From 15197129720dbb33b7874f2ec076b249d201b17b Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 5 Oct 2013 19:47:47 +1000 Subject: [PATCH 1/3] ENH: filter.d/vsftpd anchor internal regex at start --- config/filter.d/vsftpd.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf index 259e2c82..3aaf168d 100644 --- a/config/filter.d/vsftpd.conf +++ b/config/filter.d/vsftpd.conf @@ -14,7 +14,7 @@ # Values: TEXT # failregex = vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authentication failure; .* rhost=(?:\s+user=\S*)?\s*$ - \[.+\] FAIL LOGIN: Client ""\s*$ + ^ \[pid \d+\] \[.+\] FAIL LOGIN: Client ""\s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. From bc10c90ffec0d8d2783cfbf2c6d93c5235c4f9a0 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 5 Oct 2013 19:51:59 +1000 Subject: [PATCH 2/3] ENH: filter.d/vsftpd - disable regex for Pam pre 0.99.2.0 --- testcases/files/logs/vsftpd | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/testcases/files/logs/vsftpd b/testcases/files/logs/vsftpd index ac6d0454..4be6a8f8 100644 --- a/testcases/files/logs/vsftpd +++ b/testcases/files/logs/vsftpd @@ -1,7 +1,9 @@ #1 PAM based # failJSON: { "time": "2004-10-11T01:06:47", "match": true , "host": "209.67.1.67" } Oct 11 01:06:47 ServerJV vsftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=209.67.1.67 -# failJSON: { "time": "2005-02-06T12:02:29", "match": true , "host": "64.168.103.1" } + +# Pam pre 0.99.2.0 - https://github.com/fail2ban/fail2ban/pull/358 +# failJSON: { "time": "2005-02-06T12:02:29", "match": false , "host": "64.168.103.1" } Feb 6 12:02:29 server vsftpd(pam_unix)[15522]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=64.168.103.1 user=user1 #2 Internal From 46386412a4eaabb659f0226dfafa6f6cb1d6fb81 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 5 Oct 2013 20:01:43 +1000 Subject: [PATCH 3/3] ENH: filter.d/vsftpd - pam regex as syslog and anchored at start --- ChangeLog | 1 + config/filter.d/vsftpd.conf | 9 ++++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 46b12528..cfbe9fd6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -76,6 +76,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests * filter.d/apache-auth - added expressions for mod_authz, mod_auth and mod_auth_digest failures. * filter.d/recidive -- support f2b syslog target and anchor regex at start + * filter.d/vsftpd - anchored regex at start. disable old pam format regex * filter.d/pam-generic - added syslog prefix. Disabled support for linux-pam before version 0.99.2.0 (2005) * filter.d/gssftpd - anchored regex at start diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf index 3aaf168d..661fbb61 100644 --- a/config/filter.d/vsftpd.conf +++ b/config/filter.d/vsftpd.conf @@ -4,8 +4,15 @@ # # +[INCLUDES] + +before = common.conf + [Definition] +__pam_re=\(?pam_unix(?:\(\S+\))?\)?:? +_daemon = vsftpd + # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "" can @@ -13,7 +20,7 @@ # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authentication failure; .* rhost=(?:\s+user=\S*)?\s*$ +failregex = ^%(__prefix_line)s%(__pam_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty= ruser=\S* rhost=(?:\s+user=.*)?\s*$ ^ \[pid \d+\] \[.+\] FAIL LOGIN: Client ""\s*$ # Option: ignoreregex