From 30dc22fb2e59bb373613c8c9115959d3c14bfc4f Mon Sep 17 00:00:00 2001 From: benrubson Date: Thu, 29 Mar 2018 11:36:49 +0200 Subject: [PATCH 1/3] Detect Apache SNI error / misredirect attempts --- config/filter.d/apache-auth.conf | 2 ++ fail2ban/tests/files/logs/apache-auth | 9 +++++++++ 2 files changed, 11 insertions(+) diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf index d9a6fa5e..35911745 100644 --- a/config/filter.d/apache-auth.conf +++ b/config/filter.d/apache-auth.conf @@ -24,6 +24,8 @@ failregex = ^client (?:denied by server configuration|used wrong authentication ^%(auth_type)sunknown algorithm `(?:[^']*|.*?)' received\b ^invalid qop `(?:[^']*|.*?)' received\b ^%(auth_type)sinvalid nonce .*? received - user attempted time travel\b + ^Hostname .* provided via SNI(, but no hostname| and hostname .*) provided\b + ^No hostname was provided via SNI for a name based virtual host\b ignoreregex = diff --git a/fail2ban/tests/files/logs/apache-auth b/fail2ban/tests/files/logs/apache-auth index d430e291..93040b1d 100644 --- a/fail2ban/tests/files/logs/apache-auth +++ b/fail2ban/tests/files/logs/apache-auth @@ -125,6 +125,15 @@ # failJSON: { "time": "2013-11-18T22:39:33", "match": true , "host": "91.49.82.139" } [Mon Nov 18 22:39:33 2013] [error] [client 91.49.82.139] user gg not found: /, referer: http://sj.hopto.org/management.html +# failJSON: { "time": "2018-03-28T01:31:42", "match": true , "host": "91.49.82.139" } +[Wed Mar 28 01:31:42.355210 2018] [ssl:error] [pid 6586] [client 91.49.82.139:58028] AH02031: Hostname www.testdom.com provided via SNI, but no hostname provided in HTTP request + +# failJSON: { "time": "2018-03-28T01:31:42", "match": true , "host": "91.49.82.139" } +[Wed Mar 28 01:31:42.355210 2018] [ssl:error] [pid 6586] [client 91.49.82.139:58028] AH02032: Hostname www.testdom.com provided via SNI and hostname dummy.com provided via HTTP have no compatible SSL setup + +# failJSON: { "time": "2018-03-28T01:31:42", "match": true , "host": "91.49.82.139" } +[Wed Mar 28 01:31:42.355210 2018] [ssl:error] [pid 6586] [client 91.49.82.139:58028] AH02033: No hostname was provided via SNI for a name based virtual host + # filterOptions: {"logging": "syslog"} # failJSON: { "time": "2005-02-15T16:23:00", "match": true , "host": "192.0.2.1", "desc": "using syslog (ErrorLog syslog)" } From bd74f7ba8b3f706d0107f3065ea7d6fc3aee534f Mon Sep 17 00:00:00 2001 From: benrubson Date: Wed, 4 Apr 2018 00:20:58 +0200 Subject: [PATCH 2/3] Detect Apache SNI error / misredirect attempts, typos --- config/filter.d/apache-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf index 35911745..b7aa8b30 100644 --- a/config/filter.d/apache-auth.conf +++ b/config/filter.d/apache-auth.conf @@ -24,7 +24,7 @@ failregex = ^client (?:denied by server configuration|used wrong authentication ^%(auth_type)sunknown algorithm `(?:[^']*|.*?)' received\b ^invalid qop `(?:[^']*|.*?)' received\b ^%(auth_type)sinvalid nonce .*? received - user attempted time travel\b - ^Hostname .* provided via SNI(, but no hostname| and hostname .*) provided\b + ^Hostname \S+ provided via SNI(?:, but no hostname| and hostname \S+) provided\b ^No hostname was provided via SNI for a name based virtual host\b ignoreregex = From 28ae32f0cab8076382ed4134e86ca04b98c0be48 Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Wed, 4 Apr 2018 16:31:14 +0200 Subject: [PATCH 3/3] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 238bf56c..bab1f442 100644 --- a/ChangeLog +++ b/ChangeLog @@ -48,6 +48,7 @@ ver. 0.10.3-dev-1 (20??/??/??) - development edition ### New Features ### Enhancements +* `filter.d/apache-auth.conf`: detection of Apache SNI errors resp. misredirect attempts (gh-2017, gh-2097); * `filter.d/apache-noscript.conf`: extend failregex to match "Primary script unknown", e. g. from php-fpm (gh-2073); * date-detector extended with long epoch (`LEPOCH`) to parse milliseconds/microseconds posix-dates (gh-2029); * possibility to specify own regex-pattern to match epoch date-time, e. g. `^\[{EPOCH}\]` or `^\[{LEPOCH}\]` (gh-2038);