From 6ccd57813cca617561fc67d2771361f30642eef7 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 11 Jun 2013 14:56:25 -0400 Subject: [PATCH] BF: anchor apache- filters. Close #248 See https://vndh.net/note:fail2ban-089-denial-service for more information --- config/filter.d/apache-auth.conf | 10 +++++++--- config/filter.d/apache-common.conf | 17 +++++++++++++++++ config/filter.d/apache-nohome.conf | 8 +++++++- config/filter.d/apache-noscript.conf | 10 ++++++++-- config/filter.d/apache-overflows.conf | 8 +++++++- testcases/files/logs/apache-auth | 5 +++++ testcases/files/logs/apache-noscript | 1 + 7 files changed, 52 insertions(+), 7 deletions(-) create mode 100644 config/filter.d/apache-common.conf create mode 100644 testcases/files/logs/apache-auth create mode 100644 testcases/files/logs/apache-noscript diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf index 66f6a1d6..ae3232f2 100644 --- a/config/filter.d/apache-auth.conf +++ b/config/filter.d/apache-auth.conf @@ -4,6 +4,12 @@ # # +[INCLUDES] + +# Read common prefixes. If any customizations available -- read them from +# common.local +before = apache-common.conf + [Definition] # Option: failregex @@ -13,9 +19,7 @@ # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = [[]client []] user .* authentication failure - [[]client []] user .* not found - [[]client []] user .* password mismatch +failregex = ^%(_apache_error_client)s user .* (authentication failure|not found|password mismatch)\s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/config/filter.d/apache-common.conf b/config/filter.d/apache-common.conf new file mode 100644 index 00000000..c3829e2f --- /dev/null +++ b/config/filter.d/apache-common.conf @@ -0,0 +1,17 @@ +# Generic configuration items (to be used as interpolations) in other +# apache filters +# +# Author: Yaroslav Halchenko +# +# + +[INCLUDES] + +# Load customizations if any available +after = apache-common.local + + +[DEFAULT] + +# Common prefix for [error] apache messages which also would include +_apache_error_client = \[[^]]+\] \[error\] \[client \] diff --git a/config/filter.d/apache-nohome.conf b/config/filter.d/apache-nohome.conf index 6e738c68..1347b10d 100644 --- a/config/filter.d/apache-nohome.conf +++ b/config/filter.d/apache-nohome.conf @@ -4,6 +4,12 @@ # # +[INCLUDES] + +# Read common prefixes. If any customizations available -- read them from +# common.local +before = apache-common.conf + [Definition] # Option: failregex @@ -13,7 +19,7 @@ # per-domain log files. # Values: TEXT # -failregex = [[]client []] File does not exist: .*/~.* +failregex = ^%(_apache_error_client)s File does not exist: .*/~.* # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf index 5b48cb32..295e1b9f 100644 --- a/config/filter.d/apache-noscript.conf +++ b/config/filter.d/apache-noscript.conf @@ -4,6 +4,12 @@ # # +[INCLUDES] + +# Read common prefixes. If any customizations available -- read them from +# common.local +before = apache-common.conf + [Definition] # Option: failregex @@ -13,8 +19,8 @@ # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = [[]client []] (File does not exist|script not found or unable to stat): /\S*(\.php|\.asp|\.exe|\.pl) - [[]client []] script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat *$ +failregex = ^%(_apache_error_client)s (File does not exist|script not found or unable to stat): /\S*(\.php|\.asp|\.exe|\.pl)\s*$ + ^%(_apache_error_client)s script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat\s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/config/filter.d/apache-overflows.conf b/config/filter.d/apache-overflows.conf index e25b79a4..1cf08db7 100644 --- a/config/filter.d/apache-overflows.conf +++ b/config/filter.d/apache-overflows.conf @@ -4,13 +4,19 @@ # # +[INCLUDES] + +# Read common prefixes. If any customizations available -- read them from +# common.local +before = apache-common.conf + [Definition] # Option: failregex # Notes.: Regexp to catch Apache overflow attempts. # Values: TEXT # -failregex = [[]client []] (Invalid (method|URI) in request|request failed: URI too long|erroneous characters after protocol string) +failregex = ^%(_apache_error_client)s (Invalid (method|URI) in request|request failed: URI too long|erroneous characters after protocol string) # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth new file mode 100644 index 00000000..cf0f6d30 --- /dev/null +++ b/testcases/files/logs/apache-auth @@ -0,0 +1,5 @@ +# Should not match -- DoS vector https://vndh.net/note:fail2ban-089-denial-service +[Sat Jun 01 02:17:42 2013] [error] [client 192.168.33.1] File does not exist: /srv/http/site/[client 192.168.0.1] user root not found + +# should match +[Sat Jun 01 02:17:42 2013] [error] [client 192.168.0.2] user root not found diff --git a/testcases/files/logs/apache-noscript b/testcases/files/logs/apache-noscript new file mode 100644 index 00000000..5d5d35ff --- /dev/null +++ b/testcases/files/logs/apache-noscript @@ -0,0 +1 @@ +[Sun Jun 09 07:57:47 2013] [error] [client 192.0.43.10] script '/usr/lib/cgi-bin/gitweb.cgiwp-login.php' not found or unable to stat