name="ffiljYo5v" dev=dm-1 ino=3145732 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file
type=AVC msg=audit(1308116009.625:19): avc:  denied  { remove_name } for  pid=2078 comm="fail2ban-server" name="ffiljYo5v" dev=dm-1 ino=3145732 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
----
time->Wed Jun 15 07:33:29 2011
type=SYSCALL msg=audit(1308116009.625:20): arch=40000003 syscall=192 success=yes exit=3035136 a0=0 a1=1000 a2=5 a3=1 items=0 ppid=1 pid=2078 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="fail2ban-server" exe="/usr/bin/python" subj=system_u:system_r:fail2ban_t:s0 key=(null)
type=AVC msg=audit(1308116009.625:20): avc:  denied  { execute } for  pid=2078 comm="fail2ban-server" path=2F746D702F6666696C6A596F3576202864656C6574656429 dev=dm-1 ino=3145732 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file
----
time->Wed Jun 15 07:33:29 2011
type=SYSCALL msg=audit(1308116009.644:21): arch=40000003 syscall=11 success=yes exit=0 a0=82a5228 a1=82a52a8 a2=82a47a8 a3=82a52a8 items=0 ppid=2081 pid=2082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ldconfig" exe="/sbin/ldconfig" subj=system_u:system_r:fail2ban_t:s0 key=(null)
type=AVC msg=audit(1308116009.644:21): avc:  denied  { execute_no_trans } for  pid=2082 comm="sh" path="/sbin/ldconfig" dev=dm-1 ino=1572983 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
type=AVC msg=audit(1308116009.644:21): avc:  denied  { read open } for  pid=2082 comm="sh" name="ldconfig" dev=dm-1 ino=1572983 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
type=AVC msg=audit(1308116009.644:21): avc:  denied  { execute } for  pid=2082 comm="sh" name="ldconfig" dev=dm-1 ino=1572983 scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
----
time->Wed Jun 15 07:33:30 2011
type=SYSCALL msg=audit(1308116010.054:22): arch=40000003 syscall=11 success=yes exit=0 a0=85924d8 a1=8592830 a2=8591868 a3=8592830 items=0 ppid=2086 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=486 sgid=486 fsgid=486 tty=(none) ses=4294967295 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:system_mail_t:s0 key=(null)
type=AVC msg=audit(1308116010.054:22): avc:  denied  { read write } for  pid=2090 comm="sendmail" path=2F746D702F6666696C6A596F3576202864656C6574656429 dev=dm-1 ino=3145732 scontext=system_u:system_r:system_mail_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file

Comment 27 Eddie Lania 2011-06-15 06:53:39 UTC

Just as a reminder, this is what you've let me put in ~/mytest/newtest.te:

policy_module(newtest, 1.0.0)
gen_require(` type fail2ban_t, system_mail_t, ftpd_t; ')
read_files_pattern(ftpd_t, fail2ban_var_lib_t, fail2ban_var_lib_t)
# read_files_pattern(system_mail_t, fail2ban_var_lib_t, fail2ban_var_lib_t)
read_files_pattern(sendmail_t, fail2ban_var_lib_t, fail2ban_var_lib_t)
libs_exec_ldconfig(fail2ban_t)
type fail2ban_tmp_t;
files_tmp_file(fail2ban_tmp_t)
manage_files_pattern(fail2ban_t, fail2ban_tmp_t, fail2ban_tmp_t)
exec_files_pattern(fail2ban_t, fail2ban_tmp_t, fail2ban_tmp_t)
files_tmp_filetrans(fail2ban_t, fail2ban_tmp_t, file)
allow system_mail_t fail2ban_tmp_t:file rw_inherited_file_perms;
type fail2ban_client_t;
type fail2ban_client_exec_t;
init_daemon_domain(fail2ban_client_t, fail2ban_client_exec_t)
# permissive fail2ban_client_t;
files_search_pids(fail2ban_client_t)
fail2ban_stream_connect(fail2ban_client_t)
gen_require(` type fail2ban_var_lib_t; ')
# mta_send_mail(fail2ban_client_t)
gen_require(` type fail2ban_exec_t; ')
domtrans_pattern(fail2ban_client_t, fail2ban_exec_t, fail2ban_t)
kernel_read_system_state(fail2ban_client_t)
# python
corecmd_exec_bin(fail2ban_client_t)
files_read_etc_files(fail2ban_client_t)
files_read_usr_files(fail2ban_client_t)
miscfiles_read_localization(fail2ban_client_t)
gen_require(` type sendmail_t; ')
fail2ban_read_lib_files(sendmail_t)

And in ~/mytest/mytest.fc:

/usr/bin/fail2ban-client --gen_context(system_u:object_r:fail2ban_client_exec_t, s0)

Comment 28 Eddie Lania 2011-06-15 07:05:30 UTC

Forget about my last comment, it was on a different machine. Sorry.

Comment 29 Eddie Lania 2011-06-15 07:23:42 UTC

----
time->Tue Jun 14 08:10:56 2011
type=SYSCALL msg=audit(1308031856.226:42694): arch=40000003 syscall=54 success=yes exit=0 a0=0 a1=5401 a2=bfe6bae8 a3=bfe6bb28 items=0 ppid=9739 pid=9747 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="fail2ban-client" exe="/usr/bin/python" subj=system_u:system_r:fail2ban_client_t:s0 key=(null)
type=AVC msg=audit(1308031856.226:42694): avc:  denied  { sys_tty_config } for  pid=9747 comm="fail2ban-client" capability=26  scontext=system_u:system_r:fail2ban_client_t:s0 tcontext=system_u:system_r:fail2ban_client_t:s0 tclass=capability

[root@ls2ka ~]# grep avc /var/log/messages
Jun 14 08:12:46 ls2ka dbus: avc:  netlink poll: error 4

[root@ls2ka ~]# grep SELinux /var/log/messages
Jun 14 08:11:00 ls2ka setroubleshoot: SELinux is preventing /usr/bin/python from using the sys_tty_config capability. For complete SELinux messages. run sealert -l 29d303f4-16a1-4648-890f-a037aded9041


[root@ls2ka ~]# sealert -l 29d303f4-16a1-4648-890f-a037aded9041
SELinux is preventing /usr/bin/python from using the sys_tty_config capability.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that python should have the sys_tty_config capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep fail2ban-client /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Comment 30 Miroslav Grepl 2011-06-15 07:55:06 UTC

I need to backport fail2ban policy fixes also to F14 policy.

Comment 31 Eddie Lania 2011-07-05 12:01:26 UTC

I do not know if this is related to the same issue but today i noticed that fail2ban is not banning at all:

--------------------- pam_unix Begin ------------------------

 vsftpd:
    Authentication Failures:
       1 rhost=westrumbrown.westrumbrown.com : 35 Time(s)
       administrateur rhost=westrumbrown.westrumbrown.com : 35 Time(s)
       orange rhost=westrumbrown.westrumbrown.com : 34 Time(s)
       access rhost=westrumbrown.westrumbrown.com : 33 Time(s)
       administrator rhost=westrumbrown.westrumbrown.com : 33 Time(s)
       demo rhost=westrumbrown.westrumbrown.com : 33 Time(s)
       info rhost=westrumbrown.westrumbrown.com : 33 Time(s)
       postmaster rhost=westrumbrown.westrumbrown.com : 33 Time(s)
       admin123 rhost=westrumbrown.westrumbrown.com : 32 Time(s)
       apple rhost=westrumbrown.westrumbrown.com : 32 Time(s)
       sysadmin rhost=westrumbrown.westrumbrown.com : 32 Time(s)
       welcome rhost=westrumbrown.westrumbrown.com : 32 Time(s)
       12345678 rhost=westrumbrown.westrumbrown.com : 31 Time(s)
       1q2w3e rhost=westrumbrown.westrumbrown.com : 31 Time(s)
       admin rhost=westrumbrown.westrumbrown.com : 31 Time(s)
       dave rhost=westrumbrown.westrumbrown.com : 31 Time(s)
       garage rhost=westrumbrown.westrumbrown.com : 31 Time(s)
       pass123 rhost=westrumbrown.westrumbrown.com : 31 Time(s)
       spam rhost=westrumbrown.westrumbrown.com : 31 Time(s)
       test rhost=westrumbrown.westrumbrown.com : 31 Time(s)
       123 rhost=westrumbrown.westrumbrown.com : 30 Time(s)
       Admin rhost=westrumbrown.westrumbrown.com : 30 Time(s)
       administrador rhost=westrumbrown.westrumbrown.com : 30 Time(s)
       backup rhost=westrumbrown.westrumbrown.com : 30 Time(s)
       password rhost=westrumbrown.westrumbrown.com : 30 Time(s)
       qwerasdf rhost=westrumbrown.westrumbrown.com : 30 Time(s)
       setup rhost=westrumbrown.westrumbrown.com : 30 Time(s)
       teste rhost=westrumbrown.westrumbrown.com : 30 Time(s)
       123456 rhost=westrumbrown.westrumbrown.com : 29 Time(s)
       abascus rhost=westrumbrown.westrumbrown.com : 29 Time(s)
       qwerty rhost=westrumbrown.westrumbrown.com : 29 Time(s)
       user rhost=westrumbrown.westrumbrown.com : 29 Time(s)
       netgear1 rhost=westrumbrown.westrumbrown.com : 27 Time(s)
    Password Failures:
       user unknown: 1028 Time(s)


 ---------------------- pam_unix End -------------------------

While a manual test of:

fail2ban-regex /var/log/secure "vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authentication failure; .* rhost=<HOST>(?:\s+user=\S*)?\s*$"

Gives:

Running tests
=============

Use regex line : vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authenticat...
Use log file   : /var/log/secure


Results
=======

Failregex
|- Regular expressions:
|  [1] vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authentication failure; .* rhost=<HOST>(?:\s+user=\S*)?\s*$
|
`- Number of matches:
   [1] 1028 match(es)

Ignoreregex
|- Regular expressions:
|
`- Number of matches:

Summary
=======

Addresses found:
[1]
    50.23.47.204 (Mon Jul 04 06:09:14 2011)
    50.23.47.204 (Mon Jul 04 06:09:17 2011)
    50.23.47.204 (Mon Jul 04 06:09:21 2011)
    50.23.47.204 (Mon Jul 04 06:09:25 2011)
    50.23.47.204 (Mon Jul 04 06:09:28 2011)
    50.23.47.204 (Mon Jul 04 06:09:32 2011)
    50.23.47.204 (Mon Jul 04 06:09:36 2011)
    50.23.47.204 (Mon Jul 04 06:09:39 2011)
    50.23.47.204 (Mon Jul 04 06:09:43 2011)
    50.23.47.204 (Mon Jul 04 06:09:46 2011)
    50.23.47.204 (Mon Jul 04 06:09:50 2011)
    50.23.47.204 (Mon Jul 04 06:09:53 2011)
    50.23.47.204 (Mon Jul 04 06:09:57 2011)
    50.23.47.204 (Mon Jul 04 06:10:00 2011)
    50.23.47.204 (Mon Jul 04 06:10:03 2011)
    50.23.47.204 (Mon Jul 04 06:10:07 2011)
    50.23.47.204 (Mon Jul 04 06:10:10 2011)
    50.23.47.204 (Mon Jul 04 06:10:13 2011)
    50.23.47.204 (Mon Jul 04 06:10:17 2011)
    50.23.47.204 (Mon Jul 04 06:10:20 2011)
    50.23.47.204 (Mon Jul 04 06:10:23 2011)
    50.23.47.204 (Mon Jul 04 06:10:27 2011)
    50.23.47.204 (Mon Jul 04 06:10:30 2011)
    50.23.47.204 (Mon Jul 04 06:10:33 2011)
    50.23.47.204 (Mon Jul 04 06:10:36 2011)
    50.23.47.204 (Mon Jul 04 06:10:39 2011)
    50.23.47.204 (Mon Jul 04 06:10:42 2011)
    50.23.47.204 (Mon Jul 04 06:10:46 2011)
    50.23.47.204 (Mon Jul 04 06:10:49 2011)
    50.23.47.204 (Mon Jul 04 06:10:52 2011)
    50.23.47.204 (Mon Jul 04 06:10:56 2011)
    50.23.47.204 (Mon Jul 04 06:10:59 2011)
    50.23.47.204 (Mon Jul 04 06:11:03 2011)
    50.23.47.204 (Mon Jul 04 06:11:06 2011)
    50.23.47.204 (Mon Jul 04 06:11:09 2011)
    50.23.47.204 (Mon Jul 04 06:11:12 2011)
    50.23.47.204 (Mon Jul 04 06:11:15 2011)
    50.23.47.204 (Mon Jul 04 06:11:18 2011)
    50.23.47.204 (Mon Jul 04 06:11:21 2011)
    50.23.47.204 (Mon Jul 04 06:11:25 2011)
    50.23.47.204 (Mon Jul 04 06:11:28 2011)
    50.23.47.204 (Mon Jul 04 06:11:31 2011)
    50.23.47.204 (Mon Jul 04 06:11:34 2011)
    50.23.47.204 (Mon Jul 04 06:11:37 2011)
    50.23.47.204 (Mon Jul 04 06:11:40 2011)
    50.23.47.204 (Mon Jul 04 06:11:44 2011)
    50.23.47.204 (Mon Jul 04 06:11:46 2011)
    50.23.47.204 (Mon Jul 04 06:11:50 2011)
    50.23.47.204 (Mon Jul 04 06:11:53 2011)
    50.23.47.204 (Mon Jul 04 06:11:57 2011)
    50.23.47.204 (Mon Jul 04 06:12:00 2011)
    50.23.47.204 (Mon Jul 04 06:12:03 2011)
    50.23.47.204 (Mon Jul 04 06:12:07 2011)
    50.23.47.204 (Mon Jul 04 06:12:09 2011)
    50.23.47.204 (Mon Jul 04 06:12:13 2011)
    50.23.47.204 (Mon Jul 04 06:12:15 2011)
    50.23.47.204 (Mon Jul 04 06:12:18 2011)
    50.23.47.204 (Mon Jul 04 06:12:22 2011)
    50.23.47.204 (Mon Jul 04 06:12:25 2011)
    50.23.47.204 (Mon Jul 04 06:12:28 2011)
    50.23.47.204 (Mon Jul 04 06:12:32 2011)
    50.23.47.204 (Mon Jul 04 06:12:35 2011)
    50.23.47.204 (Mon Jul 04 06:12:38 2011)
    50.23.47.204 (Mon Jul 04 06:12:41 2011)
    50.23.47.204 (Mon Jul 04 06:12:45 2011)
    50.23.47.204 (Mon Jul 04 06:12:48 2011)
    50.23.47.204 (Mon Jul 04 06:12:52 2011)
    50.23.47.204 (Mon Jul 04 06:12:55 2011)
    50.23.47.204 (Mon Jul 04 06:12:59 2011)
    50.23.47.204 (Mon Jul 04 06:13:03 2011)
    50.23.47.204 (Mon Jul 04 06:13:06 2011)
    50.23.47.204 (Mon Jul 04 06:13:09 2011)
    50.23.47.204 (Mon Jul 04 06:13:13 2011)
    50.23.47.204 (Mon Jul 04 06:13:16 2011)
    50.23.47.204 (Mon Jul 04 06:13:20 2011)
    50.23.47.204 (Mon Jul 04 06:13:23 2011)
    50.23.47.204 (Mon Jul 04 06:13:27 2011)
    50.23.47.204 (Mon Jul 04 06:13:30 2011)
    50.23.47.204 (Mon Jul 04 06:13:33 2011)
    50.23.47.204 (Mon Jul 04 06:13:36 2011)
    50.23.47.204 (Mon Jul 04 06:13:39 2011)
    50.23.47.204 (Mon Jul 04 06:13:43 2011)
    50.23.47.204 (Mon Jul 04 06:13:46 2011)
    50.23.47.204 (Mon Jul 04 06:13:50 2011)
    50.23.47.204 (Mon Jul 04 06:13:53 2011)
    50.23.47.204 (Mon Jul 04 06:13:57 2011)
    50.23.47.204 (Mon Jul 04 06:14:01 2011)
    50.23.47.204 (Mon Jul 04 06:14:04 2011)
    50.23.47.204 (Mon Jul 04 06:14:08 2011)
    50.23.47.204 (Mon Jul 04 06:14:11 2011)
    50.23.47.204 (Mon Jul 04 06:14:15 2011)
    50.23.47.204 (Mon Jul 04 06:14:18 2011)
    50.23.47.204 (Mon Jul 04 06:14:21 2011)
    50.23.47.204 (Mon Jul 04 06:14:25 2011)
    50.23.47.204 (Mon Jul 04 06:14:28 2011)
    50.23.47.204 (Mon Jul 04 06:14:31 2011)
    50.23.47.204 (Mon Jul 04 06:14:35 2011)
    50.23.47.204 (Mon Jul 04 06:14:39 2011)
    50.23.47.204 (Mon Jul 04 06:14:42 2011)
    50.23.47.204 (Mon Jul 04 06:14:45 2011)
    50.23.47.204 (Mon Jul 04 06:14:49 2011)
    50.23.47.204 (Mon Jul 04 06:14:52 2011)
    50.23.47.204 (Mon Jul 04 06:14:55 2011)
    50.23.47.204 (Mon Jul 04 06:14:59 2011)
    50.23.47.204 (Mon Jul 04 06:15:02 2011)
    50.23.47.204 (Mon Jul 04 06:15:06 2011)
    50.23.47.204 (Mon Jul 04 06:15:10 2011)
    50.23.47.204 (Mon Jul 04 06:15:13 2011)
    50.23.47.204 (Mon Jul 04 06:15:17 2011)
    50.23.47.204 (Mon Jul 04 06:15:20 2011)
    50.23.47.204 (Mon Jul 04 06:15:24 2011)
    50.23.47.204 (Mon Jul 04 06:15:27 2011)
    50.23.47.204 (Mon Jul 04 06:15:30 2011)
    50.23.47.204 (Mon Jul 04 06:15:33 2011)
    50.23.47.204 (Mon Jul 04 06:15:37 2011)
    50.23.47.204 (Mon Jul 04 06:15:40 2011)
    50.23.47.204 (Mon Jul 04 06:15:43 2011)
    50.23.47.204 (Mon Jul 04 06:15:47 2011)
    50.23.47.204 (Mon Jul 04 06:15:50 2011)
    50.23.47.204 (Mon Jul 04 06:15:53 2011)
    50.23.47.204 (Mon Jul 04 06:15:57 2011)
    50.23.47.204 (Mon Jul 04 06:16:00 2011)
    50.23.47.204 (Mon Jul 04 06:16:03 2011)
    50.23.47.204 (Mon Jul 04 06:16:07 2011)
    50.23.47.204 (Mon Jul 04 06:16:10 2011)
    50.23.47.204 (Mon Jul 04 06:16:13 2011)
    50.23.47.204 (Mon Jul 04 06:16:16 2011)
    50.23.47.204 (Mon Jul 04 06:16:20 2011)
    50.23.47.204 (Mon Jul 04 06:16:23 2011)
    50.23.47.204 (Mon Jul 04 06:16:27 2011)
    50.23.47.204 (Mon Jul 04 06:16:31 2011)
    50.23.47.204 (Mon Jul 04 06:16:34 2011)
    50.23.47.204 (Mon Jul 04 06:16:38 2011)
    50.23.47.204 (Mon Jul 04 06:16:41 2011)
    50.23.47.204 (Mon Jul 04 06:16:45 2011)
    50.23.47.204 (Mon Jul 04 06:16:48 2011)
    50.23.47.204 (Mon Jul 04 06:16:51 2011)
    50.23.47.204 (Mon Jul 04 06:16:54 2011)
    50.23.47.204 (Mon Jul 04 06:16:57 2011)
    50.23.47.204 (Mon Jul 04 06:17:01 2011)
    50.23.47.204 (Mon Jul 04 06:17:04 2011)
    50.23.47.204 (Mon Jul 04 06:17:08 2011)
    50.23.47.204 (Mon Jul 04 06:17:11 2011)
    50.23.47.204 (Mon Jul 04 06:17:14 2011)
    50.23.47.204 (Mon Jul 04 06:17:18 2011)
    50.23.47.204 (Mon Jul 04 06:17:21 2011)
    50.23.47.204 (Mon Jul 04 06:17:24 2011)
    50.23.47.204 (Mon Jul 04 06:17:28 2011)
    50.23.47.204 (Mon Jul 04 06:17:31 2011)
    50.23.47.204 (Mon Jul 04 06:17:34 2011)
    50.23.47.204 (Mon Jul 04 06:17:37 2011)
