From c8e82f18b6d58abbe145573bb66ef1081542908a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20=C5=A0um=C5=A1al?= Date: Thu, 29 Jan 2015 17:57:52 +0100 Subject: [PATCH 1/7] Add jail nginx-botsearch Jail blocks requests for predefined non-existent folders. Based on apache-botsearch jail. --- config/filter.d/nginx-botsearch.conf | 29 +++++++++++++++++++++++ config/jail.conf | 6 +++++ fail2ban/tests/files/logs/nginx-botsearch | 23 ++++++++++++++++++ 3 files changed, 58 insertions(+) create mode 100644 config/filter.d/nginx-botsearch.conf create mode 100644 fail2ban/tests/files/logs/nginx-botsearch diff --git a/config/filter.d/nginx-botsearch.conf b/config/filter.d/nginx-botsearch.conf new file mode 100644 index 00000000..a45909de --- /dev/null +++ b/config/filter.d/nginx-botsearch.conf @@ -0,0 +1,29 @@ +# Fail2Ban filter to match web requests for selected URLs that don't exist +# + +[Definition] + +failregex = ^ \- \S+ \[\] \"(GET|POST) \/ \S+\" 404 .+$ + ^ \[error\] \d+#\d+: \*\d+ (\S+ )?\"\S+\" (failed|is not found) \(2\: No such file or directory\), client\: \, server\: \S*\, request: \"(GET|POST) \/ \S+\"\, .*?$ + +ignoreregex = + + +[Init] + +# Block is the actual non-found directories to block +block = \/?(|||cgi-bin|mysqladmin)[^,]* + +# These are just convient definitions that assist the blocking of stuff that +# isn't installed +webmail = roundcube|(ext)?mail|horde|(v-?)?webmail + +phpmyadmin = (typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin) + +wordpress = wp-(login|signup)\.php + + +# DEV Notes: +# Based on apache-botsearch filter +# +# Author: Frantisek Sumsal \ No newline at end of file diff --git a/config/jail.conf b/config/jail.conf index 334e3298..ae6a1c59 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -294,6 +294,12 @@ maxretry = 1 port = http,https logpath = %(nginx_error_log)s +[nginx-botsearch] + +port = http,https +logpath = %(nginx_error_log)s +maxretry = 10 +findtime = 300 # Ban attackers that try to use PHP's URL-fopen() functionality # through GET/POST variables. - Experimental, with more than a year diff --git a/fail2ban/tests/files/logs/nginx-botsearch b/fail2ban/tests/files/logs/nginx-botsearch new file mode 100644 index 00000000..f1bf05f5 --- /dev/null +++ b/fail2ban/tests/files/logs/nginx-botsearch @@ -0,0 +1,23 @@ +# failJSON: { "time": "2015-01-20T19:53:28", "match": true , "host": "12.34.56.78" } +12.34.56.78 - - [20/Jan/2015:19:53:28 +0100] "GET //phpMyAdmin-2.8.2.3/scripts/setup.php HTTP/1.1" 404 47 "-" "-" "-" + +# failJSON: { "time": "2015-01-20T19:53:28", "match": true , "host": "12.34.56.78" } +12.34.56.78 - - [20/Jan/2015:19:53:28 +0100] "GET //pma/scripts/setup.php HTTP/1.1" 404 47 "-" "-" "-" + +# failJSON: { "time": "2015-01-20T19:53:28", "match": true , "host": "12.34.56.78" } +12.34.56.78 - - [20/Jan/2015:19:53:28 +0100] "GET //mysqladmin/scripts/setup.php HTTP/1.1" 404 47 "-" "-" "-" + +# failJSON: { "time": "2015-01-20T19:53:28", "match": true , "host": "12.34.56.78" } +12.34.56.78 - - [20/Jan/2015:19:53:28 +0100] "GET //admin/pma/scripts/setup.php HTTP/1.1" 404 47 "-" "-" "-" + +# failJSON: { "time": "2015-01-20T01:17:07", "match": true , "host": "7.8.9.10" } +7.8.9.10 - root [20/Jan/2015:01:17:07 +0100] "GET /cgi-bin/recent.cgi HTTP/1.1" 404 162 "-" "-" "-" + +# failJSON: { "time": "2014-12-12T22:59:02", "match": true , "host": "2.5.2.5" } +2.5.2.5 - tomcat [12/Dec/2014:22:59:02 +0100] "GET /cgi-bin/tools/tools.pl HTTP/1.1" 404 162 "-" "-" "-" + +# failJSON: { "time": "2015-01-21T10:56:10", "match": true , "host": "5.7.9.2" } +2015/01/21 10:56:10 [error] 2833#0: *16336 open() "/var/www/site/cgi-bin/php4" failed (2: No such file or directory), client: 5.7.9.2, server: localhost, request: "GET /cgi-bin/php4 HTTP/1.1", host: "1.2.3.4" + +# failJSON: { "time": "2015-01-21T15:02:27", "match": true , "host": "5.7.9.2" } +2015/01/21 15:02:27 [error] 2833#0: *16813 "/var/www/site/roundcube/" is not found (2: No such file or directory), client: 5.7.9.2, server: localhost, request: "GET /roundcube/ HTTP/1.1", host: "1.2.3.4" \ No newline at end of file From f8fe165cd2d1fa22d61544836b7d72eab33b8a3c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20=C5=A0um=C5=A1al?