From bb0dc17a874a296dfc86bdabf5d2e8a113b87141 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 7 Mar 2016 22:40:36 -0500 Subject: [PATCH 01/70] BF: use tests.utils.CONFIG_DIR instead of fixed one (Closes #1348) --- fail2ban/tests/fail2banregextestcase.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fail2ban/tests/fail2banregextestcase.py b/fail2ban/tests/fail2banregextestcase.py index 2fd362c7..e4af50ea 100644 --- a/fail2ban/tests/fail2banregextestcase.py +++ b/fail2ban/tests/fail2banregextestcase.py @@ -40,6 +40,7 @@ except ImportError: from ..client import fail2banregex from ..client.fail2banregex import Fail2banRegex, get_opt_parser, output from .utils import LogCaptureTestCase, logSys +from .utils import CONFIG_DIR fail2banregex.logSys = logSys @@ -48,8 +49,6 @@ def _test_output(*args): fail2banregex.output = _test_output -CONF_FILES_DIR = os.path.abspath( - os.path.join(os.path.dirname(__file__),"..", "..", "config")) TEST_FILES_DIR = os.path.join(os.path.dirname(__file__), "files") @@ -66,7 +65,7 @@ class Fail2banRegexTest(LogCaptureTestCase): FILENAME_02 = os.path.join(TEST_FILES_DIR, "testcase02.log") FILENAME_WRONGCHAR = os.path.join(TEST_FILES_DIR, "testcase-wrong-char.log") - FILTER_SSHD = os.path.join(CONF_FILES_DIR, 'filter.d', 'sshd.conf') + FILTER_SSHD = os.path.join(CONFIG_DIR, 'filter.d', 'sshd.conf') def setUp(self): """Call before every test case.""" From 634e68036e7a1dafd2cefa13a1d55b4ef72af602 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 8 Mar 2016 08:36:29 -0500 Subject: [PATCH 02/70] Get ready for further developments --- ChangeLog | 10 ++++++++++ README.md | 2 +- RELEASE | 2 +- fail2ban/version.py | 2 +- 4 files changed, 13 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3f0f9cca..1a1839a4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,6 +6,16 @@ Fail2Ban: Changelog =================== +ver. 0.9.5 (2015/XX/XXX) - wanna-be-released +----------- + +- Fixes: + +- New Features: + +- Enhancements: + + ver. 0.9.4 (2016/03/08) - for-you-ladies ----------- diff --git a/README.md b/README.md index 67ff45ec..481b7d33 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ / _|__ _(_) |_ ) |__ __ _ _ _ | _/ _` | | |/ /| '_ \/ _` | ' \ |_| \__,_|_|_/___|_.__/\__,_|_||_| - v0.9.4 2015/03/08 + v0.9.4.dev0 2016/??/?? ## Fail2Ban: ban hosts that cause multiple authentication errors diff --git a/RELEASE b/RELEASE index adbaf412..fa89fc34 100644 --- a/RELEASE +++ b/RELEASE @@ -190,7 +190,7 @@ Post Release Add the following to the top of the ChangeLog:: - ver. 0.9.5 (2015/XX/XXX) - wanna-be-released + ver. 0.9.6 (2016/XX/XXX) - wanna-be-released ----------- - Fixes: diff --git a/fail2ban/version.py b/fail2ban/version.py index 9e4ef0f8..140ca959 100644 --- a/fail2ban/version.py +++ b/fail2ban/version.py @@ -24,4 +24,4 @@ __author__ = "Cyril Jaquier, Yaroslav Halchenko, Steven Hiscocks, Daniel Black" __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2005-2016 Yaroslav Halchenko, 2013-2014 Steven Hiscocks, Daniel Black" __license__ = "GPL-v2+" -version = "0.9.4" +version = "0.9.4.dev0" From dfc65018da1b9856d8efc658ec59f366b0c4bdd5 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Wed, 9 Mar 2016 11:36:06 -0700 Subject: [PATCH 03/70] Fedora use mariadb by default, fix log path --- config/paths-fedora.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/paths-fedora.conf b/config/paths-fedora.conf index b3c978ca..e91845a1 100644 --- a/config/paths-fedora.conf +++ b/config/paths-fedora.conf @@ -34,7 +34,7 @@ apache_access_log = /var/log/httpd/*access_log exim_main_log = /var/log/exim/main.log -mysql_log = /var/lib/mysql/mysqld.log +mysql_log = /var/log/mariadb/mariadb.log roundcube_errors_log = /var/log/roundcubemail/errors From 37c9075faddbd40d4ffe202f98f4be2c9dd262a6 Mon Sep 17 00:00:00 2001 From: sebres Date: Wed, 9 Mar 2016 20:00:11 +0100 Subject: [PATCH 04/70] fixed monit filter: failregex find now both previous and new versions: - failregex of previous monit version merged as single expression; - extended failregex with new monit "access denied" version; --- config/filter.d/monit.conf | 15 +++++++++++++-- fail2ban/tests/files/logs/monit | 17 ++++++++++++++++- 2 files changed, 29 insertions(+), 3 deletions(-) diff --git a/config/filter.d/monit.conf b/config/filter.d/monit.conf index c2ef20d9..599bd363 100644 --- a/config/filter.d/monit.conf +++ b/config/filter.d/monit.conf @@ -2,9 +2,20 @@ # # +[INCLUDES] + +# Read common prefixes. If any customizations available -- read them from +# common.local +before = common.conf + [Definition] -failregex = ^\[[A-Z]+\s+\]\s*error\s*:\s*Warning:\s+Client '' supplied unknown user '\w+' accessing monit httpd$ - ^\[[A-Z]+\s+\]\s*error\s*:\s*Warning:\s+Client '' supplied wrong password for user '\w+' accessing monit httpd$ +_daemon = monit +# Regexp for previous (accessing monit httpd) and new (access denied) versions +failregex = ^\[[A-Z]+\s+\]\s*error\s*:\s*Warning:\s+Client '' supplied (?:unknown user '[^']+'|wrong password for user '[^']*') accessing monit httpd$ + ^%(__prefix_line)s\w+: access denied -- client : (?:unknown user '[^']+'|wrong password for user '[^']*'|empty password)$ + +# Ignore login with empty user (first connect, no user specified) +# ignoreregex = %(__prefix_line)s\w+: access denied -- client : (?:unknown user '') ignoreregex = diff --git a/fail2ban/tests/files/logs/monit b/fail2ban/tests/files/logs/monit index a923b6e2..57437046 100644 --- a/fail2ban/tests/files/logs/monit +++ b/fail2ban/tests/files/logs/monit @@ -1,6 +1,21 @@ +# Previous version -- # failJSON: { "time": "2005-04-16T21:05:29", "match": true , "host": "69.93.127.111" } [PDT Apr 16 21:05:29] error : Warning: Client '69.93.127.111' supplied unknown user 'foo' accessing monit httpd - # failJSON: { "time": "2005-04-16T20:59:33", "match": true , "host": "97.113.189.111" } [PDT Apr 16 20:59:33] error : Warning: Client '97.113.189.111' supplied wrong password for user 'admin' accessing monit httpd +# Current version -- corresponding "https://bitbucket.org/tildeslash/monit/src/6905335aa903d425cae732cab766bd88ea5f2d1d/src/http/processor.c?at=master&fileviewer=file-view-default#processor.c-728" +# failJSON: { "time": "2005-03-09T09:18:28", "match": false, "desc": "should be ignored: no login" } +Mar 9 09:18:28 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: missing or invalid Authorization header +# failJSON: { "time": "2005-03-09T09:18:28", "match": false, "desc": "should be ignored: no login" } +Mar 9 09:18:28 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: invalid Authorization header +# failJSON: { "time": "2005-03-09T09:18:29", "match": false, "desc": "should be ignored: connect, still no user specified" } +Mar 9 09:18:29 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: empty username +# failJSON: { "time": "2005-03-09T09:18:31", "match": false, "desc": "should be ignored: connect, still no user specified" } +Mar 9 09:18:31 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: unknown user '' +# failJSON: { "time": "2005-03-09T09:18:32", "match": true, "host": "1.2.3.4", "desc": "no password try" } +Mar 9 09:18:32 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: empty password +# failJSON: { "time": "2005-03-09T09:18:33", "match": true, "host": "1.2.3.4", "desc": "unknown user try" } +Mar 9 09:18:33 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: unknown user 'test1' +# failJSON: { "time": "2005-03-09T09:18:34", "match": true, "host": "1.2.3.4", "desc": "wrong password try" } +Mar 9 09:18:34 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: wrong password for user 'test2' From 9d13bb0c3ad0766beed7d956e87ff8c0e5674e6a Mon Sep 17 00:00:00 2001 From: sebres Date: Wed, 9 Mar 2016 20:11:14 +0100 Subject: [PATCH 05/70] ChangeLog and THANKS entries --- ChangeLog | 3 +++ THANKS | 1 + 2 files changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 1a1839a4..8ec13b48 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,9 @@ ver. 0.9.5 (2015/XX/XXX) - wanna-be-released ----------- - Fixes: + * filter.d/monit.conf + - extended failregex with new monit "access denied" version (gh-1355); + - failregex of previous monit version merged as single expression. - New Features: diff --git a/THANKS b/THANKS index 0b45c019..cfcab3ad 100644 --- a/THANKS +++ b/THANKS @@ -34,6 +34,7 @@ Daniel B. Cid Daniel B. Daniel Black David Nutter +David Reagan (jerrac) Derek Atkins Donald Yandt Eric Gerbier From f3f813a925c23951d7dbe3c86a8f5fb88b635c8c Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Wed, 9 Mar 2016 13:52:50 -0700 Subject: [PATCH 06/70] - mysqld does not log login attempts to the journal. - Add /var/log/mysqld.log to mysql_log --- config/paths-fedora.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/paths-fedora.conf b/config/paths-fedora.conf index e91845a1..d13645b1 100644 --- a/config/paths-fedora.conf +++ b/config/paths-fedora.conf @@ -35,6 +35,7 @@ apache_access_log = /var/log/httpd/*access_log exim_main_log = /var/log/exim/main.log mysql_log = /var/log/mariadb/mariadb.log + /var/log/mysqld.log roundcube_errors_log = /var/log/roundcubemail/errors @@ -48,4 +49,3 @@ pureftpd_backend = systemd wuftpd_backend = systemd postfix_backend = systemd dovecot_backend = systemd -mysql_backend = systemd From eed1a0d686ba8bb0aae7ec1546a2d4aa2415ba74 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Wed, 9 Mar 2016 23:06:59 -0500 Subject: [PATCH 07/70] BF: Include iptables-common (not removed iptables-blocktype) within firewallcmd- actions (Closes #1254) --- config/action.d/firewallcmd-allports.conf | 2 +- config/action.d/firewallcmd-multiport.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/action.d/firewallcmd-allports.conf b/config/action.d/firewallcmd-allports.conf index ec52babb..571d5ba6 100644 --- a/config/action.d/firewallcmd-allports.conf +++ b/config/action.d/firewallcmd-allports.conf @@ -6,7 +6,7 @@ [INCLUDES] -before = iptables-blocktype.conf +before = iptables-common.conf [Definition] diff --git a/config/action.d/firewallcmd-multiport.conf b/config/action.d/firewallcmd-multiport.conf index 4d806e6b..82c758fe 100644 --- a/config/action.d/firewallcmd-multiport.conf +++ b/config/action.d/firewallcmd-multiport.conf @@ -5,7 +5,7 @@ [INCLUDES] -before = iptables-blocktype.conf +before = iptables-common.conf [Definition] From bd25a43417fa4fcf8e55a991331e709f6d0fb114 Mon Sep 17 00:00:00 2001 From: Johannes Weberhofer Date: Fri, 11 Mar 2016 18:19:53 +0100 Subject: [PATCH 08/70] define journalmatch setting for pure-ftps --- config/filter.d/pure-ftpd.conf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/config/filter.d/pure-ftpd.conf b/config/filter.d/pure-ftpd.conf index be3d0ae5..034336f3 100644 --- a/config/filter.d/pure-ftpd.conf +++ b/config/filter.d/pure-ftpd.conf @@ -21,6 +21,10 @@ failregex = ^%(__prefix_line)s\(.+?@\) \[WARNING\] %(__errmsg)s\s*$ ignoreregex = +[Init] + +journalmatch = _SYSTEMD_UNIT=pure-ftpd.service + _COMM=pure-ftpd + # Author: Cyril Jaquier # Modified: Yaroslav Halchenko for pure-ftpd # Documentation thanks to Blake on http://www.fail2ban.org/wiki/index.php?title=Fail2ban:Community_Portal From bfac42eb2e970c08138380af59154c91826b8666 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 14 Mar 2016 11:10:28 -0400 Subject: [PATCH 09/70] changelog for journalmatch pure-ftpd --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 1a1839a4..7681e425 100644 --- a/ChangeLog +++ b/ChangeLog @@ -14,6 +14,7 @@ ver. 0.9.5 (2015/XX/XXX) - wanna-be-released - New Features: - Enhancements: + * journald journalmatch for pure-ftpd (gh-1362) ver. 0.9.4 (2016/03/08) - for-you-ladies From 25c2334bc89a28812b1a3dc9ce4f3a8b502aeb0f Mon Sep 17 00:00:00 2001 From: jblachly Date: Wed, 16 Mar 2016 13:52:01 -0400 Subject: [PATCH 10/70] SmartOS PAM Authentication failed (not failURE) SmartOS (and likely other Illumos platforms) enter log entries for failed sshd logins of the form: `Authentication failed for USER from HOST` The current sshd.conf regex matches `failure` -- add to this a match for `failed` to support Illumos --- config/filter.d/sshd.