    50.23.47.204 (Mon Jul 04 06:17:41 2011)
    50.23.47.204 (Mon Jul 04 06:17:44 2011)
    50.23.47.204 (Mon Jul 04 06:17:47 2011)
    50.23.47.204 (Mon Jul 04 06:17:51 2011)
    50.23.47.204 (Mon Jul 04 06:17:54 2011)
    50.23.47.204 (Mon Jul 04 06:17:57 2011)
    50.23.47.204 (Mon Jul 04 06:18:00 2011)
    50.23.47.204 (Mon Jul 04 06:18:04 2011)
    50.23.47.204 (Mon Jul 04 06:18:07 2011)
    50.23.47.204 (Mon Jul 04 06:18:10 2011)
    50.23.47.204 (Mon Jul 04 06:18:14 2011)
    50.23.47.204 (Mon Jul 04 06:18:17 2011)
    50.23.47.204 (Mon Jul 04 06:18:21 2011)
    50.23.47.204 (Mon Jul 04 06:18:23 2011)
    50.23.47.204 (Mon Jul 04 06:18:27 2011)
    50.23.47.204 (Mon Jul 04 06:18:30 2011)
    50.23.47.204 (Mon Jul 04 06:18:33 2011)
    50.23.47.204 (Mon Jul 04 06:18:37 2011)
    50.23.47.204 (Mon Jul 04 06:18:40 2011)
    50.23.47.204 (Mon Jul 04 06:18:43 2011)
    50.23.47.204 (Mon Jul 04 06:18:46 2011)
    50.23.47.204 (Mon Jul 04 06:18:50 2011)
    50.23.47.204 (Mon Jul 04 06:18:53 2011)
    50.23.47.204 (Mon Jul 04 06:18:57 2011)
    50.23.47.204 (Mon Jul 04 06:19:00 2011)
    50.23.47.204 (Mon Jul 04 06:19:04 2011)
    50.23.47.204 (Mon Jul 04 06:19:07 2011)
    50.23.47.204 (Mon Jul 04 06:19:10 2011)
    50.23.47.204 (Mon Jul 04 06:19:13 2011)
    50.23.47.204 (Mon Jul 04 06:19:17 2011)
    50.23.47.204 (Mon Jul 04 06:19:20 2011)
    50.23.47.204 (Mon Jul 04 06:19:23 2011)
    50.23.47.204 (Mon Jul 04 06:19:27 2011)
    50.23.47.204 (Mon Jul 04 06:19:30 2011)
    50.23.47.204 (Mon Jul 04 06:19:34 2011)
    50.23.47.204 (Mon Jul 04 06:19:38 2011)
    50.23.47.204 (Mon Jul 04 06:19:40 2011)
    50.23.47.204 (Mon Jul 04 06:19:44 2011)
    50.23.47.204 (Mon Jul 04 06:19:48 2011)
    50.23.47.204 (Mon Jul 04 06:19:51 2011)
    50.23.47.204 (Mon Jul 04 06:19:55 2011)
    50.23.47.204 (Mon Jul 04 06:19:58 2011)
    50.23.47.204 (Mon Jul 04 06:20:01 2011)
    50.23.47.204 (Mon Jul 04 06:20:05 2011)
    50.23.47.204 (Mon Jul 04 06:20:09 2011)
    50.23.47.204 (Mon Jul 04 06:20:12 2011)
    50.23.47.204 (Mon Jul 04 06:20:16 2011)
    50.23.47.204 (Mon Jul 04 06:20:19 2011)
    50.23.47.204 (Mon Jul 04 06:20:22 2011)
    50.23.47.204 (Mon Jul 04 06:20:26 2011)
    50.23.47.204 (Mon Jul 04 06:20:29 2011)
    50.23.47.204 (Mon Jul 04 06:20:33 2011)
    50.23.47.204 (Mon Jul 04 06:20:36 2011)
    50.23.47.204 (Mon Jul 04 06:20:41 2011)
    50.23.47.204 (Mon Jul 04 06:20:44 2011)
    50.23.47.204 (Mon Jul 04 06:20:47 2011)
    50.23.47.204 (Mon Jul 04 06:20:51 2011)
    50.23.47.204 (Mon Jul 04 06:20:54 2011)
    50.23.47.204 (Mon Jul 04 06:20:57 2011)
    50.23.47.204 (Mon Jul 04 06:21:01 2011)
    50.23.47.204 (Mon Jul 04 06:21:04 2011)
    50.23.47.204 (Mon Jul 04 06:21:08 2011)
    50.23.47.204 (Mon Jul 04 06:21:12 2011)
    50.23.47.204 (Mon Jul 04 06:21:15 2011)
    50.23.47.204 (Mon Jul 04 06:21:19 2011)
    50.23.47.204 (Mon Jul 04 06:21:22 2011)
    50.23.47.204 (Mon Jul 04 06:21:26 2011)
    50.23.47.204 (Mon Jul 04 06:21:29 2011)
    50.23.47.204 (Mon Jul 04 06:21:32 2011)
    50.23.47.204 (Mon Jul 04 06:21:36 2011)
    50.23.47.204 (Mon Jul 04 06:22:21 2011)
    50.23.47.204 (Mon Jul 04 06:22:24 2011)
    50.23.47.204 (Mon Jul 04 06:22:28 2011)
    50.23.47.204 (Mon Jul 04 06:22:31 2011)
    50.23.47.204 (Mon Jul 04 06:22:34 2011)
    50.23.47.204 (Mon Jul 04 06:22:37 2011)
    50.23.47.204 (Mon Jul 04 06:22:40 2011)
    50.23.47.204 (Mon Jul 04 06:22:43 2011)
    50.23.47.204 (Mon Jul 04 06:22:47 2011)
    50.23.47.204 (Mon Jul 04 06:22:50 2011)
    50.23.47.204 (Mon Jul 04 06:22:53 2011)
    50.23.47.204 (Mon Jul 04 06:22:56 2011)
    50.23.47.204 (Mon Jul 04 06:23:00 2011)
    50.23.47.204 (Mon Jul 04 06:23:03 2011)
    50.23.47.204 (Mon Jul 04 06:23:06 2011)
    50.23.47.204 (Mon Jul 04 06:23:10 2011)
    50.23.47.204 (Mon Jul 04 06:23:13 2011)
    50.23.47.204 (Mon Jul 04 06:23:16 2011)
    50.23.47.204 (Mon Jul 04 06:23:20 2011)
    50.23.47.204 (Mon Jul 04 06:23:22 2011)
    50.23.47.204 (Mon Jul 04 06:23:25 2011)
    50.23.47.204 (Mon Jul 04 06:23:28 2011)
    50.23.47.204 (Mon Jul 04 06:23:31 2011)
    50.23.47.204 (Mon Jul 04 06:23:34 2011)
    50.23.47.204 (Mon Jul 04 06:23:37 2011)
    50.23.47.204 (Mon Jul 04 06:23:40 2011)
    50.23.47.204 (Mon Jul 04 06:23:44 2011)
    50.23.47.204 (Mon Jul 04 06:23:47 2011)
    50.23.47.204 (Mon Jul 04 06:23:50 2011)
    50.23.47.204 (Mon Jul 04 06:23:53 2011)
    50.23.47.204 (Mon Jul 04 06:23:57 2011)
    50.23.47.204 (Mon Jul 04 06:24:00 2011)
    50.23.47.204 (Mon Jul 04 06:24:03 2011)
    50.23.47.204 (Mon Jul 04 06:24:06 2011)
    50.23.47.204 (Mon Jul 04 06:24:10 2011)
    50.23.47.204 (Mon Jul 04 06:24:13 2011)
    50.23.47.204 (Mon Jul 04 06:24:16 2011)
    50.23.47.204 (Mon Jul 04 06:24:19 2011)
    50.23.47.204 (Mon Jul 04 06:24:22 2011)
    50.23.47.204 (Mon Jul 04 06:24:25 2011)
    50.23.47.204 (Mon Jul 04 06:24:28 2011)
    50.23.47.204 (Mon Jul 04 06:24:31 2011)
    50.23.47.204 (Mon Jul 04 06:24:34 2011)
    50.23.47.204 (Mon Jul 04 06:24:38 2011)
    50.23.47.204 (Mon Jul 04 06:24:40 2011)
    50.23.47.204 (Mon Jul 04 06:24:44 2011)
    50.23.47.204 (Mon Jul 04 06:24:47 2011)
    50.23.47.204 (Mon Jul 04 06:24:50 2011)
    50.23.47.204 (Mon Jul 04 06:24:53 2011)
    50.23.47.204 (Mon Jul 04 06:24:57 2011)
    50.23.47.204 (Mon Jul 04 06:25:00 2011)
    50.23.47.204 (Mon Jul 04 06:25:04 2011)
    50.23.47.204 (Mon Jul 04 06:25:07 2011)
    50.23.47.204 (Mon Jul 04 06:25:10 2011)
    50.23.47.204 (Mon Jul 04 06:25:13 2011)
    50.23.47.204 (Mon Jul 04 06:25:16 2011)
    50.23.47.204 (Mon Jul 04 06:25:19 2011)
    50.23.47.204 (Mon Jul 04 06:25:22 2011)
    50.23.47.204 (Mon Jul 04 06:25:25 2011)
    50.23.47.204 (Mon Jul 04 06:25:28 2011)
    50.23.47.204 (Mon Jul 04 06:25:32 2011)
    50.23.47.204 (Mon Jul 04 06:25:35 2011)
    50.23.47.204 (Mon Jul 04 06:25:39 2011)
    50.23.47.204 (Mon Jul 04 06:25:42 2011)
    50.23.47.204 (Mon Jul 04 06:25:45 2011)
    50.23.47.204 (Mon Jul 04 06:25:49 2011)
    50.23.47.204 (Mon Jul 04 06:25:52 2011)
    50.23.47.204 (Mon Jul 04 06:25:55 2011)
    50.23.47.204 (Mon Jul 04 06:25:58 2011)
    50.23.47.204 (Mon Jul 04 06:26:01 2011)
    50.23.47.204 (Mon Jul 04 06:26:04 2011)
    50.23.47.204 (Mon Jul 04 06:26:08 2011)
    50.23.47.204 (Mon Jul 04 06:26:11 2011)
    50.23.47.204 (Mon Jul 04 06:26:15 2011)
    50.23.47.204 (Mon Jul 04 06:26:18 2011)
    50.23.47.204 (Mon Jul 04 06:26:22 2011)
    50.23.47.204 (Mon Jul 04 06:26:26 2011)
    50.23.47.204 (Mon Jul 04 06:26:29 2011)
    50.23.47.204 (Mon Jul 04 06:26:32 2011)
    50.23.47.204 (Mon Jul 04 06:26:36 2011)
    50.23.47.204 (Mon Jul 04 06:26:39 2011)
    50.23.47.204 (Mon Jul 04 06:26:43 2011)
