From a3b242d6dd051c9d90cb9b8911eed40532655256 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 31 Jul 2012 14:05:42 -0400 Subject: [PATCH 1/7] BF: inline comments must use ; not # -- recidive jail --- config/jail.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/jail.conf b/config/jail.conf index fa527757..ff0287a2 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -303,6 +303,6 @@ filter = recidive logpath = /var/log/fail2ban.log action = iptables-allports[name=recidive] sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log] -bantime = 604800 # 1 week -findtime = 86400 # 1 day +bantime = 604800 ; 1 week +findtime = 86400 ; 1 day maxretry = 5 From 80b191c7fddf5a6057c8bcdb7f9d5cd365deb5cc Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 31 Jul 2012 15:27:05 -0400 Subject: [PATCH 2/7] BF: anchor chain name in actioncheck's for iptables actions (Closes: #672228) --- config/action.d/iptables-allports.conf | 2 +- config/action.d/iptables-multiport.conf | 2 +- config/action.d/iptables-new.conf | 2 +- config/action.d/iptables.conf | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/action.d/iptables-allports.conf b/config/action.d/iptables-allports.conf index 1cc2daba..f534fee9 100644 --- a/config/action.d/iptables-allports.conf +++ b/config/action.d/iptables-allports.conf @@ -29,7 +29,7 @@ actionstop = iptables -D -p -j fail2ban- # Notes.: command executed once before each actionban command # Values: CMD # -actioncheck = iptables -n -L | grep -q fail2ban- +actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Option: actionban # Notes.: command executed when banning an IP. Take care that the diff --git a/config/action.d/iptables-multiport.conf b/config/action.d/iptables-multiport.conf index ad554f5c..d062f74d 100644 --- a/config/action.d/iptables-multiport.conf +++ b/config/action.d/iptables-multiport.conf @@ -27,7 +27,7 @@ actionstop = iptables -D -p -m multiport --dports -j f # Notes.: command executed once before each actionban command # Values: CMD # -actioncheck = iptables -n -L | grep -q fail2ban- +actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Option: actionban # Notes.: command executed when banning an IP. Take care that the diff --git a/config/action.d/iptables-new.conf b/config/action.d/iptables-new.conf index c249de2d..92bd9a55 100644 --- a/config/action.d/iptables-new.conf +++ b/config/action.d/iptables-new.conf @@ -29,7 +29,7 @@ actionstop = iptables -D -m state --state NEW -p --dport | grep -q fail2ban- +actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Option: actionban # Notes.: command executed when banning an IP. Take care that the diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf index 09cfb98b..a846f971 100644 --- a/config/action.d/iptables.conf +++ b/config/action.d/iptables.conf @@ -27,7 +27,7 @@ actionstop = iptables -D -p --dport -j fail2ban- # Notes.: command executed once before each actionban command # Values: CMD # -actioncheck = iptables -n -L | grep -q fail2ban- +actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' # Option: actionban # Notes.: command executed when banning an IP. Take care that the From a512ea47d283b292f8d2574e1251bba52fbdc986 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 31 Jul 2012 15:33:30 -0400 Subject: [PATCH 3/7] Adjusted changelog to reflect the last change --- ChangeLog | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 5e6e4b76..672a3fcd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -24,8 +24,10 @@ ver. 0.8.7 (2012/07/31) - stable message stays non-unicode. Close gh-32 * [b257be4] added %m-%d-%Y pattern + do not add %Y for Feb 29 fix if already present in the pattern - * [47e956b] Replace "|" with "_" in ipmasq-ZZZzzz|fail2ban.rul to be + * [47e956b] replace "|" with "_" in ipmasq-ZZZzzz|fail2ban.rul to be friend to developers stuck with Windows (Closes gh-66) + * [80b191c] anchor grep regexp in actioncheck to not match partial names + of the jails (Closes: #672228) (Thanks Szépe Viktor for the report) - New features: François Boulogne * [a7cb20e..] add lighttpd-auth filter/jail From 6ad55f64b3868c5810e684b6dd9a0a31cb03dcb6 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 31 Jul 2012 15:43:13 -0400 Subject: [PATCH 4/7] ENH: add wu-ftpd failregex for use against syslog (Closes: #514239) --- config/filter.d/wuftpd.conf | 1 + testcases/files/logs/wu-ftpd | 2 ++ 2 files changed, 3 insertions(+) create mode 100644 testcases/files/logs/wu-ftpd diff --git a/config/filter.d/wuftpd.conf b/config/filter.d/wuftpd.conf index 56ba499f..6f266fb5 100644 --- a/config/filter.d/wuftpd.conf +++ b/config/filter.d/wuftpd.conf @@ -12,6 +12,7 @@ # Values: TEXT # failregex = wu-ftpd(?:\[\d+\])?:\s+\(pam_unix\)\s+authentication failure.* rhost=$ + wu-ftpd(?:\[\d+\])?: *failed login from .*\[\] *$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/testcases/files/logs/wu-ftpd b/testcases/files/logs/wu-ftpd new file mode 100644 index 00000000..b6b41613 --- /dev/null +++ b/testcases/files/logs/wu-ftpd @@ -0,0 +1,2 @@ +# This login line is from syslog +Oct 6 09:59:26 myserver wu-ftpd[18760]: failed login from hj-145-173-a8.bta.net.cn [202.108.145.173] From 2b885e07f47ee96298a93a3c27831c2a9e9df0a3 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 31 Jul 2012 15:44:24 -0400 Subject: [PATCH 5/7] Adjusted changelog to reflect the last change --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 672a3fcd..24c83502 100644 --- a/ChangeLog +++ b/ChangeLog @@ -67,6 +67,8 @@ ver. 0.8.7 (2012/07/31) - stable default with -v to control verbosity * [b4099da] adjusted header for config/*.conf to mention .local and way to comment (Thanks Stefano Forli for the note) + * [6ad55f6] added failregex for wu-ftpd to match against syslog instead + of DoS-prone auth.log's rhost (Closes: #514239) Yehuda Katz & Yaroslav Halchenko * [322f53e,bd40cc7] ./DEVELOP -- documentation for developers From 2082fee7b1612bb17f3261a570ffb85503344c3a Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 31 Jul 2012 15:53:41 -0400 Subject: [PATCH 6/7] ENH: match possibly present "pam_unix(sshd:auth):" portion for sshd (Closes: #648020) --- config/filter.d/sshd.conf | 2 +- testcases/files/logs/sshd | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index e838cecc..1da6e55d 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -30,7 +30,7 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* fro ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from \s*$ ^%(__prefix_line)sUser .+ from not allowed because not listed in AllowUsers\s*$ ^%(__prefix_line)sUser .+ from not allowed because listed in DenyUsers\s*$ - ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=(?:\s+user=.*)?\s*$ + ^%(__prefix_line)s(?:pam_unix\(sshd:auth\):\s)?authentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=(?:\s+user=.*)?\s*$ ^%(__prefix_line)srefused connect from \S+ \(\)\s*$ ^%(__prefix_line)sAddress .* POSSIBLE BREAK-IN ATTEMPT!*\s*$ ^%(__prefix_line)sUser .+ from not allowed because none of user's groups are listed in AllowGroups\s*$ diff --git a/testcases/files/logs/sshd b/testcases/files/logs/sshd index 216a595e..639aaf0b 100644 --- a/testcases/files/logs/sshd +++ b/testcases/files/logs/sshd @@ -27,3 +27,6 @@ Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but #8 DenyUsers https://github.com/fail2ban/fail2ban/issues/47 Apr 16 22:01:15 al-ribat sshd[5154]: User root from 46.45.128.3 not allowed because listed in DenyUsers + +# http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648020 +Nov 8 11:19:38 bar sshd[25427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.6 From c06c504a8e49214ea60185a00cc8eb586f55a628 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 31 Jul 2012 15:54:33 -0400 Subject: [PATCH 7/7] Adjusted changelog to reflect the last change --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 24c83502..c3e9b5ee 100644 --- a/ChangeLog +++ b/ChangeLog @@ -69,6 +69,8 @@ ver. 0.8.7 (2012/07/31) - stable to comment (Thanks Stefano Forli for the note) * [6ad55f6] added failregex for wu-ftpd to match against syslog instead of DoS-prone auth.log's rhost (Closes: #514239) + * [2082fee] match possibly present "pam_unix(sshd:auth):" portion for + sshd filter (Closes: #648020) Yehuda Katz & Yaroslav Halchenko * [322f53e,bd40cc7] ./DEVELOP -- documentation for developers