From 818dd59d652f38fe1edd499f23f49c812a99389e Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Fri, 8 Aug 2014 11:57:30 -0400 Subject: [PATCH 01/12] ENH: symbiosis-blacklist-allports action --- ChangeLog | 8 +-- .../symbiosis-blacklist-allports.conf | 52 +++++++++++++++++++ 2 files changed, 57 insertions(+), 3 deletions(-) create mode 100644 config/action.d/symbiosis-blacklist-allports.conf diff --git a/ChangeLog b/ChangeLog index afd151ae..9e47e987 100644 --- a/ChangeLog +++ b/ChangeLog @@ -46,9 +46,11 @@ ver. 0.9.1 (2014/xx/xx) - better, faster, stronger * filters.d/sieve.conf - fixed typo in _daemon. Thanks Jisoo Park - New features: - - Added - - monit filter. Thanks Jason H Martin - - directadmin filter. Thanks niorg + - New filters: + - monit Thanks Jason H Martin + - directadmin Thanks niorg + - New actions: + - symbiosis-blacklist-allports for Bytemark symbiosis firewall - fail2ban-client can fetch the running server version - Added Cloudflare API action diff --git a/config/action.d/symbiosis-blacklist-allports.conf b/config/action.d/symbiosis-blacklist-allports.conf new file mode 100644 index 00000000..c3ce44b0 --- /dev/null +++ b/config/action.d/symbiosis-blacklist-allports.conf @@ -0,0 +1,52 @@ +# Fail2Ban configuration file for Bytemark Symbiosis firewall +# +# Author: Yaroslav Halchenko +# + + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = iptables -n -L + +# Option: actionban +# Notes.: command executed when banning an IP. +# Values: CMD +# +actionban = echo 'all' >| /etc/symbiosis/firewall/blacklist.d/.auto + iptables -I 1 -s -j + +# Option: actionunban +# Notes.: command executed when unbanning an IP. +# Values: CMD +# +actionunban = rm -f /etc/symbiosis/firewall/blacklist.d/.auto + iptables -D -s -j + +[Init] + +# Option: chain +# Notes specifies the iptables chain to which the fail2ban rules should be +# added to. blacklist is a chain initiated by symbiosis firewall. +# Values: STRING Default: blacklist +chain = blacklist + +# Option: blocktype +# Note: This is to match default symbiosis firewall type for blacklisted IPs +# Values: STRING +blocktype = DROP From 6b554fbe983a7c40558f5710bd30f412de3731d2 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Fri, 8 Aug 2014 13:27:32 -0600 Subject: [PATCH 02/12] Fxi jail.conf to use more syslog macros --- config/jail.conf | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/config/jail.conf b/config/jail.conf index fc54e2fb..c48e6a7b 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -376,7 +376,7 @@ logpath = /var/log/monit [webmin-auth] port = 10000 -logpath = /var/log/auth.log +logpath = %(syslog_authpriv)s # @@ -429,7 +429,7 @@ maxretry = 6 [vsftpd] # or overwrite it in jails.local to be -# logpath = /var/log/auth.log +# logpath = %(syslog_authpriv)s # if you want to rely on PAM failed login attempts # vsftpd's failregex should match both of those formats port = ftp,ftp-data,ftps,ftps-data @@ -539,7 +539,7 @@ logpath = %(postfix_log)s [perdition] port = imap3,imaps,pop3,pop3s -logpath = /var/log/maillog +logpath = %(syslog_mail)s [squirrelmail] @@ -663,13 +663,13 @@ maxretry = 5 [pam-generic] # pam-generic filter can be customized to monitor specific subset of 'tty's banaction = iptables-allports -logpath = /var/log/auth.log +logpath = %(syslog_authpriv)s [xinetd-fail] banaction = iptables-multiport-log -logpath = /var/log/daemon.log +logpath = %(syslog_daemon)s maxretry = 2 @@ -699,7 +699,7 @@ action = %(banaction)s[name=%(__name__)s-tcp, port="%(tcpport)s", protocol="tcp [nagios] enabled = false -logpath = /var/log/messages ; nrpe.cfg may define a different log_facility +logpath = %(syslog_daemon)s ; nrpe.cfg may define a different log_facility maxretry = 1 From 93243e7d578a382f41af9a6b418571b15d5a3a2b Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 12 Aug 2014 11:57:07 -0400 Subject: [PATCH 03/12] ENH: Ignore errors while unbaning in symbiosis firewall Fail2Ban at times "interfers" with the firewall reflashing thus leading to the sporadic errors. IMHO should be safe to ignore --- config/action.d/symbiosis-blacklist-allports.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/action.d/symbiosis-blacklist-allports.conf b/config/action.d/symbiosis-blacklist-allports.conf index c3ce44b0..c4979302 100644 --- a/config/action.d/symbiosis-blacklist-allports.conf +++ b/config/action.d/symbiosis-blacklist-allports.conf @@ -36,7 +36,7 @@ actionban = echo 'all' >| /etc/symbiosis/firewall/blacklist.d/.auto # Values: CMD # actionunban = rm -f /etc/symbiosis/firewall/blacklist.d/.auto - iptables -D -s -j + iptables -D -s -j || : [Init] From 544cfaff2c582945abb188e0e32e6ed249694fa3 Mon Sep 17 00:00:00 2001 From: Paul Traina Date: Sat, 6 Sep 2014 10:23:38 -0700 Subject: [PATCH 04/12] Add support for postfix/submission/smtpd matching. --- config/filter.d/postfix-sasl.conf | 2 +- config/filter.d/postfix.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/filter.d/postfix-sasl.conf b/config/filter.d/postfix-sasl.conf index c5f8e3bc..52cff8c8 100644 --- a/config/filter.d/postfix-sasl.conf +++ b/config/filter.d/postfix-sasl.conf @@ -7,7 +7,7 @@ before = common.conf [Definition] -_daemon = postfix/smtpd +_daemon = postfix/(submission/)?smtpd failregex = ^%(__prefix_line)swarning: [-._\w]+\[\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$ diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf index ff58c58c..9e34d9cc 100644 --- a/config/filter.d/postfix.conf +++ b/config/filter.d/postfix.conf @@ -10,7 +10,7 @@ before = common.conf [Definition] -_daemon = postfix/smtpd +_daemon = postfix/(submission/)?smtpd failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 554 5\.7\.1 .*$ ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$ From 218ffe862e49d8b65a389b09ad60b649c6129d5a Mon Sep 17 00:00:00 2001 From: weberho Date: Mon, 8 Sep 2014 10:23:07 +0200 Subject: [PATCH 05/12] fixed encoding --- config/filter.d/pure-ftpd.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/config/filter.d/pure-ftpd.conf b/config/filter.d/pure-ftpd.conf index b6d36603..eb5f6167 100644 --- a/config/filter.d/pure-ftpd.conf +++ b/config/filter.d/pure-ftpd.conf @@ -16,6 +16,7 @@ _daemon = pure-ftpd # Error message specified in multiple languages __errmsg = (?:�ϥΪ�\[.*\]���ҥ���|ʹ����\[.*\]��֤ʧ��|\[.*\] kullan�c�s� i�in giri� hatal�|����������� �� ������� ������������ \[.*\]|Godkjennelse mislyktes for \[.*\]|Beh�righetskontroll misslyckas f�r anv�ndare \[.