    50.23.47.204 (Mon Jul 04 06:26:46 2011)
    50.23.47.204 (Mon Jul 04 06:26:49 2011)
    50.23.47.204 (Mon Jul 04 06:26:53 2011)
    50.23.47.204 (Mon Jul 04 06:26:56 2011)
    50.23.47.204 (Mon Jul 04 06:26:59 2011)
    50.23.47.204 (Mon Jul 04 06:27:03 2011)
    50.23.47.204 (Mon Jul 04 06:27:06 2011)
    50.23.47.204 (Mon Jul 04 06:27:09 2011)
    50.23.47.204 (Mon Jul 04 06:27:13 2011)
    50.23.47.204 (Mon Jul 04 06:27:16 2011)
    50.23.47.204 (Mon Jul 04 06:27:20 2011)
    50.23.47.204 (Mon Jul 04 06:27:23 2011)
    50.23.47.204 (Mon Jul 04 06:27:26 2011)
    50.23.47.204 (Mon Jul 04 06:27:30 2011)
    50.23.47.204 (Mon Jul 04 06:27:33 2011)
    50.23.47.204 (Mon Jul 04 06:27:36 2011)
    50.23.47.204 (Mon Jul 04 06:27:40 2011)
    50.23.47.204 (Mon Jul 04 06:27:44 2011)
    50.23.47.204 (Mon Jul 04 06:27:47 2011)
    50.23.47.204 (Mon Jul 04 06:27:51 2011)
    50.23.47.204 (Mon Jul 04 06:27:55 2011)
    50.23.47.204 (Mon Jul 04 06:27:57 2011)
    50.23.47.204 (Mon Jul 04 06:28:01 2011)
    50.23.47.204 (Mon Jul 04 06:28:04 2011)
    50.23.47.204 (Mon Jul 04 06:28:08 2011)
    50.23.47.204 (Mon Jul 04 06:28:10 2011)
    50.23.47.204 (Mon Jul 04 06:28:14 2011)
    50.23.47.204 (Mon Jul 04 06:28:17 2011)
    50.23.47.204 (Mon Jul 04 06:28:20 2011)
    50.23.47.204 (Mon Jul 04 06:28:24 2011)
    50.23.47.204 (Mon Jul 04 06:28:27 2011)
    50.23.47.204 (Mon Jul 04 06:28:31 2011)
    50.23.47.204 (Mon Jul 04 06:28:34 2011)
    50.23.47.204 (Mon Jul 04 06:28:37 2011)
    50.23.47.204 (Mon Jul 04 06:28:41 2011)
    50.23.47.204 (Mon Jul 04 06:28:44 2011)
    50.23.47.204 (Mon Jul 04 06:28:48 2011)
    50.23.47.204 (Mon Jul 04 06:28:52 2011)
    50.23.47.204 (Mon Jul 04 06:28:55 2011)
    50.23.47.204 (Mon Jul 04 06:28:58 2011)
    50.23.47.204 (Mon Jul 04 06:29:01 2011)
    50.23.47.204 (Mon Jul 04 06:29:04 2011)
    50.23.47.204 (Mon Jul 04 06:29:08 2011)
    50.23.47.204 (Mon Jul 04 06:29:11 2011)
    50.23.47.204 (Mon Jul 04 06:29:15 2011)
    50.23.47.204 (Mon Jul 04 06:29:17 2011)
    50.23.47.204 (Mon Jul 04 06:29:21 2011)
    50.23.47.204 (Mon Jul 04 06:29:24 2011)
    50.23.47.204 (Mon Jul 04 06:29:28 2011)
    50.23.47.204 (Mon Jul 04 06:29:31 2011)
    50.23.47.204 (Mon Jul 04 06:29:35 2011)
    50.23.47.204 (Mon Jul 04 06:29:38 2011)
    50.23.47.204 (Mon Jul 04 06:29:41 2011)
    50.23.47.204 (Mon Jul 04 06:29:44 2011)
    50.23.47.204 (Mon Jul 04 06:29:47 2011)
    50.23.47.204 (Mon Jul 04 06:29:51 2011)
    50.23.47.204 (Mon Jul 04 06:29:54 2011)
    50.23.47.204 (Mon Jul 04 06:29:58 2011)
    50.23.47.204 (Mon Jul 04 06:30:01 2011)
    50.23.47.204 (Mon Jul 04 06:30:05 2011)
    50.23.47.204 (Mon Jul 04 06:30:08 2011)
    50.23.47.204 (Mon Jul 04 06:30:10 2011)
    50.23.47.204 (Mon Jul 04 06:30:14 2011)
    50.23.47.204 (Mon Jul 04 06:30:17 2011)
    50.23.47.204 (Mon Jul 04 06:30:21 2011)
    50.23.47.204 (Mon Jul 04 06:30:24 2011)
    50.23.47.204 (Mon Jul 04 06:30:27 2011)
    50.23.47.204 (Mon Jul 04 06:30:30 2011)
    50.23.47.204 (Mon Jul 04 06:30:34 2011)
    50.23.47.204 (Mon Jul 04 06:30:37 2011)
    50.23.47.204 (Mon Jul 04 06:30:41 2011)
    50.23.47.204 (Mon Jul 04 06:30:44 2011)
    50.23.47.204 (Mon Jul 04 06:30:47 2011)
    50.23.47.204 (Mon Jul 04 06:30:50 2011)
    50.23.47.204 (Mon Jul 04 06:30:53 2011)
    50.23.47.204 (Mon Jul 04 06:30:57 2011)
    50.23.47.204 (Mon Jul 04 06:31:00 2011)
    50.23.47.204 (Mon Jul 04 06:31:03 2011)
    50.23.47.204 (Mon Jul 04 06:31:07 2011)
    50.23.47.204 (Mon Jul 04 06:31:10 2011)
    50.23.47.204 (Mon Jul 04 06:31:14 2011)
    50.23.47.204 (Mon Jul 04 06:31:17 2011)
    50.23.47.204 (Mon Jul 04 06:31:20 2011)
    50.23.47.204 (Mon Jul 04 06:31:23 2011)
    50.23.47.204 (Mon Jul 04 06:31:26 2011)
    50.23.47.204 (Mon Jul 04 06:31:30 2011)
    50.23.47.204 (Mon Jul 04 06:31:33 2011)
    50.23.47.204 (Mon Jul 04 06:31:37 2011)
    50.23.47.204 (Mon Jul 04 06:31:40 2011)
    50.23.47.204 (Mon Jul 04 06:31:43 2011)
    50.23.47.204 (Mon Jul 04 06:31:47 2011)
    50.23.47.204 (Mon Jul 04 06:31:50 2011)
    50.23.47.204 (Mon Jul 04 06:31:54 2011)
    50.23.47.204 (Mon Jul 04 06:31:57 2011)
    50.23.47.204 (Mon Jul 04 06:32:01 2011)
    50.23.47.204 (Mon Jul 04 06:32:05 2011)
    50.23.47.204 (Mon Jul 04 06:32:07 2011)
    50.23.47.204 (Mon Jul 04 06:32:11 2011)
    50.23.47.204 (Mon Jul 04 06:32:14 2011)
    50.23.47.204 (Mon Jul 04 06:32:17 2011)
    50.23.47.204 (Mon Jul 04 06:32:20 2011)
    50.23.47.204 (Mon Jul 04 06:32:24 2011)
    50.23.47.204 (Mon Jul 04 06:32:27 2011)
    50.23.47.204 (Mon Jul 04 06:32:31 2011)
    50.23.47.204 (Mon Jul 04 06:32:34 2011)
    50.23.47.204 (Mon Jul 04 06:32:38 2011)
    50.23.47.204 (Mon Jul 04 06:32:40 2011)
    50.23.47.204 (Mon Jul 04 06:32:44 2011)
    50.23.47.204 (Mon Jul 04 06:32:47 2011)
    50.23.47.204 (Mon Jul 04 06:32:51 2011)
    50.23.47.204 (Mon Jul 04 06:32:55 2011)
    50.23.47.204 (Mon Jul 04 06:32:58 2011)
    50.23.47.204 (Mon Jul 04 06:33:02 2011)
    50.23.47.204 (Mon Jul 04 06:33:05 2011)
    50.23.47.204 (Mon Jul 04 06:33:09 2011)
    50.23.47.204 (Mon Jul 04 06:33:12 2011)
    50.23.47.204 (Mon Jul 04 06:33:16 2011)
    50.23.47.204 (Mon Jul 04 06:33:19 2011)
    50.23.47.204 (Mon Jul 04 06:33:23 2011)
    50.23.47.204 (Mon Jul 04 06:33:27 2011)
    50.23.47.204 (Mon Jul 04 06:33:30 2011)
    50.23.47.204 (Mon Jul 04 06:33:33 2011)
    50.23.47.204 (Mon Jul 04 06:33:37 2011)
    50.23.47.204 (Mon Jul 04 06:33:41 2011)
    50.23.47.204 (Mon Jul 04 06:33:44 2011)
    50.23.47.204 (Mon Jul 04 06:33:47 2011)
    50.23.47.204 (Mon Jul 04 06:33:51 2011)
    50.23.47.204 (Mon Jul 04 06:33:54 2011)
    50.23.47.204 (Mon Jul 04 06:33:58 2011)
    50.23.47.204 (Mon Jul 04 06:34:01 2011)
    50.23.47.204 (Mon Jul 04 06:34:05 2011)
    50.23.47.204 (Mon Jul 04 06:34:08 2011)
    50.23.47.204 (Mon Jul 04 06:34:12 2011)
    50.23.47.204 (Mon Jul 04 06:34:16 2011)
    50.23.47.204 (Mon Jul 04 06:34:19 2011)
    50.23.47.204 (Mon Jul 04 06:34:23 2011)
    50.23.47.204 (Mon Jul 04 06:34:27 2011)
    50.23.47.204 (Mon Jul 04 06:34:30 2011)
    50.23.47.204 (Mon Jul 04 06:34:34 2011)
    50.23.47.204 (Mon Jul 04 06:34:37 2011)
    50.23.47.204 (Mon Jul 04 06:34:41 2011)
    50.23.47.204 (Mon Jul 04 06:34:44 2011)
    50.23.47.204 (Mon Jul 04 06:34:47 2011)
    50.23.47.204 (Mon Jul 04 06:34:51 2011)
    50.23.47.204 (Mon Jul 04 06:34:55 2011)
    50.23.47.204 (Mon Jul 04 06:34:58 2011)
    50.23.47.204 (Mon Jul 04 06:35:02 2011)
    50.23.47.204 (Mon Jul 04 06:35:05 2011)
    50.23.47.204 (Mon Jul 04 06:35:08 2011)
    50.23.47.204 (Mon Jul 04 06:35:11 2011)
    50.23.47.204 (Mon Jul 04 06:35:14 2011)
