diff --git a/ChangeLog b/ChangeLog index e9cc2b79..f0df7ddc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -13,7 +13,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released - Fixes: - New Features: - + Daniel Black & ykimon + * filter.d/3proxy.conf -- filter added - Enhancements: Daniel Black * filter.d/{asterisk,assp,dovecot,proftpd}.conf -- regex hardening diff --git a/THANKS b/THANKS index 05c46561..47c3e999 100644 --- a/THANKS +++ b/THANKS @@ -49,5 +49,6 @@ Tyler Vaclav Misek Vincent Deffontaines Yaroslav Halchenko +ykimon Yehuda Katz zugeschmiert diff --git a/config/filter.d/3proxy.conf b/config/filter.d/3proxy.conf new file mode 100644 index 00000000..b22b4588 --- /dev/null +++ b/config/filter.d/3proxy.conf @@ -0,0 +1,18 @@ +# Fail2Ban configuration file +# +# Author: Daniel Black +# +# Requested by ykimon in https://github.com/fail2ban/fail2ban/issues/246 +# + +[Definition] + +# Option: failregex +# Notes.: http://www.3proxy.ru/howtoe.asp#ERRORS indicates that 01-09 are +# all authentication problems (%E field) +# Log format is: "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T" +# Values: TEXT +# +failregex = ^\s[+-]\d{4} \S+ \d{3}0[1-9] \S+ :\d+ [\d.]+:\d+ \d+ \d+ \d+\s + +ignoreregex = diff --git a/config/jail.conf b/config/jail.conf index d3a23920..c999cc7b 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -401,4 +401,10 @@ action = pf logpath = /var/log/sshd.log maxretry=5 +[3proxy] + +enabled = false +filter = 3proxy +action = iptables-multiport[name=3proxy, port=3128, protocol=tcp] +logpath = /var/log/3proxy.log diff --git a/testcases/files/logs/3proxy b/testcases/files/logs/3proxy new file mode 100644 index 00000000..2967c9bf --- /dev/null +++ b/testcases/files/logs/3proxy @@ -0,0 +1,3 @@ +11-06-2013 02:09:40 +0300 PROXY.3128 00004 - 1.2.3.4:28783 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1 +11-06-2013 02:09:43 +0300 PROXY.3128 00005 ewr 1.2.3.4:28788 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1 +13-06-2013 01:39:34 +0300 PROXY.3128 00508 - 1.2.3.4:28938 0.0.0.0:0 0 0 0