*\]|Autentifikacia uzivatela zlyhala \[.*\]|Autentificare esuata pentru utilizatorul \[.*\]|Autentica��o falhou para usu�rio \[.*\]|Autentyfikacja nie powiod�a si� dla u�ytkownika \[.*\]|Autorisatie faalde voor gebruiker \[.*\]|\[.*\] ��� ���� ����|Autenticazione falita per l'utente \[.*\]|Azonos�t�s sikertelen \[.*\] felhaszn�l�nak|\[.*\] c'est un batard, il connait pas son code|Erreur d'authentification pour l'utilisateur \[.*\]|Autentificaci�n fallida para el usuario \[.*\]|Authentication failed for user \[.*\]|Authentifizierung fehlgeschlagen f�r Benutzer \[.*\].|Godkendelse mislykkedes for \[.*\]|Autentifikace u�ivatele selhala \[.*\]) +__errmsg = (?:Godkendelse mislykkedes for \[.*\]|Authentifizierung fehlgeschlagen für Benutzer \[.*\].|Authentication failed for user \[.*\]|Autentificación fallida para el usuario \[.*\]|\[.*\] c'est un batard, il connait pas son code|Erreur d'authentification pour l'utilisateur \[.*\]|Azonosítás sikertelen \[.*\] felhasználónak|Autenticazione falita per l'utente \[.*\]|Autorisatie faalde voor gebruiker \[.*\]|Godkjennelse mislyktes for \[.*\]|\[.*\] kullanýcýsý için giriþ hatalý|Autenticação falhou para usuário \[.*\]|Autentificare esuata pentru utilizatorul \[.*\]|Autentifikace uživatele selhala \[.*\]|Autentyfikacja nie powiodła się dla użytkownika \[.*\]|Autentifikacia uzivatela zlyhala \[.*\]|Behörighetskontroll misslyckas för användare \[.*\]|Авторизация не удалась пользователю \[.*\]|\[.*\] 嶸盪 檣隸 褒ぬ|妏蚚氪\[.*\]桄痐囮啖|使用者\[.*\]驗證失敗) failregex = ^%(__prefix_line)s\(.+?@\) \[WARNING\] %(__errmsg)s\s*$ From d2c086b18707aacd212ea9448f9d59ecc8ff7d94 Mon Sep 17 00:00:00 2001 From: weberho Date: Mon, 8 Sep 2014 10:26:08 +0200 Subject: [PATCH 06/12] fixed encoding --- config/filter.d/pure-ftpd.conf | 1 - 1 file changed, 1 deletion(-) diff --git a/config/filter.d/pure-ftpd.conf b/config/filter.d/pure-ftpd.conf index eb5f6167..a1fcdbc2 100644 --- a/config/filter.d/pure-ftpd.conf +++ b/config/filter.d/pure-ftpd.conf @@ -15,7 +15,6 @@ before = common.conf _daemon = pure-ftpd # Error message specified in multiple languages -__errmsg = (?:�ϥΪ�\[.*\]���ҥ���|ʹ����\[.*\]��֤ʧ��|\[.*\] kullan�c�s� i�in giri� hatal�|����������� �� ������� ������������ \[.*\]|Godkjennelse mislyktes for \[.*\]|Beh�righetskontroll misslyckas f�r anv�ndare \[.*\]|Autentifikacia uzivatela zlyhala \[.*\]|Autentificare esuata pentru utilizatorul \[.*\]|Autentica��o falhou para usu�rio \[.*\]|Autentyfikacja nie powiod�a si� dla u�ytkownika \[.*\]|Autorisatie faalde voor gebruiker \[.*\]|\[.*\] ��� ���� ����|Autenticazione falita per l'utente \[.*\]|Azonos�t�s sikertelen \[.*\] felhaszn�l�nak|\[.*\] c'est un batard, il connait pas son code|Erreur d'authentification pour l'utilisateur \[.*\]|Autentificaci�n fallida para el usuario \[.*\]|Authentication failed for user \[.*\]|Authentifizierung fehlgeschlagen f�r Benutzer \[.*\].|Godkendelse mislykkedes for \[.*\]|Autentifikace u�ivatele selhala \[.*\]) __errmsg = (?:Godkendelse mislykkedes for \[.*\]|Authentifizierung fehlgeschlagen für Benutzer \[.*\].|Authentication failed for user \[.*\]|Autentificación fallida para el usuario \[.*\]|\[.*\] c'est un batard, il connait pas son code|Erreur d'authentification pour l'utilisateur \[.