    50.23.47.204 (Mon Jul 04 06:35:18 2011)
    50.23.47.204 (Mon Jul 04 06:35:21 2011)
    50.23.47.204 (Mon Jul 04 06:35:24 2011)
    50.23.47.204 (Mon Jul 04 06:35:28 2011)
    50.23.47.204 (Mon Jul 04 06:35:31 2011)
    50.23.47.204 (Mon Jul 04 06:35:34 2011)
    50.23.47.204 (Mon Jul 04 06:35:38 2011)
    50.23.47.204 (Mon Jul 04 06:35:41 2011)
    50.23.47.204 (Mon Jul 04 06:35:44 2011)
    50.23.47.204 (Mon Jul 04 06:35:46 2011)
    50.23.47.204 (Mon Jul 04 06:35:50 2011)
    50.23.47.204 (Mon Jul 04 06:35:52 2011)
    50.23.47.204 (Mon Jul 04 06:35:56 2011)
    50.23.47.204 (Mon Jul 04 06:35:58 2011)
    50.23.47.204 (Mon Jul 04 06:36:02 2011)
    50.23.47.204 (Mon Jul 04 06:36:05 2011)
    50.23.47.204 (Mon Jul 04 06:36:08 2011)
    50.23.47.204 (Mon Jul 04 06:36:11 2011)
    50.23.47.204 (Mon Jul 04 06:36:15 2011)
    50.23.47.204 (Mon Jul 04 06:36:18 2011)
    50.23.47.204 (Mon Jul 04 06:36:21 2011)
    50.23.47.204 (Mon Jul 04 06:36:24 2011)
    50.23.47.204 (Mon Jul 04 06:36:28 2011)
    50.23.47.204 (Mon Jul 04 06:36:30 2011)
    50.23.47.204 (Mon Jul 04 06:36:34 2011)
    50.23.47.204 (Mon Jul 04 06:36:37 2011)
    50.23.47.204 (Mon Jul 04 06:36:41 2011)
    50.23.47.204 (Mon Jul 04 06:36:44 2011)
    50.23.47.204 (Mon Jul 04 06:36:47 2011)
    50.23.47.204 (Mon Jul 04 06:36:50 2011)
    50.23.47.204 (Mon Jul 04 06:36:53 2011)
    50.23.47.204 (Mon Jul 04 06:36:56 2011)
    50.23.47.204 (Mon Jul 04 06:37:00 2011)
    50.23.47.204 (Mon Jul 04 06:37:03 2011)
    50.23.47.204 (Mon Jul 04 06:37:05 2011)
    50.23.47.204 (Mon Jul 04 06:37:08 2011)
    50.23.47.204 (Mon Jul 04 06:37:12 2011)
    50.23.47.204 (Mon Jul 04 06:37:15 2011)
    50.23.47.204 (Mon Jul 04 06:37:19 2011)
    50.23.47.204 (Mon Jul 04 06:37:22 2011)
    50.23.47.204 (Mon Jul 04 06:37:25 2011)
    50.23.47.204 (Mon Jul 04 06:37:28 2011)
    50.23.47.204 (Mon Jul 04 06:37:31 2011)
    50.23.47.204 (Mon Jul 04 06:37:35 2011)
    50.23.47.204 (Mon Jul 04 06:37:38 2011)
    50.23.47.204 (Mon Jul 04 06:37:41 2011)
    50.23.47.204 (Mon Jul 04 06:37:45 2011)
    50.23.47.204 (Mon Jul 04 06:37:48 2011)
    50.23.47.204 (Mon Jul 04 06:37:51 2011)
    50.23.47.204 (Mon Jul 04 06:37:55 2011)
    50.23.47.204 (Mon Jul 04 06:37:58 2011)
    50.23.47.204 (Mon Jul 04 06:38:01 2011)
    50.23.47.204 (Mon Jul 04 06:38:05 2011)
    50.23.47.204 (Mon Jul 04 06:38:08 2011)
    50.23.47.204 (Mon Jul 04 06:38:11 2011)
    50.23.47.204 (Mon Jul 04 06:38:14 2011)
    50.23.47.204 (Mon Jul 04 06:38:17 2011)
    50.23.47.204 (Mon Jul 04 06:38:20 2011)
    50.23.47.204 (Mon Jul 04 06:38:23 2011)
    50.23.47.204 (Mon Jul 04 06:38:26 2011)
    50.23.47.204 (Mon Jul 04 06:38:30 2011)
    50.23.47.204 (Mon Jul 04 06:38:33 2011)
    50.23.47.204 (Mon Jul 04 06:38:37 2011)
    50.23.47.204 (Mon Jul 04 06:38:40 2011)
    50.23.47.204 (Mon Jul 04 06:38:44 2011)
    50.23.47.204 (Mon Jul 04 06:38:47 2011)
    50.23.47.204 (Mon Jul 04 06:38:50 2011)
    50.23.47.204 (Mon Jul 04 06:38:53 2011)
    50.23.47.204 (Mon Jul 04 06:38:57 2011)
    50.23.47.204 (Mon Jul 04 06:39:00 2011)
    50.23.47.204 (Mon Jul 04 06:39:04 2011)
    50.23.47.204 (Mon Jul 04 06:39:07 2011)
    50.23.47.204 (Mon Jul 04 06:39:10 2011)
    50.23.47.204 (Mon Jul 04 06:39:14 2011)
    50.23.47.204 (Mon Jul 04 06:39:17 2011)
    50.23.47.204 (Mon Jul 04 06:39:20 2011)
    50.23.47.204 (Mon Jul 04 06:39:24 2011)
    50.23.47.204 (Mon Jul 04 06:39:27 2011)
    50.23.47.204 (Mon Jul 04 06:39:30 2011)
    50.23.47.204 (Mon Jul 04 06:39:34 2011)
    50.23.47.204 (Mon Jul 04 06:39:38 2011)
    50.23.47.204 (Mon Jul 04 06:39:41 2011)
    50.23.47.204 (Mon Jul 04 06:39:45 2011)
    50.23.47.204 (Mon Jul 04 06:39:48 2011)
    50.23.47.204 (Mon Jul 04 06:39:51 2011)
    50.23.47.204 (Mon Jul 04 06:39:54 2011)
    50.23.47.204 (Mon Jul 04 06:39:58 2011)
    50.23.47.204 (Mon Jul 04 06:40:01 2011)
    50.23.47.204 (Mon Jul 04 06:40:05 2011)
    50.23.47.204 (Mon Jul 04 06:40:09 2011)
    50.23.47.204 (Mon Jul 04 06:40:12 2011)
    50.23.47.204 (Mon Jul 04 06:40:16 2011)
    50.23.47.204 (Mon Jul 04 06:40:19 2011)
    50.23.47.204 (Mon Jul 04 06:40:23 2011)
    50.23.47.204 (Mon Jul 04 06:40:26 2011)
    50.23.47.204 (Mon Jul 04 06:40:29 2011)
    50.23.47.204 (Mon Jul 04 06:40:33 2011)
    50.23.47.204 (Mon Jul 04 06:40:36 2011)
    50.23.47.204 (Mon Jul 04 06:40:39 2011)
    50.23.47.204 (Mon Jul 04 06:40:42 2011)
    50.23.47.204 (Mon Jul 04 06:40:46 2011)
    50.23.47.204 (Mon Jul 04 06:40:49 2011)
    50.23.47.204 (Mon Jul 04 06:40:53 2011)
    50.23.47.204 (Mon Jul 04 06:40:57 2011)
    50.23.47.204 (Mon Jul 04 06:41:00 2011)
    50.23.47.204 (Mon Jul 04 06:41:03 2011)
    50.23.47.204 (Mon Jul 04 06:41:07 2011)
    50.23.47.204 (Mon Jul 04 06:41:10 2011)
    50.23.47.204 (Mon Jul 04 06:41:13 2011)
    50.23.47.204 (Mon Jul 04 06:41:17 2011)
    50.23.47.204 (Mon Jul 04 06:41:20 2011)
    50.23.47.204 (Mon Jul 04 06:41:23 2011)
    50.23.47.204 (Mon Jul 04 06:41:26 2011)
    50.23.47.204 (Mon Jul 04 06:41:29 2011)
    50.23.47.204 (Mon Jul 04 06:41:33 2011)
    50.23.47.204 (Mon Jul 04 06:41:36 2011)
    50.23.47.204 (Mon Jul 04 06:41:40 2011)
    50.23.47.204 (Mon Jul 04 06:41:43 2011)
    50.23.47.204 (Mon Jul 04 06:41:46 2011)
    50.23.47.204 (Mon Jul 04 06:41:49 2011)
    50.23.47.204 (Mon Jul 04 06:41:53 2011)
    50.23.47.204 (Mon Jul 04 06:41:56 2011)
    50.23.47.204 (Mon Jul 04 06:41:59 2011)
    50.23.47.204 (Mon Jul 04 06:42:02 2011)
    50.23.47.204 (Mon Jul 04 06:42:06 2011)
    50.23.47.204 (Mon Jul 04 06:42:09 2011)
    50.23.47.204 (Mon Jul 04 06:42:12 2011)
    50.23.47.204 (Mon Jul 04 06:42:16 2011)
    50.23.47.204 (Mon Jul 04 06:42:19 2011)
    50.23.47.204 (Mon Jul 04 06:42:23 2011)
    50.23.47.204 (Mon Jul 04 06:42:27 2011)
    50.23.47.204 (Mon Jul 04 06:42:29 2011)
    50.23.47.204 (Mon Jul 04 06:42:32 2011)
    50.23.47.204 (Mon Jul 04 06:42:35 2011)
    50.23.47.204 (Mon Jul 04 06:42:39 2011)
    50.23.47.204 (Mon Jul 04 06:42:42 2011)
    50.23.47.204 (Mon Jul 04 06:42:46 2011)
    50.23.47.204 (Mon Jul 04 06:42:49 2011)
    50.23.47.204 (Mon Jul 04 06:42:52 2011)
    50.23.47.204 (Mon Jul 04 06:42:55 2011)
    50.23.47.204 (Mon Jul 04 06:42:58 2011)
    50.23.47.204 (Mon Jul 04 06:43:02 2011)
    50.23.47.204 (Mon Jul 04 06:43:05 2011)
    50.23.47.204 (Mon Jul 04 06:43:08 2011)
    50.23.47.204 (Mon Jul 04 06:43:12 2011)
    50.23.47.204 (Mon Jul 04 06:43:15 2011)
    50.23.47.204 (Mon Jul 04 06:43:18 2011)
    50.23.47.204 (Mon Jul 04 06:43:21 2011)
    50.23.47.204 (Mon Jul 04 06:43:24 2011)
    50.23.47.204 (Mon Jul 04 06:43:27 2011)
    50.23.47.204 (Mon Jul 04 06:43:30 2011)
    50.23.47.204 (Mon Jul 04 06:43:34 2011)
