From a7604c899fba5835891c7650939c0b0e0ed7293e Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Wed, 13 Nov 2013 09:43:36 +1100 Subject: [PATCH 01/15] DOC: list Wiki pages to update after a release --- DEVELOP | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/DEVELOP b/DEVELOP index 500f119f..3766d192 100644 --- a/DEVELOP +++ b/DEVELOP @@ -839,10 +839,15 @@ Which indicates that testcases/files/logs/mysqld.log has been moved or is a dire page: http://www.fail2ban.org/wiki/index.php/Commands * Update: - http://www.fail2ban.org/wiki/index.php/Downloads + http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_Versions&action=edit + + http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_News&action=edit + move old bits to: + http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_OldNews&action=edit + + http://www.fail2ban.org/wiki/index.php?title=Template:Fail2ban_Versions&action=edit http://www.fail2ban.org/wiki/index.php/ChangeLog http://www.fail2ban.org/wiki/index.php/Requirements (Check requirement) - http://www.fail2ban.org/wiki/index.php/Main_Page (Add to News) http://www.fail2ban.org/wiki/index.php/Features * See if any filters are upgraded: From ed212fcdccd155ef3cb9b053082c1b843d14fc0f Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 16 Nov 2013 09:40:05 +1100 Subject: [PATCH 02/15] DOC: new ChangeLog header --- ChangeLog | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index e901d9af..98792d9e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,9 +4,21 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ================================================================================ -Fail2Ban (version 0.8.11) 2013/11/13 +Fail2Ban (version 0.8.12.dev) 2013/11/13 ================================================================================ +ver. 0.8.12 (2013/12/XX) - things-can-only-get-better +----------- + +- IMPORTANT incompatible changes: + +- Fixes: + +- New Features: + +- Enhancements: + + ver. 0.8.11 (2013/11/13) - loves-unittests-and-tight-DoS-free-filter-regexes ----------- From 88eff70774fe96a5f241ae3d5365f504a3df4c8b Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 16 Nov 2013 09:43:15 +1100 Subject: [PATCH 03/15] ENH: filter.d/solid-pop3d added --- ChangeLog | 3 +++ THANKS | 1 + config/filter.d/solid-pop3d.conf | 18 ++++++++++++++++++ testcases/files/logs/solid-pop3d | 2 ++ 4 files changed, 24 insertions(+) create mode 100644 config/filter.d/solid-pop3d.conf create mode 100644 testcases/files/logs/solid-pop3d diff --git a/ChangeLog b/ChangeLog index 98792d9e..b93a1c31 100644 --- a/ChangeLog +++ b/ChangeLog @@ -16,6 +16,9 @@ ver. 0.8.12 (2013/12/XX) - things-can-only-get-better - New Features: + Daniel Black + * filter.d/solid-pop3d -- added thanks to Jacques Lav!gnotte on mailinglist. + - Enhancements: diff --git a/THANKS b/THANKS index 13303c21..ee3922dd 100644 --- a/THANKS +++ b/THANKS @@ -33,6 +33,7 @@ Georgiy Mernov Guillaume Delvit Hanno 'Rince' Wagner Iain Lea +Jacques Lav!gnotte Jonathan Kamens Jonathan Lanning Jonathan Underwood diff --git a/config/filter.d/solid-pop3d.conf b/config/filter.d/solid-pop3d.conf new file mode 100644 index 00000000..67deafb6 --- /dev/null +++ b/config/filter.d/solid-pop3d.conf @@ -0,0 +1,18 @@ +# Fail2Ban filter for unsuccesful solid-pop3 authentication attempts +# +# +[INCLUDES] + +before = common.conf + +[Definition] + +_daemon = solid-pop3d + +failregex = ^%(__prefix_line)sauthentication failed: no such user: .