diff --git a/debian/changelog b/debian/changelog index 593e648f..ed10c5e3 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +fail2ban (0.8.1-2~pre1) UNRELEASED; urgency=low + + * Fixed named-refused filter. + + -- Yaroslav Halchenko Tue, 14 Aug 2007 23:16:56 -0400 + fail2ban (0.8.1-1) unstable; urgency=low * New upstream release. diff --git a/debian/jail.conf b/debian/jail.conf index 7053c6fd..55d3c2e9 100644 --- a/debian/jail.conf +++ b/debian/jail.conf @@ -229,8 +229,8 @@ logpath = /var/log/mail.log # Mention: by default logging is off with bind installation. # Need smth like # logging { -# channel lame-servers_file { file "/var/log/named/lame-servers.log" versions 3 size 30m; severity dynamic; print-time yes; }; -# category lame-servers { lame-servers_file; }; +# channel security_file { file "/var/log/named/security.log" versions 3 size 30m; severity dynamic; print-time yes; }; +# category security { security_file; }; # } # in your named.conf to provide proper logging @@ -244,7 +244,7 @@ enabled = false port = domain,953 protocol = udp filter = named-refused -logpath = /var/log/named/lame-servers.log +logpath = /var/log/named/security.log [named-refused-tcp] @@ -252,5 +252,5 @@ enabled = false port = domain,953 protocol = tcp filter = named-refused -logpath = /var/log/named/lame-servers.log +logpath = /var/log/named/security.log diff --git a/debian/patches/00_named_refused.dpatch b/debian/patches/00_named_refused.dpatch index fab9982b..97dfde57 100755 --- a/debian/patches/00_named_refused.dpatch +++ b/debian/patches/00_named_refused.dpatch @@ -5,20 +5,75 @@ ## DP: No description. @DPATCH@ +diff -urNad trunk~/config/filter.d/named-refused.conf trunk/config/filter.d/named-refused.conf +--- trunk~/config/filter.d/named-refused.conf 2007-08-14 19:42:35.000000000 -0400 ++++ trunk/config/filter.d/named-refused.conf 2007-08-17 12:36:28.000000000 -0400 +@@ -9,10 +9,8 @@ + + [Definition] + +-# if you want to catch only login erros from specific daemons, use smth like +-#_named_rcodes=(?:REFUSED|SERVFAIL) +-# To catch all REFUSED queries only +-_named_rcodes=REFUSED ++# ++# Daemon name + _daemon=named + + # +@@ -28,7 +26,6 @@ + # Notes.: regex to match the password failures messages in the logfile. + # Values: TEXT + # +-failregex = %(__line_prefix)sunexpected RCODE \(%(_named_rcodes)s\) resolving '.*': #\S+$ +- %(__line_prefix)sclient #\S+: query(?: \(cache\))? '.*' denied\s*$ ++failregex = %(__line_prefix)sclient #\S+: query(?: \(cache\))? '.*' denied\s*$ + + diff -urNad trunk~/config/filter.d/named-refused.examples trunk/config/filter.d/named-refused.examples --- trunk~/config/filter.d/named-refused.examples 1969-12-31 19:00:00.000000000 -0500 -+++ trunk/config/filter.d/named-refused.examples 2007-08-14 19:44:13.000000000 -0400 -@@ -0,0 +1,13 @@ -+Jul 15 18:42:00 raid5 named[3888]: unexpected RCODE (SERVFAIL) resolving 'skira.de/NS/IN': 216.14.208.5#53 -+Jul 15 18:42:01 raid5 named[3888]: unexpected RCODE (SERVFAIL) resolving 'skira.de/NS/IN': 216.14.208.4#53 -+Jul 17 01:46:09 raid5 named[3866]: lame server resolving 'vallone.de' (in 'vallone.de'?): 62.156.146.242#53 -+Jul 17 01:49:41 raid5 named[3866]: unexpected RCODE (REFUSED) resolving 'a-s-l.de/A/IN': 192.76.144.17#53 -+Jul 17 01:49:41 raid5 named[3866]: unexpected RCODE (REFUSED) resolving 'a-s-l.de/A/IN': 194.128.171.100#53 -+Jul 17 11:18:39 raid5 named[3866]: unexpected RCODE (REFUSED) resolving 'stadtkrankenhaus-ruesselsheim.de/A/IN': 192.76.144.15#53 -+Jul 17 11:18:39 raid5 named[3866]: unexpected RCODE (REFUSED) resolving 'stadtkrankenhaus-ruesselsheim.de/A/IN': 194.128.171.101#53 -+Jul 18 23:26:34 raid5 named[3891]: unexpected RCODE (REFUSED) resolving 'golgotha.de/A/IN': 217.195.32.108#53 ++++ trunk/config/filter.d/named-refused.examples 2007-08-17 12:36:00.000000000 -0400 +@@ -0,0 +1,5 @@ +Jul 24 14:16:55 raid5 named[3935]: client 194.145.196.18#4795: query 'ricreig.com/NS/IN' denied +Jul 24 14:16:56 raid5 named[3935]: client 62.123.164.113#32768: query 'ricreig.com/NS/IN' denied +Jul 24 14:17:13 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'geo-mueller.de/NS/IN' denied +Jul 24 14:20:25 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'shivaree.de/NS/IN' denied +Jul 24 14:23:36 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'mietberatung.de/NS/IN' denied +diff -urNad trunk~/config/jail.conf trunk/config/jail.conf +--- trunk~/config/jail.conf 2007-08-14 19:12:48.000000000 -0400 ++++ trunk/config/jail.conf 2007-08-17 12:36:00.000000000 -0400 +@@ -170,13 +170,13 @@ + # with bind9 installation. You will need something like this: + # + # logging { +-# channel lame-servers_file { +-# file "/var/log/named/lame-servers.log" versions 3 size 30m; ++# channel security_file { ++# file "/var/log/named/security.log" versions 3 size 30m; + # severity dynamic; + # print-time yes; + # }; +-# category lame-servers { +-# lame-servers_file; ++# category security { ++# security_file; + # }; + # } + # +@@ -189,7 +189,7 @@ + filter = named-refused + action = iptables-multiport[name=Named, port="domain,953", protocol=udp] + sendmail-whois[name=Named, dest=you@mail.com] +-logpath = /var/log/named/lame-servers.log ++logpath = /var/log/named/security.log + ignoreip = 168.192.0.1 + + # This jail blocks TCP traffic for DNS requests. +@@ -200,6 +200,6 @@ + filter = named-refused + action = iptables-multiport[name=Named, port="domain,953", protocol=tcp] + sendmail-whois[name=Named, dest=you@mail.com] +-logpath = /var/log/named/lame-servers.log ++logpath = /var/log/named/security.log + ignoreip = 168.192.0.1 +