    50.23.47.204 (Mon Jul 04 06:43:37 2011)
    50.23.47.204 (Mon Jul 04 06:43:40 2011)
    50.23.47.204 (Mon Jul 04 06:43:43 2011)
    50.23.47.204 (Mon Jul 04 06:43:47 2011)
    50.23.47.204 (Mon Jul 04 06:43:50 2011)
    50.23.47.204 (Mon Jul 04 06:43:53 2011)
    50.23.47.204 (Mon Jul 04 06:43:56 2011)
    50.23.47.204 (Mon Jul 04 06:44:00 2011)
    50.23.47.204 (Mon Jul 04 06:44:04 2011)
    50.23.47.204 (Mon Jul 04 06:44:07 2011)
    50.23.47.204 (Mon Jul 04 06:44:11 2011)
    50.23.47.204 (Mon Jul 04 06:44:14 2011)
    50.23.47.204 (Mon Jul 04 06:44:18 2011)
    50.23.47.204 (Mon Jul 04 06:44:21 2011)
    50.23.47.204 (Mon Jul 04 06:44:24 2011)
    50.23.47.204 (Mon Jul 04 06:44:28 2011)
    50.23.47.204 (Mon Jul 04 06:44:31 2011)
    50.23.47.204 (Mon Jul 04 06:44:35 2011)
    50.23.47.204 (Mon Jul 04 06:44:38 2011)
    50.23.47.204 (Mon Jul 04 06:44:42 2011)
    50.23.47.204 (Mon Jul 04 06:44:46 2011)
    50.23.47.204 (Mon Jul 04 06:44:49 2011)
    50.23.47.204 (Mon Jul 04 06:44:53 2011)
    50.23.47.204 (Mon Jul 04 06:44:56 2011)
    50.23.47.204 (Mon Jul 04 06:45:00 2011)
    50.23.47.204 (Mon Jul 04 06:45:03 2011)
    50.23.47.204 (Mon Jul 04 06:45:06 2011)
    50.23.47.204 (Mon Jul 04 06:45:10 2011)
    50.23.47.204 (Mon Jul 04 06:45:13 2011)
    50.23.47.204 (Mon Jul 04 06:45:17 2011)
    50.23.47.204 (Mon Jul 04 06:45:20 2011)
    50.23.47.204 (Mon Jul 04 06:45:24 2011)
    50.23.47.204 (Mon Jul 04 06:45:28 2011)
    50.23.47.204 (Mon Jul 04 06:45:31 2011)
    50.23.47.204 (Mon Jul 04 06:45:34 2011)
    50.23.47.204 (Mon Jul 04 06:45:38 2011)
    50.23.47.204 (Mon Jul 04 06:45:41 2011)
    50.23.47.204 (Mon Jul 04 06:45:44 2011)
    50.23.47.204 (Mon Jul 04 06:45:48 2011)
    50.23.47.204 (Mon Jul 04 06:45:52 2011)
    50.23.47.204 (Mon Jul 04 06:45:55 2011)
    50.23.47.204 (Mon Jul 04 06:45:59 2011)
    50.23.47.204 (Mon Jul 04 06:46:02 2011)
    50.23.47.204 (Mon Jul 04 06:46:06 2011)
    50.23.47.204 (Mon Jul 04 06:46:09 2011)
    50.23.47.204 (Mon Jul 04 06:46:13 2011)
    50.23.47.204 (Mon Jul 04 06:46:16 2011)
    50.23.47.204 (Mon Jul 04 06:46:19 2011)
    50.23.47.204 (Mon Jul 04 06:46:23 2011)
    50.23.47.204 (Mon Jul 04 06:46:27 2011)
    50.23.47.204 (Mon Jul 04 06:46:30 2011)
    50.23.47.204 (Mon Jul 04 06:46:33 2011)
    50.23.47.204 (Mon Jul 04 06:46:37 2011)
    50.23.47.204 (Mon Jul 04 06:46:41 2011)
    50.23.47.204 (Mon Jul 04 06:46:44 2011)
    50.23.47.204 (Mon Jul 04 06:46:48 2011)
    50.23.47.204 (Mon Jul 04 06:46:51 2011)
    50.23.47.204 (Mon Jul 04 06:46:54 2011)
    50.23.47.204 (Mon Jul 04 06:46:57 2011)
    50.23.47.204 (Mon Jul 04 06:47:01 2011)
    50.23.47.204 (Mon Jul 04 06:47:04 2011)
    50.23.47.204 (Mon Jul 04 06:47:08 2011)
    50.23.47.204 (Mon Jul 04 06:47:12 2011)
    50.23.47.204 (Mon Jul 04 06:47:16 2011)
    50.23.47.204 (Mon Jul 04 06:47:19 2011)
    50.23.47.204 (Mon Jul 04 06:47:23 2011)
    50.23.47.204 (Mon Jul 04 06:47:27 2011)
    50.23.47.204 (Mon Jul 04 06:47:30 2011)
    50.23.47.204 (Mon Jul 04 06:47:34 2011)
    50.23.47.204 (Mon Jul 04 06:47:37 2011)
    50.23.47.204 (Mon Jul 04 06:47:40 2011)
    50.23.47.204 (Mon Jul 04 06:47:44 2011)
    50.23.47.204 (Mon Jul 04 06:47:48 2011)
    50.23.47.204 (Mon Jul 04 06:47:51 2011)
    50.23.47.204 (Mon Jul 04 06:47:54 2011)
    50.23.47.204 (Mon Jul 04 06:47:58 2011)
    50.23.47.204 (Mon Jul 04 06:48:01 2011)
    50.23.47.204 (Mon Jul 04 06:48:04 2011)
    50.23.47.204 (Mon Jul 04 06:48:07 2011)
    50.23.47.204 (Mon Jul 04 06:48:11 2011)
    50.23.47.204 (Mon Jul 04 06:48:14 2011)
    50.23.47.204 (Mon Jul 04 06:48:18 2011)
    50.23.47.204 (Mon Jul 04 06:48:21 2011)
    50.23.47.204 (Mon Jul 04 06:48:24 2011)
    50.23.47.204 (Mon Jul 04 06:48:28 2011)
    50.23.47.204 (Mon Jul 04 06:48:31 2011)
    50.23.47.204 (Mon Jul 04 06:48:35 2011)
    50.23.47.204 (Mon Jul 04 06:48:37 2011)
    50.23.47.204 (Mon Jul 04 06:48:41 2011)
    50.23.47.204 (Mon Jul 04 06:48:45 2011)
    50.23.47.204 (Mon Jul 04 06:48:48 2011)
    50.23.47.204 (Mon Jul 04 06:48:51 2011)
    50.23.47.204 (Mon Jul 04 06:48:54 2011)
    50.23.47.204 (Mon Jul 04 06:48:57 2011)
    50.23.47.204 (Mon Jul 04 06:49:00 2011)
    50.23.47.204 (Mon Jul 04 06:49:04 2011)
    50.23.47.204 (Mon Jul 04 06:49:07 2011)
    50.23.47.204 (Mon Jul 04 06:49:10 2011)
    50.23.47.204 (Mon Jul 04 06:49:13 2011)
    50.23.47.204 (Mon Jul 04 06:49:17 2011)
    50.23.47.204 (Mon Jul 04 06:49:19 2011)
    50.23.47.204 (Mon Jul 04 06:49:23 2011)
    50.23.47.204 (Mon Jul 04 06:49:26 2011)
    50.23.47.204 (Mon Jul 04 06:49:29 2011)
    50.23.47.204 (Mon Jul 04 06:49:32 2011)
    50.23.47.204 (Mon Jul 04 06:49:35 2011)
    50.23.47.204 (Mon Jul 04 06:49:38 2011)
    50.23.47.204 (Mon Jul 04 06:49:42 2011)
    50.23.47.204 (Mon Jul 04 06:49:45 2011)
    50.23.47.204 (Mon Jul 04 06:49:48 2011)
    50.23.47.204 (Mon Jul 04 06:49:51 2011)
    50.23.47.204 (Mon Jul 04 06:49:54 2011)
    50.23.47.204 (Mon Jul 04 06:49:58 2011)
    50.23.47.204 (Mon Jul 04 06:50:01 2011)
    50.23.47.204 (Mon Jul 04 06:50:05 2011)
    50.23.47.204 (Mon Jul 04 06:50:08 2011)
    50.23.47.204 (Mon Jul 04 06:50:11 2011)
    50.23.47.204 (Mon Jul 04 06:50:14 2011)
    50.23.47.204 (Mon Jul 04 06:50:18 2011)
    50.23.47.204 (Mon Jul 04 06:50:21 2011)
    50.23.47.204 (Mon Jul 04 06:50:24 2011)
    50.23.47.204 (Mon Jul 04 06:50:27 2011)
    50.23.47.204 (Mon Jul 04 06:50:30 2011)
    50.23.47.204 (Mon Jul 04 06:50:33 2011)
    50.23.47.204 (Mon Jul 04 06:50:36 2011)
    50.23.47.204 (Mon Jul 04 06:50:40 2011)
    50.23.47.204 (Mon Jul 04 06:50:43 2011)
    50.23.47.204 (Mon Jul 04 06:50:47 2011)
    50.23.47.204 (Mon Jul 04 06:50:50 2011)
    50.23.47.204 (Mon Jul 04 06:50:54 2011)
    50.23.47.204 (Mon Jul 04 06:50:58 2011)
    50.23.47.204 (Mon Jul 04 06:51:01 2011)
    50.23.47.204 (Mon Jul 04 06:51:04 2011)
    50.23.47.204 (Mon Jul 04 06:51:07 2011)
    50.23.47.204 (Mon Jul 04 06:51:11 2011)
    50.23.47.204 (Mon Jul 04 06:51:14 2011)
    50.23.47.204 (Mon Jul 04 06:51:18 2011)
    50.23.47.204 (Mon Jul 04 06:51:22 2011)
    50.23.47.204 (Mon Jul 04 06:51:25 2011)
    50.23.47.204 (Mon Jul 04 06:51:28 2011)
    50.23.47.204 (Mon Jul 04 06:51:32 2011)
    50.23.47.204 (Mon Jul 04 06:51:35 2011)
    50.23.47.204 (Mon Jul 04 06:51:38 2011)
    50.23.47.204 (Mon Jul 04 06:51:42 2011)
    50.23.47.204 (Mon Jul 04 06:51:45 2011)
    50.23.47.204 (Mon Jul 04 06:51:48 2011)
    50.23.47.204 (Mon Jul 04 06:51:52 2011)
    50.23.47.204 (Mon Jul 04 06:51:55 2011)
    50.23.47.204 (Mon Jul 04 06:51:58 2011)
    50.23.47.204 (Mon Jul 04 06:52:02 2011)
    50.23.47.204 (Mon Jul 04 06:52:05 2011)
    50.23.47.204 (Mon Jul 04 06:52:09 2011)