*? - $ + +ignoreregex = + +# DEV Notes: +# +# Authors: Daniel Black diff --git a/testcases/files/logs/solid-pop3d b/testcases/files/logs/solid-pop3d new file mode 100644 index 00000000..0574084d --- /dev/null +++ b/testcases/files/logs/solid-pop3d @@ -0,0 +1,2 @@ +# failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } +Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: authentication failed: no such user: adrian - 123.33.44.45 From d4f6ca4f8531f332bcb7ce3a89102f60afaaa08e Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sat, 16 Nov 2013 22:15:27 -0500 Subject: [PATCH 04/15] ENH: adding custom date format for proftpd when logging in its own log file (default on Debian) -- includes milliseconds Should resolve Debian #648276 --- server/datedetector.py | 7 +++++++ testcases/datedetectortestcase.py | 1 + testcases/files/logs/proftpd | 2 ++ 3 files changed, 10 insertions(+) diff --git a/server/datedetector.py b/server/datedetector.py index ab2dd174..b12a8d46 100644 --- a/server/datedetector.py +++ b/server/datedetector.py @@ -101,6 +101,13 @@ class DateDetector: template.setRegex("\d{2}/\d{2}/\d{4}:\d{2}:\d{2}:\d{2}") template.setPattern("%m/%d/%Y:%H:%M:%S") self._appendTemplate(template) + # proftpd 2013-11-16 21:43:03,296 + # So like Exim below but with ,subsecond + template = DateStrptime() + template.setName("Year-Month-Day Hour:Minute:Second[,subsecond]") + template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d+") + template.setPattern("%Y-%m-%d %H:%M:%S,%f") + self._appendTemplate(template) # Exim 2006-12-21 06:43:20 template = DateStrptime() template.setName("Year-Month-Day Hour:Minute:Second") diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py index de324aa6..4cc7dcfc 100644 --- a/testcases/datedetectortestcase.py +++ b/testcases/datedetectortestcase.py @@ -74,6 +74,7 @@ class DateDetectorTest(unittest.TestCase): (False, "23/Jan/2005:21:59:59"), (False, "01/23/2005:21:59:59"), (False, "2005-01-23 21:59:59"), + (False, "2005-01-23 21:59:59,099"), # proftpd (False, "23-Jan-2005 21:59:59"), (False, "23-01-2005 21:59:59"), (False, "01-23-2005 21:59:59.252"), # reported on f2b, causes Feb29 fix to break diff --git a/testcases/files/logs/proftpd b/testcases/files/logs/proftpd index 9687d992..b255e91e 100644 --- a/testcases/files/logs/proftpd +++ b/testcases/files/logs/proftpd @@ -14,3 +14,5 @@ Jun 14 00:09:59 platypus.ace-hosting.com.au proftpd[17839] platypus.ace-hosting. May 31 10:53:25 mail proftpd[15302]: xxxxxxxxxx (::ffff:1.2.3.4[::ffff:1.2.3.4]) - Maximum login attempts (3) exceeded # failJSON: { "time": "2004-12-05T15:44:32", "match": true , "host": "1.2.3.4" } Dec 5 15:44:32 serv1 proftpd[70944]: serv1.domain.com (example.com[1.2.3.4]) - USER jtittle@domain.org: no such user found from example.com [1.2.3.4] to 1.2.3.4:21 +# failJSON: { "time": "2013-11-16T21:59:30", "match": true , "host": "1.2.3.4", "desc": "proftpd-basic 1.3.5~rc3-2.1 on Debian uses date format with milliseconds if logging under /var/log/proftpd/proftpd.log" } +2013-11-16 21:59:30,121 novo proftpd[25891] localhost (andy[1.2.3.4]): USER kjsad: no such user found from andy [1.2.3.5] to ::ffff:192.168.1.14:21 From 82174ea4c4521731f3cb88cd84adfb261a8c74a0 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sat, 16 Nov 2013 22:18:51 -0500 Subject: [PATCH 05/15] Changelog for preceding proftpd date format change --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 98792d9e..2369bc21 100644 --- a/ChangeLog +++ b/ChangeLog @@ -13,6 +13,7 @@ ver. 0.8.12 (2013/12/XX) - things-can-only-get-better - IMPORTANT incompatible changes: - Fixes: + - allow for ",milliseconds" in the custom date format of proftpd.log - New Features: From b3b9ea45597e4f8484afbefc6e0887617b61df82 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 18 Nov 2013 07:42:45 +1100 Subject: [PATCH 06/15] ENH: jail for solid-pop3d --- config/jail.conf | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/config/jail.conf b/config/jail.conf index 486ea078..0de7f524 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -518,6 +518,14 @@ action = iptables-multiport[name=dovecot-auth, port="pop3,pop3s,imap,imaps,subm logpath = /var/log/secure +[solid-pop3d] + +enabled = false +filter = solid-pop3d +action = iptables-multiport[name=solid-pop3, port="pop3,pop3s", protocol=tcp] +logpath = /var/log/mail.log + + [selinux-ssh] enabled = false filter = selinux-ssh From 0eea0a35db8061d51c35cba7bed7911ed822ca38 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 18 Nov 2013 08:58:23 +1100 Subject: [PATCH 07/15] ENH: filter.d/solid-pop3d - added log messages and regexes --- config/filter.d/solid-pop3d.conf | 13 ++++++++++++- testcases/files/logs/solid-pop3d | 20 ++++++++++++++++++++ 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/config/filter.d/solid-pop3d.conf b/config/filter.d/solid-pop3d.conf index 67deafb6..68ac0a8e 100644 --- a/config/filter.d/solid-pop3d.conf +++ b/config/filter.d/solid-pop3d.conf @@ -1,5 +1,7 @@ # Fail2Ban filter for unsuccesful solid-pop3 authentication attempts # +# Doesn't currently provide PAM support. Please contribute sample logs +# to http://github.com/fail2ban/fail2ban/issues. # [INCLUDES] @@ -9,10 +11,19 @@ before = common.conf _daemon = solid-pop3d -failregex = ^%(__prefix_line)sauthentication failed: no such user: .*? - $ +failregex = ^%(__prefix_line)sauthentication failed: (no such user|can't map user name): .*? - $ + ^%(__prefix_line)s(APOP )?authentication failed for (mapped )?user .*? - $ + ^%(__prefix_line)sroot login not allowed - $ + ^%(__prefix_line)scan't find APOP secret for user .*? - $ ignoreregex = # DEV Notes: # +# solid-pop3d needs to be compiled with --enable-logextend to support +# IP addresses in log messages. +# +# solid-pop3d-0.15/src/main.c contains all authentication errors +# except for PAM authentication messages ( src/authenticate.c ) +# # Authors: Daniel Black diff --git a/testcases/files/logs/solid-pop3d b/testcases/files/logs/solid-pop3d index 0574084d..3fe27e58 100644 --- a/testcases/files/logs/solid-pop3d +++ b/testcases/files/logs/solid-pop3d @@ -1,2 +1,22 @@ # failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: authentication failed: no such user: adrian - 123.33.44.45 + +# All below are manufactured from looking at log +# failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } +Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: authentication failed: can't map user name: adrian - 123.33.44.45 + +# failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } +Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: authentication failed for user adrain - 123.33.44.45 + +# failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } +Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: authentication failed for mapped user adrain - 123.33.44.45 + +# failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } +Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: root login not allowed - 123.33.44.45 + +# failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } +Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: can't find APOP secret for user adrian - 123.33.44.45 + +# failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } +Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: APOP authentication failed for user adrian - 123.33.44.45 + From 1ea68b2d0c5415709cebec0edd6dbca85e15be5c Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 18 Nov 2013 09:44:26 +1100 Subject: [PATCH 08/15] DOC: filter.d/solid-pop3d - document lack of PAM support. Thanks to Jacques for the log messages --- config/filter.d/solid-pop3d.conf | 7 +++++-- testcases/files/logs/solid-pop3d | 3 +++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/config/filter.d/solid-pop3d.conf b/config/filter.d/solid-pop3d.conf index 68ac0a8e..d97cc134 100644 --- a/config/filter.d/solid-pop3d.conf +++ b/config/filter.d/solid-pop3d.conf @@ -1,7 +1,7 @@ # Fail2Ban filter for unsuccesful solid-pop3 authentication attempts # -# Doesn't currently provide PAM support. Please contribute sample logs -# to http://github.com/fail2ban/fail2ban/issues. +# Doesn't currently provide PAM support as PAM log messages don't include rhost as +# remote IP. # [INCLUDES] @@ -25,5 +25,8 @@ ignoreregex = # # solid-pop3d-0.15/src/main.c contains all authentication errors # except for PAM authentication messages ( src/authenticate.c ) +# +# A pam authentication failure message (note no IP for rhost). +# Nov 17 23:17:50 emf1pt2-2-35-70 solid-pop3d[17176]: pam_unix(solid-pop3d:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=jacques # # Authors: Daniel Black diff --git a/testcases/files/logs/solid-pop3d b/testcases/files/logs/solid-pop3d index 3fe27e58..45c4ecaf 