From 16d63434ef3f4691ee68553582705b2aa7d1ae69 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Tue, 11 Jun 2013 23:56:09 +1000 Subject: [PATCH 1/6] DOC: credits --- ChangeLog | 2 ++ THANKS | 1 + config/filter.d/3proxy.conf | 17 +++++++++++++++++ config/jail.conf | 6 ++++++ testcases/files/logs/3proxy | 2 ++ 5 files changed, 28 insertions(+) create mode 100644 config/filter.d/3proxy.conf create mode 100644 testcases/files/logs/3proxy diff --git a/ChangeLog b/ChangeLog index e58bce06..d2bf5d42 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,8 @@ ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED * action.d/{route,shorewall}.conf - blocktype must be defined within [Init]. Closes gh-232 - New Features + Daniel Black and ykimon + * filter.d/3proxy filter added - Enhancements Yaroslav Halchenko * jail.conf -- assure all jails have actions and remove unused diff --git a/THANKS b/THANKS index ba33b766..9e151406 100644 --- a/THANKS +++ b/THANKS @@ -48,5 +48,6 @@ Tyler Vaclav Misek Vincent Deffontaines Yaroslav Halchenko +ykimon Yehuda Katz zugeschmiert diff --git a/config/filter.d/3proxy.conf b/config/filter.d/3proxy.conf new file mode 100644 index 00000000..f68ad44e --- /dev/null +++ b/config/filter.d/3proxy.conf @@ -0,0 +1,17 @@ +# Fail2Ban configuration file +# +# Author: Daniel Black +# +# Requested by ykimon in https://github.com/fail2ban/fail2ban/issues/246 +# + +[Definition] + +# Option: failregex +# Notes.: http://www.3proxy.ru/howtoe.asp#ERRORS that 1-9 are all authentication problems +# Log format is: "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T" +# Values: TEXT +# +failregex = \S+\s0000[1-9]\s\S+\s:[0-9]+\S+[0-9]+\s[0-9]+\s.*$ + +ignoreregex = diff --git a/config/jail.conf b/config/jail.conf index d3a23920..69197f5b 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -401,4 +401,10 @@ action = pf logpath = /var/log/sshd.log maxretry=5 +[3proxy] + +enabled = false +filter = 3proxy +action = iptables-multiport[name=3proxy, port=318, protocol=tcp] +logpath = /var/log/3proxy.log diff --git a/testcases/files/logs/3proxy b/testcases/files/logs/3proxy new file mode 100644 index 00000000..ff4774f3 --- /dev/null +++ b/testcases/files/logs/3proxy @@ -0,0 +1,2 @@ +11-06-2013 02:09:40 +0300 PROXY.3128 00004 - 1.2.3.4:28783 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1 +11-06-2013 02:09:43 +0300 PROXY.3128 00005 ewr 1.2.3.4:28788 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1 From f2fa4d53a8d5fbaa5e4b3769eed8a21832379eb1 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Wed, 12 Jun 2013 08:30:59 +1000 Subject: [PATCH 2/6] ENH: stricter regex thanks to Steven Hiscocks (kwirk) --- config/filter.d/3proxy.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/filter.d/3proxy.conf b/config/filter.d/3proxy.conf index f68ad44e..be3a68d0 100644 --- a/config/filter.d/3proxy.conf +++ b/config/filter.d/3proxy.conf @@ -8,10 +8,10 @@ [Definition] # Option: failregex -# Notes.: http://www.3proxy.ru/howtoe.asp#ERRORS that 1-9 are all authentication problems +# Notes.: http://www.3proxy.ru/howtoe.asp#ERRORS that 1-9 are all authentication problems (%E field) # Log format is: "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T" # Values: TEXT # -failregex = \S+\s0000[1-9]\s\S+\s:[0-9]+\S+[0-9]+\s[0-9]+\s.*$ +failregex = \s[+-][0-9]{4} \S+ 0000[1-9] \S+ :[0-9]+ [0-9.]+:[0-9]+ [0-9]+ .*$ ignoreregex = From fd9f9f16e0b6ed8ff2c6f9761c1f42c61468e656 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Wed, 12 Jun 2013 08:48:30 +1000 Subject: [PATCH 3/6] BF: need to anchor the start to avoid another repeat of DoS injection like Apache --- config/filter.d/3proxy.