From 7e6964dd9d0a21cc2219591c628bfd68e8ec0726 Mon Sep 17 00:00:00 2001 From: Pablo Date: Thu, 15 Oct 2015 10:40:56 +0200 Subject: [PATCH 1/5] Fix section jail.conf.5 manpage The section of jail.conf manpage is wrong, should be 5, not 10 --- man/jail.conf.5 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/man/jail.conf.5 b/man/jail.conf.5 index 45eea040..957a04b4 100644 --- a/man/jail.conf.5 +++ b/man/jail.conf.5 @@ -1,4 +1,4 @@ -.TH JAIL.CONF "10" "October 2013" "Fail2Ban" "Fail2Ban Configuration" +.TH JAIL.CONF "5" "October 2013" "Fail2Ban" "Fail2Ban Configuration" .SH NAME jail.conf \- configuration for the fail2ban server .SH SYNOPSIS From 74fcb219ab6d17f365befeb10be99e7a9eb05e16 Mon Sep 17 00:00:00 2001 From: Pablo Rodriguez Fernandez Date: Mon, 19 Oct 2015 09:13:05 +0200 Subject: [PATCH 2/5] Enhanced Google domain detection in apache-fakegooglebot Previously, an attacker could fake a domain like crawl-1-1-1-1.googlebot.com.fake.net and get resolved. This change avoids to resolve fake Google domains. --- config/filter.d/ignorecommands/apache-fakegooglebot | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/ignorecommands/apache-fakegooglebot b/config/filter.d/ignorecommands/apache-fakegooglebot index 3028d86a..9e0f0d83 100755 --- a/config/filter.d/ignorecommands/apache-fakegooglebot +++ b/config/filter.d/ignorecommands/apache-fakegooglebot @@ -26,7 +26,7 @@ def is_googlebot(ip): from fail2ban.server.filter import DNSUtils host = DNSUtils.ipToName(ip) - if not host or not re.match('crawl-.*\.googlebot\.com', host): + if not host or not re.match('crawl-.*\.googlebot\.com$', host): sys.exit(1) host_ips = DNSUtils.dnsToIp(host) sys.exit(0 if ip in host_ips else 1) From 2c576c64f8192cad469bd839321c03bcc1f8113a Mon Sep 17 00:00:00 2001 From: Pablo Rodriguez Fernandez Date: Tue, 20 Oct 2015 10:37:07 +0200 Subject: [PATCH 3/5] Change domain filter regex Change domain filter regex since there are other Google crawlers. See "Google crawlers" --- ChangeLog | 3 +++ config/filter.d/ignorecommands/apache-fakegooglebot | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 2f5a158b..9449f2cd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -21,6 +21,7 @@ ver. 0.9.4 (2015/XX/XXX) - wanna-be-released * Treat failed and killed execution of commands identically (only different log messages), which addresses different behavior on different exit codes of dash and bash (gh-1155) + * Fix jail.conf.5 man's section (gh-1226) - New Features: @@ -34,6 +35,8 @@ ver. 0.9.4 (2015/XX/XXX) - wanna-be-released (Thanks M. Maraun) * Added check against atacker's Googlebot PTR fake records (Thanks Pablo Rodriguez Fernandez) + * Enhance filter against atacker's Googlebot PTR fake records + (gh-1226) ver. 0.9.3 (2015/08/01) - lets-all-stay-friends ---------- diff --git a/config/filter.d/ignorecommands/apache-fakegooglebot b/config/filter.d/ignorecommands/apache-fakegooglebot index 9e0f0d83..19fb5107 100755 --- a/config/filter.d/ignorecommands/apache-fakegooglebot +++ b/config/filter.d/ignorecommands/apache-fakegooglebot @@ -26,7 +26,7 @@ def is_googlebot(ip): from fail2ban.server.filter import DNSUtils host = DNSUtils.ipToName(ip) - if not host or not re.match('crawl-.*\.googlebot\.com$', host): + if not host or not re.match('.*\.google(bot)?\.com$', host): sys.exit(1) host_ips = DNSUtils.dnsToIp(host) sys.exit(0 if ip in host_ips else 1) From 2861a957a9ba691a44005673e90883fd1def1890 Mon Sep 17 00:00:00 2001 From: 1technophile Date: Sun, 25 Oct 2015 20:36:40 +0100 Subject: [PATCH 4/5] filter for openhab domotic software authentication failure with the rest api and web interface + test cases; closes gh-1223 --- config/filter.d/openhab.conf | 16 ++++++++++++++++ config/jail.conf | 6 ++++++ fail2ban/tests/files/logs/openhab | 11 +++++++++++ 3 files changed, 33 insertions(+) create mode 100644 config/filter.d/openhab.conf create mode 100644 fail2ban/tests/files/logs/openhab diff --git a/config/filter.d/openhab.conf b/config/filter.d/openhab.conf new file mode 100644 index 00000000..83857c7a --- /dev/null +++ b/config/filter.d/openhab.conf @@ -0,0 +1,16 @@ +# Openhab brute force auth filter: /etc/fail2ban/filter.d/openhab.conf: +# +# Block IPs trying to auth openhab by web or rest api +# +# Matches e.g. +# 12.34.33.22 - - [26/sept./2015:18:04:43 +0200] "GET /openhab.app HTTP/1.1" 401 1382 +# 175.18.15.10 - - [02/sept./2015:00:11:31 +0200] "GET /rest/bindings HTTP/1.1" 401 1384 + +[Definition] +failregex = ^\s+-\s+-\s+\[\]\s+"[A-Z]+ .*" 401 \d+\s*$ + +[Init] +datepattern = %%d/%%b[^/]*/%%Y:%%H:%%M:%%S %%z + + + diff --git a/config/jail.conf b/config/jail.conf index 7500f4ff..fd7f376e 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -306,6 +306,12 @@ port = http,https logpath = %(apache_error_log)s maxretry = 1 +[openhab-auth] + +filter = openhab +action = iptables-allports[name=NoAuthFailures] +logpath = /opt/openhab/logs/request.log + [nginx-http-auth] port = http,https diff --git a/fail2ban/tests/files/logs/openhab b/fail2ban/tests/files/logs/openhab new file mode 100644 index 00000000..983989a9 --- /dev/null +++ b/fail2ban/tests/files/logs/openhab @@ -0,0 +1,11 @@ +# should match +# failJSON: { "time": "2015-09-02T00:11:31", "match": true , "host": "175.18.15.10" } +175.18.15.10 - - [02/sept./2015:00:11:31 +0200] "GET /openhab.app HTTP/1.1" 401 1382 +# failJSON: { "time": "2015-09-02T00:11:31", "match": true , "host": "175.18.15.10" } +175.18.15.10 - - [02/sept./2015:00:11:31 +0200] "GET /rest/bindings HTTP/1.1" 401 1384 + +# Should not match +# failJSON: { "match": false } +175.18.15.11 - - [17/oct./2015:00:35:12 +0200] "GET /openhab.app?sitemap=default&poll=true&__async=true&__source=waHome HTTP/1.1" 200 92 +# failJSON: { "match": false } +175.18.15.11 - - [16/oct./2015:20:29:38 +0200] "GET /rest/sitemaps/default/maison HTTP/1.1" 200 2837 From eb87638eadbfe215f875675b0f2383222830f424 Mon Sep 17 00:00:00 2001 From: sebres Date: Mon, 26 Oct 2015 15:52:10 +0100 Subject: [PATCH 5/5] ChangeLog entry for OpenHAB home automation filter (gh-1223) --- ChangeLog | 2 ++ THANKS | 1 + 2 files changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 9449f2cd..391eabc6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -37,6 +37,8 @@ ver. 0.9.4 (2015/XX/XXX) - wanna-be-released (Thanks Pablo Rodriguez Fernandez) * Enhance filter against atacker's Googlebot PTR fake records (gh-1226) + * Added filter for openhab domotic software authentication failure with the + rest api and web interface (gh-1223) ver. 0.9.3 (2015/08/01) - lets-all-stay-friends ---------- diff --git a/THANKS b/THANKS index 45674847..47156d82 100644 --- a/THANKS +++ b/THANKS @@ -40,6 +40,7 @@ Eric Gerbier Enrico Labedzki Eugene Hopkinson (SlowRiot) ftoppi +Florian Robert (1technophile) François Boulogne Frantisek Sumsal Frédéric