From 35afe20ea0ddf003c0b63f50bef132fc73c80356 Mon Sep 17 00:00:00 2001 From: Maksim Usmanov | Maks Date: Fri, 9 Aug 2024 22:53:45 +0200 Subject: [PATCH 1/4] Roundcube 1.4 change log format From roundcube 1.4 log change format -> https://github.com/roundcube/roundcubemail/blob/e92d8e31a342653fb65d12cf5fb706cac4031841/program/lib/Roundcube/rcube_imap.php#L194 --- config/filter.d/roundcube-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/roundcube-auth.conf b/config/filter.d/roundcube-auth.conf index 9912ff47..2e0e1ea6 100644 --- a/config/filter.d/roundcube-auth.conf +++ b/config/filter.d/roundcube-auth.conf @@ -15,7 +15,7 @@ before = common.conf prefregex = ^\s*(\[\])?(%(__hostname)s\s*(?:roundcube(?:\[(\d*)\])?:)?\s*(<[\w]+>)? IMAP Error)?: .+$ -failregex = ^(?:FAILED login|Login failed) for .* from (?:(?:\([^\)]*\))?\. (?:(?! from ).)*(?: user=(?P=user))? in \S+\.php on line \d+ \(\S+ \S+\))?$ +failregex = ^(?:FAILED login|Login failed) for .*(?:against \S+)? from (?:(?:\([^\)]*\))?\. (?:(?! from ).)*(?: user=(?P=user))? in \S+\.php on line \d+ \(\S+ \S+\))?$ ^(?:<[\w]+> )?Failed login for .* from in session \w+( \(error: \d\))?$ ignoreregex = From af119e0ae1c27fcb82fe33d782af9b431fad0116 Mon Sep 17 00:00:00 2001 From: Maksim Usmanov | Maks Date: Fri, 9 Aug 2024 23:22:43 +0200 Subject: [PATCH 2/4] roundcube 1.4+ logs --- fail2ban/tests/files/logs/roundcube-auth | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fail2ban/tests/files/logs/roundcube-auth b/fail2ban/tests/files/logs/roundcube-auth index f3f762d2..c596de78 100644 --- a/fail2ban/tests/files/logs/roundcube-auth +++ b/fail2ban/tests/files/logs/roundcube-auth @@ -54,3 +54,8 @@ Jul 11 03:06:37 myhostname roundcube: IMAP Error: Login failed for admin from 12 # failJSON: { "time": "2005-05-19T06:07:48", "match": true , "host": "192.0.2.1", "desc": "Roundcube logged to journald instead to a local file."} May 19 06:07:48 server roundcube[21296]: IMAP Error: Login failed for test from 192.0.2.1. AUTHENTICATE PLAIN: Authentication failed. in /usr/share/php5/Roundcube/rcube_imap.php on line 193 (POST /mail/?_task=login&_action=login) + +# Roundcube 1.5.0 (/var/log/roundcubemail/errors) +# failJSON: { "time": "2014-12-30T19:02:34", "match": true , "host": "1.2.3.4" } +[30-Dec-2014 13:02:34 -0500]: <3z506z6r> IMAP Error: Login failed for admin@example.com against localhost from 1.2.3.4. AUTHENTICATE PLAIN: Authentication failed. in /docroot/path/program/lib/Roundcube/rcube_imap.php on line 221 (POST /?_task=login?_task=login&_action=login) + From 8e0a2366f067ee33d0840b57fcd2810b3281b378 Mon Sep 17 00:00:00 2001 From: sebres Date: Sat, 10 Aug 2024 13:20:18 +0200 Subject: [PATCH 3/4] Fixes unmatched tag (caused unmatched brace); review: combined to single regex, simple case without injection attempts faster, `` replaced with `` (faster and fewer vulnerable on complex cases, since doesn't match text as hostname) etc. --- config/filter.d/roundcube-auth.conf | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/config/filter.d/roundcube-auth.conf b/config/filter.d/roundcube-auth.conf index 2e0e1ea6..9599bb26 100644 --- a/config/filter.d/roundcube-auth.conf +++ b/config/filter.d/roundcube-auth.conf @@ -13,10 +13,9 @@ before = common.conf [Definition] -prefregex = ^\s*(\[\])?(%(__hostname)s\s*(?:roundcube(?:\[(\d*)\])?:)?\s*(<[\w]+>)? IMAP Error)?: .+$ +prefregex = ^\s*(\[\])?(%(__hostname)s\s*(?:roundcube(?:\[(\d*)\])?:)?\s*(<[\w]+>)? IMAP Error)?: (?:<[\w]+> )?.+$ -failregex = ^(?:FAILED login|Login failed) for .*(?:against \S+)? from (?:(?:\([^\)]*\))?\. (?:(?! from ).)*(?: user=(?P=user))? in \S+\.php on line \d+ \(\S+ \S+\))?$ - ^(?:<[\w]+> )?Failed login for .* from in session \w+( \(error: \d\))?$ +failregex = ^(?:Login failed|(?i:Failed) login) for (?:(?P\S+)|.*) (?:against \S+ )?from (?:(?:\([^\)]*\))?\.(?! from ) (?(simple)(?:\S+(?! from ) )*|(?:(?! from ).)*(?: user=(?P=user))? )in \S+\.php on line \d+| in session \w+)?(?: \([^\)]*\))?$ ignoreregex = From 2749109f10b1f86c4300d538a4f146fd83e218e9 Mon Sep 17 00:00:00 2001 From: sebres Date: Sat, 10 Aug 2024 13:23:28 +0200 Subject: [PATCH 4/4] ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 8c4fec7a..c8344d81 100644 --- a/ChangeLog +++ b/ChangeLog @@ -23,6 +23,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition * `filter.d/apache-overflows.conf` - consider AH10244: invalid URI path (gh-3778) * `filter.d/postfix.conf` - consider CONNECT and other rejected commands as a valid `_pref` (gh-3800) * `filter.d/recidive.conf` - restore possibility to set jail name in the filter, _jailname is positive now (gh-3769) +* `filter.d/roundcube-auth.conf` - improved RE better matching log format of roundcube version 1.4+ (gh-3816) * `filter.d/sshd.conf` - adapted to conform possible new daemon name sshd-session, since OpenSSH 9.8 several log messages will be tagged with as originating from a process named "sshd-session" rather than "sshd" (gh-3782)