*\]|Azonosítás sikertelen \[.*\] felhasználónak|Autenticazione falita per l'utente \[.*\]|Autorisatie faalde voor gebruiker \[.*\]|Godkjennelse mislyktes for \[.*\]|\[.*\] kullanýcýsý için giriþ hatalý|Autenticação falhou para usuário \[.*\]|Autentificare esuata pentru utilizatorul \[.*\]|Autentifikace uživatele selhala \[.*\]|Autentyfikacja nie powiodła się dla użytkownika \[.*\]|Autentifikacia uzivatela zlyhala \[.*\]|Behörighetskontroll misslyckas för användare \[.*\]|Авторизация не удалась пользователю \[.*\]|\[.*\] 嶸盪 檣隸 褒ぬ|妏蚚氪\[.*\]桄痐囮啖|使用者\[.*\]驗證失敗) failregex = ^%(__prefix_line)s\(.+?@\) \[WARNING\] %(__errmsg)s\s*$ From 1864f75b3bc8e55e727e8b76d0978a954eb39864 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 8 Sep 2014 19:02:37 +1000 Subject: [PATCH 07/12] Credits and notes from #806 --- ChangeLog | 1 + THANKS | 3 ++- config/filter.d/pure-ftpd.conf | 8 +++++++- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index b6c52eef..6a9bf03f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -16,6 +16,7 @@ ver. 0.9.1 (2014/xx/xx) - better, faster, stronger provides defaults for the chain, port, protocol and name tags - Fixes: + * UTF-8 fixes in pure-ftp thanks to Johannes Weberhofer. Closes gh-806. * systemd backend error on bad utf-8 in python3 * badips.py action error when logging HTTP error raised with badips request * fail2ban-regex failed to work in python3 due to space/tab mix diff --git a/THANKS b/THANKS index 38a71889..b9288d4d 100644 --- a/THANKS +++ b/THANKS @@ -44,10 +44,11 @@ Hank Leininger Hanno 'Rince' Wagner Helmut Grohne Iain Lea +Ioan Indreias Ivo Truxa John Thoe Jacques Lav!gnotte -Ioan Indreias +Johannes Weberhofer Jason H Martin Jisoo Park Joel M Snyder diff --git a/config/filter.d/pure-ftpd.conf b/config/filter.d/pure-ftpd.conf index a1fcdbc2..be3d0ae5 100644 --- a/config/filter.d/pure-ftpd.conf +++ b/config/filter.d/pure-ftpd.conf @@ -24,7 +24,13 @@ ignoreregex = # Author: Cyril Jaquier # Modified: Yaroslav Halchenko for pure-ftpd # Documentation thanks to Blake on http://www.fail2ban.org/wiki/index.php?title=Fail2ban:Community_Portal +# UTF-8 editing and mechanism thanks to Johannes Weberhofer # # Only logs to syslog though facility can be changed configuration file/command line # -# fgrep -r MSG_AUTH_FAILED_LOG pure-ftpd-1.0.36/src +# To get messages in the right encoding: +# grep MSG_AUTH_FAILED_LOG pure-ftpd-1.0.36/src/messages_[defhint]* | grep -Po '".?"' | recode latin1..utf-8 | tr -d '"' > messages +# grep MSG_AUTH_FAILED_LOG pure-ftpd-1.0.36/src/messages_[pr][to] | grep -Po '".?"' | recode latin1..utf-8 | tr -d '"' >> messages +# grep MSG_AUTH_FAILED_LOG pure-ftpd-1.0.36/src/messages_[cps][slkv] | grep -Po '".?"' | recode latin2..utf-8 | tr -d '"' >> messages +# grep MSG_AUTH_FAILED_LOG pure-ftpd-1.0.36/src/messages_ru | grep -Po '".?"' | recode KOI8-R..utf-8 | tr -d '"' >> messages +# grep MSG_AUTH_FAILED_LOG pure-ftpd-1.0.36/src/messages_[kz] | grep -Po '".