From f4c7c8f4b303b8d450ea7a1073fb6ea23b7a186b Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 5 Oct 2013 18:59:41 +1000 Subject: [PATCH 01/10] ENH: sasl - anchor regex at start --- ChangeLog | 1 + config/filter.d/sasl.conf | 20 +++++++------------- 2 files changed, 8 insertions(+), 13 deletions(-) diff --git a/ChangeLog b/ChangeLog index 46b12528..295d7156 100644 --- a/ChangeLog +++ b/ChangeLog @@ -80,6 +80,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests linux-pam before version 0.99.2.0 (2005) * filter.d/gssftpd - anchored regex at start * filter.d/mysqld-auth.conf - mysql can use syslog + * filter.d/sasl - anchor at start and base on syslog * fail2ban-regex - now generates http://www.debuggex.com urls for debugging regular expressions with the -D parameter. * filter.d/sshd - regex enhancements to support openssh-6.3. Closes Debian diff --git a/config/filter.d/sasl.conf b/config/filter.d/sasl.conf index 6c4aeba7..c720abc1 100644 --- a/config/filter.d/sasl.conf +++ b/config/filter.d/sasl.conf @@ -4,19 +4,13 @@ # # +[INCLUDES] + +before = common.conf + [Definition] -# Option: failregex -# Notes.: regex to match the password failures messages in the logfile. The -# host must be matched by a group named "host". The tag "" can -# be used for standard IP/hostname matching and is only an alias for -# (?:::f{4,6}:)?(?P[\w\-.^_]+) -# Values: TEXT -# -failregex = (?i): warning: [-._\w]+\[\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$ +_daemon = postfix/smtpd + +failregex = ^%(__prefix_line)swarning: [-._\w]+\[\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$ -# Option: ignoreregex -# Notes.: regex to ignore. If this regex matches, the line is ignored. -# Values: TEXT -# -ignoreregex = From 0d8d1ae26c96e2819ebc29e6ac387cfaec34ef4a Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 14 Oct 2013 22:36:01 +1100 Subject: [PATCH 02/10] ENH: new action.d/firewall-cmd-direct-new.conf from Redhat Bugzilla #979622 --- ChangeLog | 3 + config/action.d/firewall-cmd-direct-new.conf | 101 +++++++++++++++++++ 2 files changed, 104 insertions(+) create mode 100644 config/action.d/firewall-cmd-direct-new.conf diff --git a/ChangeLog b/ChangeLog index 0e2210b7..688ed206 100644 --- a/ChangeLog +++ b/ChangeLog @@ -49,6 +49,9 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests to Should- rc init fields - New Features: + Edgar Hoch + * action.d/firewall-cmd-direct-new.conf - action for Fedora firewalld + from https://bugzilla.redhat.com/show_bug.cgi?id=979622 Andy Fragen and Daniel Black * filter.d/osx-ipfw.conf - ipfw action for OSX based on random rule numbers. diff --git a/config/action.d/firewall-cmd-direct-new.conf b/config/action.d/firewall-cmd-direct-new.conf new file mode 100644 index 00000000..8b323068 --- /dev/null +++ b/config/action.d/firewall-cmd-direct-new.conf @@ -0,0 +1,101 @@ +# Fail2Ban configuration file +# +# Author: Edgar Hoch, Cyril Jaquier +# Copied from iptables-new.conf and modified for use with firewalld by Edgar Hoch. +# It uses "firewall-cmd" instead of "iptables". +# firewall-cmd is based on the command of version firewalld-0.3.4-1.fc19 . +# iptables-new.conf copied from iptables.conf and modified by Yaroslav Halchenko +# to fullfill the needs of bugreporter dbts#350746. +# +# $Revision$ +# + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +## Old version of iptables-new.conf: +## actionstart = iptables -N fail2ban- +## iptables -A fail2ban- -j RETURN +## iptables -I -m state --state NEW -p --dport -j fail2ban- +actionstart = firewall-cmd --direct --add-chain ipv4 filter fail2ban- + firewall-cmd --direct --add-rule ipv4 filter fail2ban- 1000 -j RETURN + firewall-cmd --direct --add-rule ipv4 filter 0 -m state --state NEW -p --dport -j fail2ban- + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +## Old version of iptables-new.conf: +## actionstop = iptables -D -m state --state NEW -p --dport -j fail2ban- +## iptables -F fail2ban- +## iptables -X fail2ban- + + # The following rule does not work, because firewalld keeps its own database of firewall rules. + # firewall-cmd --direct --passthrough ipv4 -F fail2ban- + # The better rule would be the following, + # but firewall-cmd has not implemented this command with firewalld-0.3.3-2.fc19 . + # firewall-cmd --direct --flush-chain ipv4 filter fail2ban- + # The following is a workaround using a loop to implement the --flush-chain command. + +actionstop = firewall-cmd --direct --remove-rule ipv4 filter 0 -m state --state NEW -p --dport -j fail2ban- + ( IFS='|' ; for r in $( firewall-cmd --direct --get-rules ipv4 filter fail2ban- | tr '\n' '|' ) ; do eval firewall-cmd --direct --remove-rule ipv4 filter fail2ban- $r ; done ) + firewall-cmd --direct --remove-chain ipv4 filter fail2ban- + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +## Old version of iptables-new.conf: +## actioncheck = iptables -n -L | grep -q 'fail2ban-[ \t]' +actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q 'fail2ban-[ \t]' + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: IP address +# number of failures +#