diff --git a/config/filter.d/mysqld.conf b/config/filter.d/mysqld.conf new file mode 100644 index 00000000..bc9164ce --- /dev/null +++ b/config/filter.d/mysqld.conf @@ -0,0 +1,32 @@ +# Fail2Ban configuration file +# +# Author: Artur Penttinen +# +# $Revision$ +# + +[INCLUDES] + +# Read common prefixes. If any customizations available -- read them from +# common.local +before = common.conf + + +[Definition] + +#_daemon = mysqld + +# Option: failregex +# Notes.: regex to match the password failures messages in the logfile. The +# host must be matched by a group named "host". The tag "" can +# be used for standard IP/hostname matching and is only an alias for +# (?:::f{4,6}:)?(?P[\w\-.^_]+) +# Values: TEXT +# 130322 11:26:54 [Warning] Access denied for user 'root'@'127.0.0.1' (using password: YES) +failregex = Access denied for user '\w+'@'' + +# Option: ignoreregex +# Notes.: regex to ignore. If this regex matches, the line is ignored. +# Values: TEXT +# +ignoreregex = diff --git a/config/jail.conf b/config/jail.conf index 29af88c0..4c1528f1 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -345,6 +345,19 @@ action = iptables-multiport[name=asterisk-udp, port="5060,5061", protocol=udp] logpath = /var/log/asterisk/messages maxretry = 10 +# For log wrong MySQL access add to /etc/my.cnf: +# log-error=/var/log/mysqld.log +# log-warning = 2 +[mysqld-iptables] + +enabled = false +filter = mysqld +action = iptables[name=mysql, port=3306, protocol=tcp] + sendmail-whois[name=MySQL, dest=root, sender=fail2ban@example.com] +logpath = /var/log/mysqld.log +maxretry = 5 + + # Jail for more extended banning of persistent abusers # !!! WARNING !!! # Make sure that your loglevel specified in fail2ban.conf/.local diff --git a/server/datedetector.py b/server/datedetector.py index c013d551..a54e072d 100644 --- a/server/datedetector.py +++ b/server/datedetector.py @@ -155,6 +155,12 @@ class DateDetector: template.setRegex("^<\d{2}/\d{2}/\d{2}@\d{2}:\d{2}:\d{2}>") template.setPattern("<%m/%d/%y@%H:%M:%S>") self._appendTemplate(template) + # MySQL: 130322 11:46:11 + template = DateStrptime() + template.setName("MonthDayYear Hour:Minute:Second") + template.setRegex("^\d{2}\d{2}\d{2} +\d{1,2}:\d{2}:\d{2}") + template.setPattern("%y%m%d %H:%M:%S") + self._appendTemplate(template) finally: self.__lock.release() diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py index 64af1fab..7c3c7140 100644 --- a/testcases/datedetectortestcase.py +++ b/testcases/datedetectortestcase.py @@ -84,6 +84,7 @@ class DateDetectorTest(unittest.TestCase): "2005-01-23T21:59:59.252Z", #ISO 8601 "2005-01-23T21:59:59-05:00Z", #ISO 8601 with TZ "<01/23/05@21:59:59>", + "050123 21:59:59", # MySQL ): log = sdate + "[sshd] error: PAM: Authentication failure" # exclude diff --git a/testcases/files/logs/mysqld.log b/testcases/files/logs/mysqld.log new file mode 100644 index 00000000..8dfd6338 --- /dev/null +++ b/testcases/files/logs/mysqld.log @@ -0,0 +1,17 @@ +130323 21:14:28 [Warning] Access denied for user 'root'@'192.168.1.34' (using password: NO) +130324 0:04:00 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: NO) +130324 0:04:02 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) +130324 0:04:05 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) +130324 0:04:07 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) +130324 0:04:09 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) +130324 0:04:11 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) +130324 0:04:13 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) +130324 0:04:16 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) +130324 0:04:18 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) +130324 8:24:09 [Warning] Access denied for user 'root'@'220.95.238.171' (using password: NO) +130324 17:56:13 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: NO) +130324 17:56:14 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: YES) +130324 17:56:15 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: YES) +130324 19:01:39 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: NO) +130324 19:01:40 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: YES) +130324 19:01:41 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: YES)