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index 180ac52a..58e9c977 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -18,7 +18,7 @@ before = common.conf _daemon = sshd -failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|error) for .* from ( via \S+)?\s*$ +failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failed|failure|error) for .* from ( via \S+)?\s*$ ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from \s*$ ^%(__prefix_line)sFailed \S+ for .*? from (?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ \(serial \d+\) CA )?\S+ %(__md5hex)s(, client user ".*", client host ".*")?))?\s*$ ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM \s*$ From cf2aa9c1c02631b0b6603bc4f19c4668af1989a8 Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Mon, 21 Mar 2016 05:53:23 +0000 Subject: [PATCH 11/70] Added regex for LDAP authentication failures --- config/filter.d/dovecot.conf | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf index 856c220e..136a3947 100644 --- a/config/filter.d/dovecot.conf +++ b/config/filter.d/dovecot.conf @@ -13,6 +13,7 @@ failregex = ^%(__prefix_line)s(%(__pam_auth)s(\(dovecot:auth\))?:)?\s+authentica ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=(, lip=(\d{1,3}\.){3}\d{1,3})?(, TLS( handshaking(: SSL_accept\(\) failed: error:[\dA-F]+:SSL routines:[TLS\d]+_GET_CLIENT_HELLO:unknown protocol)?)?(: Disconnected)?)?(, session=<\S+>)?\s*$ ^%(__prefix_line)s(Info|dovecot: auth\(default\)|auth-worker\(\d+\)): pam\(\S+,\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$ ^%(__prefix_line)s(auth|auth-worker\(\d+\)): (pam|passwd-file)\(\S+,\): unknown user\s*$ + ^%(__prefix_line)s(auth|auth-worker\(\d+\)): Info: ldap\(\S*,,\S*\): invalid credentials\s*$ ignoreregex = @@ -22,9 +23,10 @@ journalmatch = _SYSTEMD_UNIT=dovecot.service # DEV Notes: # * the first regex is essentially a copy of pam-generic.conf -# * Probably doesn't do dovecot sql/ldap backends properly +# * Probably doesn't do dovecot sql/ldap backends properly (resolved in edit 21/03/2016) # * Removed the 'no auth attempts' log lines from the matches because produces # lots of false positives on misconfigured MTAs making regexp unusable # # Author: Martin Waschbuesch # Daniel Black (rewrote with begin and end anchors) +# Martin O'Neal (added LDAP authentication failure regex) From fe1475be952c8d76527bbe4b0c1249b0e6b10bf4 Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Mon, 21 Mar 2016 05:59:59 +0000 Subject: [PATCH 12/70] Additional exim regexes to cover common attacks... --- config/filter.d/exim.conf | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf index 11fd03d1..1af15430 100644 --- a/config/filter.d/exim.conf +++ b/config/filter.d/exim.conf @@ -14,10 +14,13 @@ before = exim-common.conf [Definition] failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$ - ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$ - ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$ - ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$ - ^%(pid)s SMTP call from \S+ \[\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$ + ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$ + ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$ + ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$ + ^%(pid)s SMTP call from \S+ \[\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$ + ^%(pid)s SMTP protocol error in "AUTH LOGIN(| \S*)" H=\(\S*\) \[\]\:\d+ I=\[\S*\]\:\d+ AUTH command used when not advertised\s*$ + ^%(pid)s no MAIL in SMTP connection from (|\S* )\[\]\:\d+ I=\[\S*\]\:\d+ D=\d+s(| C=\S*)\s*$ + ^%(pid)s \S+ SMTP connection from (|\S* )(|\(\S*\))\[\]\:\d+ I=\[\S*\]\:\d+ closed by DROP in ACL\s*$ ignoreregex = @@ -30,3 +33,4 @@ ignoreregex = # # Author: Cyril Jaquier # Daniel Black (rewrote with strong regexs) +# Martin O'Neal (added additional regexs to detect authentication failures, protocol errors, and drops) From eaf6bbb08f087c01b3ce2ede8e1b3051bfff2452 Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Wed, 23 Mar 2016 11:47:31 +0000 Subject: [PATCH 13/70] add test to catch LDAP auth failures --- fail2ban/tests/files/logs/dovecot | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fail2ban/tests/files/logs/dovecot b/fail2ban/tests/files/logs/dovecot index 4c2ccc94..627b8dc8 100644 --- a/fail2ban/tests/files/logs/dovecot +++ b/fail2ban/tests/files/logs/dovecot @@ -70,3 +70,6 @@ Jun 13 21:48:06 platypus dovecot: pop3-login: Disconnected: Inactivity (no auth Jun 13 20:20:21 platypus dovecot: imap-login: Disconnected (no auth attempts): rip=180.189.168.166, lip=113.212.99.194, TLS handshaking: Disconnected # failJSON: { "time": "2005-07-02T13:49:32", "match": false , "host": "192.51.100.13" } Jul 02 13:49:32 hostname dovecot[442]: pop3-login: Disconnected (no auth attempts in 58 secs): user=<>, rip=192.51.100.13, lip=203.0.113.17, session= + +# failJSON: { "time": "2005-03-23T06:10:52", "match": true , "host": "52.37.139.121" } +Mar 23 06:10:52 auth: Info: ldap(dog,52.37.139.121,): invalid credentials From 42f43d0f8aefe840d5f590634d9559217cffdc84 Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Wed, 23 Mar 2016 11:51:12 +0000 Subject: [PATCH 14/70] added note to cover dovecot ldap regex --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 7681e425..e3e57154 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,7 @@ ver. 0.9.5 (2015/XX/XXX) - wanna-be-released - Enhancements: * journald journalmatch for pure-ftpd (gh-1362) + * Add additional regex filter for dovecot ldap authentication failures ver. 0.9.4 (2016/03/08) - for-you-ladies From 28e246b5d78f59753dcc6eacb94ef021d051e4c9 Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Wed, 23 Mar 2016 11:52:09 +0000 Subject: [PATCH 15/70] added note to cover additional exim filters --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 7681e425..48829ef0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,7 @@ ver. 0.9.5 (2015/XX/XXX) - wanna-be-released - Enhancements: * journald journalmatch for pure-ftpd (gh-1362) + * added additional regex filters for exim ver. 0.9.4 (2016/03/08) - for-you-ladies From 33ef2311e7b6d31d940bec14358109841e1bed89 Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Wed, 23 Mar 2016 11:58:03 +0000 Subject: [PATCH 16/70] added tests to cover exim regex additions --- fail2ban/tests/files/logs/exim | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fail2ban/tests/files/logs/exim b/fail2ban/tests/files/logs/exim index c015eb29..36185604 100644 --- a/fail2ban/tests/files/logs/exim +++ b/fail2ban/tests/files/logs/exim @@ -43,3 +43,16 @@ # failJSON: { "time": "2014-12-02T03:00:23", "match": true , "host": "193.254.202.35" } 2014-12-02 03:00:23 auth_plain authenticator failed for (rom182) [193.254.202.35]:41556 I=[10.0.0.1]:25: 535 Incorrect authentication data (set_id=webmaster) + +# failJSON: { "time": "2016-03-18T00:34:06", "match": true , "host": "45.32.34.167" } +2016-03-18 00:34:06 [7513] SMTP protocol error in "AUTH LOGIN" H=(ylmf-pc) [45.32.34.167]:60723 I=[172.89.0.6]:587 AUTH command used when not advertised +# failJSON: { "time": "2016-03-19T18:40:44", "match": true , "host": "92.45.204.170" } +2016-03-19 18:40:44 [26221] SMTP protocol error in "AUTH LOGIN aW5mb0BtYW5iYXQub3Jn" H=([127.0.0.1]) [92.45.204.170]:14243 I=[172.89.0.6]:587 AUTH command used when not advertised +# failJSON: { "time": "2016-03-21T06:38:05", "match": true , "host": "49.212.207.15" } +2016-03-21 06:38:05 [5718] no MAIL in SMTP connection from www3005.sakura.ne.jp [49.212.207.15]:28890 I=[172.89.0.6]:25 D=21s C=EHLO,STARTTLS +# failJSON: { "time": "2016-03-21T06:57:36", "match": true , "host": "122.165.71.116" } +2016-03-21 06:57:36 [5908] no MAIL in SMTP connection from [122.165.71.116]:2056 I=[172.89.0.6]:25 D=10s +# failJSON: { "time": "2016-03-21T04:07:49", "match": true , "host": "174.137.147.204" } +2016-03-21 04:07:49 [25874] 1ahr79-0006jK-G9 SMTP connection from (voyeur.webair.com) [174.137.147.204]:44884 I=[172.89.0.6]:25 closed by DROP in ACL +# failJSON: { "time": "2016-03-21T04:33:13", "match": true , "host": "206.214.71.53" } +2016-03-21 04:33:13 [26074] 1ahrVl-0006mY-79 SMTP connection from riveruse.com [206.214.71.53]:39865 I=[172.89.0.6]:25 closed by DROP in ACL From e9202fa0b2805833c9383b154986335df7cbca0e Mon Sep 17 00:00:00 2001 From: jblachly Date: Thu, 24 Mar 2016 00:43:15 -0400 Subject: [PATCH 17/70] Placed failure (illumos) at end of regex --- config/filter.d/sshd.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index 58e9c977..eeb1518e 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -18,7 +18,7 @@ before = common.conf _daemon = sshd -failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failed|failure|error) for .* from ( via \S+)?\s*$ +failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|error|failed) for .* from ( via \S+)?\s*$ ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from \s*$ ^%(__prefix_line)sFailed \S+ for .*? from (?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ \(serial \d+\) CA )?\S+ %(__md5hex)s(, client user ".*", client host ".*")?))?\s*$ ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM \s*$ From 3d239215cd2681951d9bce20f2622fa0565136d6 Mon Sep 17 00:00:00 2001 From: TorontoMedia Date: Thu, 17 Mar 2016 05:33:14 +0100 Subject: [PATCH 18/70] Two new firewalld actions with rich rules for firewalld-0.3.1+ (gh-1367) closes #1367 --- ChangeLog | 5 +- config/action.d/firewallcmd-allports.conf | 2 +- config/action.d/firewallcmd-multiport.conf | 6 +- config/action.d/firewallcmd-rich-logging.conf | 65 +++++++++++++++++++ config/action.d/firewallcmd-rich-rules.conf | 57 ++++++++++++++++ 5 files changed, 129 insertions(+), 6 deletions(-) create mode 100644 config/action.d/firewallcmd-rich-logging.conf create mode 100644 config/action.d/firewallcmd-rich-rules.conf diff --git a/ChangeLog b/ChangeLog index 80a92edb..6d8f4567 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,13 +6,14 @@ Fail2Ban: Changelog =================== -ver. 0.9.5 (2015/XX/XXX) - wanna-be-released +ver. 0.9.5 (2016/XX/XXX) - wanna-be-released ----------- - Fixes: - New Features: - + * New Actions: + - action.d/firewallcmd-rich-rules and action.d/firewallcmd-rich-logging (gh-1367) - Enhancements: * journald journalmatch for pure-ftpd (gh-1362) * Add additional regex filter for dovecot ldap authentication failures (gh-1370) diff --git a/config/action.d/firewallcmd-allports.conf b/config/action.d/firewallcmd-allports.conf index ec52babb..571d5ba6 100644 --- a/config/action.d/firewallcmd-allports.conf +++ b/config/action.d/firewallcmd-allports.conf @@ -6,7 +6,7 @@ [INCLUDES] -before = iptables-blocktype.conf +before = iptables-common.conf [Definition] diff --git a/config/action.d/firewallcmd-multiport.conf b/config/action.d/firewallcmd-multiport.conf index 4d806e6b..438d4cf7 100644 --- a/config/action.d/firewallcmd-multiport.conf +++ b/config/action.d/firewallcmd-multiport.conf @@ -5,15 +5,15 @@ [INCLUDES] -before = iptables-blocktype.conf +before = iptables-common.conf [Definition] actionstart = firewall-cmd --direct --add-chain ipv4 filter f2b- firewall-cmd --direct --add-rule ipv4 filter f2b- 1000 -j RETURN - firewall-cmd --direct --add-rule ipv4 filter 0 -m state --state NEW -p -m multiport --dports -j f2b- + firewall-cmd --direct --add-rule ipv4 filter 0 -m conntrack --ctstate NEW -p -m multiport --dports -j f2b- -actionstop = firewall-cmd --direct --remove-rule ipv4 filter 0 -m state --state NEW -p -m multiport --dports -j f2b- +actionstop = firewall-cmd --direct --remove-rule ipv4 filter 0 -m conntrack --ctstate NEW -p -m multiport --dports -j f2b- firewall-cmd --direct --remove-rules ipv4 filter f2b- firewall-cmd --direct --remove-chain ipv4 filter f2b- diff --git a/config/action.d/firewallcmd-rich-logging.conf b/config/action.d/firewallcmd-rich-logging.conf new file mode 100644 index 00000000..1b88c2d9 --- /dev/null +++ b/config/action.d/firewallcmd-rich-logging.conf @@ -0,0 +1,65 @@ +# Fail2Ban configuration file +# +# Author: Donald Yandt +# +# Because of the rich rule commands requires firewalld-0.3.1+ +# This action uses firewalld