prehistoric-systems/fail2ban
1
0
Fork 0
mirror of https://github.com/fail2ban/fail2ban.git synced 2026-03-11 08:55:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add rsyslog filter for TLS connections

Browse source
This commit is contained in:
Orion Poplawski 2023-10-18 13:14:35 -06:00
parent 0bf1106d72
commit 0f748184b8
3 changed files with 45 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
config/filter.d/rsyslog.conf Normal file
View file

@ -0,0 +1,24 @@
# Fail2Ban filter for rsyslog
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf
[DEFAULT]
_daemon = rsyslogd
[Definition]
failregex = ^(?P<__prefix>%(__prefix_line)s)(?:gnutls returned error on handshake|peer did not provide a certificate).*<SKIPLINES>^(?P=__prefix)netstream session \S+ from <HOST> will be closed due to error
ignoreregex =
maxlines = 3
journalmatch = _SYSTEMD_UNIT=rsyslog.service + _COMM=rsyslogd
#
# Author: Orion Poplawski (@opoplawski)

4
config/jail.conf
View file

@ -993,3 +993,7 @@ logpath = %(syslog_daemon)s
[proxmox]
port = https,http,8006
logpath = /var/log/daemon.log
[rsyslog]
port = 6514
logpath = %(syslog_daemon)s

17
fail2ban/tests/files/logs/rsyslog Normal file
View file

@ -0,0 +1,17 @@
# This is normal closing of connection
# failJSON: { "match": false }
Oct 15 12:31:31 localhost.localdomain rsyslogd[284640]: unexpected GnuTLS error -54 in nsd_gtls.c:612: Error in the pull function. [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2078 ]
# failJSON: { "match": false }
Oct 15 12:31:31 localhost.localdomain rsyslogd[284640]: netstream session 0x7f97d00021e0 from 73.189.107.42 will be closed due to error [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2078 ]
# This is failed connection
# failJSON: { "match": false }
Oct 15 15:15:20 localhost.localdomain rsyslogd[284640]: peer did not provide a certificate, not permitted to talk to it [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2085 ]
# failJSON: { "time": "2004-10-15T15:15:20", "match": true , "host": "185.233.19.152" }
Oct 15 15:15:20 localhost.localdomain rsyslogd[284640]: netstream session 0x7f97d0061b70 from 185.233.19.152 will be closed due to error [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2089 ]
# This is failed connection
# failJSON: { "match": false }
Oct 15 15:15:20 localhost.localdomain rsyslogd[284640]: gnutls returned error on handshake: An unexpected TLS packet was received. [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2083 ]
# failJSON: { "match": false }
Oct 15 15:15:30 localhost.localdomain rsyslogd[284640]: GnuTLS handshake retry returned error: The TLS connection was non-properly terminated. [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2083 ]
# failJSON: { "time": "2004-10-15T15:15:30", "match": true , "host": "185.233.19.152" }
Oct 15 15:15:30 localhost.localdomain rsyslogd[284640]: netstream session 0x7f97d0036b00 from 185.233.19.152 will be closed due to error [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2089 ]