From 0f748184b81f017cdeeec65e9949ad3068c48284 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Wed, 18 Oct 2023 13:14:35 -0600 Subject: [PATCH] Add rsyslog filter for TLS connections --- config/filter.d/rsyslog.conf | 24 ++++++++++++++++++++++++ config/jail.conf | 4 ++++ fail2ban/tests/files/logs/rsyslog | 17 +++++++++++++++++ 3 files changed, 45 insertions(+) create mode 100644 config/filter.d/rsyslog.conf create mode 100644 fail2ban/tests/files/logs/rsyslog diff --git a/config/filter.d/rsyslog.conf b/config/filter.d/rsyslog.conf new file mode 100644 index 00000000..6b443630 --- /dev/null +++ b/config/filter.d/rsyslog.conf @@ -0,0 +1,24 @@ +# Fail2Ban filter for rsyslog +# + +[INCLUDES] + +# Read common prefixes. If any customizations available -- read them from +# common.local +before = common.conf + +[DEFAULT] + +_daemon = rsyslogd + +[Definition] + +failregex = ^(?P<__prefix>%(__prefix_line)s)(?:gnutls returned error on handshake|peer did not provide a certificate).*^(?P=__prefix)netstream session \S+ from will be closed due to error + +ignoreregex = + +maxlines = 3 + +journalmatch = _SYSTEMD_UNIT=rsyslog.service + _COMM=rsyslogd +# +# Author: Orion Poplawski (@opoplawski) diff --git a/config/jail.conf b/config/jail.conf index edf3e676..77f08d02 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -993,3 +993,7 @@ logpath = %(syslog_daemon)s [proxmox] port = https,http,8006 logpath = /var/log/daemon.log + +[rsyslog] +port = 6514 +logpath = %(syslog_daemon)s diff --git a/fail2ban/tests/files/logs/rsyslog b/fail2ban/tests/files/logs/rsyslog new file mode 100644 index 00000000..0aeabf9a --- /dev/null +++ b/fail2ban/tests/files/logs/rsyslog @@ -0,0 +1,17 @@ +# This is normal closing of connection +# failJSON: { "match": false } +Oct 15 12:31:31 localhost.localdomain rsyslogd[284640]: unexpected GnuTLS error -54 in nsd_gtls.c:612: Error in the pull function. [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2078 ] +# failJSON: { "match": false } +Oct 15 12:31:31 localhost.localdomain rsyslogd[284640]: netstream session 0x7f97d00021e0 from 73.189.107.42 will be closed due to error [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2078 ] +# This is failed connection +# failJSON: { "match": false } +Oct 15 15:15:20 localhost.localdomain rsyslogd[284640]: peer did not provide a certificate, not permitted to talk to it [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2085 ] +# failJSON: { "time": "2004-10-15T15:15:20", "match": true , "host": "185.233.19.152" } +Oct 15 15:15:20 localhost.localdomain rsyslogd[284640]: netstream session 0x7f97d0061b70 from 185.233.19.152 will be closed due to error [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2089 ] +# This is failed connection +# failJSON: { "match": false } +Oct 15 15:15:20 localhost.localdomain rsyslogd[284640]: gnutls returned error on handshake: An unexpected TLS packet was received. [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2083 ] +# failJSON: { "match": false } +Oct 15 15:15:30 localhost.localdomain rsyslogd[284640]: GnuTLS handshake retry returned error: The TLS connection was non-properly terminated. [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2083 ] +# failJSON: { "time": "2004-10-15T15:15:30", "match": true , "host": "185.233.19.152" } +Oct 15 15:15:30 localhost.localdomain rsyslogd[284640]: netstream session 0x7f97d0036b00 from 185.233.19.152 will be closed due to error [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2089 ]