From 88385eb6c15732c7a2352c8899e9ec8c146e4093 Mon Sep 17 00:00:00 2001 From: Philipp Burndorfer Date: Sat, 25 Apr 2020 13:54:44 +0200 Subject: [PATCH 1/4] New openvpn jail. --- config/filter.d/openvpn.conf | 14 ++++++++++++++ config/jail.conf | 7 +++++++ fail2ban/tests/files/logs/openvpn | 22 ++++++++++++++++++++++ 3 files changed, 43 insertions(+) create mode 100644 config/filter.d/openvpn.conf create mode 100644 fail2ban/tests/files/logs/openvpn diff --git a/config/filter.d/openvpn.conf b/config/filter.d/openvpn.conf new file mode 100644 index 00000000..71b80de2 --- /dev/null +++ b/config/filter.d/openvpn.conf @@ -0,0 +1,14 @@ +# Fail2Ban filter for openvpn server +# Detecting wrong TLS handshakes +# typically logged in /var/log/syslog +# Author: Philipp Burndorfer + +[INCLUDES] +before = common.conf + +[Definition] +failregex =%(__hostname)s ovpn-server\[[0-9]{2,5}\]:.:[0-9]{3,5} TLS Auth Error:.* + %(__hostname)s ovpn-server\[[0-9]{2,5}\]:.:[0-9]{3,5} VERIFY ERROR:.* + %(__hostname)s ovpn-server\[[0-9]{2,5}\]:.:[0-9]{3,5} TLS Error: TLS handshake failed.* + %(__hostname)s ovpn-server\[[0-9]{2,5}\]:.:[0-9]{3,5} SIGUSR1\[soft,connection-reset\] received.* + %(__hostname)s ovpn-server\[[0-9]{2,5}\]: TLS Error: cannot locate HMAC in incoming packet from \[AF_INET\]:[0-9]{3,5} diff --git a/config/jail.conf b/config/jail.conf index edf3e676..fe89733c 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -978,6 +978,13 @@ logpath = %(apache_error_log)s port = http,https logpath = /var/log/traefik/access.log +[openvpn] +port = 443 # port of your openvpn server +protocol = tcp # protocol of your openvpn server +filter = openvpn +logpath = /var/log/syslog +maxretry = 5 + [scanlogd] logpath = %(syslog_local0)s banaction = %(banaction_allports)s diff --git a/fail2ban/tests/files/logs/openvpn b/fail2ban/tests/files/logs/openvpn new file mode 100644 index 00000000..04aa63dc --- /dev/null +++ b/fail2ban/tests/files/logs/openvpn @@ -0,0 +1,22 @@ +# should match + +Apr 25 10:57:30 hostname ovpn-server[901]: TCP connection established with [AF_INET]83.97.20.30:10107 +Apr 25 10:57:36 hostname ovpn-server[901]: 83.97.20.30:10107 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1626 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...] +Apr 25 10:57:36 hostname ovpn-server[901]: 83.97.20.30:10107 Connection reset, restarting [0] +# failJSON: { "time": "2005-04-25T10:57:36", "match": true , "host": "83.97.20.30" } +Apr 25 10:57:36 hostname ovpn-server[901]: 83.97.20.30:10107 SIGUSR1[soft,connection-reset] received, client-instance restarting +Apr 25 10:57:43 hostname ovpn-server[901]: TCP connection established with [AF_INET]83.97.20.30:29148 +Apr 25 10:57:49 hostname ovpn-server[901]: 83.97.20.30:29148 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1626 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...] +Apr 25 10:57:49 hostname ovpn-server[901]: 83.97.20.30:29148 Connection reset, restarting [0] +# failJSON: { "time": "2005-04-25T10:57:49", "match": true , "host": "83.97.20.30" } +Apr 25 10:57:49 hostname ovpn-server[901]: 83.97.20.30:29148 SIGUSR1[soft,connection-reset] received, client-instance restarting +Apr 25 10:57:56 hostname ovpn-server[901]: TCP connection established with [AF_INET]83.97.20.30:2495 +Apr 25 10:58:03 hostname ovpn-server[901]: 83.97.20.30:2495 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1626 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...] +Apr 25 10:58:03 hostname ovpn-server[901]: 83.97.20.30:2495 Connection reset, restarting [0] +# failJSON: { "time": "2005-04-25T10:58:03", "match": true , "host": "83.97.20.30" } +Apr 25 10:58:03 hostname ovpn-server[901]: 83.97.20.30:2495 SIGUSR1[soft,connection-reset] received, client-instance restarting +Apr 25 10:58:09 hostname ovpn-server[901]: TCP connection established with [AF_INET]83.97.20.30:30968 +Apr 25 10:58:15 hostname ovpn-server[901]: 83.97.20.30:30968 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1626 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...] +Apr 25 10:58:15 hostname ovpn-server[901]: 83.97.20.30:30968 Connection reset, restarting [0] +# failJSON: { "time": "2005-04-25T10:58:15", "match": true , "host": "83.97.20.30" } +Apr 25 10:58:15 hostname ovpn-server[901]: 83.97.20.30:30968 SIGUSR1[soft,connection-reset] received, client-instance restarting From 95710e9dacefd4a8ff95e6bd8f39fb2b267a5958 Mon Sep 17 00:00:00 2001 From: Philipp Burndorfer Date: Sat, 25 Apr 2020 13:56:53 +0200 Subject: [PATCH 2/4] Adapted changelog. --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 74f83e47..3a90d48c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -42,6 +42,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition * `action.d/firewallcmd-rich-*.conf` - fixed incorrect quoting, disabling port variable expansion by substitution of rich rule (gh-3815) * `filter.d/proxmox.conf` - add support to Proxmox Web GUI (gh-2966) +* `filter.d/openvpn.conf` - new filter and jail for openvpn recognizing failed TLS handshakes (gh-2702) ver. 1.1.0 (2024/04/25) - object-found--norad-59479-cospar-2024-069a--altitude-36267km ----------- From e1fc569291a34509eb8440d154101e3e67afeaa6 Mon Sep 17 00:00:00 2001 From: sebres Date: Wed, 29 Jan 2025 21:09:47 +0100 Subject: [PATCH 3/4] normalize jail (defaults, etc); added missing tests for all REs; common prefix for failregex, no catch-alls, etc --- config/filter.d/openvpn.conf | 12 +++++++----- config/jail.conf | 5 +---- fail2ban/tests/files/logs/openvpn | 10 ++++++++-- 3 files changed, 16 insertions(+), 11 deletions(-) diff --git a/config/filter.d/openvpn.conf b/config/filter.d/openvpn.conf index 71b80de2..97e6812f 100644 --- a/config/filter.d/openvpn.conf +++ b/config/filter.d/openvpn.conf @@ -7,8 +7,10 @@ before = common.conf [Definition] -failregex =%(__hostname)s ovpn-server\[[0-9]{2,5}\]:.:[0-9]{3,5} TLS Auth Error:.* - %(__hostname)s ovpn-server\[[0-9]{2,5}\]:.:[0-9]{3,5} VERIFY ERROR:.* - %(__hostname)s ovpn-server\[[0-9]{2,5}\]:.:[0-9]{3,5} TLS Error: TLS handshake failed.* - %(__hostname)s ovpn-server\[[0-9]{2,5}\]:.:[0-9]{3,5} SIGUSR1\[soft,connection-reset\] received.* - %(__hostname)s ovpn-server\[[0-9]{2,5}\]: TLS Error: cannot locate HMAC in incoming packet from \[AF_INET\]:[0-9]{3,5} +_daemon = ovpn-server\d* + +failregex = ^%(__prefix_line)s:\d{4,5} TLS Auth Error: + ^%(__prefix_line)s:\d{4,5} VERIFY ERROR: + ^%(__prefix_line)s:\d{4,5} TLS Error: TLS handshake failed\b + ^%(__prefix_line)s:\d{4,5} SIGUSR1\[soft,connection-reset\] received\b + ^%(__prefix_line)sTLS Error: cannot locate HMAC in incoming packet from \[AF_INET\]\s*:\d{4,5} diff --git a/config/jail.conf b/config/jail.conf index fe89733c..bce6df63 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -979,11 +979,8 @@ port = http,https logpath = /var/log/traefik/access.log [openvpn] -port = 443 # port of your openvpn server -protocol = tcp # protocol of your openvpn server -filter = openvpn +port = 443 logpath = /var/log/syslog -maxretry = 5 [scanlogd] logpath = %(syslog_local0)s diff --git a/fail2ban/tests/files/logs/openvpn b/fail2ban/tests/files/logs/openvpn index 04aa63dc..3be7e0f5 100644 --- a/fail2ban/tests/files/logs/openvpn +++ b/fail2ban/tests/files/logs/openvpn @@ -1,5 +1,3 @@ -# should match - Apr 25 10:57:30 hostname ovpn-server[901]: TCP connection established with [AF_INET]83.97.20.30:10107 Apr 25 10:57:36 hostname ovpn-server[901]: 83.97.20.30:10107 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1626 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...] Apr 25 10:57:36 hostname ovpn-server[901]: 83.97.20.30:10107 Connection reset, restarting [0] @@ -20,3 +18,11 @@ Apr 25 10:58:15 hostname ovpn-server[901]: 83.97.20.30:30968 WARNING: Bad encaps Apr 25 10:58:15 hostname ovpn-server[901]: 83.97.20.30:30968 Connection reset, restarting [0] # failJSON: { "time": "2005-04-25T10:58:15", "match": true , "host": "83.97.20.30" } Apr 25 10:58:15 hostname ovpn-server[901]: 83.97.20.30:30968 SIGUSR1[soft,connection-reset] received, client-instance restarting +# failJSON: { "time": "2005-04-25T11:19:00", "match": true , "host": "192.0.2.251" } +Apr 25 11:19:00 ovpn-server[13818]: 192.0.2.251:55329 VERIFY ERROR: depth=2, error=unable to get issuer certificate: +# failJSON: { "time": "2005-04-25T11:19:00", "match": true , "host": "192.0.2.252" } +Apr 25 11:19:00 ovpn-server[13819]: 192.0.2.252:55330 TLS Error: TLS handshake failed +# failJSON: { "time": "2005-04-25T11:19:00", "match": true , "host": "192.0.2.253" } +Apr 25 11:19:00 ovpn-server[13820]: TLS Error: cannot locate HMAC in incoming packet from [AF_INET]192.0.2.253:55340 +# failJSON: { "time": "2005-04-25T11:19:22", "match": true , "host": "192.0.2.254" } +Apr 25 11:19:22 ovpn-server[13821]: 192.0.2.254:64480 TLS Auth Error: Auth Username/Password verification failed for peer From d2c60a168f61ad87f3841a35ea49a2e81ae50e53 Mon Sep 17 00:00:00 2001 From: sebres Date: Wed, 29 Jan 2025 21:14:56 +0100 Subject: [PATCH 4/4] combine several regexes to single RE --- config/filter.d/openvpn.conf | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/config/filter.d/openvpn.conf b/config/filter.d/openvpn.conf index 97e6812f..2e0f13e1 100644 --- a/config/filter.d/openvpn.conf +++ b/config/filter.d/openvpn.conf @@ -9,8 +9,5 @@ before = common.conf [Definition] _daemon = ovpn-server\d* -failregex = ^%(__prefix_line)s:\d{4,5} TLS Auth Error: - ^%(__prefix_line)s:\d{4,5} VERIFY ERROR: - ^%(__prefix_line)s:\d{4,5} TLS Error: TLS handshake failed\b - ^%(__prefix_line)s:\d{4,5} SIGUSR1\[soft,connection-reset\] received\b +failregex = ^%(__prefix_line)s:\d{4,5} (?:TLS Auth Error:|VERIFY ERROR:|TLS Error: TLS handshake failed\b|SIGUSR1\[soft,connection-reset\] received\b) ^%(__prefix_line)sTLS Error: cannot locate HMAC in incoming packet from \[AF_INET\]\s*:\d{4,5}