From bb88cfaddb4d86f4fc84d0a301bdb787684c800f Mon Sep 17 00:00:00 2001 From: Ivo Truxa Date: Sun, 29 Dec 2013 18:53:04 +0100 Subject: [PATCH 1/6] Update exim-spam attached sample Exim log line to demonstrate a silently tossed message as described at https://github.com/fail2ban/fail2ban/issues/533 --- testcases/files/logs/exim-spam | 3 +++ 1 file changed, 3 insertions(+) diff --git a/testcases/files/logs/exim-spam b/testcases/files/logs/exim-spam index 46b915d1..6e6392e0 100644 --- a/testcases/files/logs/exim-spam +++ b/testcases/files/logs/exim-spam @@ -14,4 +14,7 @@ 2013-06-15 11:20:36 [2516] 1Unmew-0000ea-SE H=egeftech.static.otenet.gr [83.235.177.148]:32706 I=[1.2.3.4]:25 F=auguriesvbd40@google.com rejected after DATA: This message contains a virus (Sanesecurity.Junk.39934.UNOFFICIAL). # failJSON: { "time": "2013-06-16T02:50:43", "match": true , "host": "111.67.203.114" } 2013-06-16 02:50:43 H=dbs.marsukov.com [111.67.203.114] F= rejected RCPT : rejected because 111.67.203.114 is in a black list at dnsbl.sorbs.net\nCurrently Sending Spam See: http://www.sorbs.net/lookup.shtml?111.67.203.114 +# https://github.com/fail2ban/fail2ban/issues/533 +# failJSON: { "time": "2013-12-29T15:34:12", "match": true , "host": "188.76.45.72" } +2013-12-29 15:34:12 1VxHRO-000NiI-Ly SA: Action: silently tossed message: score=31.0 required=5.0 trigger=30.0 (scanned in 6/6 secs | Message-Id: etPan.09bd0c40.c3d5f675.fdf7@server.local). From (host=72.45.76.188.dynamic.jazztel.es [188.76.45.72]) for me@my.com From d727ba639a58bd066e086d0f1ca2b3ddb0a6c21e Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sun, 29 Dec 2013 20:16:37 +0000 Subject: [PATCH 2/6] ENH: exim-spam to include spamassassin log entry. Closes gh-533 --- ChangeLog | 1 + THANKS | 1 + config/filter.d/exim-spam.conf | 1 + 3 files changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index f3d2839f..434b12d0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -43,6 +43,7 @@ ver. 0.8.12 (2013/12/XX) - things-can-only-get-better - filter apache-noscript now includes php cgi scripts. Thanks dani. Closes gh-503 - added ufw action. Thanks Guilhem Lettron. lp-#701522 + - exim-spam include spamassassin log entry. Thanks Ivo Truxa. Closes gh-533 - New Features: diff --git a/THANKS b/THANKS index 1919263e..04aa1f20 100644 --- a/THANKS +++ b/THANKS @@ -39,6 +39,7 @@ Guilhem Lettron Guillaume Delvit Hanno 'Rince' Wagner Iain Lea +Ivo Truxa Jacques Lav!gnotte Ioan Indreias Jonathan Kamens diff --git a/config/filter.d/exim-spam.conf b/config/filter.d/exim-spam.conf index 15737b2f..8303e7c1 100644 --- a/config/filter.d/exim-spam.conf +++ b/config/filter.d/exim-spam.conf @@ -12,6 +12,7 @@ before = exim-common.conf failregex = ^%(pid)s \S+ F=(<>|\S+@\S+) %(host_info)srejected by local_scan\(\): .{0,256}$ ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: .*dnsbl.*\s*$ ^%(pid)s \S+ %(host_info)sF=(<>|[^@]+@\S+) rejected after DATA: This message contains a virus \(\S+\)\.\s*$ + ^%(pid)s \S+ SA: Action: silently tossed message: score=\d+\.\d+ required=\d+\.\d+ trigger=\d+\.\d+ \(scanned in \d+/\d+ secs \| Message-Id: \S+\)\. From \S+ \(host=(\S+ )?\[\]\) for \S+ ignoreregex = From b5f5ddf1233d110fd2d837c1fb2c62e5162b0bec Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sun, 29 Dec 2013 20:56:25 +0000 Subject: [PATCH 3/6] ENH: end anchor for exim-spam --- config/filter.d/exim-spam.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/exim-spam.conf b/config/filter.d/exim-spam.conf index 8303e7c1..bab19b8f 100644 --- a/config/filter.d/exim-spam.conf +++ b/config/filter.d/exim-spam.conf @@ -12,7 +12,7 @@ before = exim-common.conf failregex = ^%(pid)s \S+ F=(<>|\S+@\S+) %(host_info)srejected by local_scan\(\): .{0,256}$ ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: .*dnsbl.*\s*$ ^%(pid)s \S+ %(host_info)sF=(<>|[^@]+@\S+) rejected after DATA: This message contains a virus \(\S+\)\.\s*$ - ^%(pid)s \S+ SA: Action: silently tossed message: score=\d+\.\d+ required=\d+\.\d+ trigger=\d+\.\d+ \(scanned in \d+/\d+ secs \| Message-Id: \S+\)\. From \S+ \(host=(\S+ )?\[\]\) for \S+ + ^%(pid)s \S+ SA: Action: silently tossed message: score=\d+\.\d+ required=\d+\.\d+ trigger=\d+\.\d+ \(scanned in \d+/\d+ secs \| Message-Id: \S+\)\. From \S+ \(host=(\S+ )?\[\]\) for \S+$ ignoreregex = From d2658e063ca1f7f8900aa219d44734e697f3a45f Mon Sep 17 00:00:00 2001 From: Ivo Truxa Date: Sun, 29 Dec 2013 22:33:08 +0100 Subject: [PATCH 4/6] Update exim-spam An example with no valid FROM email address and host without reverse DNS record --- testcases/files/logs/exim-spam | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/testcases/files/logs/exim-spam b/testcases/files/logs/exim-spam index 46b915d1..17a95a86 100644 --- a/testcases/files/logs/exim-spam +++ b/testcases/files/logs/exim-spam @@ -14,4 +14,8 @@ 2013-06-15 11:20:36 [2516] 1Unmew-0000ea-SE H=egeftech.static.otenet.gr [83.235.177.148]:32706 I=[1.2.3.4]:25 F=auguriesvbd40@google.com rejected after DATA: This message contains a virus (Sanesecurity.Junk.39934.UNOFFICIAL). # failJSON: { "time": "2013-06-16T02:50:43", "match": true , "host": "111.67.203.114" } 2013-06-16 02:50:43 H=dbs.marsukov.com [111.67.203.114] F= rejected RCPT : rejected because 111.67.203.114 is in a black list at dnsbl.sorbs.net\nCurrently Sending Spam See: http://www.sorbs.net/lookup.shtml?111.67.203.114 +# https://github.com/fail2ban/fail2ban/issues/533 +# failJSON: { "time": "2013-12-29T15:39:11", "match": true , "host": "178.123.108.196" } +2013-12-29 15:39:11 1VxHWD-000NuW-83 SA: Action: silently tossed message: score=35.8 required=5.0 trigger=30.0 (scanned in 6/6 secs | Message-Id: 1VxHWD-000NuW-83). From <> (host=NULL [178.123.108.196]) for me@my.com + From ccb64e68b46dcf19e34cb4e6ac585c668ef6d26f Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sun, 29 Dec 2013 21:53:26 +0000 Subject: [PATCH 5/6] DOC: for exim-spam to say how to enable the log lines for the latest regex --- config/filter.d/exim-spam.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/config/filter.d/exim-spam.conf b/config/filter.d/exim-spam.conf index bab19b8f..7c02215a 100644 --- a/config/filter.d/exim-spam.conf +++ b/config/filter.d/exim-spam.conf @@ -1,5 +1,6 @@ # Fail2Ban filter for exim the spam rejection messages # +## For the SA: Action: silently tossed message... to be logged exim's SAdevnull option needs to be used. [INCLUDES] From e220210dc44def294b71f59e280e92f08838c067 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sun, 29 Dec 2013 21:55:04 +0000 Subject: [PATCH 6/6] DOC: fix ChangeLog entry for exim-spam --- ChangeLog | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 434b12d0..70361a53 100644 --- a/ChangeLog +++ b/ChangeLog @@ -43,7 +43,8 @@ ver. 0.8.12 (2013/12/XX) - things-can-only-get-better - filter apache-noscript now includes php cgi scripts. Thanks dani. Closes gh-503 - added ufw action. Thanks Guilhem Lettron. lp-#701522 - - exim-spam include spamassassin log entry. Thanks Ivo Truxa. Closes gh-533 + - exim-spam filter to match spamassassin log entry for option SAdevnull. + Thanks Ivo Truxa. Closes gh-533 - New Features: