From 03aba922383c6f9246589dbe7014f94dc03d9ee5 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sun, 5 Jan 2014 23:41:49 +1100 Subject: [PATCH 1/8] ENH: add kerio filter --- MANIFEST | 2 ++ config/filter.d/kerio.conf | 16 ++++++++++++++++ config/jail.conf | 5 +++++ fail2ban/tests/files/logs/kerio | 2 ++ 4 files changed, 25 insertions(+) create mode 100644 config/filter.d/kerio.conf create mode 100644 fail2ban/tests/files/logs/kerio diff --git a/MANIFEST b/MANIFEST index 5bdcd66d..4232b287 100644 --- a/MANIFEST +++ b/MANIFEST @@ -117,6 +117,7 @@ fail2ban/tests/files/logs/exim fail2ban/tests/files/logs/exim-spam fail2ban/tests/files/logs/gssftpd fail2ban/tests/files/logs/guacamole +fail2ban/tests/files/logs/kerio fail2ban/tests/files/logs/lighttpd-auth fail2ban/tests/files/logs/mysqld-auth fail2ban/tests/files/logs/nsd @@ -175,6 +176,7 @@ config/filter.d/courier-smtp.conf config/filter.d/cyrus-imap.conf config/filter.d/exim.conf config/filter.d/gssftpd.conf +config/filter.d/kerio.conf config/filter.d/suhosin.conf config/filter.d/named-refused.conf config/filter.d/openwebmail.conf diff --git a/config/filter.d/kerio.conf b/config/filter.d/kerio.conf new file mode 100644 index 00000000..f45d0940 --- /dev/null +++ b/config/filter.d/kerio.conf @@ -0,0 +1,16 @@ +# Fail2ban filter for kerio + +[Definition] + +failregex = ^\[\] SMTP Spam attack detected from , + ^\[\] IP address found in DNS blacklist \S+( \S+), mail from \S+$ + ^\[\] Relay attempt from IP address + ^\[\] Attempt to deliver to unknown recipient \S+, from \S+, IP address $ + +datepattern = %d/%b/%Y %H:%M:%S + +# DEV NOTES: +# +# Author: A.P. Lawrence +# +# Based off: http://aplawrence.com/Kerio/fail2ban.html diff --git a/config/jail.conf b/config/jail.conf index 5a0f22e3..4f315d1d 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -549,6 +549,11 @@ port = smtp,ssmtp,submission logpath = /var/log/exim/mainlog +[kerio] +port = imap,smtp,imaps,465 +logpath = /opt/kerio/mailserver/store/logs/security.log + + # # Mail servers authenticators: might be used for smtp,ftp,imap servers, so # all relevant ports get banned diff --git a/fail2ban/tests/files/logs/kerio b/fail2ban/tests/files/logs/kerio new file mode 100644 index 00000000..2eaf9a38 --- /dev/null +++ b/fail2ban/tests/files/logs/kerio @@ -0,0 +1,2 @@ +# failJSON: { "time": "", "match": true, "host": "200.90.149.178" } +[17/Jun/2011 17:00:45] Attempt to deliver to unknown recipient , from , IP address 200.90.149.178 From f47ff95b8edbcf954899b3d663cc0c5e7d1c6bc4 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 6 Jan 2014 08:47:39 +1100 Subject: [PATCH 2/8] BF: datepattern for fail2ban-regex --- bin/fail2ban-regex | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/bin/fail2ban-regex b/bin/fail2ban-regex index fc39c958..014bfb2f 100755 --- a/bin/fail2ban-regex +++ b/bin/fail2ban-regex @@ -297,6 +297,14 @@ class Fail2banRegex(object): pass else: self.setJournalMatch(shlex.split(journalmatch)) + # Read out and set possible value for journalmatch + try: + datepattern = reader.get("Init", "datepattern") + except (NoSectionError, NoOptionError): + # No [Init].datepattern found. + pass + else: + self.setDatePattern(datepattern) else: print "Use %11s line : %s" % (regex, shortstr(value)) regex_values = [RegexStat(value)] From 16875059957ae6c056b59e68dacb105feda5fc9c Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 6 Jan 2014 09:06:05 +1100 Subject: [PATCH 3/8] BF: Fix