rich-rules which gives you a cleaner iptables since it stores rules according to zones and not +# by chain. So for an example all deny rules will be listed under _deny and all log rules under _log. +# +# Also this action logs banned access attempts so you can filter that and increase ban time for offenders. +# +# If you use the --permanent rule you get a xml file in /etc/firewalld/zones/.xml that can be shared and parsed easliy +# +# Example commands to view rules: +# firewall-cmd [--zone=] --list-rich-rules +# firewall-cmd [--zone=] --list-all +# firewall-cmd [--zone=zone] --query-rich-rule='rule' + +[Definition] + +actionstart = + +actionstop = + +actioncheck = + +# you can also use zones and/or service names. +# +# zone example: +# firewall-cmd --zone= --add-rich-rule="rule family='ipv4' source address='' port port='' protocol='' log prefix='f2b-' level='' limit value='/m' " +# service name example: +# firewall-cmd --zone= --add-rich-rule="rule family='ipv4' source address='' service name='' log prefix='f2b-' level='' limit value='/m' " +# Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges seperated by a comma or space for an example: http, https, 22-60, 18 smtp + +actionban = ports=""; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='' port port='$p' protocol='' log prefix='f2b-' level='' limit value='/m' "; done + +actionunban = ports=""; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='' port port='$p' protocol='' log prefix='f2b-' level='' limit value='/m' "; done + +[Init] + +name = default + +# log levels are "emerg", "alert", "crit", "error", "warning", "notice", "info" or "debug" +level = info + +# log rate per minute +rate = 1 + +zone = public + +# use command firewall-cmd --get-services to see a list of services available +# +# Examples: +# +# amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps +# freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos +# kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s +# postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy +# telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server + +service = ssh + +# reject types: 'icmp-net-unreachable', 'icmp-host-unreachable', 'icmp-port-unreachable', 'icmp-proto-unreachable', +# 'icmp-net-prohibited', 'icmp-host-prohibited', 'icmp-admin-prohibited' or 'tcp-reset' + +blocktype = reject type='icmp-port-unreachable' diff --git a/config/action.d/firewallcmd-rich-rules.conf b/config/action.d/firewallcmd-rich-rules.conf new file mode 100644 index 00000000..4e39df54 --- /dev/null +++ b/config/action.d/firewallcmd-rich-rules.conf @@ -0,0 +1,57 @@ +# Fail2Ban configuration file +# +# Author: Donald Yandt +# +# Because of the rich rule commands requires firewalld-0.3.1+ +# This action uses firewalld rich-rules which gives you a cleaner iptables since it stores rules according to zones and not +# by chain. So for an example all deny rules will be listed under _deny. +# +# If you use the --permanent rule you get a xml file in /etc/firewalld/zones/.xml that can be shared and parsed easliy +# +# Example commands to view rules: +# firewall-cmd [--zone=] --list-rich-rules +# firewall-cmd [--zone=] --list-all +# firewall-cmd [--zone=zone] --query-rich-rule='rule' + +[Definition] + +actionstart = + +actionstop = + +actioncheck = + +#you can also use zones and/or service names. +# +# zone example: +# firewall-cmd --zone= --add-rich-rule="rule family='ipv4' source address='' port port='' protocol='' " +# service name example: +# firewall-cmd --zone= --add-rich-rule="rule family='ipv4' source address='' service name='' " +# Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges seperated by a comma or space for an example: http, https, 22-60, 18 smtp + +actionban = ports=""; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='' port port='$p' protocol='' "; done + +actionunban = ports=""; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='' port port='$p' protocol='' "; done + +[Init] + +name = default + +zone = public + +# use command firewall-cmd --get-services to see a list of services available +# +# Examples: +# +# amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps +# freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kadmin kerberos +# kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s +# postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp squid ssh synergy +# telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server + +service = ssh + +# reject types: 'icmp-net-unreachable', 'icmp-host-unreachable', 'icmp-port-unreachable', 'icmp-proto-unreachable', +# 'icmp-net-prohibited', 'icmp-host-prohibited', 'icmp-admin-prohibited' or 'tcp-reset' + +blocktype = reject type='icmp-port-unreachable' From 9d7e860edb7f77dd29479e6c60453697030224cb Mon Sep 17 00:00:00 2001 From: sebres Date: Thu, 31 Mar 2016 11:43:14 +0200 Subject: [PATCH 19/70] possibility to increase verbosity up to heavy debug (partial ported from 716-cs) --- bin/fail2ban-client | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/bin/fail2ban-client b/bin/fail2ban-client index 7f3f5639..bc0c0be8 100755 --- a/bin/fail2ban-client +++ b/bin/fail2ban-client @@ -376,8 +376,10 @@ class Fail2banClient: logSys.setLevel(logging.WARNING) elif verbose == 2: logSys.setLevel(logging.INFO) - else: + elif verbose == 3: logSys.setLevel(logging.DEBUG) + else: + logSys.setLevel(logging.HEAVYDEBUG) # Add the default logging handler to dump to stderr logout = logging.StreamHandler(sys.stderr) # set a format which is simpler for console use From 1eb51b1bc2cfb2b0c37016cad9fe665a843eba73 Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Fri, 1 Apr 2016 18:07:01 +0100 Subject: [PATCH 20/70] Tightened up regexes to catch rDNS entries --- config/filter.d/exim.conf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf index 1af15430..4aadf15c 100644 --- a/config/filter.d/exim.conf +++ b/config/filter.d/exim.conf @@ -18,9 +18,9 @@ failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user| ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$ ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$ ^%(pid)s SMTP call from \S+ \[\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$ - ^%(pid)s SMTP protocol error in "AUTH LOGIN(| \S*)" H=\(\S*\) \[\]\:\d+ I=\[\S*\]\:\d+ AUTH command used when not advertised\s*$ - ^%(pid)s no MAIL in SMTP connection from (|\S* )\[\]\:\d+ I=\[\S*\]\:\d+ D=\d+s(| C=\S*)\s*$ - ^%(pid)s \S+ SMTP connection from (|\S* )(|\(\S*\))\[\]\:\d+ I=\[\S*\]\:\d+ closed by DROP in ACL\s*$ + ^%(pid)s SMTP protocol error in "AUTH \S*(| \S*)" H=(|\S* )(|\(\S*\) )\[\]\:\d+ I=\[\S*\]\:\d+ AUTH command used when not advertised\s*$ + ^%(pid)s no MAIL in SMTP connection from (|\S* )(|\(\S*\) )\[\]\:\d+ I=\[\S*\]\:\d+ D=\d+s(| C=\S*)\s*$ + ^%(pid)s \S+ SMTP connection from (|\S* )(|\(\S*\) )\[\]\:\d+ I=\[\S*\]\:\d+ closed by DROP in ACL\s*$ ignoreregex = From fcca1413b0800bfec091aa04c4c34d770aac8daa Mon Sep 17 00:00:00 2001 From: theDogOfPavlov Date: Fri, 1 Apr 2016 18:47:19 +0100 Subject: [PATCH 21/70] rDNS tests added additional tests to cover logs with rDNS --- fail2ban/tests/files/logs/exim | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fail2ban/tests/files/logs/exim b/fail2ban/tests/files/logs/exim index 36185604..a3b287d4 100644 --- a/fail2ban/tests/files/logs/exim +++ b/fail2ban/tests/files/logs/exim @@ -56,3 +56,10 @@ 2016-03-21 04:07:49 [25874] 1ahr79-0006jK-G9 SMTP connection from (voyeur.webair.com) [174.137.147.204]:44884 I=[172.89.0.6]:25 closed by DROP in ACL # failJSON: { "time": "2016-03-21T04:33:13", "match": true , "host": "206.214.71.53" } 2016-03-21 04:33:13 [26074] 1ahrVl-0006mY-79 SMTP connection from riveruse.com [206.214.71.53]:39865 I=[172.89.0.6]:25 closed by DROP in ACL + +# failJSON: { "time": "2016-04-01T11:08:39", "match": true , "host": "192.0.2.1" } +2016-04-01 11:08:39 [18643] no MAIL in SMTP connection from host.example.com (SERVER) [192.0.2.1]:1418 I=[172.89.0.6]:25 D=34s C=EHLO,AUTH +# failJSON: { "time": "2016-04-01T11:09:21", "match": true , "host": "192.0.2.1" } +2016-04-01 11:09:21 [18648] SMTP protocol error in "AUTH LOGIN" H=host.example.com (SERVER) [192.0.2.1]:4692 I=[172.89.0.6]:25 AUTH command used when not advertised +# failJSON: { "time": "2016-03-27T16:48:48", "match": true , "host": "192.0.2.1" } +2016-03-27 16:48:48 [21478] 1akDqs-0005aQ-9b SMTP connection from host.example.com (SERVER) [192.0.2.1]:47714 I=[172.89.0.6]:25 closed by DROP in ACL From 1a299409e5750b0a4ec4d3d820b278c0366fe5da Mon Sep 17 00:00:00 2001 From: Alexandre Perrin Date: Thu, 14 Apr 2016 12:10:58 +0200 Subject: [PATCH 22/70] Fix postfix/smtps/smtpd matching. --- config/filter.d/postfix-sasl.conf | 2 +- config/filter.d/postfix.conf | 2 +- fail2ban/tests/files/logs/postfix | 3 +++ fail2ban/tests/files/logs/postfix-sasl | 3 +++ 4 files changed, 8 insertions(+), 2 deletions(-) diff --git a/config/filter.d/postfix-sasl.conf b/config/filter.d/postfix-sasl.conf index 7ff995c9..470b069d 100644 --- a/config/filter.d/postfix-sasl.conf +++ b/config/filter.d/postfix-sasl.conf @@ -7,7 +7,7 @@ before = common.conf [Definition] -_daemon = postfix(-\w+)?/(submission/)?smtp(d|s) +_daemon = postfix(-\w+)?/((?:submission|smtps)/)?smtpd failregex = ^%(__prefix_line)swarning: [-._\w]+\[\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/:]*={0,2})?\s*$ diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf index 002b02b2..e162c1ff 100644 --- a/config/filter.d/postfix.conf +++ b/config/filter.d/postfix.conf @@ -10,7 +10,7 @@ before = common.conf [Definition] -_daemon = postfix(-\w+)?/(submission/)?smtp(d|s) +_daemon = postfix(-\w+)?/((?:submission|smtps)/)?smtpd failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 554 5\.7\.1 .*$ ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 450 4\.7\.1 Client host rejected: cannot find your hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$ diff --git a/fail2ban/tests/files/logs/postfix b/fail2ban/tests/files/logs/postfix index 3ec2886a..78f72287 100644 --- a/fail2ban/tests/files/logs/postfix +++ b/fail2ban/tests/files/logs/postfix @@ -32,3 +32,6 @@ Jan 31 13:55:24 xxx postfix/smtpd[3462]: NOQUEUE: reject: EHLO from s271272.stat # failJSON: { "time": "2005-01-31T13:55:24", "match": true , "host": "78.107.251.238" } Jan 31 13:55:24 xxx postfix-incoming/smtpd[3462]: NOQUEUE: reject: EHLO from s271272.static.corbina.ru[78.107.251.238]: 504 5.5.2 : Helo command rejected: need fully-qualified hostname; proto=SMTP helo= + +# failJSON: { "time": "2005-04-12T02:24:11", "match": true , "host": "62.138.2.143" } +Apr 12 02:24:11 xxx postfix/smtps/smtpd[42]: NOQUEUE: reject: EHLO from astra4139.startdedicated.de[62.138.2.143]: 504 5.5.2 : Helo command rejected: need fully-qualified hostname; proto=SMTP helo= diff --git a/fail2ban/tests/files/logs/postfix-sasl b/fail2ban/tests/files/logs/postfix-sasl index 586f9584..9fcb0f49 100644 --- a/fail2ban/tests/files/logs/postfix-sasl +++ b/fail2ban/tests/files/logs/postfix-sasl @@ -23,3 +23,6 @@ Feb 3 08:29:28 mail postfix/smtpd[21022]: warning: unknown[1.1.1.1]: SASL LOGIN # failJSON: { "time": "2005-01-29T08:11:45", "match": true , "host": "1.1.1.1" } Jan 29 08:11:45 mail postfix-incoming/smtpd[10752]: warning: unknown[1.1.1.1]: SASL LOGIN authentication failed: Password: + +# failJSON: { "time": "2005-04-12T02:24:11", "match": true , "host": "62.138.2.143" } +Apr 12 02:24:11 xxx postfix/smtps/smtpd[42]: warning: astra4139.startdedicated.de[62.138.2.143]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 From 7712310d2d9f36a3502cd4807bb40a02edfe3df7 Mon Sep 17 00:00:00 2001 From: Alexandre Perrin Date: Thu, 14 Apr 2016 13:54:58 +0200 Subject: [PATCH 23/70] Be more backward compatible on matching postfix/smtps/smtpd Support trailing smtps also and not only smtpd. suggested by @sebres --- config/filter.d/postfix-sasl.conf | 2 +- config/filter.d/postfix.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/filter.d/postfix-sasl.conf b/config/filter.d/postfix-sasl.conf index 470b069d..4a6ceaaa 100644 --- a/config/filter.d/postfix-sasl.conf +++ b/config/filter.d/postfix-sasl.conf @@ -7,7 +7,7 @@ before = common.conf [Definition] -_daemon = postfix(-\w+)?