From 52f952e6454d12fbe31dbd53bf2220c8b7658610 Mon Sep 17 00:00:00 2001 From: ArndRa Date: Mon, 11 Feb 2013 17:14:29 +0100 Subject: [PATCH 1/5] Update config/jail.conf Update to use the new sogo-auth filter --- config/jail.conf | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/config/jail.conf b/config/jail.conf index 1817ebd5..215e5b9a 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -201,6 +201,20 @@ filter = roundcube-auth action = iptables[name=RoundCube, port="http,https"] logpath = /var/log/roundcube/userlogins + +# Monitor SOGo groupware server + +[sogo-iptables] + +enabled = false +filter = sogo-auth +port = http, https +# without proxy this would be: +# port = 20000 + +action = iptables[name=SOGo, port="http,https"] +logpath = /var/log/sogo/sogo.log + # Ban attackers that try to use PHP's URL-fopen() functionality # through GET/POST variables. - Experimental, with more than a year # of usage in production environments. From 35bf84abadfc633e33a36bdcb32586f652fdadf3 Mon Sep 17 00:00:00 2001 From: ArndRa Date: Mon, 11 Feb 2013 08:19:48 -0800 Subject: [PATCH 2/5] Create sogo-auth.conf Regexp works with SOGo 2.0.5 or newer, following new feature implemented here: http://www.sogo.nu/bugs/view.php?id=2229 --- config/filter.d/sogo-auth.conf | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 config/filter.d/sogo-auth.conf diff --git a/config/filter.d/sogo-auth.conf b/config/filter.d/sogo-auth.conf new file mode 100644 index 00000000..e4d29c23 --- /dev/null +++ b/config/filter.d/sogo-auth.conf @@ -0,0 +1,19 @@ +# /etc/fail2ban/filter.d/sogo.conf +# +# Fail2Ban configuration file +# By Arnd Brandes +# SOGo +# + +[Definition] +# Option: failregex +# Filter Ban in /var/log/sogo/sogo.log +# Note: the error log may contain multiple hosts, whereas the first one +# is the client and all others are poxys. We match the first one, only + +failregex = Login from '.*' for user '.*' might not have worked + +# Option: ignoreregex +# Notes.: regex to ignore. If this regex matches, the line is ignored. +# Values: TEXT +# From 6cd358ee95dbeef5a07af25ee028df5cfe543731 Mon Sep 17 00:00:00 2001 From: ArndRa Date: Tue, 12 Feb 2013 10:45:37 +0100 Subject: [PATCH 3/5] Update config/filter.d/sogo-auth.conf Comment line in the top altered to fit file name. My local file was named differently... --- config/filter.d/sogo-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/sogo-auth.conf b/config/filter.d/sogo-auth.conf index e4d29c23..6a1abd3f 100644 --- a/config/filter.d/sogo-auth.conf +++ b/config/filter.d/sogo-auth.conf @@ -1,4 +1,4 @@ -# /etc/fail2ban/filter.d/sogo.conf +# /etc/fail2ban/filter.d/sogo-auth.conf # # Fail2Ban configuration file # By Arnd Brandes From bba3fd85688a95b5c6bd95ae7c7fec6a524d47f8 Mon Sep 17 00:00:00 2001 From: ArndRa Date: Mon, 25 Mar 2013 08:43:13 +0100 Subject: [PATCH 4/5] Update sogo-auth.conf included hint by user yarikoptic --- config/filter.d/sogo-auth.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/config/filter.d/sogo-auth.conf b/config/filter.d/sogo-auth.conf index 6a1abd3f..6054c589 100644 --- a/config/filter.d/sogo-auth.conf +++ b/config/filter.d/sogo-auth.conf @@ -17,3 +17,4 @@ failregex = Login from '.*' for user '.*' might not have worked # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # +ignoreregex = From ebb6e5f4eba5be26af46e9abc6eb84f238126389 Mon Sep 17 00:00:00 2001 From: ArndRa Date: Mon, 25 Mar 2013 09:11:51 +0100 Subject: [PATCH 5/5] An example of failed logins against sogo --- testcases/files/logs/sogo-auth | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 testcases/files/logs/sogo-auth diff --git a/testcases/files/logs/sogo-auth b/testcases/files/logs/sogo-auth new file mode 100644 index 00000000..6dbe7356 --- /dev/null +++ b/testcases/files/logs/sogo-auth @@ -0,0 +1,15 @@ +Mar 24 08:58:32 sogod [26818]: <0x0xb8537990[LDAPSource]> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=hack0r,ou=users,dc=mail,dc=example,dc=org"; } +Mar 24 08:58:32 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'hack0r' might not have worked - password policy: 65535 grace: -1 expire: -1 bound: 0 +173.194.44.31 - - [24/Mar/2013:08:58:32 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/38 0.311 - - 2M +Mar 24 08:58:40 sogod [26818]: <0x0xb8537990[LDAPSource]> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=kiddy,ou=users,dc=mail,dc=example,dc=org"; } +Mar 24 08:58:40 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'kiddy' might not have worked - password policy: 65535 grace: -1 expire: -1 bound: 0 +173.194.44.31 - - [24/Mar/2013:08:58:40 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/37 0.007 - - 32K +Mar 24 08:58:50 sogod [26818]: <0x0xb8537990[LDAPSource]> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=plsBanMe,ou=users,dc=mail,dc=example,dc=org"; } +Mar 24 08:58:50 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'plsBanMe' might not have worked - password policy: 65535 grace: -1 expire: -1 bound: 0 +173.194.44.31 - - [24/Mar/2013:08:58:50 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/40 0.008 - - 0 +Mar 24 08:58:59 sogod [26818]: <0x0xb8537990[LDAPSource]> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=root,ou=users,dc=mail,dc=example,dc=org"; } +Mar 24 08:58:59 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'root' might not have worked - password policy: 65535 grace: -1 expire: -1 bound: 0 +173.194.44.31 - - [24/Mar/2013:08:58:59 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/36 0.007 - - 0 +Mar 24 08:59:04 sogod [26818]: <0x0xb8537990[LDAPSource]> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=admin,ou=users,dc=mail,dc=example,dc=org"; } +Mar 24 08:59:04 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'admin' might not have worked - password policy: 65535 grace: -1 expire: -1 bound: 0 +173.194.44.31 - - [24/Mar/2013:08:59:04 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/37 0.007 - - 0