From b3b62d65bf7f50b8e0f380ed561220bda44e3e55 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sun, 29 Sep 2013 18:06:27 +1000 Subject: [PATCH 1/5] ENH: filter.d/uwimap-auth added. Closes #18 --- ChangeLog | 2 ++ THANKS | 2 ++ config/filter.d/uwimap-auth.conf | 15 +++++++++++++++ config/jail.conf | 6 ++++++ testcases/files/logs/uwimap-auth | 5 +++++ 5 files changed, 30 insertions(+) create mode 100644 config/filter.d/uwimap-auth.conf create mode 100644 testcases/files/logs/uwimap-auth diff --git a/ChangeLog b/ChangeLog index 324b6ec2..eb957f7f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -64,6 +64,8 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests * filter.d/perdition.conf -- filter added Mark McKinstry * action.d/apf.conf - add action for Advanced Policy Firewall (apf) + Amir Caspi and kjohnsonecl + * filter.d/uwimap-auth - filter for uwimap-auth IMAP/POP server - Enhancements: François Boulogne and Frédéric diff --git a/THANKS b/THANKS index b89b7e27..e70ca9c9 100644 --- a/THANKS +++ b/THANKS @@ -8,6 +8,7 @@ be added Adrien Clerc ache +Amir Caspi Andrey G. Grozin Andy Fragen Arturo 'Buanzo' Busleiman @@ -38,6 +39,7 @@ Joël Bertrand JP Espinosa Justin Shore Kévin Drapel +kjohnsonecl kojiro Manuel Arostegui Ramirez Marcel Dopita diff --git a/config/filter.d/uwimap-auth.conf b/config/filter.d/uwimap-auth.conf new file mode 100644 index 00000000..30f2b7bc --- /dev/null +++ b/config/filter.d/uwimap-auth.conf @@ -0,0 +1,15 @@ +# Fail2Ban configuration file +# +# Author: Amir Caspi +# +[INCLUDES] + +before = common.conf + +[Definition] + +_daemon = (?:ipop3d|imapd) + +failregex = ^%(__prefix_line)sLogin (?:failed|excessive login failures) user=\S* auth=\S* host=.*\[\]\s*$ + +ignoreregex = diff --git a/config/jail.conf b/config/jail.conf index 4878122f..80b774e5 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -416,6 +416,12 @@ filter = perdition action = iptables-multiport[name=perdition,port="110,143,993,995"] logpath = /var/log/maillog +[uwimap-auth] +enabled = false +filter = uwimap-auth +action = iptables-multiport[name=perdition,port="110,143,993,995"] +logpath = /var/log/maillog + [osx-ssh-ipfw] enabled = false filter = sshd diff --git a/testcases/files/logs/uwimap-auth b/testcases/files/logs/uwimap-auth new file mode 100644 index 00000000..84760bde --- /dev/null +++ b/testcases/files/logs/uwimap-auth @@ -0,0 +1,5 @@ +# failJSON: { "time": "2005-07-03T20:56:53", "match": true , "host": "81.169.154.112" } +Jul 3 20:56:53 Linux2 imapd[666]: Login failed user=lizdy auth=lizdy host=h2066373.stratoserver.net [81.169.154.112] + +# failJSON: { "time": "2005-07-29T18:30:19", "match": true , "host": "198.52.115.74" } +Jul 29 18:30:19 Linux2 ipop3d[25745]: Login failed user=info auth=info host=74-115-52-198-dedicated.multacom.com [198.52.115.74] From 791183b6398c11576d63bda6cd48c07fbbd97bb8 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Tue, 1 Oct 2013 10:10:53 +1000 Subject: [PATCH 2/5] ENH: filter.d/uwimap-auth - add SYSTEM BREAK-IN ATTEMPT --- config/filter.d/uwimap-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/uwimap-auth.conf b/config/filter.d/uwimap-auth.conf index 30f2b7bc..c6a062dc 100644 --- a/config/filter.d/uwimap-auth.conf +++ b/config/filter.d/uwimap-auth.conf @@ -10,6 +10,6 @@ before = common.conf _daemon = (?:ipop3d|imapd) -failregex = ^%(__prefix_line)sLogin (?:failed|excessive login failures) user=\S* auth=\S* host=.*\[\]\s*$ +failregex = ^%(__prefix_line)sLogin (?:failed|excessive login failures|SYSTEM BREAK-IN ATTEMPT) user=\S* auth=\S* host=.