/((?:submission|smtps)/)?smtpd +_daemon = postfix(-\w+)?/(?:submission/|smtps/)?smtp[ds] failregex = ^%(__prefix_line)swarning: [-._\w]+\[\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/:]*={0,2})?\s*$ diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf index e162c1ff..3051409b 100644 --- a/config/filter.d/postfix.conf +++ b/config/filter.d/postfix.conf @@ -10,7 +10,7 @@ before = common.conf [Definition] -_daemon = postfix(-\w+)?/((?:submission|smtps)/)?smtpd +_daemon = postfix(-\w+)?/(?:submission/|smtps/)?smtp[ds] failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 554 5\.7\.1 .*$ ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[\]: 450 4\.7\.1 Client host rejected: cannot find your hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$ From e595fefc9b2f3ab0e17abcca563dd63dbba4157c Mon Sep 17 00:00:00 2001 From: sebres Date: Thu, 14 Apr 2016 14:50:17 +0200 Subject: [PATCH 24/70] change log and thanks entries --- ChangeLog | 2 ++ THANKS | 1 + 2 files changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index e51a2962..033cd9ec 100644 --- a/ChangeLog +++ b/ChangeLog @@ -13,6 +13,8 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released * filter.d/monit.conf - extended failregex with new monit "access denied" version (gh-1355); - failregex of previous monit version merged as single expression. + * filter.d/postfix.conf, filter.d/postfix-sasl.conf + - extended failregex daemon part, matching also `postfix/smtps/smtpd` now (gh-1391) - New Features: * New Actions: diff --git a/THANKS b/THANKS index cfcab3ad..64de43a4 100644 --- a/THANKS +++ b/THANKS @@ -12,6 +12,7 @@ Adrien Clerc ache ag4ve (Shawn) Alasdair D. Campbell +Alexandre Perrin (kAworu) Amir Caspi Amy Andrew St. Jean From add67227f4d7dd03ba840c3faae2d7211d4e3d39 Mon Sep 17 00:00:00 2001 From: Daniel Aleksandersen Date: Sun, 24 Apr 2016 02:20:02 +0200 Subject: [PATCH 25/70] Use HTTPS in Debuggex URLs --- fail2ban/client/fail2banregex.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/client/fail2banregex.py b/fail2ban/client/fail2banregex.py index d0cdab84..7c56a77e 100755 --- a/fail2ban/client/fail2banregex.py +++ b/fail2ban/client/fail2banregex.py @@ -61,7 +61,7 @@ def debuggexURL(sample, regex): q = urllib.urlencode({ 're': regex.replace('', '(?&.ipv4)'), 'str': sample, 'flavor': 'python' }) - return 'http://www.debuggex.com/?' + q + return 'https://www.debuggex.com/?' + q def output(args): print(args) From d889918f19964071d752c4fa5e7b0b0020699c6d Mon Sep 17 00:00:00 2001 From: jungle-boogie Date: Sun, 24 Apr 2016 21:35:18 -0700 Subject: [PATCH 26/70] update doc url direct to confluence page. no code changes. --- config/filter.d/freeswitch.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/freeswitch.conf b/config/filter.d/freeswitch.conf index ecc4a8bd..1ef5a256 100644 --- a/config/filter.d/freeswitch.conf +++ b/config/filter.d/freeswitch.conf @@ -16,7 +16,7 @@ failregex = ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ SIP auth (failure|challenge) \(( ignoreregex = # Author: Rupa SChomaker, soapee01, Daniel Black -# http://wiki.freeswitch.org/wiki/Fail2ban +# https://freeswitch.org/confluence/display/FREESWITCH/Fail2Ban # Thanks to Jim on mailing list of samples and guidance # # No need to match the following. Its a duplicate of the SIP auth regex. From 340a5a23f4a8453294de2bc5fe54690241230875 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 26 Apr 2016 09:30:36 -0400 Subject: [PATCH 27/70] BF+ENH: fixed up testing querying cymru information + assert_dict_equal helper --- fail2ban/tests/banmanagertestcase.py | 43 +++++++++++++++------------- fail2ban/tests/utils.py | 8 +++++- 2 files changed, 30 insertions(+), 21 deletions(-) diff --git a/fail2ban/tests/banmanagertestcase.py b/fail2ban/tests/banmanagertestcase.py index 09d2411e..8c58994c 100644 --- a/fail2ban/tests/banmanagertestcase.py +++ b/fail2ban/tests/banmanagertestcase.py @@ -28,7 +28,7 @@ import unittest from ..server.banmanager import BanManager from ..server.ticket import BanTicket - +from .utils import assert_dict_equal class AddFailure(unittest.TestCase): def setUp(self): @@ -74,15 +74,10 @@ class StatusExtendedCymruInfo(unittest.TestCase): def testCymruInfo(self): cymru_info = self.__banManager.getBanListExtendedCymruInfo() - if "assertDictEqual" in dir(self): - self.assertDictEqual(cymru_info, {"asn": [self.__asn], - "country": [self.__country], - "rir": [self.__rir]}) - else: - # Python 2.6 does not support assertDictEqual() - self.assertEqual(cymru_info["asn"], [self.__asn]) - self.assertEqual(cymru_info["country"], [self.__country]) - self.assertEqual(cymru_info["rir"], [self.__rir]) + assert_dict_equal(cymru_info, + {"asn": [self.__asn], + "country": [self.__country], + "rir": [self.__rir]}) def testCymruInfoASN(self): self.assertEqual( @@ -100,16 +95,24 @@ class StatusExtendedCymruInfo(unittest.TestCase): [self.__rir]) def testCymruInfoNxdomain(self): - ticket = BanTicket("10.0.0.0", 1167605999.0) self.__banManager = BanManager() + + # non-existing IP + ticket = BanTicket("0.0.0.0", 1167605999.0) self.assertTrue(self.__banManager.addBanTicket(ticket)) cymru_info = self.__banManager.getBanListExtendedCymruInfo() - if "assertDictEqual" in dir(self): - self.assertDictEqual(cymru_info, {"asn": ["nxdomain"], - "country": ["nxdomain"], - "rir": ["nxdomain"]}) - else: - # Python 2.6 does not support assertDictEqual() - self.assertEqual(cymru_info["asn"], ["nxdomain"]) - self.assertEqual(cymru_info["country"], ["nxdomain"]) - self.assertEqual(cymru_info["rir"], ["nxdomain"]) + assert_dict_equal(cymru_info, + {"asn": ["nxdomain"], + "country": ["nxdomain"], + "rir": ["nxdomain"]}) + + # even for private IPs ASNs defined + # Since it outputs for all active tickets we would get previous results + # and new ones + ticket = BanTicket("10.0.0.0", 1167606000.0) + self.assertTrue(self.__banManager.addBanTicket(ticket)) + cymru_info = self.__banManager.getBanListExtendedCymruInfo() + assert_dict_equal(cymru_info, + {"asn": ["nxdomain", "4565",], + "country": ["nxdomain", "unknown"], + "rir": ["nxdomain", "other"]}) diff --git a/fail2ban/tests/utils.py b/fail2ban/tests/utils.py index 0c29e638..8fc78683 100644 --- a/fail2ban/tests/utils.py +++ b/fail2ban/tests/utils.py @@ -312,4 +312,10 @@ else: kernel32.CloseHandle(process) return True else: - return False \ No newline at end of file + return False + +# Python 2.6 compatibility. in 2.7 assertDictEqual +def assert_dict_equal(a, b): + assert isinstance(a, dict), "Object is not dictionary: %r" % a + assert isinstance(b, dict), "Object is not dictionary: %r" % b + assert a==b, "Dictionaries differ:\n%r !=\n%r" % (a, b) From 75eb240846f91452ae7ff397dc88c69f8459a794 Mon Sep 17 00:00:00 2001 From: Daniel Aleksandersen Date: Sat, 30 Apr 2016 16:18:56 +0200 Subject: [PATCH 28/70] Assert https not http Resolves test regression from issue #1395. --- fail2ban/tests/fail2banregextestcase.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/tests/fail2banregextestcase.py b/fail2ban/tests/fail2banregextestcase.py index e4af50ea..49d6a3a6 100644 --- a/fail2ban/tests/fail2banregextestcase.py +++ b/fail2ban/tests/fail2banregextestcase.py @@ -175,6 +175,6 @@ class Fail2banRegexTest(LogCaptureTestCase): self.assertTrue(fail2banRegex.start(opts, args)) self.assertLogged('Lines: 4 lines, 0 ignored, 2 matched, 2 missed') - self.assertLogged('http://') + self.assertLogged('https://') From bdc2d07946d2b10ccf4634db6117e798ab079555 Mon Sep 17 00:00:00 2001 From: sebres Date: Mon, 2 May 2016 19:00:06 +0200 Subject: [PATCH 29/70] fix suhosin_log in common paths - log files should be separated using "\n": prevents to throw an error "File option must be 'head' or 'tail'", if jail suhosin will be enabled. --- config/paths-common.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/config/paths-common.conf b/config/paths-common.conf index e2f08325..9072136c 100644 --- a/config/paths-common.conf +++ b/config/paths-common.conf @@ -40,7 +40,8 @@ lighttpd_error_log = /var/log/lighttpd/error.log # http://www.hardened-php.net/suhosin/configuration.html#suhosin.log.syslog.facility # syslog_user is the default. Lighttpd also hooks errors into its log. -suhosin_log = %(syslog_user)s %(lighttpd_error_log)s +suhosin_log = %(syslog_user)s + %(lighttpd_error_log)s # defaults to ftp or local2 if ftp doesn't exist proftpd_log = %(syslog_ftp)s From a4b8f6e49e81340f3fdc31d2dd92935ea22160f5 Mon Sep 17 00:00:00 2001 From: sebres Date: Thu, 12 May 2016 20:21:42 +0200 Subject: [PATCH 30/70] [part. cherry-picked from 0.10] invalid recursion check in substituteRecursiveTags: for example action `bsd-ipfw` produced ValueError('properties contain self referencing definitions and cannot be resolved...') test cases extended for exactly this case; closes gh-1417 --- fail2ban/server/action.py | 11 ++++++++--- fail2ban/tests/actiontestcase.py | 7 +++++++ 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/fail2ban/server/action.py b/fail2ban/server/action.py index de0c8efc..b1af659e 100644 --- a/fail2ban/server/action.py +++ b/fail2ban/server/action.py @@ -400,12 +400,16 @@ class CommandAction(ActionBase): value = str(tags[tag]) # search and replace all tags within value, that can be interpolated using other tags: m = t.search(value) - done = [] + done = {} + last_found = tag #logSys.log(5, 'TAG: %s, value: %s' % (tag, value)) while m: found_tag = m.group(1) #logSys.log(5, 'found: %s' % found_tag) - if found_tag == tag or found_tag in done: + curdone = done.get(last_found) + if curdone is None: + done[last_found] = curdone = [] + if found_tag == tag or found_tag in curdone: # recursive definitions are bad #logSys.log(5, 'recursion fail tag: %s value: %s' % (tag, value) ) return False @@ -417,7 +421,8 @@ class CommandAction(ActionBase): continue value = value.replace('<%s>' % found_tag , tags[found_tag]) #logSys.log(5, 'value now: %s' % value) - done.append(found_tag) + curdone.append(found_tag) + last_found = found_tag m = t.search(value, m.start()) #logSys.log(5, 'TAG: %s, newvalue: %s' % (tag, value)) # was substituted? diff --git a/fail2ban/tests/actiontestcase.py b/fail2ban/tests/actiontestcase.py index 289d8896..e20a6341 100644 --- a/fail2ban/tests/actiontestcase.py +++ b/fail2ban/tests/actiontestcase.py @@ -29,6 +29,7 @@ import time import tempfile from ..server.action import CommandAction, CallingMap +from ..server.actions import OrderedDict from .utils import LogCaptureTestCase from .utils import pid_exists @@ -58,6 +59,12 @@ class CommandActionTest(LogCaptureTestCase): # Unresolveable substition self.assertFalse(CommandAction.substituteRecursiveTags({'A': 'to= fromip=', 'C': '', 'B': '', 'D': ''})) self.assertFalse(CommandAction.substituteRecursiveTags({'failregex': 'to= fromip=', 'sweet': '', 'honeypot': '', 'ignoreregex': ''})) + # No-recursion, just multiple replacement of tag , should be successful + if OrderedDict: # we need here an ordered, because the sequence of iteration is very important for this test + self.assertEqual(CommandAction.substituteRecursiveTags( + OrderedDict((('X', 'x=x'), ('T', '1'), ('Z', ' '), ('Y', 'y=y'))) + ), {'X': 'x=x1', 'T': '1', 'Y': 'y=y1', 'Z': 'x=x1 1 y=y1'} + ) # missing tags are ok self.assertEqual(CommandAction.substituteRecursiveTags({'A': ''}), {'A': ''}) self.assertEqual(CommandAction.substituteRecursiveTags({'A': ' ','X':'fun'}), {'A': ' fun', 'X':'fun'}) From cce63926ce9bb7b96fa1820e7893af67e0ac021a Mon Sep 17 00:00:00 2001 From: sebres Date: Fri, 13 May 2016 14:37:48 +0200 Subject: [PATCH 31/70] ChangeLog entry added --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 033cd9ec..9ac9a752 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,9 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released - failregex of previous monit version merged as single expression. * filter.d/postfix.conf, filter.d/postfix-sasl.conf - extended failregex daemon part, matching also `postfix/smtps/smtpd` now (gh-1391) + * fixed a grave bug within tags substitutions because of incorrect detection of recursion + in case of multiple inline substitutions of the same tag (affected actions: `bsd-ipfw`, etc). + Now tracks the actual list of the already substituted tags (per tag instead of single list) - New Features: * New Actions: From 3e49522b7ab75833e412ec38d05e5edc9645993b Mon Sep 17 00:00:00 2001 From: sebres Date: Fri, 13 May 2016 20:07:19 +0200 Subject: [PATCH 32/70] fixes unexpected extra regex-space in generic `__prefix_line` (gh-1405, misleadingly committed in d2a953756802bd7cf63f5f5f792371f52f5cba8c); all optional spaces normalized in generic include `common.conf` + test cases are extended (using new example pseudo-filter and test log `zzz-generic-example`); --- ChangeLog | 3 ++ config/filter.d/common.conf | 8 +++--- config/filter.d/zzz-generic-example.conf | 17 +++++++++++ fail2ban/tests/clientreadertestcase.py | 7 +++-- fail2ban/tests/files/logs/zzz-generic-example | 28 +++++++++++++++++++ 5 files changed, 56 insertions(+), 7 deletions(-) create mode 100644 config/filter.d/zzz-generic-example.conf create mode 100644 fail2ban/tests/files/logs/zzz-generic-example diff --git a/ChangeLog b/ChangeLog index 9ac9a752..44ba9d11 100644 --- a/ChangeLog +++ b/ChangeLog @@ -18,6 +18,9 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released * fixed a grave bug within tags substitutions because of incorrect detection of recursion in case of multiple inline substitutions of the same tag (affected actions: `bsd-ipfw`, etc). Now tracks the actual list of the already substituted tags (per tag instead of single list) + * filter.d/common.conf + - unexpected extra regex-space in generic `__prefix_line` (gh-1405) + - all optional spaces normalized in `common.conf`, test covered now - New Features: * New Actions: diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf index 3e35f1d8..115fa96c 100644 --- a/config/filter.d/common.conf +++ b/config/filter.d/common.conf @@ -26,11 +26,11 @@ __daemon_re = [\[\(]?%(_daemon)s(?:\(\S+\))?[\]\)]?:? # extra daemon info # EXAMPLE: [ID 800047 auth.info] -__daemon_extra_re = (?:\[ID \d+ \S+\]) +__daemon_extra_re = \[ID \d+ \S+\] # Combinations of daemon name and PID # EXAMPLES: sshd[31607], pop(pam_unix)[4920] -__daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:?) +__daemon_combs_re = %(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:? # Some messages have a kernel prefix with a timestamp # EXAMPLES: kernel: [769570.846956] @@ -44,14 +44,14 @@ __md5hex = (?:[\da-f]{2}:){15}[\da-f]{2} # bsdverbose is where syslogd is started with -v or -vv and results in <4.3> or # appearing before the host as per testcases/files/logs/bsd/*. -__bsd_syslog_verbose = (<[^.]+\.[^.]+>) +__bsd_syslog_verbose = <[^.]+\.[^.]+> # Common line prefixes (beginnings) which could be used in filters # # [bsdverbose]? [hostname] [vserver tag] daemon_id spaces # # This can be optional (for instance if we match named native log files) -__prefix_line = \s*%(__bsd_syslog_verbose)s?\s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s%(__daemon_extra_re)s?\s* +__prefix_line = \s*(?:(?:%(__bsd_syslog_verbose)s)\s*)?(?:(?:%(__hostname)s)\s*)?(?:(?:%(__kernel_prefix)s)\s*)?(?:(?:@vserver_\S+)\s*)?(?:(?:%(__daemon_combs_re)s)\s*)?(?:(?:%(__daemon_extra_re)s)\s*)? # PAM authentication mechanism check for failures, e.g.: pam_unix, pam_sss, # pam_ldap diff --git a/config/filter.d/zzz-generic-example.conf b/config/filter.d/zzz-generic-example.conf new file mode 100644 index 00000000..421c117d --- /dev/null +++ b/config/filter.d/zzz-generic-example.conf @@ -0,0 +1,17 @@ +# Fail2Ban generic example resp. test filter +# +# Author: Serg G. Brester (sebres) +# + +[INCLUDES] + +# Read common prefixes. If any customizations available -- read them from +# common.local +before = common.conf + +[Definition] + +_daemon = test-demo + +failregex = ^%(__prefix_line)sF2B: failure from $ +ignoreregex = diff --git a/fail2ban/tests/clientreadertestcase.py b/fail2ban/tests/clientreadertestcase.py index 0a3734e5..b5c31c38 100644 --- a/fail2ban/tests/clientreadertestcase.py +++ b/fail2ban/tests/clientreadertestcase.py @@ -600,9 +600,10 @@ class JailsReaderTest(LogCaptureTestCase): self.assertTrue(jails.read()) # opens fine self.assertTrue(jails.getOptions()) # reads fine # grab all filter names - filters = set(os.path.splitext(os.path.split(a)[1])[0] - for a in glob.glob(os.path.join('config', 'filter.d', '*.conf')) - if not a.endswith('common.conf')) + filters = (os.path.splitext(os.path.split(flt)[1])[0] + for flt in glob.glob(os.path.join('config', 'filter.d', '*.conf')) + if not flt.endswith('common.conf')) + filters = set(filter(lambda flt: not flt.startswith('zzz-'), filters)) # get filters of all jails (filter names without options inside filter[...]) filters_jail = set( JailReader.extractOptions(jail.options['filter'])[0] for jail in jails.jails diff --git a/fail2ban/tests/files/logs/zzz-generic-example b/fail2ban/tests/files/logs/zzz-generic-example new file mode 100644 index 00000000..ecc5a1c6 --- /dev/null +++ b/fail2ban/tests/files/logs/zzz-generic-example @@ -0,0 +1,28 @@ +# -- _daemon with __pid_re, without __hostname -- +# failJSON: { "time": "2005-06-21T16:47:46", "match": true , "host": "192.0.2.1" } +Jun 21 16:47:46 machine test-demo[13709]: F2B: failure from 192.0.2.1 +# -- _daemon with __pid_re -- +# failJSON: { "time": "2005-06-21T16:47:48", "match": true , "host": "192.0.2.1" } +Jun 21 16:47:48 test-demo[13709]: F2B: failure from 192.0.2.1 + +# -- __kernel_prefix -- +# failJSON: { "time": "2005-06-21T16:47:50", "match": true , "host": "192.0.2.2" } +Jun 21 16:47:50 machine kernel: [ 970.699396] F2B: failure from 192.0.2.2 + +# -- _daemon_re with and without __pid_re -- +# failJSON: { "time": "2005-06-21T16:47:52", "match": true , "host": "192.0.2.3" } +Jun 21 16:47:52 machine [test-demo] F2B: failure from 192.0.2.3 +# failJSON: { "time": "2005-06-21T16:47:53", "match": true , "host": "192.0.2.3" } +Jun 21 16:47:53 machine [test-demo][13709] F2B: failure from 192.0.2.3 +# failJSON: { "time": "2005-06-21T16:50:00", "match": true , "host": "192.0.2.3" } +Jun 21 16:50:00 machine test-demo(pam_unix) F2B: failure from 192.0.2.3 +# failJSON: { "time": "2005-06-21T16:50:02", "match": true , "host": "192.0.2.3" } +Jun 21 16:50:02 machine test-demo(pam_unix)[13709] F2B: failure from 192.0.2.3 + + +# -- all common definitions together (bsdverbose hostname kernel_prefix vserver tag daemon_id space) -- +# failJSON: { "time": "2005-06-21T16:55:01", "match": true , "host": "192.0.2.3" } +Jun 21 16:55:01 machine kernel: [ 970.699396] @vserver_demo test-demo(pam_unix)[13709] [ID 255 test] F2B: failure from 192.0.2.3 +# -- the same as above with additional spaces around -- +# failJSON: { "time": "2005-06-21T16:55:02", "match": true , "host": "192.0.2.3" } +Jun 21 16:55:02 machine kernel: [ 970.699396] @vserver_demo test-demo(pam_unix)[13709] [ID 255 test] F2B: failure from 192.0.2.3 From de813acf5104dc00c0086b544c6fe82f428d4ca8 Mon Sep 17 00:00:00 2001 From: sebres Date: Tue, 17 May 2016 11:33:49 +0200 Subject: [PATCH 33/70] extends generic `__prefix_line` with optional brackets for the date ambit (gh-1421), added new parameter `__date_ambit` + test case added; --- ChangeLog | 2 ++ config/filter.d/common.conf | 4 +++- fail2ban/tests/files/logs/zzz-generic-example | 3 +++ 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 44ba9d11..d52e1cff 100644 --- a/ChangeLog +++ b/ChangeLog @@ -21,6 +21,8 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released * filter.d/common.conf - unexpected extra regex-space in generic `__prefix_line` (gh-1405) - all optional spaces normalized in `common.conf`, test covered now + - generic `__prefix_line` extended with optional brackets for the date ambit (gh-1421), + added new parameter `__date_ambit` - New Features: * New Actions: diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf index 115fa96c..23fd1d5a 100644 --- a/config/filter.d/common.conf +++ b/config/filter.d/common.conf @@ -46,12 +46,14 @@ __md5hex = (?:[\da-f]{2}:){15}[\da-f]{2} # appearing before the host as per testcases/files/logs/bsd/*. __bsd_syslog_verbose = <[^.]+\.[^.]+> +__date_ambit = \[\] + # Common line prefixes (beginnings) which could be used in filters # # [bsdverbose]? [hostname] [vserver tag] daemon_id spaces # # This can be optional (for instance if we match named native log files) -__prefix_line = \s*(?:(?:%(__bsd_syslog_verbose)s)\s*)?(?:(?:%(__hostname)s)\s*)?(?:(?:%(__kernel_prefix)s)\s*)?(?:(?:@vserver_\S+)\s*)?(?:(?:%(__daemon_combs_re)s)\s*)?(?:(?:%(__daemon_extra_re)s)\s*)? +__prefix_line = (?:%(__date_ambit)s)?\s*(?:(?:%(__bsd_syslog_verbose)s)\s*)?(?:(?:%(__hostname)s)\s*)?(?:(?:%(__kernel_prefix)s)\s*)?(?:(?:@vserver_\S+)\s*)?(?:(?:%(__daemon_combs_re)s)\s*)?(?:(?:%(__daemon_extra_re)s)\s*)? # PAM authentication mechanism check for failures, e.g.: pam_unix, pam_sss, # pam_ldap diff --git a/fail2ban/tests/files/logs/zzz-generic-example b/fail2ban/tests/files/logs/zzz-generic-example index ecc5a1c6..e3480b63 100644 --- a/fail2ban/tests/files/logs/zzz-generic-example +++ b/fail2ban/tests/files/logs/zzz-generic-example @@ -26,3 +26,6 @@ Jun 21 16:55:01 machine kernel: [ 970.699396] @vserver_demo test-de # -- the same as above with additional spaces around -- # failJSON: { "time": "2005-06-21T16:55:02", "match": true , "host": "192.0.2.3" } Jun 21 16:55:02 machine kernel: [ 970.699396] @vserver_demo test-demo(pam_unix)[13709] [ID 255 test] F2B: failure from 192.0.2.3 +# -- the same as above with brackets as date ambit -- +# failJSON: { "time": "2005-06-21T16:55:03", "match": true , "host": "192.0.2.3" } +[Jun 21 16:55:03] machine kernel: [ 970.699396] @vserver_demo test-demo(pam_unix)[13709] [ID 255 test] F2B: failure from 192.0.2.3 From cb4f9be8b2748e940303cff77d72ab7fdcf06a53 Mon Sep 17 00:00:00 2001 From: sebres Date: Tue, 17 May 2016 11:54:08 +0200 Subject: [PATCH 34/70] the date brackets removed from filters using `__prefix_line`, because `__prefix_line` already contains the date ambit; --- config/filter.d/asterisk.conf | 20 ++++++++++---------- config/filter.d/nsd.conf | 4 ++-- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf index 3975fb29..01063efa 100644 --- a/config/filter.d/asterisk.conf +++ b/config/filter.d/asterisk.conf @@ -16,17 +16,17 @@ __pid_re = (?:\[\d+\]) iso8601 = \d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+[+-]\d{4} # All Asterisk log messages begin like this: -log_prefix= (?:NOTICE|SECURITY)%(__pid_re)s:?(?:\[C-[\da-f]*\])? \S+:\d*( in \w+:)? +log_prefix= (?:NOTICE|SECURITY|WARNING)%(__pid_re)s:?(?:\[C-[\da-f]*\])? [^:]+:\d*( in \w+:)? -failregex = ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Registration from '[^']*' failed for '(:\d+)?' - (Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$ - ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Call from '[^']*' \(:\d+\) to extension '[^']*' rejected because extension not found in context - ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Host failed to authenticate as '[^']*'$ - ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s No registration for peer '[^']*' \(from \)$ - ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Host failed MD5 authentication for '[^']*' \([^)]+\)$ - ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Failed to authenticate (user|device) [^@]+@\S*$ - ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s hacking attempt detected ''$ - ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="([\d-]+|%(iso8601)s)",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="(\d*|)",SessionID=".+",LocalAddress="IPV[46]/(UDP|TCP|WS)/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UDP|TCP|WS)//\d+"(,Challenge="[\w/]+")?(,ReceivedChallenge="\w+")?(,Response="\w+",ExpectedResponse="\w*")?(,ReceivedHash="[\da-f]+")?(,ACLName="\w+")?$ - ^(%(__prefix_line)s|\[\]\s*WARNING%(__pid_re)s:?