diff --git a/ChangeLog b/ChangeLog index e58bce06..d2bf5d42 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,8 @@ ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED * action.d/{route,shorewall}.conf - blocktype must be defined within [Init]. Closes gh-232 - New Features + Daniel Black and ykimon + * filter.d/3proxy filter added - Enhancements Yaroslav Halchenko * jail.conf -- assure all jails have actions and remove unused diff --git a/THANKS b/THANKS index ba33b766..9e151406 100644 --- a/THANKS +++ b/THANKS @@ -48,5 +48,6 @@ Tyler Vaclav Misek Vincent Deffontaines Yaroslav Halchenko +ykimon Yehuda Katz zugeschmiert diff --git a/config/filter.d/3proxy.conf b/config/filter.d/3proxy.conf new file mode 100644 index 00000000..f68ad44e --- /dev/null +++ b/config/filter.d/3proxy.conf @@ -0,0 +1,17 @@ +# Fail2Ban configuration file +# +# Author: Daniel Black +# +# Requested by ykimon in https://github.com/fail2ban/fail2ban/issues/246 +# + +[Definition] + +# Option: failregex +# Notes.: http://www.3proxy.ru/howtoe.asp#ERRORS that 1-9 are all authentication problems +# Log format is: "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T" +# Values: TEXT +# +failregex = \S+\s0000[1-9]\s\S+\s:[0-9]+\S+[0-9]+\s[0-9]+\s.*$ + +ignoreregex = diff --git a/config/jail.conf b/config/jail.conf index d3a23920..69197f5b 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -401,4 +401,10 @@ action = pf logpath = /var/log/sshd.log maxretry=5 +[3proxy] + +enabled = false +filter = 3proxy +action = iptables-multiport[name=3proxy, port=318, protocol=tcp] +logpath = /var/log/3proxy.log diff --git a/testcases/files/logs/3proxy b/testcases/files/logs/3proxy new file mode 100644 index 00000000..ff4774f3 --- /dev/null +++ b/testcases/files/logs/3proxy @@ -0,0 +1,2 @@ +11-06-2013 02:09:40 +0300 PROXY.3128 00004 - 1.2.3.4:28783 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1 +11-06-2013 02:09:43 +0300 PROXY.3128 00005 ewr 1.2.3.4:28788 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1