From 88eff70774fe96a5f241ae3d5365f504a3df4c8b Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 16 Nov 2013 09:43:15 +1100 Subject: [PATCH 1/4] ENH: filter.d/solid-pop3d added --- ChangeLog | 3 +++ THANKS | 1 + config/filter.d/solid-pop3d.conf | 18 ++++++++++++++++++ testcases/files/logs/solid-pop3d | 2 ++ 4 files changed, 24 insertions(+) create mode 100644 config/filter.d/solid-pop3d.conf create mode 100644 testcases/files/logs/solid-pop3d diff --git a/ChangeLog b/ChangeLog index 98792d9e..b93a1c31 100644 --- a/ChangeLog +++ b/ChangeLog @@ -16,6 +16,9 @@ ver. 0.8.12 (2013/12/XX) - things-can-only-get-better - New Features: + Daniel Black + * filter.d/solid-pop3d -- added thanks to Jacques Lav!gnotte on mailinglist. + - Enhancements: diff --git a/THANKS b/THANKS index 13303c21..ee3922dd 100644 --- a/THANKS +++ b/THANKS @@ -33,6 +33,7 @@ Georgiy Mernov Guillaume Delvit Hanno 'Rince' Wagner Iain Lea +Jacques Lav!gnotte Jonathan Kamens Jonathan Lanning Jonathan Underwood diff --git a/config/filter.d/solid-pop3d.conf b/config/filter.d/solid-pop3d.conf new file mode 100644 index 00000000..67deafb6 --- /dev/null +++ b/config/filter.d/solid-pop3d.conf @@ -0,0 +1,18 @@ +# Fail2Ban filter for unsuccesful solid-pop3 authentication attempts +# +# +[INCLUDES] + +before = common.conf + +[Definition] + +_daemon = solid-pop3d + +failregex = ^%(__prefix_line)sauthentication failed: no such user: .*? - $ + +ignoreregex = + +# DEV Notes: +# +# Authors: Daniel Black diff --git a/testcases/files/logs/solid-pop3d b/testcases/files/logs/solid-pop3d new file mode 100644 index 00000000..0574084d --- /dev/null +++ b/testcases/files/logs/solid-pop3d @@ -0,0 +1,2 @@ +# failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } +Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: authentication failed: no such user: adrian - 123.33.44.45 From b3b9ea45597e4f8484afbefc6e0887617b61df82 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 18 Nov 2013 07:42:45 +1100 Subject: [PATCH 2/4] ENH: jail for solid-pop3d --- config/jail.conf | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/config/jail.conf b/config/jail.conf index 486ea078..0de7f524 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -518,6 +518,14 @@ action = iptables-multiport[name=dovecot-auth, port="pop3,pop3s,imap,imaps,subm logpath = /var/log/secure +[solid-pop3d] + +enabled = false +filter = solid-pop3d +action = iptables-multiport[name=solid-pop3, port="pop3,pop3s", protocol=tcp] +logpath = /var/log/mail.log + + [selinux-ssh] enabled = false filter = selinux-ssh From 0eea0a35db8061d51c35cba7bed7911ed822ca38 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 18 Nov 2013 08:58:23 +1100 Subject: [PATCH 3/4] ENH: filter.d/solid-pop3d - added log messages and regexes --- config/filter.d/solid-pop3d.conf | 13 ++++++++++++- testcases/files/logs/solid-pop3d | 20 ++++++++++++++++++++ 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/config/filter.d/solid-pop3d.conf b/config/filter.d/solid-pop3d.conf index 67deafb6..68ac0a8e 100644 --- a/config/filter.d/solid-pop3d.conf +++ b/config/filter.d/solid-pop3d.conf @@ -1,5 +1,7 @@ # Fail2Ban filter for unsuccesful solid-pop3 authentication attempts # +# Doesn't currently provide PAM support. Please contribute sample logs +# to http://github.com/fail2ban/fail2ban/issues. # [INCLUDES] @@ -9,10 +11,19 @@ before = common.conf _daemon = solid-pop3d -failregex = ^%(__prefix_line)sauthentication failed: no such user: .*? - $ +failregex = ^%(__prefix_line)sauthentication failed: (no such user|can't map user name): .*? - $ + ^%(__prefix_line)s(APOP )?authentication failed for (mapped )?user .*? - $ + ^%(__prefix_line)sroot login not allowed - $ + ^%(__prefix_line)scan't find APOP secret for user .*? - $ ignoreregex = # DEV Notes: # +# solid-pop3d needs to be compiled with --enable-logextend to support +# IP addresses in log messages. +# +# solid-pop3d-0.15/src/main.c contains all authentication errors +# except for PAM authentication messages ( src/authenticate.c ) +# # Authors: Daniel Black diff --git a/testcases/files/logs/solid-pop3d b/testcases/files/logs/solid-pop3d index 0574084d..3fe27e58 100644 --- a/testcases/files/logs/solid-pop3d +++ b/testcases/files/logs/solid-pop3d @@ -1,2 +1,22 @@ # failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: authentication failed: no such user: adrian - 123.33.44.45 + +# All below are manufactured from looking at log +# failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } +Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: authentication failed: can't map user name: adrian - 123.33.44.45 + +# failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } +Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: authentication failed for user adrain - 123.33.44.45 + +# failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } +Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: authentication failed for mapped user adrain - 123.33.44.45 + +# failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } +Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: root login not allowed - 123.33.44.45 + +# failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } +Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: can't find APOP secret for user adrian - 123.33.44.45 + +# failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } +Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: APOP authentication failed for user adrian - 123.33.44.45 + From 1ea68b2d0c5415709cebec0edd6dbca85e15be5c Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 18 Nov 2013 09:44:26 +1100 Subject: [PATCH 4/4] DOC: filter.d/solid-pop3d - document lack of PAM support. Thanks to Jacques for the log messages --- config/filter.d/solid-pop3d.conf | 7 +++++-- testcases/files/logs/solid-pop3d | 3 +++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/config/filter.d/solid-pop3d.conf b/config/filter.d/solid-pop3d.conf index 68ac0a8e..d97cc134 100644 --- a/config/filter.d/solid-pop3d.conf +++ b/config/filter.d/solid-pop3d.conf @@ -1,7 +1,7 @@ # Fail2Ban filter for unsuccesful solid-pop3 authentication attempts # -# Doesn't currently provide PAM support. Please contribute sample logs -# to http://github.com/fail2ban/fail2ban/issues. +# Doesn't currently provide PAM support as PAM log messages don't include rhost as +# remote IP. # [INCLUDES] @@ -25,5 +25,8 @@ ignoreregex = # # solid-pop3d-0.15/src/main.c contains all authentication errors # except for PAM authentication messages ( src/authenticate.c ) +# +# A pam authentication failure message (note no IP for rhost). +# Nov 17 23:17:50 emf1pt2-2-35-70 solid-pop3d[17176]: pam_unix(solid-pop3d:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=jacques # # Authors: Daniel Black diff --git a/testcases/files/logs/solid-pop3d b/testcases/files/logs/solid-pop3d index 3fe27e58..45c4ecaf 100644 --- a/testcases/files/logs/solid-pop3d +++ b/testcases/files/logs/solid-pop3d @@ -20,3 +20,6 @@ Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: can't find APOP secret for us # failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: APOP authentication failed for user adrian - 123.33.44.45 +# Real log messages again: +# failJSON: { "time": "2004-11-17T23:10:03", "match": true , "host": "190.16.165.230" } +Nov 17 23:10:03 emf1pt2-2-35-70 solid-pop3d[16993]: authentication failed for user jacques - 190.16.165.230