*?"' | tr -d '"' | recode big5..utf-8 >> messages From 249e169d8e36ae7b5b15164918304d7d04d831cf Mon Sep 17 00:00:00 2001 From: Paul Traina Date: Mon, 8 Sep 2014 11:53:51 -0700 Subject: [PATCH 08/12] Update test cases and also suport smtps per request. --- config/filter.d/postfix-sasl.conf | 2 +- config/filter.d/postfix.conf | 4 +++- fail2ban/tests/files/logs/postfix | 6 ++++++ fail2ban/tests/files/logs/postfix-sasl | 3 +++ 4 files changed, 13 insertions(+), 2 deletions(-) diff --git a/config/filter.d/postfix-sasl.conf b/config/filter.d/postfix-sasl.conf index 52cff8c8..7e70a423 100644 --- a/config/filter.d/postfix-sasl.conf +++ b/config/filter.d/postfix-sasl.conf @@ -7,7 +7,7 @@ before = common.conf [Definition] -_daemon = postfix/(submission/)?smtpd +_daemon = postfix/(submission/)?smtp(d|s) failregex = ^%(__prefix_line)swarning: [-._\w]+\[\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$ diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf index 9e34d9cc..1d7c63ac 100644 --- a/config/filter.d/postfix.conf +++ b/config/filter.d/postfix.conf @@ -10,11 +10,13 @@ before = common.conf [Definition] -_daemon = postfix/(submission/)?smtpd +_daemon = postfix/(submission/)?smtp(d|s) failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 554 5\.7\.1 .*$ ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$ ^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[\]: 550 5\.1\.1 .*$ + ^%(__prefix_line)swarning: Connection concurrency limit exceeded: \d+ from \S+\[\] for service.*$ + ^%(__prefix_line)slost connection after AUTH from \S+\[\]$ ^%(__prefix_line)simproper command pipelining after \S+ from [^[]*\[\]:?$ ignoreregex = diff --git a/fail2ban/tests/files/logs/postfix b/fail2ban/tests/files/logs/postfix index ccf2f8bc..9cb4fa79 100644 --- a/fail2ban/tests/files/logs/postfix +++ b/fail2ban/tests/files/logs/postfix @@ -20,3 +20,9 @@ Dec 25 02:35:54 platypus postfix/smtpd[9144]: improper command pipelining after # failJSON: { "time": "2004-12-18T02:05:46", "match": true , "host": "216.245.198.245" } Dec 18 02:05:46 platypus postfix/smtpd[16349]: improper command pipelining after NOOP from unknown[216.245.198.245] + +# failJSON: { "time": "2004-09-07T08:24:30", "match": true , "host": "83.110.98.15" } +Sep 7 08:24:30 umkc postfix/smtpd[2282]: lost connection after AUTH from bba453913.alshamil.net.ae[83.110.98.15] + +# failJSON: { "time": "2004-09-05T12:45:53", "match": true , "host": "213.123.185.20" } +Sep 5 12:45:53 umkc postfix/smtpd[20286]: warning: Connection concurrency limit exceeded: 6 from mail.baileysbodybuilders.co.uk[213.123.185.20] for service smtp diff --git a/fail2ban/tests/files/logs/postfix-sasl b/fail2ban/tests/files/logs/postfix-sasl index ca306098..697ac424 100644 --- a/fail2ban/tests/files/logs/postfix-sasl +++ b/fail2ban/tests/files/logs/postfix-sasl @@ -5,3 +5,6 @@ Dec 2 22:24:22 hel postfix/smtpd[7676]: warning: 114-44-142-233.dynamic.hinet.n # failJSON: { "time": "2005-03-10T13:33:30", "match": true , "host": "1.1.1.1" } Mar 10 13:33:30 gandalf postfix/smtpd[3937]: warning: HOSTNAME[1.1.1.1]: SASL LOGIN authentication failed: authentication failure +#3 Example from postfix post-debian changes to rename to add "submission" to syslog name +# failJSON: { "time": "2004-09-06T00:44:56", "match": true , "host": "82.221.106.233" } +Sep 6 00:44:56 trianon postfix/submission/smtpd[11538]: warning: unknown[82.221.106.233]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 From c58c4de9bc05f6ee73fa3af0ea2942a917b990db Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sat, 13 Sep 2014 10:18:37 -0400 Subject: [PATCH 09/12] ENH: add empty ignoreregex to avoid a warning (Close #805) --- config/filter.d/postfix-sasl.