mirror of
https://github.com/fail2ban/fail2ban.git
synced 2026-03-11 08:55:31 +00:00
* Adjustsed failregex'es in non-iptables (shorewall, hostsdeny) example
files. That is to fix issue reported at http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6302
This commit is contained in:
Yaroslav Halchenko
parent
fb116326ec
commit
0a2a5b5ae0
5 changed files with 175 additions and 4 deletions
|
|
@ -1,3 +1,11 @@
|
|||
fail2ban (0.6.1-7bpo3) sarge-backports; urgency=low
|
||||
|
||||
* Adjustsed failregex'es in non-iptables (shorewall, hostsdeny) example
|
||||
files. That is to fix issue reported at
|
||||
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6302
|
||||
|
||||
-- Yaroslav Halchenko <debian@onerussian.com> Thu, 22 Feb 2007 20:26:10 -0500
|
||||
|
||||
fail2ban (0.6.1-7bpo2) sarge-backports; urgency=low
|
||||
|
||||
* Backported build of Debian package version 0.6.1-8 by pbuilder-ssh
|
||||
|
|
|
|||
|
|
@ -2,3 +2,5 @@
|
|||
00_vsftpd_regexp
|
||||
01_apache2_other
|
||||
02_sasl_section
|
||||
03_failregexes
|
||||
04_iptables-n
|
||||
|
|
|
|||
|
|
@ -5,14 +5,113 @@
|
|||
## DP: Added saslauthd section from martin f krafft <madduck@debian.org>
|
||||
|
||||
@DPATCH@
|
||||
|
||||
diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.iptables fail2ban-0.6.1.post/config/fail2ban.conf.iptables
|
||||
--- fail2ban-0.6.1.pre/config/fail2ban.conf.iptables 2006-05-30 10:03:16.000000000 -0400
|
||||
+++ fail2ban-0.6.1.post/config/fail2ban.conf.iptables 2006-05-30 10:13:56.000000000 -0400
|
||||
diff -urNad 0.6.1-8~/config/fail2ban.conf.hostsdeny 0.6.1-8/config/fail2ban.conf.hostsdeny
|
||||
--- 0.6.1-8~/config/fail2ban.conf.hostsdeny 2007-02-22 21:06:31.000000000 -0500
|
||||
+++ 0.6.1-8/config/fail2ban.conf.hostsdeny 2007-02-22 21:06:31.000000000 -0500
|
||||
@@ -215,6 +215,46 @@
|
||||
# failregex.
|
||||
|
||||
|
||||
+[SASL]
|
||||
+# Option: enabled
|
||||
+# Notes.: enable monitoring for this section.
|
||||
+# Values: [true | false] Default: true
|
||||
+#
|
||||
+enabled = false
|
||||
+
|
||||
+# Option: port
|
||||
+# Notes.: specifies port to monitor
|
||||
+# Values: [ NUM | STRING ] Default:
|
||||
+#
|
||||
+port = smtp
|
||||
+
|
||||
+# Option: logfile
|
||||
+# Notes.: logfile to monitor.
|
||||
+# Values: FILE Default: /var/log/auth.log
|
||||
+#
|
||||
+logfile = /var/log/mail.log
|
||||
+
|
||||
+# Option: timeregex
|
||||
+# Notes.: regex to match timestamp
|
||||
+# Values: [Mar 7 17:53:28]
|
||||
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+#
|
||||
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+
|
||||
+# Option: timepattern
|
||||
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
|
||||
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
+#
|
||||
+timepattern = %%b %%d %%H:%%M:%%S
|
||||
+
|
||||
+# Option: failregex
|
||||
+# Notes.: regex to match the password failures messages in the logfile.
|
||||
+# Values: TEXT Default:
|
||||
+#
|
||||
+failregex = : warning: [-._\w]+\[(?P<host>[.\d]+)\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
|
||||
+
|
||||
+
|
||||
[Apache]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
diff -urNad 0.6.1-8~/config/fail2ban.conf.iptables 0.6.1-8/config/fail2ban.conf.iptables
|
||||
--- 0.6.1-8~/config/fail2ban.conf.iptables 2007-02-22 21:06:31.000000000 -0500
|
||||
+++ 0.6.1-8/config/fail2ban.conf.iptables 2007-02-22 21:06:31.000000000 -0500
|
||||
@@ -260,6 +260,46 @@
|
||||
# failregex.
|
||||
|
||||
|
||||
+[SASL]
|
||||
+# Option: enabled
|
||||
+# Notes.: enable monitoring for this section.
|
||||
+# Values: [true | false] Default: true
|
||||
+#
|
||||
+enabled = false
|
||||
+
|
||||
+# Option: port
|
||||
+# Notes.: specifies port to monitor
|
||||
+# Values: [ NUM | STRING ] Default:
|
||||
+#
|
||||
+port = smtp
|
||||
+
|
||||
+# Option: logfile
|
||||
+# Notes.: logfile to monitor.