100644 --- a/testcases/files/logs/solid-pop3d +++ b/testcases/files/logs/solid-pop3d @@ -20,3 +20,6 @@ Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: can't find APOP secret for us # failJSON: { "time": "2004-11-15T00:34:53", "match": true , "host": "123.33.44.45" } Nov 15 00:34:53 rmc1pt2-2-35-70 solid-pop3d[3822]: APOP authentication failed for user adrian - 123.33.44.45 +# Real log messages again: +# failJSON: { "time": "2004-11-17T23:10:03", "match": true , "host": "190.16.165.230" } +Nov 17 23:10:03 emf1pt2-2-35-70 solid-pop3d[16993]: authentication failed for user jacques - 190.16.165.230 From 284f811c912af2f683c7eb150011337912516934 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Tue, 19 Nov 2013 10:27:55 +1100 Subject: [PATCH 09/15] BF: apache filters using error log weren't matched when referer existed in HTTP header --- ChangeLog | 1 + THANKS | 1 + config/filter.d/apache-auth.conf | 26 ++++++++++++++------------ config/filter.d/apache-noscript.conf | 4 ++-- config/filter.d/apache-overflows.conf | 2 +- testcases/files/logs/apache-auth | 3 +++ 6 files changed, 22 insertions(+), 15 deletions(-) diff --git a/ChangeLog b/ChangeLog index 2369bc21..4eb8968c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -14,6 +14,7 @@ ver. 0.8.12 (2013/12/XX) - things-can-only-get-better - Fixes: - allow for ",milliseconds" in the custom date format of proftpd.log + - allow for ", referer ..." in apache-* filter for apache error logs. - New Features: diff --git a/THANKS b/THANKS index 13303c21..45528bc7 100644 --- a/THANKS +++ b/THANKS @@ -70,6 +70,7 @@ Tyler Vaclav Misek Vincent Deffontaines Yaroslav Halchenko +Winston Smith ykimon Yehuda Katz zugeschmiert diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf index 3df91c15..f4213487 100644 --- a/config/filter.d/apache-auth.conf +++ b/config/filter.d/apache-auth.conf @@ -10,19 +10,19 @@ before = apache-common.conf [Definition] -failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server configuration: (uri )?\S*\s*$ - ^%(_apache_error_client)s (AH01617: )?user .* authentication failure for "\S*": Password Mismatch$ - ^%(_apache_error_client)s (AH01618: )?user .* not found(: )?\S*\s*$ - ^%(_apache_error_client)s (AH01614: )?client used wrong authentication scheme: \S*\s*$ +failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server configuration: (uri )?\S*(, referer: \S+)?\s*$ + ^%(_apache_error_client)s (AH01617: )?user .*? authentication failure for "\S*": Password Mismatch(, referer: \S+)?$ + ^%(_apache_error_client)s (AH01618: )?user .*? not found(: )?\S*(, referer: \S+)?\s*$ + ^%(_apache_error_client)s (AH01614: )?client used wrong authentication scheme: \S*(, referer: \S+)?\s*$ ^%(_apache_error_client)s (AH\d+: )?Authorization of user \S+ to access \S* failed, reason: .*$ - ^%(_apache_error_client)s (AH0179[24]: )?(Digest: )?user .*: password mismatch: \S*\s*$ - ^%(_apache_error_client)s (AH0179[01]: |Digest: )user `.*' in realm `.+' (not found|denied by provider): \S*\s*$ - ^%(_apache_error_client)s (AH01631: )?user .*: authorization failure for "\S*":\s*$ - ^%(_apache_error_client)s (AH01775: )?(Digest: )?invalid nonce .* received - length is not \S+\s*$ - ^%(_apache_error_client)s (AH01788: )?(Digest: )?realm mismatch - got `.*' but expected `.+'\s*$ - ^%(_apache_error_client)s (AH01789: )?(Digest: )?unknown algorithm `.*' received: \S*\s*$ - ^%(_apache_error_client)s (AH01793: )?invalid qop `.*' received: \S*\s*$ - ^%(_apache_error_client)s (AH01777: )?(Digest: )?invalid nonce .* received - user attempted time travel\s*$ + ^%(_apache_error_client)s (AH0179[24]: )?(Digest: )?user .*?: password mismatch: \S*(, referer: \S+)?\s*$ + ^%(_apache_error_client)s (AH0179[01]: |Digest: )user `.*?' in realm `.+' (not found|denied by provider): \S*(, referer: \S+)?\s*$ + ^%(_apache_error_client)s (AH01631: )?user .*?: authorization failure for "\S*":(, referer: \S+)?\s*$ + ^%(_apache_error_client)s (AH01775: )?(Digest: )?invalid nonce .* received - length is not \S+(, referer: \S+)?\s*$ + ^%(_apache_error_client)s (AH01788: )?(Digest: )?realm mismatch - got `.*?' but expected `.+'(, referer: \S+)?\s*$ + ^%(_apache_error_client)s (AH01789: )?(Digest: )?unknown algorithm `.*?' received: \S*(, referer: \S+)?\s*$ + ^%(_apache_error_client)s (AH01793: )?invalid qop `.*?' received: \S*(, referer: \S+)?\s*$ + ^%(_apache_error_client)s (AH01777: )?(Digest: )?invalid nonce .*? received - user attempted time travel(, referer: \S+)?\s*$ ignoreregex = @@ -50,5 +50,7 @@ ignoreregex = # ^%(_apache_error_client)s (AH01779: )?user .*: one-time-nonce mismatch - sending new nonce\s*$ # ^%(_apache_error_client)s (AH02486: )?realm mismatch - got `.*' but no realm specified\s*$ # +# referer is always in error log messages if it exists added as per the log_error_core function in server/log.c +# # Author: Cyril Jaquier # Major edits by Daniel Black diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf index f3c6246a..7ea257b2 100644 --- a/config/filter.d/apache-noscript.conf +++ b/config/filter.d/apache-noscript.conf @@ -9,8 +9,8 @@ before = apache-common.conf [Definition] -failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): /\S*(\.php|\.asp|\.exe|\.pl)\s*$ - ^%(_apache_error_client)s script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat\s*$ +failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): /\S*(\.php|\.asp|\.exe|\.pl)(, referer: \S+)?\s*$ + ^%(_apache_error_client)s script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat(, referer: \S+)?\s*$ ignoreregex = diff --git a/config/filter.d/apache-overflows.conf b/config/filter.d/apache-overflows.conf index 92551525..74e44b8e 100644 --- a/config/filter.d/apache-overflows.conf +++ b/config/filter.d/apache-overflows.conf @@ -8,7 +8,7 @@ before = apache-common.conf [Definition] -failregex = ^%(_apache_error_client)s ((AH0013[456]: )?Invalid (method|URI) in request .*( - possible attempt to establish SSL connection on non-SSL port)?|(AH00565: )?request failed: URI too long \(longer than \d+\)|request failed: erroneous characters after protocol string: .*|AH00566: request failed: invalid characters in URI)$ +failregex = ^%(_apache_error_client)s ((AH0013[456]: )?Invalid (method|URI) in request .*( - possible attempt to establish SSL connection on non-SSL port)?|(AH00565: )?request failed: URI too long \(longer than \d+\)|request failed: erroneous characters after protocol string: .*|AH00566: request failed: invalid characters in URI)(, referer: \S+)?$ ignoreregex = diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth index d6c40ac5..787d160a 100644 --- a/testcases/files/logs/apache-auth +++ b/testcases/files/logs/apache-auth @@ -115,3 +115,6 @@ # failJSON: { "time": "2013-06-01T02:17:42", "match": true , "host": "192.168.0.2" } [Sat Jun 01 02:17:42 2013] [error] [client 192.168.0.2] user root not found + +# failJSON: { "time": "2013-11-18T22:39:33", "match": true , "host": "91.49.82.139" } +[Mon Nov 18 22:39:33 2013] [error] [client 91.49.82.139] user gg not found: /, referer: http://sj.hopto.org/management.html From 015b403df07b4bcafa367e1b8b04611aa988a9a0 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Wed, 20 Nov 2013 10:01:06 +1100 Subject: [PATCH 10/15] TST: more test cases for suhosin --- testcases/files/logs/suhosin | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/testcases/files/logs/suhosin b/testcases/files/logs/suhosin index 90ed7bf1..a9b0002a 100644 --- a/testcases/files/logs/suhosin +++ b/testcases/files/logs/suhosin @@ -2,3 +2,9 @@ Mar 11 22:52:12 lighttpd[53690]: (mod_fastcgi.c.2676) FastCGI-stderr: ALERT - configured request variable name length limit exceeded - dropped variable 'upqchi07vFfAFuBjnIKGIwiLrHo3Vt68T3yqvhQu2TqetQ78roy7Q6bpTfDUtYFR593/MA' (attacker '198.51.100.167', file '/usr/local/captiveportal/index.php') # failJSON: { "time": "2005-02-26T22:52:29", "match": true , "host": "198.51.100.77" } Feb 26 22:52:29 host suhosin[9636]: ALERT - script tried to increase memory_limit to 268435456 bytes which is above the allowed value (attacker '198.51.100.77', file '/var/www/wordpress/wp-admin/includes/image.php', line 161) + +# failJSON: { "time": "2004-11-18T20:18:31", "match": true , "host": "188.132.244.3" } +Nov 18 20:18:31 platypus suhosin[28433]: ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'templatefile' (attacker '188.132.244.3', file '/home/ace-hosting/public_html/cart.php') + +# failJSON: { "time": "2004-10-25T10:59:49", "match": true , "host": "38.111.147.83" } +Oct 25 10:59:49 platypus suhosin[13953]: ALERT - configured GET variable value length limit exceeded - dropped variable '_route_' (attacker '38.111.147.83', file '/home/thegoblin/public_html/index.php') From 28d8aec511a96470db3816aa0ba9d35b3c5f6239 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 21 Nov 2013 07:05:21 +1100 Subject: [PATCH 11/15] DOC: Arch Linux link --- DEVELOP | 2 ++ 1 file changed, 2 insertions(+) diff --git a/DEVELOP b/DEVELOP index 3766d192..40182ff9 100644 --- a/DEVELOP +++ b/DEVELOP @@ -805,6 +805,8 @@ Which indicates that testcases/files/logs/mysqld.log has been moved or is a dire # Provide a release sample to distributors + * Arch Linux: + https://www.archlinux.org/packages/community/any/fail2ban/ * Debian: Yaroslav Halchenko http://packages.qa.debian.org/f/fail2ban.html * FreeBSD: Christoph Theis theis@gmx.at>, Nick Hilliard From 2bcc6c66b13de9252c01d53553e52aa950a33d3f Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Fri, 29 Nov 2013 21:54:36 +1100 Subject: [PATCH 12/15] TST: remove python 2.5 from TravisCI --- .travis.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 4d312575..1a0de9af 100644 --- a/.travis.yml +++ b/.travis.yml @@ -2,7 +2,6 @@ # travis-ci.org definition for Fail2Ban build language: python python: - - "2.5" - "2.6" - "2.7" - "3.2" From fe9e077acfe3f303ee4c5006cbb42707c01ddac5 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 30 Nov 2013 09:51:30 +1100 Subject: [PATCH 13/15] BF: correct spelling of port for solid-pop3 jail in jail.conf --- config/jail.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/jail.conf b/config/jail.conf index 4c3fa34e..2aab47ef 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -495,7 +495,7 @@ logpath = /var/log/secure [solid-pop3d] -posrt = pop3,pop3s +port = pop3,pop3s logpath = /var/log/mail.log From 3f4d1796122257fcf0d2e963a66526cf2fb2ea27 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 30 Nov 2013 09:52:32 +1100 Subject: [PATCH 14/15] BF: smtps not an IANA port - from #447 --- config/jail.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/jail.conf b/config/jail.conf index 2aab47ef..07389f9c 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -482,14 +482,14 @@ logpath = /var/log/mail.log # but can be set by syslog_facility in the dovecot configuration. [dovecot] -port = pop3,pop3s,imap,imaps,submission,smtps,sieve +port = pop3,pop3s,imap,imaps,submission,465,sieve logpath = /var/log/mail.log [dovecot-auth] filter = dovecot -port = pop3,pop3s,imap,imaps,submission,smtps,sieve +port = pop3,pop3s,imap,imaps,submission,465,sieve logpath = /var/log/secure From 04438cd1a198febe2aaf4eed7876bf7b0c22f4ba Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 30 Nov 2013 10:00:59 +1100 Subject: [PATCH 15/15] BF/ENH: mysql jail - rename to mysql-syslog to be consistent with 0.8.13. Add port to syslog defination. Document mysql configuration required for mysql jails --- config/jail.conf | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/config/jail.conf b/config/jail.conf index 07389f9c..84351360 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -599,7 +599,8 @@ logpath = /var/log/asterisk/messages maxretry = 10 -# To log wrong MySQL access attempts add to /etc/my.cnf: +# To log wrong MySQL access attempts add to /etc/my.cnf in [mysqld] or +# equivalent section: # log-error=/var/log/mysqld.log # log-warning = 2 [mysqld-auth] @@ -609,8 +610,12 @@ logpath = /var/log/mysqld.log maxretry = 5 -[mysqld-syslog-iptables] +# This requires my.cnf to contain (check the mysql version supports this) +# [mysqld_safe] +# syslog +[mysqld-syslog] +port = 3306 filter = mysqld-auth logpath = /var/log/daemon.log maxretry = 5