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/3proxy.conf b/config/filter.d/3proxy.conf index be3a68d0..09855d75 100644 --- a/config/filter.d/3proxy.conf +++ b/config/filter.d/3proxy.conf @@ -12,6 +12,6 @@ # Log format is: "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T" # Values: TEXT # -failregex = \s[+-][0-9]{4} \S+ 0000[1-9] \S+ :[0-9]+ [0-9.]+:[0-9]+ [0-9]+ .*$ +failregex = ^\s[+-][0-9]{4} \S+ 0000[1-9] \S+ :[0-9]+ [0-9.]+:[0-9]+ [0-9]+ .*$ ignoreregex = From 8faf84b7f7540830d40b3c643c8123a9234342a5 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 13 Jun 2013 08:34:10 +1000 Subject: [PATCH 4/6] BF: authentication errors end in 01-09 but the beginning part indicates the service as per https://github.com/fail2ban/fail2ban/issues/246#issuecomment-19327955 thanks to ykimon --- config/filter.d/3proxy.conf | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/config/filter.d/3proxy.conf b/config/filter.d/3proxy.conf index 09855d75..c341cf80 100644 --- a/config/filter.d/3proxy.conf +++ b/config/filter.d/3proxy.conf @@ -8,10 +8,11 @@ [Definition] # Option: failregex -# Notes.: http://www.3proxy.ru/howtoe.asp#ERRORS that 1-9 are all authentication problems (%E field) +# Notes.: http://www.3proxy.ru/howtoe.asp#ERRORS indicates that 01-09 are +# all authentication problems (%E field) # Log format is: "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T" # Values: TEXT # -failregex = ^\s[+-][0-9]{4} \S+ 0000[1-9] \S+ :[0-9]+ [0-9.]+:[0-9]+ [0-9]+ .*$ +failregex = ^\s[+-]\d{4} \S+ \d{3}0[1-9] \S+ :\d+ [0-9.]+:\d+ \d+ ignoreregex = From 9dbaec0894ff64de9e902771da9ccae9d2c8b7bf Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 13 Jun 2013 10:23:14 +1000 Subject: [PATCH 5/6] ENH: sample log + more specific regex --- config/filter.d/3proxy.conf | 2 +- testcases/files/logs/3proxy | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/config/filter.d/3proxy.conf b/config/filter.d/3proxy.conf index c341cf80..b22b4588 100644 --- a/config/filter.d/3proxy.conf +++ b/config/filter.d/3proxy.conf @@ -13,6 +13,6 @@ # Log format is: "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T" # Values: TEXT # -failregex = ^\s[+-]\d{4} \S+ \d{3}0[1-9] \S+ :\d+ [0-9.]+:\d+ \d+ +failregex = ^\s[+-]\d{4} \S+ \d{3}0[1-9] \S+ :\d+ [\d.]+:\d+ \d+ \d+ \d+\s ignoreregex = diff --git a/testcases/files/logs/3proxy b/testcases/files/logs/3proxy index ff4774f3..2967c9bf 100644 --- a/testcases/files/logs/3proxy +++ b/testcases/files/logs/3proxy @@ -1,2 +1,3 @@ 11-06-2013 02:09:40 +0300 PROXY.3128 00004 - 1.2.3.4:28783 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1 11-06-2013 02:09:43 +0300 PROXY.3128 00005 ewr 1.2.3.4:28788 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1 +13-06-2013 01:39:34 +0300 PROXY.3128 00508 - 1.2.3.4:28938 0.0.0.0:0 0 0 0 From 88b4598ed8a59ee5984b3e9a556ab873894811c3 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 13 Jun 2013 14:43:15 +1000 Subject: [PATCH 6/6] BF: fix to proxy port in 3proxy example --- config/jail.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/jail.conf b/config/jail.conf index 69197f5b..c999cc7b 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -405,6 +405,6 @@ maxretry=5 enabled = false filter = 3proxy -action = iptables-multiport[name=3proxy, port=318, protocol=tcp] +action = iptables-multiport[name=3proxy, port=3128, protocol=tcp] logpath = /var/log/3proxy.log