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config/filter.d/postfix-sasl.conf b/config/filter.d/postfix-sasl.conf index c5f8e3bc..9cbcb324 100644 --- a/config/filter.d/postfix-sasl.conf +++ b/config/filter.d/postfix-sasl.conf @@ -11,6 +11,8 @@ _daemon = postfix/smtpd failregex = ^%(__prefix_line)swarning: [-._\w]+\[\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$ +ignoreregex = + [Init] journalmatch = _SYSTEMD_UNIT=postfix.service From 0e1f8f7f39e0a700e8ebc8cd103e5a7ade701682 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sat, 13 Sep 2014 10:25:27 -0400 Subject: [PATCH 10/12] RF: remove those two additional failregexes for the postfix see comment https://github.com/fail2ban/fail2ban/pull/804\#discussion_r17512426 --- config/filter.d/postfix.conf | 2 -- fail2ban/tests/files/logs/postfix | 6 ------ 2 files changed, 8 deletions(-) diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf index 1d7c63ac..a7a05e47 100644 --- a/config/filter.d/postfix.conf +++ b/config/filter.d/postfix.conf @@ -15,8 +15,6 @@ _daemon = postfix/(submission/)?smtp(d|s) failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 554 5\.7\.1 .*$ ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$ ^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[\]: 550 5\.1\.1 .*$ - ^%(__prefix_line)swarning: Connection concurrency limit exceeded: \d+ from \S+\[\] for service.*$ - ^%(__prefix_line)slost connection after AUTH from \S+\[\]$ ^%(__prefix_line)simproper command pipelining after \S+ from [^[]*\[\]:?$ ignoreregex = diff --git a/fail2ban/tests/files/logs/postfix b/fail2ban/tests/files/logs/postfix index 9cb4fa79..ccf2f8bc 100644 --- a/fail2ban/tests/files/logs/postfix +++ b/fail2ban/tests/files/logs/postfix @@ -20,9 +20,3 @@ Dec 25 02:35:54 platypus postfix/smtpd[9144]: improper command pipelining after # failJSON: { "time": "2004-12-18T02:05:46", "match": true , "host": "216.245.198.245" } Dec 18 02:05:46 platypus postfix/smtpd[16349]: improper command pipelining after NOOP from unknown[216.245.198.245] - -# failJSON: { "time": "2004-09-07T08:24:30", "match": true , "host": "83.110.98.15" } -Sep 7 08:24:30 umkc postfix/smtpd[2282]: lost connection after AUTH from bba453913.alshamil.net.ae[83.110.98.15] - -# failJSON: { "time": "2004-09-05T12:45:53", "match": true , "host": "213.123.185.20" } -Sep 5 12:45:53 umkc postfix/smtpd[20286]: warning: Connection concurrency limit exceeded: 6 from mail.baileysbodybuilders.co.uk[213.123.185.20] for service smtp From 8f521b85516b2e51cd86878e89a1481b518cba8e Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sat, 13 Sep 2014 10:27:37 -0400 Subject: [PATCH 11/12] DOC: Changelog and THANKS for previous changes --- ChangeLog | 4 +++- THANKS | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 6a9bf03f..0d2ffcc6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -48,7 +48,9 @@ ver. 0.9.1 (2014/xx/xx) - better, faster, stronger * cyrus-imap -- also catch also failed