From 227f27ce6b461bc5dbe7871351e7ce688825fe28 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 25 Nov 2013 14:55:41 +1100 Subject: [PATCH] ENH: added multiline filter for sshd filter --- ChangeLog | 3 +++ THANKS | 1 + config/filter.d/sshd.conf | 1 + fail2ban/tests/files/logs/sshd | 7 +++++++ 4 files changed, 12 insertions(+) diff --git a/ChangeLog b/ChangeLog index c589dbe1..145b6625 100644 --- a/ChangeLog +++ b/ChangeLog @@ -36,6 +36,9 @@ code-review and minor additions from Yaroslav Halchenko. into logging messages in case of error or at DEBUG loglevel. Daniel Black and TESTOVIK * Multiline filter for sendmail-spam. Close gh-418 + Daniel Black and John Thoe + * Multiline regex for Disconnecting: Too many authentication failures for + root [preauth]\nConnection closed by 6X.XXX.XXX.XXX [preauth] - Enhancements Steven Hiscocks diff --git a/THANKS b/THANKS index 7fee6e03..64d88de4 100644 --- a/THANKS +++ b/THANKS @@ -33,6 +33,7 @@ Georgiy Mernov Guillaume Delvit Hanno 'Rince' Wagner Iain Lea +John Thoe Jonathan Kamens Jonathan Lanning Jonathan Underwood diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index 53be5e57..eff37250 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -23,6 +23,7 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|erro ^%(__prefix_line)sUser .+ from not allowed because a group is listed in DenyGroups\s*$ ^%(__prefix_line)sUser .+ from not allowed because none of user's groups are listed in AllowGroups\s*$ ^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked(?P=__prefix)(?:error: )?Received disconnect from : 11: Bye Bye \[preauth\]$ + ^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\](?P=__prefix)(?:error: )?Connection closed by \[preauth\]$ ignoreregex = diff --git a/fail2ban/tests/files/logs/sshd b/fail2ban/tests/files/logs/sshd index 2b4f437e..3d2f63db 100644 --- a/fail2ban/tests/files/logs/sshd +++ b/fail2ban/tests/files/logs/sshd @@ -117,3 +117,10 @@ Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 po # failJSON: { "time": "2004-11-11T08:04:51", "match": true , "host": "127.0.0.1", "desc": "Injecting on username ssh 'from 10.10.1.1'@localhost" } Nov 11 08:04:51 redbamboo sshd[2737]: Failed password for invalid user from 10.10.1.1 from 127.0.0.1 port 58946 ssh2 + + + +# failJSON: { "match": false } +Nov 23 21:50:19 sshd[8148]: Disconnecting: Too many authentication failures for root [preauth] +# failJSON: { "time": "2004-11-23T21:50:37", "match": true , "host": "61.0.0.1", "desc": "Multiline match for preauth failures" } +Nov 23 21:50:37 sshd[8148]: Connection closed by 61.0.0.1 [preauth]