diff --git a/ChangeLog b/ChangeLog index 5e6e4b76..c3e9b5ee 100644 --- a/ChangeLog +++ b/ChangeLog @@ -24,8 +24,10 @@ ver. 0.8.7 (2012/07/31) - stable message stays non-unicode. Close gh-32 * [b257be4] added %m-%d-%Y pattern + do not add %Y for Feb 29 fix if already present in the pattern - * [47e956b] Replace "|" with "_" in ipmasq-ZZZzzz|fail2ban.rul to be + * [47e956b] replace "|" with "_" in ipmasq-ZZZzzz|fail2ban.rul to be friend to developers stuck with Windows (Closes gh-66) + * [80b191c] anchor grep regexp in actioncheck to not match partial names + of the jails (Closes: #672228) (Thanks Szépe Viktor for the report) - New features: François Boulogne * [a7cb20e..] add lighttpd-auth filter/jail @@ -65,6 +67,10 @@ ver. 0.8.7 (2012/07/31) - stable default with -v to control verbosity * [b4099da] adjusted header for config/*.conf to mention .local and way to comment (Thanks Stefano Forli for the note) + * [6ad55f6] added failregex for wu-ftpd to match against syslog instead + of DoS-prone auth.log's rhost (Closes: #514239) + * [2082fee] match possibly present "pam_unix(sshd:auth):" portion for + sshd filter (Closes: #648020) Yehuda Katz & Yaroslav Halchenko * [322f53e,bd40cc7] ./DEVELOP -- documentation for developers diff --git a/config/action.d/iptables-allports.conf b/config/action.d/iptables-allports.conf index 1cc2daba..f534fee9 100644 --- a/config/action.d/iptables-allports.conf +++ b/config/action.d/iptables-allports.conf @@ -29,7 +29,7 @@ actionstop = iptables -D -p -j fail2ban- # Notes.: command executed once before each actionban command # Values: CMD # -actioncheck = iptables -n -L | grep -q fail2ban- +actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Option: actionban # Notes.: command executed when banning an IP. Take care that the diff --git a/config/action.d/iptables-multiport.conf b/config/action.d/iptables-multiport.conf index ad554f5c..d062f74d 100644 --- a/config/action.d/iptables-multiport.conf +++ b/config/action.d/iptables-multiport.conf @@ -27,7 +27,7 @@ actionstop = iptables -D -p -m multiport --dports -j f # Notes.: command executed once before each actionban command # Values: CMD # -actioncheck = iptables -n -L | grep -q fail2ban- +actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Option: actionban # Notes.: command executed when banning an IP. Take care that the diff --git a/config/action.d/iptables-new.conf b/config/action.d/iptables-new.conf index c249de2d..92bd9a55 100644 --- a/config/action.d/iptables-new.conf +++ b/config/action.d/iptables-new.conf @@ -29,7 +29,7 @@ actionstop = iptables -D -m state --state NEW -p --dport | grep -q fail2ban- +actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Option: actionban # Notes.: command executed when banning an IP. Take care that the diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf index 09cfb98b..a846f971 100644 --- a/config/action.d/iptables.conf +++ b/config/action.d/iptables.conf @@ -27,7 +27,7 @@ actionstop = iptables -D -p --dport -j fail2ban- # Notes.: command executed once before each actionban command # Values: CMD # -actioncheck = iptables -n -L | grep -q fail2ban- +actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Option: actionban # Notes.: command executed when banning an IP. Take care that the diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index e838cecc..1da6e55d 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -30,7 +30,7 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* fro ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from \s*$ ^%(__prefix_line)sUser .+ from not allowed because not listed in AllowUsers\s*$ ^%(__prefix_line)sUser .+ from not allowed because listed in DenyUsers\s*$ - ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=(?:\s+user=.*)?\s*$ + ^%(__prefix_line)s(?:pam_unix\(sshd:auth\):\s)?authentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=(?:\s+user=.*)?\s*$ ^%(__prefix_line)srefused connect from \S+ \(\)\s*$ ^%(__prefix_line)sAddress .* POSSIBLE BREAK-IN ATTEMPT!*\s*$ ^%(__prefix_line)sUser .+ from not allowed because none of user's groups are listed in AllowGroups\s*$ diff --git a/config/filter.d/wuftpd.conf b/config/filter.d/wuftpd.conf index 56ba499f..6f266fb5 100644 --- a/config/filter.d/wuftpd.conf +++ b/config/filter.d/wuftpd.conf @@ -12,6 +12,7 @@ # Values: TEXT # failregex = wu-ftpd(?:\[\d+\])?:\s+\(pam_unix\)\s+authentication failure.* rhost=$ + wu-ftpd(?:\[\d+\])?: *failed login from .*\[\] *$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/config/jail.conf b/config/jail.conf index fa527757..ff0287a2 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -303,6 +303,6 @@ filter = recidive logpath = /var/log/fail2ban.log action = iptables-allports[name=recidive] sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log] -bantime = 604800 # 1 week -findtime = 86400 # 1 day +bantime = 604800 ; 1 week +findtime = 86400 ; 1 day maxretry = 5 diff --git a/testcases/files/logs/sshd b/testcases/files/logs/sshd index 216a595e..639aaf0b 100644 --- a/testcases/files/logs/sshd +++ b/testcases/files/logs/sshd @@ -27,3 +27,6 @@ Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but #8 DenyUsers https://github.com/fail2ban/fail2ban/issues/47 Apr 16 22:01:15 al-ribat sshd[5154]: User root from 46.45.128.3 not allowed because listed in DenyUsers + +# http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648020 +Nov 8 11:19:38 bar sshd[25427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.6 diff --git a/testcases/files/logs/wu-ftpd b/testcases/files/logs/wu-ftpd new file mode 100644 index 00000000..b6b41613 --- /dev/null +++ b/testcases/files/logs/wu-ftpd @@ -0,0 +1,2 @@ +# This login line is from syslog +Oct 6 09:59:26 myserver wu-ftpd[18760]: failed login from hj-145-173-a8.bta.net.cn [202.108.145.173]