    50.23.47.204 (Mon Jul 04 06:52:12 2011)
    50.23.47.204 (Mon Jul 04 06:52:15 2011)
    50.23.47.204 (Mon Jul 04 06:52:19 2011)
    50.23.47.204 (Mon Jul 04 06:52:23 2011)
    50.23.47.204 (Mon Jul 04 06:52:26 2011)
    50.23.47.204 (Mon Jul 04 06:52:30 2011)
    50.23.47.204 (Mon Jul 04 06:52:33 2011)
    50.23.47.204 (Mon Jul 04 06:52:36 2011)
    50.23.47.204 (Mon Jul 04 06:52:40 2011)
    50.23.47.204 (Mon Jul 04 06:52:43 2011)
    50.23.47.204 (Mon Jul 04 06:52:47 2011)
    50.23.47.204 (Mon Jul 04 06:52:51 2011)
    50.23.47.204 (Mon Jul 04 06:52:54 2011)
    50.23.47.204 (Mon Jul 04 06:52:57 2011)
    50.23.47.204 (Mon Jul 04 06:53:01 2011)
    50.23.47.204 (Mon Jul 04 06:53:04 2011)
    50.23.47.204 (Mon Jul 04 06:53:07 2011)
    50.23.47.204 (Mon Jul 04 06:53:10 2011)
    50.23.47.204 (Mon Jul 04 06:53:14 2011)
    50.23.47.204 (Mon Jul 04 06:53:18 2011)
    50.23.47.204 (Mon Jul 04 06:53:21 2011)
    50.23.47.204 (Mon Jul 04 06:53:25 2011)
    50.23.47.204 (Mon Jul 04 06:53:28 2011)
    50.23.47.204 (Mon Jul 04 06:53:32 2011)
    50.23.47.204 (Mon Jul 04 06:53:36 2011)
    50.23.47.204 (Mon Jul 04 06:53:39 2011)
    50.23.47.204 (Mon Jul 04 06:53:42 2011)
    50.23.47.204 (Mon Jul 04 06:53:45 2011)
    50.23.47.204 (Mon Jul 04 06:53:48 2011)
    50.23.47.204 (Mon Jul 04 06:53:52 2011)
    50.23.47.204 (Mon Jul 04 06:53:55 2011)
    50.23.47.204 (Mon Jul 04 06:53:58 2011)
    50.23.47.204 (Mon Jul 04 06:54:02 2011)
    50.23.47.204 (Mon Jul 04 06:54:05 2011)
    50.23.47.204 (Mon Jul 04 06:54:09 2011)
    50.23.47.204 (Mon Jul 04 06:54:12 2011)
    50.23.47.204 (Mon Jul 04 06:54:15 2011)
    50.23.47.204 (Mon Jul 04 06:54:19 2011)
    50.23.47.204 (Mon Jul 04 06:54:22 2011)
    50.23.47.204 (Mon Jul 04 06:54:26 2011)
    50.23.47.204 (Mon Jul 04 06:54:29 2011)
    50.23.47.204 (Mon Jul 04 06:54:33 2011)
    50.23.47.204 (Mon Jul 04 06:54:37 2011)
    50.23.47.204 (Mon Jul 04 06:54:39 2011)
    50.23.47.204 (Mon Jul 04 06:54:42 2011)
    50.23.47.204 (Mon Jul 04 06:54:46 2011)
    50.23.47.204 (Mon Jul 04 06:54:49 2011)
    50.23.47.204 (Mon Jul 04 06:54:52 2011)
    50.23.47.204 (Mon Jul 04 06:54:56 2011)
    50.23.47.204 (Mon Jul 04 06:54:58 2011)
    50.23.47.204 (Mon Jul 04 06:55:02 2011)
    50.23.47.204 (Mon Jul 04 06:55:05 2011)
    50.23.47.204 (Mon Jul 04 06:55:09 2011)
    50.23.47.204 (Mon Jul 04 06:55:12 2011)
    50.23.47.204 (Mon Jul 04 06:55:15 2011)
    50.23.47.204 (Mon Jul 04 06:55:18 2011)
    50.23.47.204 (Mon Jul 04 06:55:21 2011)
    50.23.47.204 (Mon Jul 04 06:55:24 2011)
    50.23.47.204 (Mon Jul 04 06:55:27 2011)
    50.23.47.204 (Mon Jul 04 06:55:30 2011)
    50.23.47.204 (Mon Jul 04 06:55:33 2011)
    50.23.47.204 (Mon Jul 04 06:55:36 2011)
    50.23.47.204 (Mon Jul 04 06:55:38 2011)
    50.23.47.204 (Mon Jul 04 06:55:42 2011)
    50.23.47.204 (Mon Jul 04 06:55:45 2011)
    50.23.47.204 (Mon Jul 04 06:55:48 2011)
    50.23.47.204 (Mon Jul 04 06:55:51 2011)
    50.23.47.204 (Mon Jul 04 06:55:54 2011)
    50.23.47.204 (Mon Jul 04 06:55:57 2011)
    50.23.47.204 (Mon Jul 04 06:56:00 2011)
    50.23.47.204 (Mon Jul 04 06:56:03 2011)
    50.23.47.204 (Mon Jul 04 06:56:06 2011)
    50.23.47.204 (Mon Jul 04 06:56:10 2011)
    50.23.47.204 (Mon Jul 04 06:56:13 2011)
    50.23.47.204 (Mon Jul 04 06:56:16 2011)
    50.23.47.204 (Mon Jul 04 06:56:19 2011)
    50.23.47.204 (Mon Jul 04 06:56:22 2011)
    50.23.47.204 (Mon Jul 04 06:56:25 2011)
    50.23.47.204 (Mon Jul 04 06:56:28 2011)
    50.23.47.204 (Mon Jul 04 06:56:32 2011)
    50.23.47.204 (Mon Jul 04 06:56:34 2011)
    50.23.47.204 (Mon Jul 04 06:56:38 2011)
    50.23.47.204 (Mon Jul 04 06:56:41 2011)
    50.23.47.204 (Mon Jul 04 06:56:44 2011)
    50.23.47.204 (Mon Jul 04 06:56:47 2011)
    50.23.47.204 (Mon Jul 04 06:56:51 2011)
    50.23.47.204 (Mon Jul 04 06:56:54 2011)
    50.23.47.204 (Mon Jul 04 06:56:57 2011)
    50.23.47.204 (Mon Jul 04 06:57:01 2011)
    50.23.47.204 (Mon Jul 04 06:57:04 2011)
    50.23.47.204 (Mon Jul 04 06:57:07 2011)
    50.23.47.204 (Mon Jul 04 06:57:10 2011)
    50.23.47.204 (Mon Jul 04 06:57:14 2011)
    50.23.47.204 (Mon Jul 04 06:57:17 2011)
    50.23.47.204 (Mon Jul 04 06:57:20 2011)
    50.23.47.204 (Mon Jul 04 06:57:23 2011)
    50.23.47.204 (Mon Jul 04 06:57:27 2011)
    50.23.47.204 (Mon Jul 04 06:57:30 2011)
    50.23.47.204 (Mon Jul 04 06:57:34 2011)
    50.23.47.204 (Mon Jul 04 06:57:38 2011)
    50.23.47.204 (Mon Jul 04 06:57:40 2011)
    50.23.47.204 (Mon Jul 04 06:57:43 2011)
    50.23.47.204 (Mon Jul 04 06:57:47 2011)
    50.23.47.204 (Mon Jul 04 06:57:50 2011)
    50.23.47.204 (Mon Jul 04 06:57:53 2011)
    50.23.47.204 (Mon Jul 04 06:57:57 2011)
    50.23.47.204 (Mon Jul 04 06:58:00 2011)
    50.23.47.204 (Mon Jul 04 06:58:03 2011)
    50.23.47.204 (Mon Jul 04 06:58:07 2011)
    50.23.47.204 (Mon Jul 04 06:58:10 2011)
    50.23.47.204 (Mon Jul 04 06:58:13 2011)
    50.23.47.204 (Mon Jul 04 06:58:17 2011)
    50.23.47.204 (Mon Jul 04 06:58:21 2011)
    50.23.47.204 (Mon Jul 04 06:58:24 2011)
    50.23.47.204 (Mon Jul 04 06:58:28 2011)
    50.23.47.204 (Mon Jul 04 06:58:31 2011)
    50.23.47.204 (Mon Jul 04 06:58:34 2011)
    50.23.47.204 (Mon Jul 04 06:58:38 2011)
    50.23.47.204 (Mon Jul 04 06:58:41 2011)
    50.23.47.204 (Mon Jul 04 06:58:45 2011)
    50.23.47.204 (Mon Jul 04 06:58:48 2011)
    50.23.47.204 (Mon Jul 04 06:58:52 2011)
    50.23.47.204 (Mon Jul 04 06:58:56 2011)
    50.23.47.204 (Mon Jul 04 06:58:59 2011)
    50.23.47.204 (Mon Jul 04 06:59:03 2011)
    50.23.47.204 (Mon Jul 04 06:59:06 2011)
    50.23.47.204 (Mon Jul 04 06:59:10 2011)
    50.23.47.204 (Mon Jul 04 06:59:13 2011)
    50.23.47.204 (Mon Jul 04 06:59:16 2011)
    50.23.47.204 (Mon Jul 04 06:59:20 2011)
    50.23.47.204 (Mon Jul 04 06:59:23 2011)
    50.23.47.204 (Mon Jul 04 06:59:27 2011)
    50.23.47.204 (Mon Jul 04 06:59:30 2011)
    50.23.47.204 (Mon Jul 04 06:59:34 2011)
    50.23.47.204 (Mon Jul 04 06:59:38 2011)
    50.23.47.204 (Mon Jul 04 06:59:42 2011)
    50.23.47.204 (Mon Jul 04 06:59:45 2011)
    50.23.47.204 (Mon Jul 04 06:59:49 2011)
    50.23.47.204 (Mon Jul 04 06:59:52 2011)
    50.23.47.204 (Mon Jul 04 06:59:56 2011)
    50.23.47.204 (Mon Jul 04 06:59:59 2011)
    50.23.47.204 (Mon Jul 04 07:00:03 2011)
    50.23.47.204 (Mon Jul 04 07:00:06 2011)
    50.23.47.204 (Mon Jul 04 07:00:10 2011)
    50.23.47.204 (Mon Jul 04 07:00:13 2011)
    50.23.47.204 (Mon Jul 04 07:00:17 2011)
    50.23.47.204 (Mon Jul 04 07:00:20 2011)
    50.23.47.204 (Mon Jul 04 07:00:24 2011)
    50.23.47.204 (Mon Jul 04 07:00:28 2011)
    50.23.47.204 (Mon Jul 04 07:00:31 2011)
    50.23.47.204 (Mon Jul 04 07:00:35 2011)