*\[\]\s*$ ignoreregex = From cbdf4ceedde01b38d1ead7c223c86f8215261f88 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Tue, 1 Oct 2013 10:21:11 +1000 Subject: [PATCH 3/5] TST: test cases for uw-imapd thanks to Internet --- testcases/files/logs/uwimap-auth | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/testcases/files/logs/uwimap-auth b/testcases/files/logs/uwimap-auth index 84760bde..b29a3e6f 100644 --- a/testcases/files/logs/uwimap-auth +++ b/testcases/files/logs/uwimap-auth @@ -3,3 +3,12 @@ Jul 3 20:56:53 Linux2 imapd[666]: Login failed user=lizdy auth=lizdy host=h20663 # failJSON: { "time": "2005-07-29T18:30:19", "match": true , "host": "198.52.115.74" } Jul 29 18:30:19 Linux2 ipop3d[25745]: Login failed user=info auth=info host=74-115-52-198-dedicated.multacom.com [198.52.115.74] + +# http://lists.freebsd.org/pipermail/freebsd-questions/2005-January/072073.html +# failJSON: { "time": "2005-01-14T20:28:07", "match": true , "host": "198.52.115.74" } +Jan 14 20:28:07 grog imapd[19343]: Login excessive login failures user=user auth=user host=74-115-52-198-dedicated.multacom.com [198.52.115.74] + +#http://us.generation-nt.com/answer/uw-imapd-doesnt-authenticate-users-help-194297331.html +# failJSON: { "time": "2005-04-08T16:32:01", "match": true , "host": "198.52.115.74" } +Apr 8 16:32:01 abdon imapd[29087]: Login excessive login failures user=brada auth=brada host=xxxxxx [198.52.115.74] + From 9211179d30f183bf0d726baaa760017c69ba0801 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Tue, 1 Oct 2013 22:10:33 +1000 Subject: [PATCH 4/5] ENH: filter.d/uwimap-auth - add "disabled" to regex --- config/filter.d/uwimap-auth.conf | 2 +- testcases/files/logs/uwimap-auth | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/config/filter.d/uwimap-auth.conf b/config/filter.d/uwimap-auth.conf index c6a062dc..5e39fbbf 100644 --- a/config/filter.d/uwimap-auth.conf +++ b/config/filter.d/uwimap-auth.conf @@ -10,6 +10,6 @@ before = common.conf _daemon = (?:ipop3d|imapd) -failregex = ^%(__prefix_line)sLogin (?:failed|excessive login failures|SYSTEM BREAK-IN ATTEMPT) user=\S* auth=\S* host=.*\[\]\s*$ +failregex = ^%(__prefix_line)sLogin (?:failed|excessive login failures|disabled|SYSTEM BREAK-IN ATTEMPT) user=\S* auth=\S* host=.*\[\]\s*$ ignoreregex = diff --git a/testcases/files/logs/uwimap-auth b/testcases/files/logs/uwimap-auth index b29a3e6f..ee141bd4 100644 --- a/testcases/files/logs/uwimap-auth +++ b/testcases/files/logs/uwimap-auth @@ -12,3 +12,7 @@ Jan 14 20:28:07 grog imapd[19343]: Login excessive login failures user=user auth # failJSON: { "time": "2005-04-08T16:32:01", "match": true , "host": "198.52.115.74" } Apr 8 16:32:01 abdon imapd[29087]: Login excessive login failures user=brada auth=brada host=xxxxxx [198.52.115.74] + +# http://www.howtoforge.com/forums/showthread.php?t=3786 +# failJSON: { "time": "2005-04-08T16:32:01", "match": true , "host": "127.0.0.1" } +Apr 8 16:32:01 abdon imapd[21172]: Login disabled user=test auth=test host=localhost.localdomain [127.0.0.1] From 262616f7a7dde76ad64162a38852e4f052adee42 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Tue, 1 Oct 2013 22:32:57 +1000 Subject: [PATCH 5/5] ENH: filter.d/uwimap-auth - failure of an admin override to regex --- config/filter.d/uwimap-auth.conf | 1 + testcases/files/logs/uwimap-auth | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/config/filter.d/uwimap-auth.conf b/config/filter.d/uwimap-auth.conf index 5e39fbbf..b166f3fc 100644 --- a/config/filter.d/uwimap-auth.conf +++ b/config/filter.d/uwimap-auth.conf @@ -11,5 +11,6 @@ before = common.conf _daemon = (?:ipop3d|imapd) failregex = ^%(__prefix_line)sLogin (?:failed|excessive login failures|disabled|SYSTEM BREAK-IN ATTEMPT) user=\S* auth=\S* host=.*\[\]\s*$ + ^%(__prefix_line)sFailed .* override of user=.* host=.*\[\]\s*$ ignoreregex = diff --git a/testcases/files/logs/uwimap-auth b/testcases/files/logs/uwimap-auth index ee141bd4..71317922 100644 --- a/testcases/files/logs/uwimap-auth +++ b/testcases/files/logs/uwimap-auth @@ -16,3 +16,7 @@ Apr 8 16:32:01 abdon imapd[29087]: Login excessive login failures user=brada aut # http://www.howtoforge.com/forums/showthread.php?t=3786 # failJSON: { "time": "2005-04-08T16:32:01", "match": true , "host": "127.0.0.1" } Apr 8 16:32:01 abdon imapd[21172]: Login disabled user=test auth=test host=localhost.localdomain [127.0.0.1] + +# http://mailman2.u.washington.edu/pipermail/imap-uw/2008-February/001889.html +# failJSON: { "time": "2005-02-23T12:36:01", "match": true , "host": "127.0.55.22" } +Feb 23 12:36:01 r2 imapd[3473]: Failed uwmaster override of user=pro1 host=r22.j.de [127.0.55.22]