From 0b63fc312d27589edad94b9226d188bde8f6945f Mon Sep 17 00:00:00 2001 From: Vincent Laffargue Date: Sun, 10 Mar 2024 10:56:35 +0100 Subject: [PATCH 1/3] Change Regex Recidive and journalmatch For Systemd Match --- config/filter.d/recidive.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/filter.d/recidive.conf b/config/filter.d/recidive.conf index 63833cab..7dcecfe4 100644 --- a/config/filter.d/recidive.conf +++ b/config/filter.d/recidive.conf @@ -27,12 +27,12 @@ _daemon = (?:fail2ban(?:-server|\.actions)\s*) # this filter 'recidive', or supply another name with `filter = recidive[_jailname="jail"]` _jailname = recidive -failregex = ^%(__prefix_line)s(?:\s*fail2ban\.actions\s*%(__pid_re)s?:\s+)?NOTICE\s+\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+\s*$ +failregex = ^%(__prefix_line)s(?:\s*fail2ban(?:\.actions)?\s*%(__pid_re)s?:\s+)?(?:NOTICE\s+)?\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+\s*$ datepattern = ^{DATE} ignoreregex = -journalmatch = _SYSTEMD_UNIT=fail2ban.service PRIORITY=5 +journalmatch = _SYSTEMD_UNIT=fail2ban.service # Author: Tom Hendrikx, modifications by Amir Caspi From dd3c78ecaba07328d5a0ba29d7dcce4ee4ed2317 Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Mon, 11 Mar 2024 17:49:06 +0100 Subject: [PATCH 2/3] filter.d/recidive.conf: conditional RE depending on logtype (for file or journal) --- config/filter.d/recidive.conf | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/config/filter.d/recidive.conf b/config/filter.d/recidive.conf index 7dcecfe4..86d939bb 100644 --- a/config/filter.d/recidive.conf +++ b/config/filter.d/recidive.conf @@ -19,7 +19,7 @@ # common.local before = common.conf -[Definition] +[DEFAULT] _daemon = (?:fail2ban(?:-server|\.actions)\s*) @@ -27,8 +27,21 @@ _daemon = (?:fail2ban(?:-server|\.actions)\s*) # this filter 'recidive', or supply another name with `filter = recidive[_jailname="jail"]` _jailname = recidive +failregex = ^%(__prefix_line)s(?:\s*fail2ban\.actions\s*%(__pid_re)s?:\s+)?NOTICE\s+\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+\s*$ + +[lt_short] +_daemon = (?:fail2ban(?:-server|\.actions)?\s*) failregex = ^%(__prefix_line)s(?:\s*fail2ban(?:\.actions)?\s*%(__pid_re)s?:\s+)?(?:NOTICE\s+)?\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+\s*$ +[lt_journal] +_daemon = +failregex = + +[Definition] + +_daemon = /_daemon> +failregex = /failregex> + datepattern = ^{DATE} ignoreregex = From f12917c491181f7d4950fcb1e82db3b584d7816e Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Mon, 11 Mar 2024 17:50:09 +0100 Subject: [PATCH 3/3] recidive: test case for journal log-format --- fail2ban/tests/files/logs/recidive | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fail2ban/tests/files/logs/recidive b/fail2ban/tests/files/logs/recidive index 5746a55d..da354da7 100644 --- a/fail2ban/tests/files/logs/recidive +++ b/fail2ban/tests/files/logs/recidive @@ -17,3 +17,8 @@ Sep 16 00:44:55 spaceman fail2ban.actions: NOTICE [jail] Ban 10.0.0.7 Jan 16 17:11:25 testorg fail2ban.actions[6605]: NOTICE [postfix-auth] Ban 192.0.2.1 # failJSON: { "time": "2005-03-05T08:41:28", "match": true , "host": "192.0.2.2", "desc": "SYSLOG / systemd-journal with daemon-name" } Mar 05 08:41:28 test.org fail2ban-server[11524]: fail2ban.actions [11524]: NOTICE [postfix-auth] Ban 192.0.2.2 + +# filterOptions: {"logtype": "journal"} + +# failJSON: { "match": true , "host": "192.0.2.3", "desc": "systemd-journal short variant, gh-3693" } +host fail2ban[15699]: [postfix-sasl] Ban 192.0.2.3