= Date: Tue, 3 Feb 2015 03:35:22 +0100 Subject: [PATCH 2/7] Switched from tabs to spaces for indents --- config/filter.d/nginx-botsearch.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/nginx-botsearch.conf b/config/filter.d/nginx-botsearch.conf index a45909de..6d696de6 100644 --- a/config/filter.d/nginx-botsearch.conf +++ b/config/filter.d/nginx-botsearch.conf @@ -4,7 +4,7 @@ [Definition] failregex = ^ \- \S+ \[\] \"(GET|POST) \/ \S+\" 404 .+$ - ^ \[error\] \d+#\d+: \*\d+ (\S+ )?\"\S+\" (failed|is not found) \(2\: No such file or directory\), client\: \, server\: \S*\, request: \"(GET|POST) \/ \S+\"\, .*?$ + ^ \[error\] \d+#\d+: \*\d+ (\S+ )?\"\S+\" (failed|is not found) \(2\: No such file or directory\), client\: \, server\: \S*\, request: \"(GET|POST) \/ \S+\"\, .*?$ ignoreregex = From 18778d91749e7d9d6396706291f90a62b1f66c9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20=C5=A0um=C5=A1al?= Date: Tue, 3 Feb 2015 04:25:47 +0100 Subject: [PATCH 3/7] Created botsearch-common.conf File contains variables used in -botsearch filters --- config/filter.d/botsearch-common.conf | 19 +++++++++++++++++++ config/filter.d/nginx-botsearch.conf | 19 +++++-------------- 2 files changed, 24 insertions(+), 14 deletions(-) create mode 100644 config/filter.d/botsearch-common.conf diff --git a/config/filter.d/botsearch-common.conf b/config/filter.d/botsearch-common.conf new file mode 100644 index 00000000..65f9da2f --- /dev/null +++ b/config/filter.d/botsearch-common.conf @@ -0,0 +1,19 @@ +# Generic configuration file for -botsearch filters + +[Init] + +# Block is the actual non-found directories to block +block = \/?(|||cgi-bin|mysqladmin)[^,]* + +# These are just convient definitions that assist the blocking of stuff that +# isn't installed +webmail = roundcube|(ext)?mail|horde|(v-?)?webmail + +phpmyadmin = (typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin) + +wordpress = wp-(login|signup)\.php + +# DEV Notes: +# Taken from apache-botsearch filter +# +# Author: Frantisek Sumsal \ No newline at end of file diff --git a/config/filter.d/nginx-botsearch.conf b/config/filter.d/nginx-botsearch.conf index 6d696de6..567f2f56 100644 --- a/config/filter.d/nginx-botsearch.conf +++ b/config/filter.d/nginx-botsearch.conf @@ -1,6 +1,11 @@ # Fail2Ban filter to match web requests for selected URLs that don't exist # +[INCLUDES] + +# Load regexes for filtering +before = botsearch-common.conf + [Definition] failregex = ^ \- \S+ \[\] \"(GET|POST) \/ \S+\" 404 .+$ @@ -9,20 +14,6 @@ failregex = ^ \- \S+ \[\] \"(GET|POST) \/ \S+\" 404 .+$ ignoreregex = -[Init] - -# Block is the actual non-found directories to block -block = \/?(|||cgi-bin|mysqladmin)[^,]* - -# These are just convient definitions that assist the blocking of stuff that -# isn't installed -webmail = roundcube|(ext)?mail|horde|(v-?)?webmail - -phpmyadmin = (typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin) - -wordpress = wp-(login|signup)\.php - - # DEV Notes: # Based on apache-botsearch filter # From 705718be52b3a33f235bd07bc1d585cffc3cf20e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20=C5=A0um=C5=A1al?