From 67436078f77a921ae097a6cdda7693d7430c1a01 Mon Sep 17 00:00:00 2001 From: Ivo Truxa Date: Mon, 30 Dec 2013 16:23:21 +0100 Subject: [PATCH 1/6] TST: test case for honeypot exim-spam --- fail2ban/tests/files/logs/exim-spam | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/fail2ban/tests/files/logs/exim-spam b/fail2ban/tests/files/logs/exim-spam index 46b915d1..4dae6b74 100644 --- a/fail2ban/tests/files/logs/exim-spam +++ b/fail2ban/tests/files/logs/exim-spam @@ -14,4 +14,12 @@ 2013-06-15 11:20:36 [2516] 1Unmew-0000ea-SE H=egeftech.static.otenet.gr [83.235.177.148]:32706 I=[1.2.3.4]:25 F=auguriesvbd40@google.com rejected after DATA: This message contains a virus (Sanesecurity.Junk.39934.UNOFFICIAL). # failJSON: { "time": "2013-06-16T02:50:43", "match": true , "host": "111.67.203.114" } 2013-06-16 02:50:43 H=dbs.marsukov.com [111.67.203.114] F= rejected RCPT : rejected because 111.67.203.114 is in a black list at dnsbl.sorbs.net\nCurrently Sending Spam See: http://www.sorbs.net/lookup.shtml?111.67.203.114 - +# https://github.com/fail2ban/fail2ban/issues/533 +# failJSON: { "time": "2013-12-29T15:34:12", "match": true , "host": "188.76.45.72" } +2013-12-29 15:34:12 1VxHRO-000NiI-Ly SA: Action: silently tossed message: score=31.0 required=5.0 trigger=30.0 (scanned in 6/6 secs | Message-Id: etPan.09bd0c40.c3d5f675.fdf7@server.local). From (host=72.45.76.188.dynamic.jazztel.es [188.76.45.72]) for me@my.com +# failJSON: { "time": "2013-12-29T15:39:11", "match": true , "host": "178.123.108.196" } +2013-12-29 15:39:11 1VxHWD-000NuW-83 SA: Action: silently tossed message: score=35.8 required=5.0 trigger=30.0 (scanned in 6/6 secs | Message-Id: 1VxHWD-000NuW-83). From <> (host=NULL [178.123.108.196]) for me@my.com +# https://github.com/fail2ban/fail2ban/issues/541 +# failJSON: { "time": "2013-12-30T00:24:50", "match": true , "host": "178.123.108.196" } +2013-12-30 00:24:50 1VxPit-000MMd-U4 SA: Action: flagged as Spam but accepted: score=8.2 required=5.0 (scanned in 6/6 secs | Message-Id: 008701cf04ed_24497d70_6cdc7850_@xxx.xx). From (host=ip-4.net-3-2-1.rev.xxx.xx [178.123.108.196]) for trap@my.com + From 1365a7781b8e51997f10656fa624058b2a9a6ff1 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Wed, 1 Jan 2014 22:41:48 +1100 Subject: [PATCH 2/6] TST: log files to cinlude only the #541 test case --- fail2ban/tests/files/logs/exim-spam | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/fail2ban/tests/files/logs/exim-spam b/fail2ban/tests/files/logs/exim-spam index 4dae6b74..144f8905 100644 --- a/fail2ban/tests/files/logs/exim-spam +++ b/fail2ban/tests/files/logs/exim-spam @@ -14,12 +14,7 @@ 2013-06-15 11:20:36 [2516] 1Unmew-0000ea-SE H=egeftech.static.otenet.gr [83.235.177.148]:32706 I=[1.2.3.4]:25 F=auguriesvbd40@google.com rejected after DATA: This message contains a virus (Sanesecurity.Junk.39934.UNOFFICIAL). # failJSON: { "time": "2013-06-16T02:50:43", "match": true , "host": "111.67.203.114" } 2013-06-16 02:50:43 H=dbs.marsukov.com [111.67.203.114] F= rejected RCPT : rejected because 111.67.203.114 is in a black list at dnsbl.sorbs.net\nCurrently Sending Spam See: http://www.sorbs.net/lookup.shtml?111.67.203.114 -# https://github.com/fail2ban/fail2ban/issues/533 -# failJSON: { "time": "2013-12-29T15:34:12", "match": true , "host": "188.76.45.72" } -2013-12-29 15:34:12 1VxHRO-000NiI-Ly SA: Action: silently tossed message: score=31.0 required=5.0 trigger=30.0 (scanned in 6/6 secs | Message-Id: etPan.09bd0c40.c3d5f675.fdf7@server.local). From (host=72.45.76.188.dynamic.jazztel.es [188.76.45.72]) for me@my.com -# failJSON: { "time": "2013-12-29T15:39:11", "match": true , "host": "178.123.108.196" } -2013-12-29 15:39:11 1VxHWD-000NuW-83 SA: Action: silently tossed message: score=35.8 required=5.0 trigger=30.0 (scanned in 6/6 secs | Message-Id: 1VxHWD-000NuW-83). From <> (host=NULL [178.123.108.196]) for me@my.com # https://github.com/fail2ban/fail2ban/issues/541 # failJSON: { "time": "2013-12-30T00:24:50", "match": true , "host": "178.123.108.196" } -2013-12-30 00:24:50 1VxPit-000MMd-U4 SA: Action: flagged as Spam but accepted: score=8.2 required=5.0 (scanned in 6/6 secs | Message-Id: 008701cf04ed_24497d70_6cdc7850_@xxx.xx). From (host=ip-4.net-3-2-1.rev.xxx.xx [178.123.108.196]) for trap@my.com +2013-12-30 00:24:50 1VxPit-000MMd-U4 SA: Action: flagged as Spam but accepted: score=8.2 required=5.0 (scanned in 6/6 secs | Message-Id: 008701cf04ed_24497d70_6cdc7850_@xxx.xx). From (host=ip-4.net-3-2-1.rev.xxx.xx [178.123.108.196]) for trap@example.com From 9c7bb3b97e1dcc251e912725c413baede9b88f7c Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Wed, 1 Jan 2014 22:45:13 +1100 Subject: [PATCH 3/6] ENH: exim-spam to take honeypot email address as argument. Closes #541 --- ChangeLog | 1 + config/filter.d/exim-spam.conf | 10 ++++++++++ 2 files changed, 11 insertions(+) diff --git a/ChangeLog b/ChangeLog index b2a98046..31d16fa1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -66,6 +66,7 @@ configuration before relying on it. failregex / ignoreregex * [..e019ab7] Multiple instances of the same action are allowed in the same jail -- use actname option to disambiguate. + * Add honeypot email address to exim-spam filter as argument ver. 0.8.12 (2013/12/XX) - things-can-only-get-better ----------- diff --git a/config/filter.d/exim-spam.conf b/config/filter.d/exim-spam.conf index 15737b2f..24c80bdd 100644 --- a/config/filter.d/exim-spam.conf +++ b/config/filter.d/exim-spam.conf @@ -12,9 +12,19 @@ before = exim-common.conf failregex = ^%(pid)s \S+ F=(<>|\S+@\S+) %(host_info)srejected by local_scan\(\): .{0,256}$ ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: .*dnsbl.*\s*$ ^%(pid)s \S+ %(host_info)sF=(<>|[^@]+@\S+) rejected after DATA: This message contains a virus \(\S+\)\.\s*$ + ^%(pid)s \S+ SA: Action: flagged as Spam but accepted: score=\d+\.\d+ required=\d+\.\d+ \(scanned in \d+/\d+ secs \| Message-Id: \S+\)\. From \S+ \(host=\S+ \[\]\) for $ ignoreregex = +[Init] + +# Option: honeypot +# Notes.: honeypot is an email address that isn't published anywhere that a +# legitimate email sender would send email too. +# Values: email address + +honeypot = trap@example.com + # DEV Notes: # The %(host_info) defination contains a match # From 55688395fbb2dad9736bdcddac0f44bf11180a54 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Wed, 1 Jan 2014 22:56:08 +1100 Subject: [PATCH 4/6] DOC: doco for exim-spam --- config/filter.d/exim-spam.conf | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/config/filter.d/exim-spam.conf b/config/filter.d/exim-spam.conf index 24c80bdd..4013ca1e 100644 --- a/config/filter.d/exim-spam.conf +++ b/config/filter.d/exim-spam.conf @@ -1,5 +1,17 @@ # Fail2Ban filter for exim the spam rejection messages # +# Honeypot traps are very useful for fighting spam. You just activate an email +# address on your domain that you do not intend to use at all, and that normal +# people do not risk to try for contacting you. It may be something that +# spammers often test. You can also hide the address on a web page to be picked +# by spam spiders. Or simply parse your mail logs for an invalid address +# already being frequently targeted by spammers. Enable the address and +# redirect it to the blackhole. In Exim's alias file, you would add the +# following line (assuming the address is honeypot@yourdomain.com): +# +# honeypot: :blackhole: +# +# The use the jail.local filter = exim-spam[honeypot=honeypot@yourdomain.com] [INCLUDES] From 9e390d6549c88420343fdd255a4d6334b161540a Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Tue, 7 Jan 2014 11:53:20 +1100 Subject: [PATCH 5/6] ENH: jail.conf for exim-honeypot --- config/jail.conf | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/config/jail.conf b/config/jail.conf index acec2c5b..f63843a1 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -544,6 +544,11 @@ port = smtp,ssmtp,submission logpath = /var/log/exim/mainlog +[exim-honeypot] +port = smtp,ssmtp,submission +logpath = /var/log/exim/mainlog + + # # Mail servers authenticators: might be used for smtp,ftp,imap servers, so # all relevant ports get banned From aabdc51e870bac3ca83dd4aa0d2f8fa61019ba15 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Tue, 7 Jan 2014 16:26:29 +1100 Subject: [PATCH 6/6] BF: revert separate jail for exim-honeypot as only exim-spam exists. --- config/jail.conf | 5 ----- 1 file changed, 5 deletions(-) diff --git a/config/jail.conf b/config/jail.conf index ba43ac7b..5a0f22e3 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -549,11 +549,6 @@ port = smtp,ssmtp,submission logpath = /var/log/exim/mainlog -[exim-honeypot] -port = smtp,ssmtp,submission -logpath = /var/log/exim/mainlog - - # # Mail servers authenticators: might be used for smtp,ftp,imap servers, so # all relevant ports get banned