logins via secured (imaps/pop3s). Regression was introduced while strengthening failregex in 0.8.11 (bd175f) Debian bug #755173 - * postfix-sasl -- added journalmatch. Thanks Luc Maisonobe + * postfix-sasl - added journalmatch. Thanks Luc Maisonobe + * postfix* - match with a new daemon string (postfix/submission/smtpd). + Closes gh-804 . Thanks Paul Traina - New features: - New filters: diff --git a/THANKS b/THANKS index b9288d4d..42887a05 100644 --- a/THANKS +++ b/THANKS @@ -81,6 +81,7 @@ Mika (mkl) Nick Munger onorua Paul Marrapese +Paul Traina Noel Butler Patrick Börjesson Pressy From 2c158fe16890b9e9f98a3428cc009f792618ba75 Mon Sep 17 00:00:00 2001 From: Nick Weeds Date: Sat, 13 Sep 2014 21:43:39 +0100 Subject: [PATCH 12/12] Add apache filter for AH01630 client denied by server configuration --- ChangeLog | 1 + config/filter.d/apache-auth.conf | 2 +- fail2ban/tests/files/logs/apache-auth | 3 +++ 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 0d2ffcc6..1a98c1a0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -51,6 +51,7 @@ ver. 0.9.1 (2014/xx/xx) - better, faster, stronger * postfix-sasl - added journalmatch. Thanks Luc Maisonobe * postfix* - match with a new daemon string (postfix/submission/smtpd). Closes gh-804 . Thanks Paul Traina + * apache - added filter for AH01630 client denied by server configuration. - New features: - New filters: diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf index f4213487..8a63858d 100644 --- a/config/filter.d/apache-auth.conf +++ b/config/filter.d/apache-auth.conf @@ -10,7 +10,7 @@ before = apache-common.conf [Definition] -failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server configuration: (uri )?\S*(, referer: \S+)?\s*$ +failregex = ^%(_apache_error_client)s (AH(01797|01630): )?client denied by server configuration: (uri )?\S*(, referer: \S+)?\s*$ ^%(_apache_error_client)s (AH01617: )?user .*? authentication failure for "\S*": Password Mismatch(, referer: \S+)?$ ^%(_apache_error_client)s (AH01618: )?user .*? not found(: )?\S*(, referer: \S+)?\s*$ ^%(_apache_error_client)s (AH01614: )?client used wrong authentication scheme: \S*(, referer: \S+)?\s*$ diff --git a/fail2ban/tests/files/logs/apache-auth b/fail2ban/tests/files/logs/apache-auth index a01d2c76..5b7b3c48 100644 --- a/fail2ban/tests/files/logs/apache-auth +++ b/fail2ban/tests/files/logs/apache-auth @@ -19,6 +19,9 @@ # failJSON: { "time": "2013-07-20T21:34:49", "match": true , "host": "127.0.0.1" } [Sat Jul 20 21:34:49.453232 2013] [access_compat:error] [pid 17512:tid 140123104306944] [client 127.0.0.1:51380] AH01797: client denied by server configuration: /var/www/html/noentry/cant_get_me.html +# failJSON: { "time": "2014-09-14T21:44:43", "match": true , "host": "192.3.9.178" } +[Sun Sep 14 21:44:43.008606 2014] [authz_core:error] [pid 10691] [client 192.3.9.178:44271] AH01630: client denied by server configuration: /var/www/html/noentry/cant_get_me.html + # wget --http-user='' --http-password='' http://localhost/basic/file/cant_get_me.html -O /dev/null # failJSON: { "time": "2013-07-17T23:14:37", "match": true , "host": "127.0.0.1" } [Wed Jul 17 23:14:37 2013] [error] [client 127.0.0.1] user not found: /basic/anon/cant_get_me.html