= Date: Tue, 3 Feb 2015 04:44:33 +0100 Subject: [PATCH 4/7] Filter apache-botsearch.conf now loads variables from botsearch-common.conf --- config/filter.d/apache-botsearch.conf | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/config/filter.d/apache-botsearch.conf b/config/filter.d/apache-botsearch.conf index f7f5488c..7c03be69 100644 --- a/config/filter.d/apache-botsearch.conf +++ b/config/filter.d/apache-botsearch.conf @@ -19,6 +19,9 @@ # overwrite with apache-common.local if _apache_error_client is incorrect. before = apache-common.conf +# Load regexes for filtering +after = botsearch-common.conf + [Definition] failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): (, referer: \S+)?\s*$ @@ -31,18 +34,8 @@ ignoreregex = # Webroot represents the webroot on which all other files are based webroot = /var/www/ -# Block is the actual non-found directories to block -block = (||)[^,]* - -# These are just convient definitions that assist the blocking of stuff that -# isn't installed -webmail = roundcube|(ext)?mail|horde|(v-?)?webmail - -phpmyadmin = (typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin) - -wordpress = wp-(login|signup)\.php # DEV Notes: # -# Author: Daniel Black +# Author: Daniel Black \ No newline at end of file From fb0f463eac140acaf46287e81ff82bf464e2f057 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20=C5=A0um=C5=A1al?= Date: Tue, 3 Feb 2015 15:54:05 +0100 Subject: [PATCH 5/7] Include consistency --- config/filter.d/apache-botsearch.conf | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/config/filter.d/apache-botsearch.conf b/config/filter.d/apache-botsearch.conf index 7c03be69..5687d405 100644 --- a/config/filter.d/apache-botsearch.conf +++ b/config/filter.d/apache-botsearch.conf @@ -17,10 +17,9 @@ [INCLUDES] # overwrite with apache-common.local if _apache_error_client is incorrect. +# Load regexes for filtering from botsearch-common.conf before = apache-common.conf - -# Load regexes for filtering -after = botsearch-common.conf + botsearch-common.conf [Definition] From 1c6d2074fb6db136fb4910215b8bddae0d8c4233 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20=C5=A0um=C5=A1al?= Date: Wed, 4 Feb 2015 01:48:59 +0100 Subject: [PATCH 6/7] Changed default settings for nginx-botseach filter --- config/jail.conf | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/config/jail.conf b/config/jail.conf index ae6a1c59..5695f75f 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -298,8 +298,7 @@ logpath = %(nginx_error_log)s port = http,https logpath = %(nginx_error_log)s -maxretry = 10 -findtime = 300 +maxretry = 2 # Ban attackers that try to use PHP's URL-fopen() functionality # through GET/POST variables. - Experimental, with more than a year From 9bd25f51c1d31945ae8136fb6d7e196c3286226f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20=C5=A0um=C5=A1al?= Date: Wed, 4 Feb 2015 02:19:15 +0100 Subject: [PATCH 7/7] Added ChangeLog and THANKS entry --- ChangeLog | 1 + THANKS | 1 + 2 files changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 92eb0825..f53d386a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -41,6 +41,7 @@ ver. 0.9.2 (2014/XX/XXX) - wanna-be-released - New filter: - postfix-rbl Thanks Lee Clemens - apache-fakegooglebot.conf Thanks Lee Clemens + - nginx-botsearch Thanks Frantisek Sumsal - New recursive embedded substitution feature added: - `<HOST>` becomes `` for PREF=`IPV4`; - `<HOST>` becomes `1.2.3.4` for PREF=`IPV4` and IPV4HOST=`1.2.3.4`; diff --git a/THANKS b/THANKS index 28cbb929..583dda58 100644 --- a/THANKS +++ b/THANKS @@ -39,6 +39,7 @@ Enrico Labedzki Eugene Hopkinson (SlowRiot) ftoppi François Boulogne +Frantisek Sumsal Frédéric Georgiy Mernov Guilhem Lettron