From c55e9949dc96bf862c1e29540c24cbdf26050882 Mon Sep 17 00:00:00 2001 From: Aliaksandr Yurchyk Date: Mon, 16 Oct 2023 01:35:15 +0300 Subject: [PATCH 1/4] Fix issue with Mariadb 10.3 failed message --- config/filter.d/mysqld-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/mysqld-auth.conf b/config/filter.d/mysqld-auth.conf index 930c9b5a..2713f230 100644 --- a/config/filter.d/mysqld-auth.conf +++ b/config/filter.d/mysqld-auth.conf @@ -17,7 +17,7 @@ before = common.conf _daemon = mysqld -failregex = ^%(__prefix_line)s(?:(?:\d{6}|\d{4}-\d{2}-\d{2})[ T]\s?\d{1,2}:\d{2}:\d{2} )?(?:\d+ )?\[\w+\] (?:\[[^\]]+\] )*Access denied for user '[^']+'@'' (to database '[^']*'|\(using password: (YES|NO)\))*\s*$ +failregex = ^%(__prefix_line)s(?:(?:\d{6}|\d{4}-\d{2}-\d{2})[ T]\s?\d{1,2}:\d{2}:\d{2} )?(?:\d+ )?\[\w+\] (?:\[[^\]]+\] )*Access denied for user '[^']+'@''\s*(to database '[^']*'|\(using password: (YES|NO)\))*\s*$ ignoreregex = From 162f0c4b6c9dd4cd7a585c871943495dcbded626 Mon Sep 17 00:00:00 2001 From: Aliaksandr Yurchyk Date: Mon, 16 Oct 2023 01:45:43 +0300 Subject: [PATCH 2/4] Update mysqld-auth test file --- fail2ban/tests/files/logs/mysqld-auth | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fail2ban/tests/files/logs/mysqld-auth b/fail2ban/tests/files/logs/mysqld-auth index 29faeb71..fe60abb3 100644 --- a/fail2ban/tests/files/logs/mysqld-auth +++ b/fail2ban/tests/files/logs/mysqld-auth @@ -37,3 +37,6 @@ Sep 16 21:30:32 catinthehat mysqld: 130916 21:30:32 [Warning] Access denied for # filterOptions: [{"logtype": "file"}, {"logtype": "short"}, {"logtype": "journal"}] # failJSON: { "match": true , "host": "192.0.2.1", "user":"root", "desc": "mariadb 10.4 log format, gh-2611" } 2020-01-16 21:34:14 4644 [Warning] Access denied for user 'root'@'192.0.2.1' (using password: YES) + +# failJSON: { "match": true , "host": "192.0.2.1", "user":"root", "desc": "mariadb 10.3 log format" } +2020-01-16 21:34:14 4644 [Warning] Access denied for user 'root'@'192.0.2.1' From 7931b6732524450853dbaf0eb4a02904df8723f7 Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Mon, 16 Oct 2023 11:35:53 +0200 Subject: [PATCH 3/4] mysqld-auth.conf: better RE, optional suffix, non-capturing groups --- config/filter.d/mysqld-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/mysqld-auth.conf b/config/filter.d/mysqld-auth.conf index 2713f230..937cae65 100644 --- a/config/filter.d/mysqld-auth.conf +++ b/config/filter.d/mysqld-auth.conf @@ -17,7 +17,7 @@ before = common.conf _daemon = mysqld -failregex = ^%(__prefix_line)s(?:(?:\d{6}|\d{4}-\d{2}-\d{2})[ T]\s?\d{1,2}:\d{2}:\d{2} )?(?:\d+ )?\[\w+\] (?:\[[^\]]+\] )*Access denied for user '[^']+'@''\s*(to database '[^']*'|\(using password: (YES|NO)\))*\s*$ +failregex = ^%(__prefix_line)s(?:(?:\d{6}|\d{4}-\d{2}-\d{2})[ T]\s?\d{1,2}:\d{2}:\d{2} )?(?:\d+ )?\[\w+\] (?:\[[^\]]+\] )*Access denied for user '[^']+'@''(?:\s+(?:to database '[^']*'|\(?:using password: (?:YES|NO)\)){1,2})?\s*$ ignoreregex = From 183f805ae379c8340ba933c302b36e4a35ca5d36 Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Mon, 16 Oct 2023 11:41:05 +0200 Subject: [PATCH 4/4] amend --- config/filter.d/mysqld-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/mysqld-auth.conf b/config/filter.d/mysqld-auth.conf index 937cae65..421a26d5 100644 --- a/config/filter.d/mysqld-auth.conf +++ b/config/filter.d/mysqld-auth.conf @@ -17,7 +17,7 @@ before = common.conf _daemon = mysqld -failregex = ^%(__prefix_line)s(?:(?:\d{6}|\d{4}-\d{2}-\d{2})[ T]\s?\d{1,2}:\d{2}:\d{2} )?(?:\d+ )?\[\w+\] (?:\[[^\]]+\] )*Access denied for user '[^']+'@''(?:\s+(?:to database '[^']*'|\(?:using password: (?:YES|NO)\)){1,2})?\s*$ +failregex = ^%(__prefix_line)s(?:(?:\d{6}|\d{4}-\d{2}-\d{2})[ T]\s?\d{1,2}:\d{2}:\d{2} )?(?:\d+ )?\[\w+\] (?:\[[^\]]+\] )*Access denied for user '[^']+'@''(?:\s+(?:to database '[^']*'|\(using password: (?:YES|NO)\)){1,2})?\s*$ ignoreregex =