(?:\[C-[\da-f]*\])? )Ext\. s: "Rejecting unknown SIP connection from "$ +failregex = ^%(__prefix_line)s%(log_prefix)s Registration from '[^']*' failed for '(:\d+)?' - (Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$ + ^%(__prefix_line)s%(log_prefix)s Call from '[^']*' \(:\d+\) to extension '[^']*' rejected because extension not found in context + ^%(__prefix_line)s%(log_prefix)s Host failed to authenticate as '[^']*'$ + ^%(__prefix_line)s%(log_prefix)s No registration for peer '[^']*' \(from \)$ + ^%(__prefix_line)s%(log_prefix)s Host failed MD5 authentication for '[^']*' \([^)]+\)$ + ^%(__prefix_line)s%(log_prefix)s Failed to authenticate (user|device) [^@]+@\S*$ + ^%(__prefix_line)s%(log_prefix)s hacking attempt detected ''$ + ^%(__prefix_line)s%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="([\d-]+|%(iso8601)s)",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="(\d*|)",SessionID=".+",LocalAddress="IPV[46]/(UDP|TCP|WS)/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UDP|TCP|WS)//\d+"(,Challenge="[\w/]+")?(,ReceivedChallenge="\w+")?(,Response="\w+",ExpectedResponse="\w*")?(,ReceivedHash="[\da-f]+")?(,ACLName="\w+")?$ + ^%(__prefix_line)s%(log_prefix)s "Rejecting unknown SIP connection from "$ ignoreregex = diff --git a/config/filter.d/nsd.conf b/config/filter.d/nsd.conf index 70b41ca4..8f32f7be 100644 --- a/config/filter.d/nsd.conf +++ b/config/filter.d/nsd.conf @@ -22,7 +22,7 @@ _daemon = nsd # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT -failregex = ^\[\]%(__prefix_line)sinfo: ratelimit block .* query TYPE255$ - ^\[\]%(__prefix_line)sinfo: .* refused, no acl matches\.$ +failregex = ^%(__prefix_line)sinfo: ratelimit block .* query TYPE255$ + ^%(__prefix_line)sinfo: .* refused, no acl matches\.$ ignoreregex = From 25af11215b71dec2197b8df9ee1aa9f813965aca Mon Sep 17 00:00:00 2001 From: sebres Date: Tue, 17 May 2016 20:08:46 +0200 Subject: [PATCH 35/70] test case for generic common moved to `./fail2ban/tests/config/filter.d/zzz-generic-example.conf` to prevent shipping it with fail2ban installations --- fail2ban/tests/clientreadertestcase.py | 7 +++--- .../config}/filter.d/zzz-generic-example.conf | 2 +- fail2ban/tests/samplestestcase.py | 25 +++++++++++-------- 3 files changed, 19 insertions(+), 15 deletions(-) rename {config => fail2ban/tests/config}/filter.d/zzz-generic-example.conf (85%) diff --git a/fail2ban/tests/clientreadertestcase.py b/fail2ban/tests/clientreadertestcase.py index b5c31c38..0a3734e5 100644 --- a/fail2ban/tests/clientreadertestcase.py +++ b/fail2ban/tests/clientreadertestcase.py @@ -600,10 +600,9 @@ class JailsReaderTest(LogCaptureTestCase): self.assertTrue(jails.read()) # opens fine self.assertTrue(jails.getOptions()) # reads fine # grab all filter names - filters = (os.path.splitext(os.path.split(flt)[1])[0] - for flt in glob.glob(os.path.join('config', 'filter.d', '*.conf')) - if not flt.endswith('common.conf')) - filters = set(filter(lambda flt: not flt.startswith('zzz-'), filters)) + filters = set(os.path.splitext(os.path.split(a)[1])[0] + for a in glob.glob(os.path.join('config', 'filter.d', '*.conf')) + if not a.endswith('common.conf')) # get filters of all jails (filter names without options inside filter[...]) filters_jail = set( JailReader.extractOptions(jail.options['filter'])[0] for jail in jails.jails diff --git a/config/filter.d/zzz-generic-example.conf b/fail2ban/tests/config/filter.d/zzz-generic-example.conf similarity index 85% rename from config/filter.d/zzz-generic-example.conf rename to fail2ban/tests/config/filter.d/zzz-generic-example.conf index 421c117d..a59ccb1e 100644 --- a/config/filter.d/zzz-generic-example.conf +++ b/fail2ban/tests/config/filter.d/zzz-generic-example.conf @@ -7,7 +7,7 @@ # Read common prefixes. If any customizations available -- read them from # common.local -before = common.conf +before = ../../../../config/filter.d/common.conf [Definition] diff --git a/fail2ban/tests/samplestestcase.py b/fail2ban/tests/samplestestcase.py index 9e6c0ee7..a40a11da 100644 --- a/fail2ban/tests/samplestestcase.py +++ b/fail2ban/tests/samplestestcase.py @@ -35,6 +35,7 @@ from ..server.filter import Filter from ..client.filterreader import FilterReader from .utils import setUpMyTime, tearDownMyTime, CONFIG_DIR +TEST_CONFIG_DIR = os.path.join(os.path.dirname(__file__), "config") TEST_FILES_DIR = os.path.join(os.path.dirname(__file__), "files") @@ -60,11 +61,11 @@ class FilterSamplesRegex(unittest.TestCase): "Expected more FilterSampleRegexs tests") -def testSampleRegexsFactory(name): +def testSampleRegexsFactory(name, basedir): def testFilter(self): # Check filter exists - filterConf = FilterReader(name, "jail", {}, basedir=CONFIG_DIR) + filterConf = FilterReader(name, "jail", {}, basedir=basedir) self.assertEqual(filterConf.getFile(), name) self.assertEqual(filterConf.getJailName(), "jail") filterConf.read() @@ -147,11 +148,15 @@ def testSampleRegexsFactory(name): return testFilter -for filter_ in filter(lambda x: not x.endswith('common.conf') and x.endswith('.conf'), - os.listdir(os.path.join(CONFIG_DIR, "filter.d"))): - filterName = filter_.rpartition(".")[0] - if not filterName.startswith('.'): - setattr( - FilterSamplesRegex, - "testSampleRegexs%s" % filterName.upper(), - testSampleRegexsFactory(filterName)) +for basedir_, filter_ in ( + (CONFIG_DIR, lambda x: not x.endswith('common.conf') and x.endswith('.conf')), + (TEST_CONFIG_DIR, lambda x: x.startswith('zzz-') and x.endswith('.conf')), +): + for filter_ in filter(filter_, + os.listdir(os.path.join(basedir_, "filter.d"))): + filterName = filter_.rpartition(".")[0] + if not filterName.startswith('.'): + setattr( + FilterSamplesRegex, + "testSampleRegexs%s" % filterName.upper(), + testSampleRegexsFactory(filterName, basedir_)) From 52377984cd415c089438bdfbcc2c86e344f8ca59 Mon Sep 17 00:00:00 2001 From: sebres Date: Thu, 19 May 2016 17:01:44 +0200 Subject: [PATCH 36/70] back to mandatory space, ungrouping of sub parameters in `__prefix_line` + small code review; --- config/filter.d/common.conf | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf index 23fd1d5a..586f428a 100644 --- a/config/filter.d/common.conf +++ b/config/filter.d/common.conf @@ -30,7 +30,7 @@ __daemon_extra_re = \[ID \d+ \S+\] # Combinations of daemon name and PID # EXAMPLES: sshd[31607], pop(pam_unix)[4920] -__daemon_combs_re = %(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:? +__daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:?) # Some messages have a kernel prefix with a timestamp # EXAMPLES: kernel: [769570.846956] @@ -46,14 +46,16 @@ __md5hex = (?:[\da-f]{2}:){15}[\da-f]{2} # appearing before the host as per testcases/files/logs/bsd/*. __bsd_syslog_verbose = <[^.]+\.[^.]+> -__date_ambit = \[\] +__vserver = @vserver_\S+ + +__date_ambit = (?:\[\]) # Common line prefixes (beginnings) which could be used in filters # # [bsdverbose]? [hostname] [vserver tag] daemon_id spaces # # This can be optional (for instance if we match named native log files) -__prefix_line = (?:%(__date_ambit)s)?\s*(?:(?:%(__bsd_syslog_verbose)s)\s*)?(?:(?:%(__hostname)s)\s*)?(?:(?:%(__kernel_prefix)s)\s*)?(?:(?:@vserver_\S+)\s*)?(?:(?:%(__daemon_combs_re)s)\s*)?(?:(?:%(__daemon_extra_re)s)\s*)? +__prefix_line = %(__date_ambit)s?\s*(?:%(__bsd_syslog_verbose)s\s+)?(?:%(__hostname)s\s+)?(?:%(__kernel_prefix)s\s+)?(?:%(__vserver)s\s+)?(?:%(__daemon_combs_re)s\s+)?(?:%(__daemon_extra_re)s\s+)? # PAM authentication mechanism check for failures, e.g.: pam_unix, pam_sss, # pam_ldap From 932708de9e6a3ba5089116cc3c1ee456ba3b6855 Mon Sep 17 00:00:00 2001 From: sebres Date: Thu, 19 May 2016 19:03:32 +0200 Subject: [PATCH 37/70] fixed --pidfile bug, introduced in gh-1322: gentoo-initd fixed --pidfile bug: `--pidfile` is option of start-stop-daemon, not argument of fail2ban (see gh-1434) closes gh-1434 --- ChangeLog | 2 ++ files/gentoo-initd | 8 ++++---- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index 9ac9a752..55fb8aff 100644 --- a/ChangeLog +++ b/ChangeLog @@ -18,6 +18,8 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released * fixed a grave bug within tags substitutions because of incorrect detection of recursion in case of multiple inline substitutions of the same tag (affected actions: `bsd-ipfw`, etc). Now tracks the actual list of the already substituted tags (per tag instead of single list) + * gentoo-initd fixed --pidfile bug: `--pidfile` is option of start-stop-daemon, + not argument of fail2ban (see gh-1434) - New Features: * New Actions: diff --git a/files/gentoo-initd b/files/gentoo-initd index b7e1067b..c5b5b702 100755 --- a/files/gentoo-initd +++ b/files/gentoo-initd @@ -34,15 +34,15 @@ start() { # remove stalled sock file after system crash # bug 347477 rm -f /var/run/fail2ban/fail2ban.sock || return 1 - start-stop-daemon --start --exec ${FAIL2BAN} start \ - --pidfile /var/run/fail2ban/fail2ban.pid + start-stop-daemon --start --pidfile /var/run/fail2ban/fail2ban.pid \ + -- ${FAIL2BAN} start eend $? "Failed to start fail2ban" } stop() { ebegin "Stopping fail2ban" - start-stop-daemon --stop --exec ${FAIL2BAN} stop \ - --pidfile /var/run/fail2ban/fail2ban.pid + start-stop-daemon --stop --pidfile /var/run/fail2ban/fail2ban.pid \ + -- ${FAIL2BAN} stop eend $? "Failed to stop fail2ban" } From db9e7240386b7fdee5d796138f7118d01e3168e0 Mon Sep 17 00:00:00 2001 From: sebres Date: Fri, 20 May 2016 12:03:35 +0200 Subject: [PATCH 38/70] extremely speedup of all database operations: - (synchronous = OFF) write data through OS without syncing - (journal_mode = MEMORY) use memory for the transaction logging --- fail2ban/server/database.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fail2ban/server/database.py b/fail2ban/server/database.py index 7de87554..c0e9bf46 100644 --- a/fail2ban/server/database.py +++ b/fail2ban/server/database.py @@ -182,8 +182,11 @@ class Fail2BanDb(object): raise cur = self._db.cursor() - cur.execute("PRAGMA foreign_keys = ON;") - + cur.execute("PRAGMA foreign_keys = ON") + # speedup: write data through OS without syncing (no wait): + cur.execute("PRAGMA synchronous = OFF") + # speedup: transaction log in memory, alternate using OFF (disable, rollback will be impossible): + cur.execute("PRAGMA journal_mode = MEMORY") try: cur.execute("SELECT version FROM fail2banDb LIMIT 1") except sqlite3.OperationalError: From baafac36a4c578769d53240147d2777b6414ad1c Mon Sep 17 00:00:00 2001 From: sebres Date: Fri, 20 May 2016 12:42:18 +0200 Subject: [PATCH 39/70] ChangeLog entry --- ChangeLog | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ChangeLog b/ChangeLog index 433026f3..76719f16 100644 --- a/ChangeLog +++ b/ChangeLog @@ -30,6 +30,11 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released * New Actions: - action.d/firewallcmd-rich-rules and action.d/firewallcmd-rich-logging (gh-1367) - Enhancements: + * Extreme speedup of all sqlite database operations (gh-1436), + by using of following sqlite options: + - (synchronous = OFF) write data through OS without syncing + - (journal_mode = MEMORY) use memory for the transaction logging + - (temp_store = MEMORY) temporary tables and indices are kept in memory * journald journalmatch for pure-ftpd (gh-1362) * Add additional regex filter for dovecot ldap authentication failures (gh-1370) * added additional regex filters for exim (gh-1371) From 1718c8dbe92030617042db2c7a01e996cf16cab7 Mon Sep 17 00:00:00 2001 From: sebres Date: Fri, 20 May 2016 13:26:51 +0200 Subject: [PATCH 40/70] pypy: switch journal mode after upgrade (save it during the upgrade), to prevent errors like "database table is locked" --- fail2ban/server/database.py | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/fail2ban/server/database.py b/fail2ban/server/database.py index c0e9bf46..560fbfe5 100644 --- a/fail2ban/server/database.py +++ b/fail2ban/server/database.py @@ -181,12 +181,24 @@ class Fail2BanDb(object): filename, e.args[0]) raise + # differentiate pypy: switch journal mode later (save it during the upgrade), + # to prevent errors like "database table is locked": + try: + import __pypy__ + pypy = True + except ImportError: + pypy = False + cur = self._db.cursor() cur.execute("PRAGMA foreign_keys = ON") # speedup: write data through OS without syncing (no wait): cur.execute("PRAGMA synchronous = OFF") # speedup: transaction log in memory, alternate using OFF (disable, rollback will be impossible): - cur.execute("PRAGMA journal_mode = MEMORY") + if not pypy: + cur.execute("PRAGMA journal_mode = MEMORY") + # speedup: temporary tables and indices are kept in memory: + cur.execute("PRAGMA temp_store = MEMORY") + try: cur.execute("SELECT version FROM fail2banDb LIMIT 1") except sqlite3.OperationalError: @@ -205,6 +217,9 @@ class Fail2BanDb(object): Fail2BanDb.__version__, version, newversion) raise RuntimeError('Failed to fully update') finally: + # pypy: set journal mode after possible upgrade db: + if pypy: + cur.execute("PRAGMA journal_mode = MEMORY") cur.close() @property @@ -247,13 +262,14 @@ class Fail2BanDb(object): A timestamped backup is also created prior to attempting the update. """ - self._dbBackupFilename = self.filename + '.' + time.strftime('%Y%m%d-%H%M%S', MyTime.gmtime()) - shutil.copyfile(self.filename, self._dbBackupFilename) - logSys.info("Database backup created: %s", self._dbBackupFilename) if version > Fail2BanDb.__version__: raise NotImplementedError( "Attempt to travel to future version of database ...how did you get here??") + self._dbBackupFilename = self.filename + '.' + time.strftime('%Y%m%d-%H%M%S', MyTime.gmtime()) + shutil.copyfile(self.filename, self._dbBackupFilename) + logSys.info("Database backup created: %s", self._dbBackupFilename) + if version < 2: cur.executescript("BEGIN TRANSACTION;" "CREATE TEMPORARY TABLE logs_temp AS SELECT * FROM logs;" From 743a531eb59a4f3704dda68557fb34481538e159 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sat, 21 May 2016 10:08:54 -0400 Subject: [PATCH 41/70] BF: make :port and I=[ip]:port optional for a "AUTH command used when not advertised" Closes #1430 --- config/filter.d/exim.conf | 2 +- fail2ban/tests/files/logs/exim | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf index 4aadf15c..54ad20d8 100644 --- a/config/filter.d/exim.conf +++ b/config/filter.d/exim.conf @@ -18,7 +18,7 @@ failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user| ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$ ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$ ^%(pid)s SMTP call from \S+ \[\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$ - ^%(pid)s SMTP protocol error in "AUTH \S*(| \S*)" H=(|\S* )(|\(\S*\) )\[\]\:\d+ I=\[\S*\]\:\d+ AUTH command used when not advertised\s*$ + ^%(pid)s SMTP protocol error in "AUTH \S*(| \S*)" H=(|\S* )(|\(\S*\) )\[\](?:\:\d+)? (?:I=\[\S*\]\:\d+ )?AUTH command used when not advertised\s*$ ^%(pid)s no MAIL in SMTP connection from (|\S* )(|\(\S*\) )\[\]\:\d+ I=\[\S*\]\:\d+ D=\d+s(| C=\S*)\s*$ ^%(pid)s \S+ SMTP connection from (|\S* )(|\(\S*\) )\[\]\:\d+ I=\[\S*\]\:\d+ closed by DROP in ACL\s*$ diff --git a/fail2ban/tests/files/logs/exim b/fail2ban/tests/files/logs/exim index a3b287d4..4b3a7ff5 100644 --- a/fail2ban/tests/files/logs/exim +++ b/fail2ban/tests/files/logs/exim @@ -48,6 +48,8 @@ 2016-03-18 00:34:06 [7513] SMTP protocol error in "AUTH LOGIN" H=(ylmf-pc) [45.32.34.167]:60723 I=[172.89.0.6]:587 AUTH command used when not advertised # failJSON: { "time": "2016-03-19T18:40:44", "match": true , "host": "92.45.204.170" } 2016-03-19 18:40:44 [26221] SMTP protocol error in "AUTH LOGIN aW5mb0BtYW5iYXQub3Jn" H=([127.0.0.1]) [92.45.204.170]:14243 I=[172.89.0.6]:587 AUTH command used when not advertised +# failJSON: { "time": "2016-05-17T06:25:27", "match": true , "host": "69.10.61.61", "desc": "from gh-1430" } +2016-05-17 06:25:27 SMTP protocol error in "AUTH LOGIN" H=(ylmf-pc) [69.10.61.61] AUTH command used when not advertised # failJSON: { "time": "2016-03-21T06:38:05", "match": true , "host": "49.212.207.15" } 2016-03-21 06:38:05 [5718] no MAIL in SMTP connection from www3005.sakura.ne.jp [49.212.207.15]:28890 I=[172.89.0.6]:25 D=21s C=EHLO,STARTTLS # failJSON: { "time": "2016-03-21T06:57:36", "match": true , "host": "122.165.71.116" } From 8b8cf2a660b5727d2a864b61917d4279f80c1b60 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sat, 21 May 2016 10:27:16 -0400 Subject: [PATCH 42/70] ENH: exim filters -- make more use of %(host_info)s which in turn made more flexible --- config/filter.d/exim-common.conf | 2 +- config/filter.d/exim.conf | 8 ++++---- fail2ban/tests/files/logs/exim | 2 ++ 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/config/filter.d/exim-common.conf b/config/filter.d/exim-common.conf index 1c0a0a20..8f9553fe 100644 --- a/config/filter.d/exim-common.conf +++ b/config/filter.d/exim-common.conf @@ -9,7 +9,7 @@ after = exim-common.local [Definition] -host_info = H=([\w.-]+ )?(\(\S+\) )?\[\](:\d+)? (I=\[\S+\]:\d+ )?(U=\S+ )?(P=e?smtp )? +host_info = (H=([\w.-]+ )?(\(\S+\) )?)?\[\](:\d+)? (I=\[\S+\](:\d+)? )?(U=\S+ )?(P=e?smtp )? pid = ( \[\d+\])? # DEV Notes: diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf index 54ad20d8..517e3de7 100644 --- a/config/filter.d/exim.conf +++ b/config/filter.d/exim.conf @@ -17,10 +17,10 @@ failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user| ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$ ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$ ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$ - ^%(pid)s SMTP call from \S+ \[\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$ - ^%(pid)s SMTP protocol error in "AUTH \S*(| \S*)" H=(|\S* )(|\(\S*\) )\[\](?:\:\d+)? (?:I=\[\S*\]\:\d+ )?AUTH command used when not advertised\s*$ - ^%(pid)s no MAIL in SMTP connection from (|\S* )(|\(\S*\) )\[\]\:\d+ I=\[\S*\]\:\d+ D=\d+s(| C=\S*)\s*$ - ^%(pid)s \S+ SMTP connection from (|\S* )(|\(\S*\) )\[\]\:\d+ I=\[\S*\]\:\d+ closed by DROP in ACL\s*$ + ^%(pid)s SMTP call from \S+ %(host_info)sdropped: too many nonmail commands \(last was "\S+"\)\s*$ + ^%(pid)s SMTP protocol error in "AUTH \S*(| \S*)" %(host_info)sAUTH command used when not advertised\s*$ + ^%(pid)s no MAIL in SMTP connection from (|\S* )(|\(\S*\) )%(host_info)sD=\d+s(| C=\S*)\s*$ + ^%(pid)s \S+ SMTP connection from (|\S* )(|\(\S*\) )%(host_info)sclosed by DROP in ACL\s*$ ignoreregex = diff --git a/fail2ban/tests/files/logs/exim b/fail2ban/tests/files/logs/exim index 4b3a7ff5..9da5ff22 100644 --- a/fail2ban/tests/files/logs/exim +++ b/fail2ban/tests/files/logs/exim @@ -54,6 +54,8 @@ 2016-03-21 06:38:05 [5718] no MAIL in SMTP connection from www3005.sakura.ne.jp [49.212.207.15]:28890 I=[172.89.0.6]:25 D=21s C=EHLO,STARTTLS # failJSON: { "time": "2016-03-21T06:57:36", "match": true , "host": "122.165.71.116" } 2016-03-21 06:57:36 [5908] no MAIL in SMTP connection from [122.165.71.116]:2056 I=[172.89.0.6]:25 D=10s +# failJSON: { "time": "2016-03-21T06:57:36", "match": true , "host": "122.165.71.116" } +2016-03-21 06:57:36 [5908] no MAIL in SMTP connection from [122.165.71.116]:2056 I=[172.89.0.6]:25 D=10s # failJSON: { "time": "2016-03-21T04:07:49", "match": true , "host": "174.137.147.204" } 2016-03-21 04:07:49 [25874] 1ahr79-0006jK-G9 SMTP connection from (voyeur.webair.com) [174.137.147.204]:44884 I=[172.89.0.6]:25 closed by DROP in ACL # failJSON: { "time": "2016-03-21T04:33:13", "match": true , "host": "206.214.71.53" } From 01d0506ea07af3ad0208743e7d80646349c08d59 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sat, 21 May 2016 10:55:27 -0400 Subject: [PATCH 43/70] ENH: splitcommaspace -> splitwords allow to split ignoreip entries with new lines Closes #1432 --- fail2ban/client/jailreader.py | 4 ++-- fail2ban/helpers.py | 6 +++--- fail2ban/tests/misctestcase.py | 18 ++++++++++-------- 3 files changed, 15 insertions(+), 13 deletions(-) diff --git a/fail2ban/client/jailreader.py b/fail2ban/client/jailreader.py index 56b8889c..c86c3153 100644 --- a/fail2ban/client/jailreader.py +++ b/fail2ban/client/jailreader.py @@ -34,7 +34,7 @@ from .filterreader import FilterReader from .actionreader import ActionReader from ..version import version from ..helpers import getLogger -from ..helpers import splitcommaspace +from ..helpers import splitwords # Gets the instance of the logger. logSys = getLogger(__name__) @@ -214,7 +214,7 @@ class JailReader(ConfigReader): elif opt == "maxretry": stream.append(["set", self.__name, "maxretry", self.__opts[opt]]) elif opt == "ignoreip": - for ip in splitcommaspace(self.__opts[opt]): + for ip in splitwords(self.__opts[opt]): stream.append(["set", self.__name, "addignoreip", ip]) elif opt == "findtime": stream.append(["set", self.__name, "findtime", self.__opts[opt]]) diff --git a/fail2ban/helpers.py b/fail2ban/helpers.py index 8e1b0e32..fc51a88e 100644 --- a/fail2ban/helpers.py +++ b/fail2ban/helpers.py @@ -128,12 +128,12 @@ def excepthook(exctype, value, traceback): "Unhandled exception in Fail2Ban:", exc_info=True) return sys.__excepthook__(exctype, value, traceback) -def splitcommaspace(s): - """Helper to split on any comma or space +def splitwords(s): + """Helper to split words on any comma, space, or a new line Returns empty list if input is empty (or None) and filters out empty entries """ if not s: return [] - return filter(bool, re.split('[ ,]', s)) + return filter(bool, map(str.strip, re.split('[ ,\n]', s))) diff --git a/fail2ban/tests/misctestcase.py b/fail2ban/tests/misctestcase.py index e28ce422..48074d53 100644 --- a/fail2ban/tests/misctestcase.py +++ b/fail2ban/tests/misctestcase.py @@ -33,7 +33,7 @@ from glob import glob from StringIO import StringIO from ..helpers import formatExceptionInfo, mbasename, TraceBack, FormatterWithTraceBack, getLogger -from ..helpers import splitcommaspace +from ..helpers import splitwords from ..server.datetemplate import DatePatternRegex @@ -56,13 +56,15 @@ class HelpersTest(unittest.TestCase): # might be fragile due to ' vs " self.assertEqual(args, "('Very bad', None)") - def testsplitcommaspace(self): - self.assertEqual(splitcommaspace(None), []) - self.assertEqual(splitcommaspace(''), []) - self.assertEqual(splitcommaspace(' '), []) - self.assertEqual(splitcommaspace('1'), ['1']) - self.assertEqual(splitcommaspace(' 1 2 '), ['1', '2']) - self.assertEqual(splitcommaspace(' 1, 2 , '), ['1', '2']) + def testsplitwords(self): + self.assertEqual(splitwords(None), []) + self.assertEqual(splitwords(''), []) + self.assertEqual(splitwords(' '), []) + self.assertEqual(splitwords('1'), ['1']) + self.assertEqual(splitwords(' 1 2 '), ['1', '2']) + self.assertEqual(splitwords(' 1, 2 , '), ['1', '2']) + self.assertEqual(splitwords(' 1\n 2'), ['1', '2']) + self.assertEqual(splitwords(' 1\n 2, 3'), ['1', '2', '3']) class SetupTest(unittest.TestCase): From 9bb869b8d4d92a3ffbba5e37ea74a0a8934971fa Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sat, 21 May 2016 22:17:09 -0400 Subject: [PATCH 44/70] ENH: courier-smtp -- allow for trailing username (no spaces) in the logline Closes #1440 --- config/filter.d/courier-smtp.conf | 2 +- fail2ban/tests/files/logs/courier-smtp | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/config/filter.d/courier-smtp.conf b/config/filter.d/courier-smtp.conf index 7df385bf..fc0afc26 100644 --- a/config/filter.d/courier-smtp.conf +++ b/config/filter.d/courier-smtp.conf @@ -13,7 +13,7 @@ before = common.conf _daemon = courieresmtpd failregex = ^%(__prefix_line)serror,relay=,.*: 550 User (<.*> )?unknown\.?$ - ^%(__prefix_line)serror,relay=,msg="535 Authentication failed\.",cmd:( AUTH \S+)?( [0-9a-zA-Z\+/=]+)?$ + ^%(__prefix_line)serror,relay=,msg="535 Authentication failed\.",cmd:( AUTH \S+)?( [0-9a-zA-Z\+/=]+)?(?: \S+)$ ignoreregex = diff --git a/fail2ban/tests/files/logs/courier-smtp b/fail2ban/tests/files/logs/courier-smtp index 7beaf856..ab99d322 100644 --- a/fail2ban/tests/files/logs/courier-smtp +++ b/fail2ban/tests/files/logs/courier-smtp @@ -10,3 +10,5 @@ Jul 6 03:42:28 whistler courieresmtpd: error,relay=::ffff:1.2.3.4,from=<>,to=,to=<>: 550 User unknown. # failJSON: { "time": "2004-08-14T12:51:04", "match": true , "host": "1.2.3.4" } Aug 14 12:51:04 HOSTNAME courieresmtpd: error,relay=::ffff:1.2.3.4,from=,to=: 550 User unknown. +# failJSON: { "time": "2004-08-14T12:51:04", "match": true , "host": "1.2.3.4" } +Aug 14 12:51:04 mail.server courieresmtpd[26762]: error,relay=::ffff:1.2.3.4,msg="535 Authentication failed.",cmd: AUTH PLAIN AAAAABBBBCCCCWxlZA== admin From 156065e70d3c71168c212a2c55a06e909f993b09 Mon Sep 17 00:00:00 2001 From: sebres Date: Mon, 23 May 2016 15:33:45 +0200 Subject: [PATCH 45/70] splitwords: prevent to split to empty values by multiple separator characters together --- fail2ban/helpers.