datepattern --- config/filter.d/kerio.conf | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/config/filter.d/kerio.conf b/config/filter.d/kerio.conf index f45d0940..b757386e 100644 --- a/config/filter.d/kerio.conf +++ b/config/filter.d/kerio.conf @@ -2,12 +2,13 @@ [Definition] -failregex = ^\[\] SMTP Spam attack detected from , - ^\[\] IP address found in DNS blacklist \S+( \S+), mail from \S+$ - ^\[\] Relay attempt from IP address - ^\[\] Attempt to deliver to unknown recipient \S+, from \S+, IP address $ +failregex = ^ SMTP Spam attack detected from , + ^ IP address found in DNS blacklist \S+( \S+), mail from \S+$ + ^ Relay attempt from IP address + ^ Attempt to deliver to unknown recipient \S+, from \S+, IP address $ +[Init] -datepattern = %d/%b/%Y %H:%M:%S +datepattern = ^[%%d/%%b/%%Y %%H:%%M:%%S] # DEV NOTES: # From b963d17009864354b54d2dc95a1ab31a1e74a769 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 6 Jan 2014 09:07:25 +1100 Subject: [PATCH 4/8] TST: datepattern needed in testSampleRegexsFactory --- fail2ban/tests/samplestestcase.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fail2ban/tests/samplestestcase.py b/fail2ban/tests/samplestestcase.py index 78120df5..781587ae 100644 --- a/fail2ban/tests/samplestestcase.py +++ b/fail2ban/tests/samplestestcase.py @@ -78,6 +78,8 @@ def testSampleRegexsFactory(name): self.filter.setMaxLines(opt[3]) elif opt[2] == "addignoreregex": self.filter.addIgnoreRegex(opt[3]) + elif opt[2] == "datepattern": + self.filter.setDatePattern(opt[3]) self.assertTrue( os.path.isfile(os.path.join(TEST_FILES_DIR, "logs", name)), From 981ded4da99e3d41ae47988ad47e4d2bcc2db77e Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 6 Jan 2014 09:52:39 +1100 Subject: [PATCH 5/8] TST: add JSON data --- fail2ban/tests/files/logs/kerio | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/tests/files/logs/kerio b/fail2ban/tests/files/logs/kerio index 2eaf9a38..d5c44f9d 100644 --- a/fail2ban/tests/files/logs/kerio +++ b/fail2ban/tests/files/logs/kerio @@ -1,2 +1,2 @@ -# failJSON: { "time": "", "match": true, "host": "200.90.149.178" } +# failJSON: { "time": "2011-06-17T17:00:45", "match": true, "host": "200.90.149.178" } [17/Jun/2011 17:00:45] Attempt to deliver to unknown recipient , from , IP address 200.90.149.178 From 263ac327308323550e1a9c7efe47ac696be2fd6c Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 18 Jan 2014 23:18:33 +1100 Subject: [PATCH 6/8] ENH: test log samples for kerio thanks to Tony Lawrence --- THANKS | 1 + config/filter.d/kerio.conf | 2 +- fail2ban/tests/files/logs/kerio | 27 +++++++++++++++++++++++++++ 3 files changed, 29 insertions(+), 1 deletion(-) diff --git a/THANKS b/THANKS index 3bd2e411..46dcd4c1 100644 --- a/THANKS +++ b/THANKS @@ -84,6 +84,7 @@ Steven Hiscocks TESTOVIK Tom Pike Tomas Pihl +Tony Lawrence Tyler Vaclav Misek Vincent Deffontaines diff --git a/config/filter.d/kerio.conf b/config/filter.d/kerio.conf index b757386e..e7ca0a01 100644 --- a/config/filter.d/kerio.conf +++ b/config/filter.d/kerio.conf @@ -3,7 +3,7 @@ [Definition] failregex = ^ SMTP Spam attack detected from , - ^ IP address found in DNS blacklist \S+( \S+), mail from \S+$ + ^ IP address found in DNS blacklist \S+, mail from \S+ to \S+$ ^ Relay attempt from IP address ^ Attempt to deliver to unknown recipient \S+, from \S+, IP address $ [Init] diff --git a/fail2ban/tests/files/logs/kerio b/fail2ban/tests/files/logs/kerio index d5c44f9d..c9368c22 