From 5b2b680bfea74f5083c893677860e0d427faf475 Mon Sep 17 00:00:00 2001 From: benrubson Date: Thu, 2 May 2019 11:42:45 +0200 Subject: [PATCH 1/3] SSHd add Bad protocol version message --- config/filter.d/sshd.conf | 1 + fail2ban/tests/files/logs/sshd | 2 ++ 2 files changed, 3 insertions(+) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index 60efead7..418badbf 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -64,6 +64,7 @@ mdre-normal = mdrp-normal-suff-onclosed = (?:%(__suff)s|\s*)$ mdre-ddos = ^Did not receive identification string from + ^Bad protocol version identification '.*' from ^Connection reset by ^Connection closed by%(__authng_user)s %(__on_port_opt)s\s+\[preauth\]\s*$ ^SSH: Server;Ltype: (?:Authname|Version|Kex);Remote: -\d+;[A-Z]\w+: diff --git a/fail2ban/tests/files/logs/sshd b/fail2ban/tests/files/logs/sshd index e2b3d456..68e65901 100644 --- a/fail2ban/tests/files/logs/sshd +++ b/fail2ban/tests/files/logs/sshd @@ -260,6 +260,8 @@ Mar 7 18:53:38 bar sshd[1559]: Connection closed by 192.0.2.116 Jun 7 01:10:56 host sshd[5937]: Did not receive identification string from 69.61.56.114 # failJSON: { "time": "2005-06-07T01:11:57", "match": true , "host": "192.0.2.5", "desc": "refactored message (with port now, gh-2062)" } Jun 7 01:11:57 host sshd[8782]: Did not receive identification string from 192.0.2.5 port 35836 +# failJSON: { "time": "2005-06-07T01:11:58", "match": true , "host": "69.61.56.115" } +Jun 7 01:11:58 host sshd[8783]: Bad protocol version identification 'dummy string' from 69.61.56.115 port 31778 # gh-864(1): # failJSON: { "match": false } From a98315386d9155f721fc4e7892192ccea1d89f74 Mon Sep 17 00:00:00 2001 From: Ben RUBSON <6764151+benrubson@users.noreply.github.com> Date: Fri, 19 Jul 2019 17:59:16 +0200 Subject: [PATCH 2/3] Update zzz-sshd-obsolete-multiline.conf --- fail2ban/tests/config/filter.d/zzz-sshd-obsolete-multiline.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/fail2ban/tests/config/filter.d/zzz-sshd-obsolete-multiline.conf b/fail2ban/tests/config/filter.d/zzz-sshd-obsolete-multiline.conf index 98fca7f5..b158e347 100644 --- a/fail2ban/tests/config/filter.d/zzz-sshd-obsolete-multiline.conf +++ b/fail2ban/tests/config/filter.d/zzz-sshd-obsolete-multiline.conf @@ -56,6 +56,7 @@ cmnfailre = ^%(__prefix_line_sl)s[aA]uthentication (?:failure|error|failed) for mdre-normal = mdre-ddos = ^%(__prefix_line_sl)sDid not receive identification string from + ^%(__prefix_line_sl)sBad protocol version identification '.*' from ^%(__prefix_line_sl)sConnection closed by%(__authng_user)s %(__on_port_opt)s\s+\[preauth\]\s*$ ^%(__prefix_line_sl)sConnection reset by ^%(__prefix_line_ml1)sSSH: Server;Ltype: (?:Authname|Version|Kex);Remote: -\d+;[A-Z]\w+:.*%(__prefix_line_ml2)sRead from socket failed: Connection reset by peer%(__suff)s$ From eb308d0fc86709dbb638618c76d10f1bd23e57f2 Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Mon, 22 Jul 2019 11:50:01 +0200 Subject: [PATCH 3/3] add test for injection on version identification --- fail2ban/tests/files/logs/sshd | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fail2ban/tests/files/logs/sshd b/fail2ban/tests/files/logs/sshd index 68e65901..ffce2844 100644 --- a/fail2ban/tests/files/logs/sshd +++ b/fail2ban/tests/files/logs/sshd @@ -260,8 +260,10 @@ Mar 7 18:53:38 bar sshd[1559]: Connection closed by 192.0.2.116 Jun 7 01:10:56 host sshd[5937]: Did not receive identification string from 69.61.56.114 # failJSON: { "time": "2005-06-07T01:11:57", "match": true , "host": "192.0.2.5", "desc": "refactored message (with port now, gh-2062)" } Jun 7 01:11:57 host sshd[8782]: Did not receive identification string from 192.0.2.5 port 35836 -# failJSON: { "time": "2005-06-07T01:11:58", "match": true , "host": "69.61.56.115" } +# failJSON: { "time": "2005-06-07T01:11:58", "match": true , "host": "69.61.56.115", "desc": "bad protocol version, gh-2404" } Jun 7 01:11:58 host sshd[8783]: Bad protocol version identification 'dummy string' from 69.61.56.115 port 31778 +# failJSON: { "time": "2005-06-07T01:11:58", "match": true , "host": "69.61.56.115", "desc": "check inject on ident" } +Jun 7 01:11:58 host sshd[8783]: Bad protocol version identification 'dummy string' from 192.0.2.1' from 69.61.56.115 port 31778 # gh-864(1): # failJSON: { "match": false }