From 50eab4df815e3ccb8b7d98040dfc52980be6b59b Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 6 Jan 2014 21:56:22 +1100 Subject: [PATCH 1/2] ENH: add filter groupoffice. Closes gh-566 --- MANIFEST | 2 ++ config/filter.d/groupoffice.conf | 14 ++++++++++++++ testcases/files/logs/groupoffice | 4 ++++ 3 files changed, 20 insertions(+) create mode 100644 config/filter.d/groupoffice.conf create mode 100644 testcases/files/logs/groupoffice diff --git a/MANIFEST b/MANIFEST index a8195b54..98a98532 100644 --- a/MANIFEST +++ b/MANIFEST @@ -59,6 +59,7 @@ testcases/files/logs/assp testcases/files/logs/asterisk testcases/files/logs/dovecot testcases/files/logs/exim +testcases/files/logs/groupoffice testcases/files/logs/suhosin testcases/files/logs/mysqld-auth testcases/files/logs/named-refused @@ -181,6 +182,7 @@ config/filter.d/3proxy.conf config/filter.d/apache-common.conf config/filter.d/exim-common.conf config/filter.d/exim-spam.conf +config/filter.d/groupoffice.conf config/filter.d/perdition.conf config/filter.d/uwimap-auth.conf config/action.d/apf.conf diff --git a/config/filter.d/groupoffice.conf b/config/filter.d/groupoffice.conf new file mode 100644 index 00000000..d5a4e4d8 --- /dev/null +++ b/config/filter.d/groupoffice.conf @@ -0,0 +1,14 @@ +# Fail2Ban filter for Group-Office +# +# Enable logging with: +# $config['info_log']='/home/groupoffice/log/info.log'; +# + +[Definition] + +failregex = ^\[\]LOGIN FAILED for user: "\S+" from IP: $ + + + +# Author: Daniel Black + diff --git a/testcases/files/logs/groupoffice b/testcases/files/logs/groupoffice new file mode 100644 index 00000000..7809f018 --- /dev/null +++ b/testcases/files/logs/groupoffice @@ -0,0 +1,4 @@ +# failJSON: { "time": "2014-01-06T10:59:38", "match": true, "host": "127.0.0.1" } +[2014-01-06 10:59:38]LOGIN FAILED for user: "asdsad" from IP: 127.0.0.1 +# failJSON: { "time": "2014-01-06T10:59:49", "match": false, "host": "127.0.0.1" } +[2014-01-06 10:59:49]LOGIN SUCCESS for user: "admin" from IP: 127.0.0.1 From db7b7bfefacdbc03fdeb3cc4e0de16f8438eda14 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 6 Jan 2014 22:00:12 +1100 Subject: [PATCH 2/2] Credits for groupoffice --- ChangeLog | 2 ++ THANKS | 1 + 2 files changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 9ca3382b..1e5ab543 100644 --- a/ChangeLog +++ b/ChangeLog @@ -46,6 +46,8 @@ ver. 0.8.12 (2013/12/XX) - things-can-only-get-better - exim-spam filter to match spamassassin log entry for option SAdevnull. Thanks Ivo Truxa. Closes gh-533 - Added filter.d/openwebmail filter thanks Ivo Truxa. Closes gh-543 + - Added filter.d/groupoffice filter thanks to logs from Merijn Schering. + Closes gh-566 - Added to sshd filter expression for "Received disconnect from : 3: ...: Auth fail". Thanks Marcel Dopita. Closes gh-289 diff --git a/THANKS b/THANKS index 04aa1f20..efbcbe75 100644 --- a/THANKS +++ b/THANKS @@ -61,6 +61,7 @@ Markus Hoffmann Marvin Rouge mEDI Мернов Георгий +Merijn Schering Michael C. Haller Michael Hanselmann Nick Munger