    50.23.47.204 (Mon Jul 04 07:00:38 2011)
    50.23.47.204 (Mon Jul 04 07:00:41 2011)
    50.23.47.204 (Mon Jul 04 07:00:44 2011)
    50.23.47.204 (Mon Jul 04 07:00:47 2011)
    50.23.47.204 (Mon Jul 04 07:00:51 2011)
    50.23.47.204 (Mon Jul 04 07:00:55 2011)
    50.23.47.204 (Mon Jul 04 07:00:58 2011)
    50.23.47.204 (Mon Jul 04 07:01:02 2011)
    50.23.47.204 (Mon Jul 04 07:01:05 2011)
    50.23.47.204 (Mon Jul 04 07:01:08 2011)
    50.23.47.204 (Mon Jul 04 07:01:11 2011)
    50.23.47.204 (Mon Jul 04 07:01:15 2011)
    50.23.47.204 (Mon Jul 04 07:01:18 2011)
    50.23.47.204 (Mon Jul 04 07:01:22 2011)
    50.23.47.204 (Mon Jul 04 07:01:25 2011)
    50.23.47.204 (Mon Jul 04 07:01:28 2011)
    50.23.47.204 (Mon Jul 04 07:01:31 2011)
    50.23.47.204 (Mon Jul 04 07:01:34 2011)
    50.23.47.204 (Mon Jul 04 07:01:38 2011)
    50.23.47.204 (Mon Jul 04 07:01:41 2011)
    50.23.47.204 (Mon Jul 04 07:01:45 2011)
    50.23.47.204 (Mon Jul 04 07:01:48 2011)
    50.23.47.204 (Mon Jul 04 07:01:51 2011)
    50.23.47.204 (Mon Jul 04 07:01:54 2011)
    50.23.47.204 (Mon Jul 04 07:01:58 2011)
    50.23.47.204 (Mon Jul 04 07:02:01 2011)
    50.23.47.204 (Mon Jul 04 07:02:04 2011)
    50.23.47.204 (Mon Jul 04 07:02:07 2011)
    50.23.47.204 (Mon Jul 04 07:02:10 2011)
    50.23.47.204 (Mon Jul 04 07:02:13 2011)
    50.23.47.204 (Mon Jul 04 07:02:16 2011)
    50.23.47.204 (Mon Jul 04 07:02:20 2011)
    50.23.47.204 (Mon Jul 04 07:02:23 2011)
    50.23.47.204 (Mon Jul 04 07:02:27 2011)
    50.23.47.204 (Mon Jul 04 07:02:30 2011)
    50.23.47.204 (Mon Jul 04 07:02:33 2011)
    50.23.47.204 (Mon Jul 04 07:02:36 2011)
    50.23.47.204 (Mon Jul 04 07:02:39 2011)
    50.23.47.204 (Mon Jul 04 07:02:43 2011)
    50.23.47.204 (Mon Jul 04 07:02:46 2011)
    50.23.47.204 (Mon Jul 04 07:02:49 2011)
    50.23.47.204 (Mon Jul 04 07:02:52 2011)
    50.23.47.204 (Mon Jul 04 07:02:55 2011)
    50.23.47.204 (Mon Jul 04 07:02:58 2011)
    50.23.47.204 (Mon Jul 04 07:03:01 2011)
    50.23.47.204 (Mon Jul 04 07:03:04 2011)
    50.23.47.204 (Mon Jul 04 07:03:07 2011)
    50.23.47.204 (Mon Jul 04 07:03:10 2011)
    50.23.47.204 (Mon Jul 04 07:03:14 2011)
    50.23.47.204 (Mon Jul 04 07:03:17 2011)
    50.23.47.204 (Mon Jul 04 07:03:21 2011)
    50.23.47.204 (Mon Jul 04 07:03:24 2011)
    50.23.47.204 (Mon Jul 04 07:03:28 2011)
    50.23.47.204 (Mon Jul 04 07:03:32 2011)
    50.23.47.204 (Mon Jul 04 07:03:35 2011)
    50.23.47.204 (Mon Jul 04 07:03:38 2011)
    50.23.47.204 (Mon Jul 04 07:03:41 2011)
    50.23.47.204 (Mon Jul 04 07:03:45 2011)
    50.23.47.204 (Mon Jul 04 07:03:48 2011)
    50.23.47.204 (Mon Jul 04 07:03:52 2011)
    50.23.47.204 (Mon Jul 04 07:03:56 2011)
    50.23.47.204 (Mon Jul 04 07:03:59 2011)
    50.23.47.204 (Mon Jul 04 07:04:03 2011)
    50.23.47.204 (Mon Jul 04 07:04:06 2011)
    50.23.47.204 (Mon Jul 04 07:04:10 2011)
    50.23.47.204 (Mon Jul 04 07:04:14 2011)
    50.23.47.204 (Mon Jul 04 07:04:17 2011)
    50.23.47.204 (Mon Jul 04 07:04:20 2011)
    50.23.47.204 (Mon Jul 04 07:04:23 2011)
    50.23.47.204 (Mon Jul 04 07:04:27 2011)
    50.23.47.204 (Mon Jul 04 07:04:30 2011)
    50.23.47.204 (Mon Jul 04 07:04:35 2011)
    50.23.47.204 (Mon Jul 04 07:04:38 2011)
    50.23.47.204 (Mon Jul 04 07:04:41 2011)
    50.23.47.204 (Mon Jul 04 07:04:45 2011)
    50.23.47.204 (Mon Jul 04 07:04:48 2011)
    50.23.47.204 (Mon Jul 04 07:04:52 2011)
    50.23.47.204 (Mon Jul 04 07:04:56 2011)
    50.23.47.204 (Mon Jul 04 07:04:59 2011)
    50.23.47.204 (Mon Jul 04 07:05:02 2011)
    50.23.47.204 (Mon Jul 04 07:05:05 2011)
    50.23.47.204 (Mon Jul 04 07:05:09 2011)
    50.23.47.204 (Mon Jul 04 07:05:12 2011)
    50.23.47.204 (Mon Jul 04 07:05:16 2011)
    50.23.47.204 (Mon Jul 04 07:05:20 2011)
    50.23.47.204 (Mon Jul 04 07:05:24 2011)
    50.23.47.204 (Mon Jul 04 07:05:28 2011)
    50.23.47.204 (Mon Jul 04 07:05:31 2011)
    50.23.47.204 (Mon Jul 04 07:05:35 2011)
    50.23.47.204 (Mon Jul 04 07:05:39 2011)
    50.23.47.204 (Mon Jul 04 07:05:42 2011)
    50.23.47.204 (Mon Jul 04 07:05:46 2011)
    50.23.47.204 (Mon Jul 04 07:05:49 2011)
    50.23.47.204 (Mon Jul 04 07:05:52 2011)
    50.23.47.204 (Mon Jul 04 07:05:55 2011)
    50.23.47.204 (Mon Jul 04 07:05:59 2011)
    50.23.47.204 (Mon Jul 04 07:06:03 2011)
    50.23.47.204 (Mon Jul 04 07:06:06 2011)
    50.23.47.204 (Mon Jul 04 07:06:10 2011)
    50.23.47.204 (Mon Jul 04 07:06:14 2011)
    50.23.47.204 (Mon Jul 04 07:06:17 2011)
    50.23.47.204 (Mon Jul 04 07:06:21 2011)
    50.23.47.204 (Mon Jul 04 07:06:24 2011)
    50.23.47.204 (Mon Jul 04 07:06:28 2011)
    50.23.47.204 (Mon Jul 04 07:06:31 2011)
    50.23.47.204 (Mon Jul 04 07:06:34 2011)
    50.23.47.204 (Mon Jul 04 07:06:37 2011)
    50.23.47.204 (Mon Jul 04 07:06:41 2011)
    50.23.47.204 (Mon Jul 04 07:06:44 2011)
    50.23.47.204 (Mon Jul 04 07:06:47 2011)
    50.23.47.204 (Mon Jul 04 07:06:51 2011)
    50.23.47.204 (Mon Jul 04 07:06:54 2011)
    50.23.47.204 (Mon Jul 04 07:06:57 2011)
    50.23.47.204 (Mon Jul 04 07:07:01 2011)
    50.23.47.204 (Mon Jul 04 07:07:04 2011)
    50.23.47.204 (Mon Jul 04 07:07:07 2011)
    50.23.47.204 (Mon Jul 04 07:07:10 2011)
    50.23.47.204 (Mon Jul 04 07:07:14 2011)
    50.23.47.204 (Mon Jul 04 07:07:17 2011)

Date template hits:
4120 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/MONTH/Year:Hour:Minute:Second
0 hit(s): Month/Day/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond]
0 hit(s): Day-Month-Year Hour:Minute:Second
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
0 hit(s): Hour:Minute:Second
0 hit(s): <Month/Day/Year@Hour:Minute:Second>

Success, the total number of match is 1028

However, look at the above section 'Running tests' which could contain important
information.

Bad thing!

Comment 32 Eddie Lania 2011-07-20 14:16:21 UTC

Sorry for comment #31, it is related to fail2ban but a complete different issue.

Comment 33 Fedora End Of Life 2012-08-16 16:44:30 UTC

This message is a notice that Fedora 14 is now at end of life. Fedora 
has stopped maintaining and issuing updates for Fedora 14. It is 
Fedora's policy to close all bug reports from releases that are no 
longer maintained.  At this time, all open bugs with a Fedora 'version'
of '14' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this 
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen 
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we were unable to fix it before Fedora 14 reached end of life. If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora, you are encouraged to click on 
"Clone This Bug" (top right of this page) and open it against that 
version of Fedora.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping