From f15ed356198728c18470794ce6d88fb786571dc4 Mon Sep 17 00:00:00 2001 From: Mike Gabriel Date: Thu, 25 Feb 2021 20:13:18 +0100 Subject: [PATCH 1/5] config/: Add support for filtering out detected port scans via scanlogd. --- config/filter.d/scanlogd.conf | 17 +++++++++++++++++ config/jail.conf | 3 +++ 2 files changed, 20 insertions(+) create mode 100644 config/filter.d/scanlogd.conf diff --git a/config/filter.d/scanlogd.conf b/config/filter.d/scanlogd.conf new file mode 100644 index 00000000..65ad63f6 --- /dev/null +++ b/config/filter.d/scanlogd.conf @@ -0,0 +1,17 @@ +# Fail2Ban filter for port scans detected by scanlogd + +[INCLUDES] + +# Read common prefixes. If any customizations available -- read them from +# common.local +before = common.conf + +[Definition] + +_daemon = scanlogd + +failregex = ^%(__prefix_line)s\ to\ [\.:0-9a-f]+\ ports\ [\ \.,0-9]+,\ f.......,\ TOS\ [0-9]+,\ TTL\ [0-9]+\ \@[0-9]{1,2}:[0-9]{2}:[0-9]{2}$ + +ignoreregex = + +# Author: Mike Gabriel diff --git a/config/jail.conf b/config/jail.conf index 28f259a0..d6d8af67 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -965,3 +965,6 @@ logpath = %(apache_error_log)s # see `filter.d/traefik-auth.conf` for details and service example. port = http,https logpath = /var/log/traefik/access.log + +[scanlogd] +logpath = %{syslog_local0} From 0c4d356d118d1282d8bdbed21cb514f02953e65f Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Sat, 3 Apr 2021 23:10:51 +0200 Subject: [PATCH 2/5] added test log-file --- fail2ban/tests/files/logs/scanlogd | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 fail2ban/tests/files/logs/scanlogd diff --git a/fail2ban/tests/files/logs/scanlogd b/fail2ban/tests/files/logs/scanlogd new file mode 100644 index 00000000..5a97c578 --- /dev/null +++ b/fail2ban/tests/files/logs/scanlogd @@ -0,0 +1,8 @@ +# failJSON: { "time": "2005-03-05T21:44:43", "match": true , "host": "192.0.2.123" } +Mar 5 21:44:43 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 80, 81, 83, 88, 99, 443, 1080, 3128, ..., f????uxy, TOS 00, TTL 49 @20:44:43 +# failJSON: { "time": "2005-03-05T21:44:44", "match": true , "host": "192.0.2.123" } +Mar 5 21:44:44 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 497, 515, 544, 543, 464, 513, ..., fSrpauxy, TOS 00 @09:04:25 +# failJSON: { "time": "2005-03-05T21:44:45", "match": true , "host": "192.0.2.123" } +Mar 5 21:44:45 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 593, 548, 636, 646, 625, 631, ..., fSrpauxy, TOS 00, TTL 239 @17:34:00 +# failJSON: { "time": "2005-03-05T21:44:46", "match": true , "host": "192.0.2.123" } +Mar 5 21:44:46 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 22, 26, 37, 80, 25, 79, ..., fSrpauxy, TOS 00 @22:38:37 From 14edeed310ea5d74a13ec72d415b934cb4f7beb1 Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Sat, 3 Apr 2021 23:24:55 +0200 Subject: [PATCH 3/5] fixed regex (don't need to match whole line, e. g. every port etc) --- config/filter.d/scanlogd.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/scanlogd.conf b/config/filter.d/scanlogd.conf index 65ad63f6..15fea329 100644 --- a/config/filter.d/scanlogd.conf +++ b/config/filter.d/scanlogd.conf @@ -10,7 +10,7 @@ before = common.conf _daemon = scanlogd -failregex = ^%(__prefix_line)s\ to\ [\.:0-9a-f]+\ ports\ [\ \.,0-9]+,\ f.......,\ TOS\ [0-9]+,\ TTL\ [0-9]+\ \@[0-9]{1,2}:[0-9]{2}:[0-9]{2}$ +failregex = ^%(__prefix_line)s(?::) to \S+ ports\b ignoreregex = From 977dfe4bd762474e4e2d077e258c49772a48f6f3 Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Sat, 3 Apr 2021 23:29:16 +0200 Subject: [PATCH 4/5] small amend: sport after saddr is optional format of message: saddr[:sport] to daddr [and others,] ports port[, port...], ..., flags[, TOS TOS][, TTL TTL] @HH:MM:SS --- config/filter.d/scanlogd.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/scanlogd.conf b/config/filter.d/scanlogd.conf index 15fea329..d3fe78b0 100644 --- a/config/filter.d/scanlogd.conf +++ b/config/filter.d/scanlogd.conf @@ -10,7 +10,7 @@ before = common.conf _daemon = scanlogd -failregex = ^%(__prefix_line)s(?::) to \S+ ports\b +failregex = ^%(__prefix_line)s(?::)? to \S+ ports\b ignoreregex = From 2d51240b3e9e19a4259c03058ddde6ce8698397b Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Sat, 3 Apr 2021 23:33:49 +0200 Subject: [PATCH 5/5] correction for default log interpolation and added allports banaction --- config/jail.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/config/jail.conf b/config/jail.conf index d6d8af67..52cc161d 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -967,4 +967,5 @@ port = http,https logpath = /var/log/traefik/access.log [scanlogd] -logpath = %{syslog_local0} +logpath = %(syslog_local0)s +banaction = %(banaction_allports)s