100644 --- a/fail2ban/tests/files/logs/kerio +++ b/fail2ban/tests/files/logs/kerio @@ -1,2 +1,29 @@ # failJSON: { "time": "2011-06-17T17:00:45", "match": true, "host": "200.90.149.178" } [17/Jun/2011 17:00:45] Attempt to deliver to unknown recipient , from , IP address 200.90.149.178 + +# failJSON: { "time": "2014-01-18T06:41:25", "match": true, "host": "202.169.236.195" } +[18/Jan/2014 06:41:25] SMTP Spam attack detected from 202.169.236.195, client closed connection before SMTP greeting + +# failJSON: { "time": "2014-01-18T06:42:12", "match": true, "host": "115.147.104.13" } +[18/Jan/2014 06:42:12] SMTP Spam attack detected from 115.147.104.13, client sent data before SMTP greeting + +# failJSON: { "time": "2014-01-18T05:47:17", "match": true, "host": "112.140.49.130" } +[18/Jan/2014 05:47:17] IP address 112.140.49.130 found in DNS blacklist UCEProtect1, mail from to + +# failJSON: { "time": "2014-01-18T06:39:44", "match": true, "host": "91.232.105.66" } +[18/Jan/2014 06:39:44] IP address 91.232.105.66 found in DNS blacklist BarracudaCentral, mail from to + +# failJSON: { "time": "2013-12-30T05:27:59", "match": true, "host": "64.31.59.75" } +[30/Dec/2013 05:27:59] Relay attempt from IP address 64.31.59.75, mail from to rejected + +# failJSON: { "time": "2013-12-30T19:24:28", "match": true, "host": "74.63.193.116" } +[30/Dec/2013 19:24:28] Relay attempt from IP address 74.63.193.116, mail from to rejected + +# failJSON: { "time": "2013-12-13T00:22:45", "match": true, "host": "23.108.148.156" } +[13/Dec/2013 00:22:45] Attempt to deliver to unknown recipient , from , IP address 23.108.148.156 + +# failJSON: { "time": "2013-12-13T01:11:04", "match": true, "host": "218.85.253.185" } +[13/Dec/2013 01:11:04] Attempt to deliver to unknown recipient , from , IP address 218.85.253.185 + + + From 10edd994d17a969079a613c8794283e8032c8cf3 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 18 Jan 2014 23:21:44 +1100 Subject: [PATCH 7/8] DOC: ChangeLog for kerio filters --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 0e433e90..8174993a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -56,6 +56,8 @@ configuration before relying on it. according to the XARF standard (v0.2). Close gh-105 * Support PyPy * Add filter for apache-botsearch + * Add filter for kerio. Thanks Tony Lawrence for blog of regexs and + providing samples. Close gh-120 * Filter for stunnel * Filter for Counter Strike 1.6. Thanks to onorua for logs. Close gh-347 From 97c7d391a48522e9dccaabd74f920944cd4fb169 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 18 Jan 2014 23:52:20 +1100 Subject: [PATCH 8/8] BF: remove duplicate implemenation of reading datepatterns in fail2ban-regex --- bin/fail2ban-regex | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/bin/fail2ban-regex b/bin/fail2ban-regex index d470be9c..cfaa4a89 100755 --- a/bin/fail2ban-regex +++ b/bin/fail2ban-regex @@ -284,15 +284,8 @@ class Fail2banRegex(object): datepattern = command[3] self.setDatePattern(datepattern) else: - self.setJournalMatch(shlex.split(journalmatch)) - # Read out and set possible value for journalmatch - try: - datepattern = reader.get("Init", "datepattern") - except (NoSectionError, NoOptionError): - # No [Init].datepattern found. - pass - else: - self.setDatePattern(datepattern) + print "ERROR: failed to read %s" % value + return False else: print "Use %11s line : %s" % (regex, shortstr(value)) regex_values = [RegexStat(value)]