From 74fcb219ab6d17f365befeb10be99e7a9eb05e16 Mon Sep 17 00:00:00 2001 From: Pablo Rodriguez Fernandez Date: Mon, 19 Oct 2015 09:13:05 +0200 Subject: [PATCH] Enhanced Google domain detection in apache-fakegooglebot Previously, an attacker could fake a domain like crawl-1-1-1-1.googlebot.com.fake.net and get resolved. This change avoids to resolve fake Google domains. --- config/filter.d/ignorecommands/apache-fakegooglebot | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/ignorecommands/apache-fakegooglebot b/config/filter.d/ignorecommands/apache-fakegooglebot index 3028d86a..9e0f0d83 100755 --- a/config/filter.d/ignorecommands/apache-fakegooglebot +++ b/config/filter.d/ignorecommands/apache-fakegooglebot @@ -26,7 +26,7 @@ def is_googlebot(ip): from fail2ban.server.filter import DNSUtils host = DNSUtils.ipToName(ip) - if not host or not re.match('crawl-.*\.googlebot\.com', host): + if not host or not re.match('crawl-.*\.googlebot\.com$', host): sys.exit(1) host_ips = DNSUtils.dnsToIp(host) sys.exit(0 if ip in host_ips else 1)