From 8bf15db688ac0f95f6f1489947ee00825340b23e Mon Sep 17 00:00:00 2001 From: sebres Date: Tue, 18 Jan 2022 15:06:16 +0100 Subject: [PATCH] filter.d/sshd.conf: `ddos` mode extended - recognizes new message "banner exchange: invalid format" generated by port scanner, https payload on ssh port; closes gh-3169 --- config/filter.d/sshd.conf | 1 + fail2ban/tests/files/logs/sshd | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index e7942262..c265b9eb 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -75,6 +75,7 @@ mdre-ddos = ^Did not receive identification string from ^Bad protocol version identification '.*' from ^SSH: Server;Ltype: (?:Authname|Version|Kex);Remote: -\d+;[A-Z]\w+: ^Read from socket failed: Connection reset by peer + ^banner exchange: Connection from <__on_port_opt>: invalid format # same as mdre-normal-other, but as failure (without ) and [preauth] only: mdre-ddos-other = ^(Connection (?:closed|reset)|Disconnected) (?:by|from)%(__authng_user)s %(__on_port_opt)s\s+\[preauth\]\s*$ diff --git a/fail2ban/tests/files/logs/sshd b/fail2ban/tests/files/logs/sshd index 5d23f96f..ac8524a8 100644 --- a/fail2ban/tests/files/logs/sshd +++ b/fail2ban/tests/files/logs/sshd @@ -315,6 +315,11 @@ Feb 17 17:40:17 sshd[19725]: error: kex_exchange_identification: client sent inv # failJSON: { "time": "2005-02-17T17:40:18", "match": true , "host": "192.0.2.10", "desc": "ddos: flood attack vector, gh-2850" } Feb 17 17:40:18 sshd[19725]: error: kex_exchange_identification: Connection closed by remote host +# failJSON: { "match": false } +Mar 1 18:59:33 hostname sshd[1189575]: error: kex_exchange_identification: banner line too long +# failJSON: { "time": "2005-03-01T18:59:33", "match": true , "host": "192.0.2.12", "desc": "ddos: port scanner, https payload on ssh port (banner exchange: invalid format, gh-3169)" } +Mar 1 18:59:33 hostname sshd[1189575]: banner exchange: Connection from 192.0.2.12 port 44105: invalid format + # failJSON: { "time": "2005-03-15T09:21:01", "match": true , "host": "192.0.2.212", "desc": "DDOS mode causes failure on close within preauth stage" } Mar 15 09:21:01 host sshd[2717]: Connection closed by 192.0.2.212 [preauth] # failJSON: { "time": "2005-03-15T09:21:02", "match": true , "host": "192.0.2.212", "desc": "DDOS mode causes failure on close within preauth stage" }