|
||||
+# Values: FILE Default: /var/log/auth.log
|
||||
+#
|
||||
+logfile = /var/log/mail.log
|
||||
+
|
||||
+# Option: timeregex
|
||||
+# Notes.: regex to match timestamp
|
||||
+# Values: [Mar 7 17:53:28]
|
||||
+# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+#
|
||||
+timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
|
||||
+
|
||||
+# Option: timepattern
|
||||
+# Notes.: format used in "timeregex" fields definition. Note that '%' must be
|
||||
+# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
|
||||
+# Values: TEXT Default: %%b %%d %%H:%%M:%%S
|
||||
+#
|
||||
+timepattern = %%b %%d %%H:%%M:%%S
|
||||
+
|
||||
+# Option: failregex
|
||||
+# Notes.: regex to match the password failures messages in the logfile.
|
||||
+# Values: TEXT Default:
|
||||
+#
|
||||
+failregex = : warning: [-._\w]+\[(?P<host>[.\d]+)\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
|
||||
+
|
||||
+
|
||||
[Apache]
|
||||
# Option: enabled
|
||||
# Notes.: enable monitoring for this section.
|
||||
diff -urNad 0.6.1-8~/config/fail2ban.conf.shorewall 0.6.1-8/config/fail2ban.conf.shorewall
|
||||
--- 0.6.1-8~/config/fail2ban.conf.shorewall 2007-02-22 21:06:31.000000000 -0500
|
||||
+++ 0.6.1-8/config/fail2ban.conf.shorewall 2007-02-22 21:06:31.000000000 -0500
|
||||
@@ -209,6 +209,46 @@
|
||||
# failregex.
|
||||
|
||||
|
||||
+[SASL]
|
||||
+# Option: enabled
|
||||
+# Notes.: enable monitoring for this section.
|
||||
|
|
|
|||
43
0.6.1-8/debian/patches/03_failregexes.dpatch
Executable file
43
0.6.1-8/debian/patches/03_failregexes.dpatch
Executable file
|
|
@ -0,0 +1,43 @@
|
|||
#! /bin/sh /usr/share/dpatch/dpatch-run
|
||||
## 03_failregexes.dpatch by Yaroslav Halchenko <debian@onerussian.com>
|
||||
##
|
||||
## All lines beginning with `## DP:' are a description of the patch.
|
||||
## DP: No description.
|
||||
|
||||
@DPATCH@
|
||||
diff -urNad 0.6.1-8~/config/fail2ban.conf.hostsdeny 0.6.1-8/config/fail2ban.conf.hostsdeny
|
||||
--- 0.6.1-8~/config/fail2ban.conf.hostsdeny 2007-02-22 19:49:33.000000000 -0500
|
||||
+++ 0.6.1-8/config/fail2ban.conf.hostsdeny 2007-02-22 21:14:08.000000000 -0500
|
||||
@@ -248,7 +248,7 @@
|
||||
# Notes.: regex to match the password failure messages in the logfile.
|
||||
# Values: TEXT Default: authentication failure|user .* not found
|
||||
#
|
||||
-failregex = authentication failure|user .* not found
|
||||
+failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
|
||||
|
||||
|
||||
[VSFTPD]
|
||||
@@ -324,4 +324,4 @@
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
-failregex = Authentication failure|Failed password|Invalid user
|
||||
+failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
|
||||
diff -urNad 0.6.1-8~/config/fail2ban.conf.shorewall 0.6.1-8/config/fail2ban.conf.shorewall
|
||||
--- 0.6.1-8~/config/fail2ban.conf.shorewall 2007-02-22 19:49:33.000000000 -0500
|
||||
+++ 0.6.1-8/config/fail2ban.conf.shorewall 2007-02-22 21:14:08.000000000 -0500
|
||||
@@ -242,7 +242,7 @@
|
||||
# Notes.: regex to match the password failure messages in the logfile.
|
||||
# Values: TEXT Default: authentication failure|user .* not found
|
||||
#
|
||||
-failregex = authentication failure|user .* not found
|
||||
+failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
|
||||
|
||||
[VSFTPD]
|
||||
# Option: enabled
|
||||
@@ -311,4 +311,4 @@
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
|
||||
#
|
||||
-failregex = Authentication failure|Failed password|Invalid user
|
||||
+failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
|
||||
19
0.6.1-8/debian/patches/04_iptables-n.dpatch
Executable file
19
0.6.1-8/debian/patches/04_iptables-n.dpatch
Executable file
|
|
@ -0,0 +1,19 @@
|
|||
#! /bin/sh /usr/share/dpatch/dpatch-run
|
||||
## 04_iptables-n.dpatch by Yaroslav Halchenko <debian@onerussian.com>
|
||||
##
|
||||
## All lines beginning with `## DP:' are a description of the patch.
|
||||
## DP: No description.
|
||||
|
||||
@DPATCH@
|
||||
diff -urNad 0.6.1-8~/config/fail2ban.conf.iptables 0.6.1-8/config/fail2ban.conf.iptables
|
||||
--- 0.6.1-8~/config/fail2ban.conf.iptables 2007-02-22 21:15:49.000000000 -0500
|
||||
+++ 0.6.1-8/config/fail2ban.conf.iptables 2007-02-22 21:17:07.000000000 -0500
|
||||
@@ -153,7 +153,7 @@
|
||||
# Notes.: command executed once before each fwban command
|
||||
# Values: CMD Default:
|
||||
#
|
||||
-fwcheck = iptables -L %(fwchain)s | grep -q fail2ban-%(__name__)s
|
||||
+fwcheck = iptables -n -L %(fwchain)s | grep -q fail2ban-%(__name__)s
|
||||
|
||||
# Option: fwban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
Loading…
Reference in a new issue