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/helpers.py b/fail2ban/helpers.py index fc51a88e..aef39835 100644 --- a/fail2ban/helpers.py +++ b/fail2ban/helpers.py @@ -136,4 +136,4 @@ def splitwords(s): """ if not s: return [] - return filter(bool, map(str.strip, re.split('[ ,\n]', s))) + return filter(bool, map(str.strip, re.split('[ ,\n]+', s))) From a80043ce808cfb96ae5908c056ce8ccb969d9bc0 Mon Sep 17 00:00:00 2001 From: sebres Date: Wed, 25 May 2016 21:33:26 +0200 Subject: [PATCH 46/70] amend for gh-1419: tags substitution bug - wrong recognition of cyclic recursion, new test cases covered this --- fail2ban/server/action.py | 25 ++++++++------ fail2ban/tests/actiontestcase.py | 59 +++++++++++++++++++++++++++++--- 2 files changed, 69 insertions(+), 15 deletions(-) diff --git a/fail2ban/server/action.py b/fail2ban/server/action.py index b1af659e..4901472d 100644 --- a/fail2ban/server/action.py +++ b/fail2ban/server/action.py @@ -55,6 +55,9 @@ _RETCODE_HINTS = { signame = dict((num, name) for name, num in signal.__dict__.iteritems() if name.startswith("SIG")) +# max tag replacement count: +MAX_TAG_REPLACE_COUNT = 10 + class CallingMap(MutableMapping): """A Mapping type which returns the result of callable values. @@ -390,26 +393,22 @@ class CommandAction(ActionBase): """ t = re.compile(r'<([^ <>]+)>') # repeat substitution while embedded-recursive (repFlag is True) + done = cls._escapedTags.copy() while True: repFlag = False # substitute each value: for tag in tags.iterkeys(): - if tag in cls._escapedTags: - # Escaped so won't match - continue + # ignore escaped or already done: + if tag in done: continue value = str(tags[tag]) # search and replace all tags within value, that can be interpolated using other tags: m = t.search(value) - done = {} - last_found = tag + refCounts = {} #logSys.log(5, 'TAG: %s, value: %s' % (tag, value)) while m: found_tag = m.group(1) #logSys.log(5, 'found: %s' % found_tag) - curdone = done.get(last_found) - if curdone is None: - done[last_found] = curdone = [] - if found_tag == tag or found_tag in curdone: + if found_tag == tag or refCounts.get(found_tag, 1) > MAX_TAG_REPLACE_COUNT: # recursive definitions are bad #logSys.log(5, 'recursion fail tag: %s value: %s' % (tag, value) ) return False @@ -421,8 +420,9 @@ class CommandAction(ActionBase): continue value = value.replace('<%s>' % found_tag , tags[found_tag]) #logSys.log(5, 'value now: %s' % value) - curdone.append(found_tag) - last_found = found_tag + # increment reference count: + refCounts[found_tag] = refCounts.get(found_tag, 0) + 1 + # the next match for replace: m = t.search(value, m.start()) #logSys.log(5, 'TAG: %s, newvalue: %s' % (tag, value)) # was substituted? @@ -431,6 +431,9 @@ class CommandAction(ActionBase): if t.search(value): repFlag = True tags[tag] = value + # no more sub tags (and no possible composite), add this tag to done set (just to be faster): + if '<' not in value: done.add(tag) + # stop interpolation, if no replacements anymore: if not repFlag: break return tags diff --git a/fail2ban/tests/actiontestcase.py b/fail2ban/tests/actiontestcase.py index e20a6341..f33f3a5f 100644 --- a/fail2ban/tests/actiontestcase.py +++ b/fail2ban/tests/actiontestcase.py @@ -59,12 +59,62 @@ class CommandActionTest(LogCaptureTestCase): # Unresolveable substition self.assertFalse(CommandAction.substituteRecursiveTags({'A': 'to= fromip=', 'C': '', 'B': '', 'D': ''})) self.assertFalse(CommandAction.substituteRecursiveTags({'failregex': 'to= fromip=', 'sweet': '', 'honeypot': '', 'ignoreregex': ''})) - # No-recursion, just multiple replacement of tag , should be successful - if OrderedDict: # we need here an ordered, because the sequence of iteration is very important for this test - self.assertEqual(CommandAction.substituteRecursiveTags( - OrderedDict((('X', 'x=x'), ('T', '1'), ('Z', ' '), ('Y', 'y=y'))) + # We need here an ordered, because the sequence of iteration is very important for this test + if OrderedDict: + # No cyclic recursion, just multiple replacement of tag , should be successful: + self.assertEqual(CommandAction.substituteRecursiveTags( OrderedDict( + (('X', 'x=x'), ('T', '1'), ('Z', ' '), ('Y', 'y=y'))) ), {'X': 'x=x1', 'T': '1', 'Y': 'y=y1', 'Z': 'x=x1 1 y=y1'} ) + # No cyclic recursion, just multiple replacement of tag in composite tags, should be successful: + self.assertEqual(CommandAction.substituteRecursiveTags( OrderedDict( + (('X', 'x=x <> <>'), ('R1', 'Z'), ('R2', 'Y'), ('T', '1'), ('Z', ' '), ('Y', 'y=y'))) + ), {'X': 'x=x1 1 y=y1 1 y=y1 y=y1', 'R1': 'Z', 'R2': 'Y', 'T': '1', 'Z': '1 y=y1', 'Y': 'y=y1'} + ) + # No cyclic recursion, just multiple replacement of same tags, should be successful: + self.assertEqual(CommandAction.substituteRecursiveTags( OrderedDict(( + ('actionstart', 'ipset create hash:ip timeout family \n -I '), + ('ipmset', 'f2b-'), + ('name', 'any'), + ('bantime', '600'), + ('ipsetfamily', 'inet'), + ('iptables', 'iptables '), + ('lockingopt', '-w'), + ('chain', 'INPUT'), + ('actiontype', ''), + ('multiport', '-p -m multiport --dports -m set --match-set src -j '), + ('protocol', 'tcp'), + ('port', 'ssh'), + ('blocktype', 'REJECT',), + )) + ), OrderedDict(( + ('actionstart', 'ipset create f2b-any hash:ip timeout 600 family inet\niptables -w -I INPUT -p tcp -m multiport --dports ssh -m set --match-set f2b-any src -j REJECT'), + ('ipmset', 'f2b-any'), + ('name', 'any'), + ('bantime', '600'), + ('ipsetfamily', 'inet'), + ('iptables', 'iptables -w'), + ('lockingopt', '-w'), + ('chain', 'INPUT'), + ('actiontype', '-p tcp -m multiport --dports ssh -m set --match-set f2b-any src -j REJECT'), + ('multiport', '-p tcp -m multiport --dports ssh -m set --match-set f2b-any src -j REJECT'), + ('protocol', 'tcp'), + ('port', 'ssh'), + ('blocktype', 'REJECT') + )) + ) + # Cyclic recursion by composite tag creation, tags "create" another tag, that closes cycle: + self.assertFalse(CommandAction.substituteRecursiveTags( OrderedDict(( + ('A', '<>'), + ('B', 'D'), ('C', 'E'), + ('DE', 'cycle '), + )) )) + self.assertFalse(CommandAction.substituteRecursiveTags( OrderedDict(( + ('DE', 'cycle '), + ('A', '<>'), + ('B', 'D'), ('C', 'E'), + )) )) + # missing tags are ok self.assertEqual(CommandAction.substituteRecursiveTags({'A': ''}), {'A': ''}) self.assertEqual(CommandAction.substituteRecursiveTags({'A': ' ','X':'fun'}), {'A': ' fun', 'X':'fun'}) @@ -132,6 +182,7 @@ class CommandActionTest(LogCaptureTestCase): CallingMap(matches=lambda: str(10))), "09 10 11") + def testReplaceNoTag(self): # As tag not present, therefore callable should not be called # Will raise ValueError if it is self.assertEqual( From b7787f4af496c9b57814f77fa21873dfa14cfb62 Mon Sep 17 00:00:00 2001 From: sebres Date: Mon, 30 May 2016 12:30:51 +0200 Subject: [PATCH 47/70] use raw host (don't use textToIp) if usedns not yes or warn --- fail2ban/server/filter.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/server/filter.py b/fail2ban/server/filter.py index d561b507..1e751057 100644 --- a/fail2ban/server/filter.py +++ b/fail2ban/server/filter.py @@ -523,7 +523,7 @@ class Filter(JailThread): self.__lineBuffer = failRegex.getUnmatchedTupleLines() try: host = failRegex.getHost() - if returnRawHost: + if returnRawHost or self.__useDns not in ("yes", "warn"): failList.append([failRegexIndex, host, date, failRegex.getMatchedLines()]) if not checkAllRegex: From c33e25bab6a370a16ce5e16fdb8c4e564c06b92f Mon Sep 17 00:00:00 2001 From: sebres Date: Mon, 30 May 2016 13:32:58 +0200 Subject: [PATCH 48/70] fail2ban-regex: extended with option '--raw' (switch to raw host, prevent resolving of ip) --- fail2ban/client/fail2banregex.py | 5 ++++- fail2ban/tests/fail2banregextestcase.py | 9 +++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/fail2ban/client/fail2banregex.py b/fail2ban/client/fail2banregex.py index 7c56a77e..c2b2e894 100755 --- a/fail2ban/client/fail2banregex.py +++ b/fail2ban/client/fail2banregex.py @@ -126,6 +126,8 @@ Report bugs to https://github.com/fail2ban/fail2ban/issues help="set custom pattern used to match date/times"), Option("-e", "--encoding", help="File encoding. Default: system locale"), + Option("-r", "--raw", action='store_true', + help="Raw hosts, don't resolve dns"), Option("-L", "--maxlines", type=int, default=0, help="maxlines for multi-line regex"), Option("-m", "--journalmatch", @@ -239,6 +241,7 @@ class Fail2banRegex(object): self.encoding = opts.encoding else: self.encoding = locale.getpreferredencoding() + self.raw = True if opts.raw else False def decode_line(self, line): return FileContainer.decode_line('', self.encoding, line) @@ -335,7 +338,7 @@ class Fail2banRegex(object): orgLineBuffer = self._filter._Filter__lineBuffer fullBuffer = len(orgLineBuffer) >= self._filter.getMaxLines() try: - line, ret = self._filter.processLine(line, date, checkAllRegex=True) + line, ret = self._filter.processLine(line, date, checkAllRegex=True, returnRawHost=self.raw) for match in ret: # Append True/False flag depending if line was matched by # more than one regex diff --git a/fail2ban/tests/fail2banregextestcase.py b/fail2ban/tests/fail2banregextestcase.py index 49d6a3a6..3321ffd8 100644 --- a/fail2ban/tests/fail2banregextestcase.py +++ b/fail2ban/tests/fail2banregextestcase.py @@ -132,6 +132,15 @@ class Fail2banRegexTest(LogCaptureTestCase): self.assertLogged('Dez 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128') self.assertLogged('Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10') + def testDirectRE_1raw(self): + (opts, args, fail2banRegex) = _Fail2banRegex( + "--print-all-matched", "--raw", + Fail2banRegexTest.FILENAME_01, + Fail2banRegexTest.RE_00 + ) + self.assertTrue(fail2banRegex.start(opts, args)) + self.assertLogged('Lines: 19 lines, 0 ignored, 16 matched, 3 missed') + def testDirectRE_2(self): (opts, args, fail2banRegex) = _Fail2banRegex( "--print-all-matched", From 8ec4e1189e0eb904473c1b7fcaa99e800e93911b Mon Sep 17 00:00:00 2001 From: sebres Date: Mon, 30 May 2016 15:34:21 +0200 Subject: [PATCH 49/70] use raw host (don't use textToIp) if usedns exactly `raw`, because `usedns = no` should ignore no ip failures --- config/jail.conf | 1 + fail2ban/server/filter.py | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/config/jail.conf b/config/jail.conf index cea9a06e..941737ff 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -94,6 +94,7 @@ backend = auto # but it will be logged as a warning. # no: if a hostname is encountered, will not be used for banning, # but it will be logged as info. +# raw: use raw value (no hostname), allow use it for no-host filters/actions (example user) usedns = warn # "logencoding" specifies the encoding of the log files handled by the jail diff --git a/fail2ban/server/filter.py b/fail2ban/server/filter.py index 1e751057..3901fae9 100644 --- a/fail2ban/server/filter.py +++ b/fail2ban/server/filter.py @@ -523,7 +523,7 @@ class Filter(JailThread): self.__lineBuffer = failRegex.getUnmatchedTupleLines() try: host = failRegex.getHost() - if returnRawHost or self.__useDns not in ("yes", "warn"): + if returnRawHost or self.__useDns == "raw": failList.append([failRegexIndex, host, date, failRegex.getMatchedLines()]) if not checkAllRegex: From 48a8324662afdeed4016fd4630712331af66d610 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 30 May 2016 11:02:12 -0400 Subject: [PATCH 50/70] ENH: use non-capturing regex groups in exim-common and exim filters --- config/filter.d/exim-common.conf | 4 ++-- config/filter.d/exim.conf | 12 ++++++------ 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/config/filter.d/exim-common.conf b/config/filter.d/exim-common.conf index 8f9553fe..0e1b74fa 100644 --- a/config/filter.d/exim-common.conf +++ b/config/filter.d/exim-common.conf @@ -9,8 +9,8 @@ after = exim-common.local [Definition] -host_info = (H=([\w.-]+ )?(\(\S+\) )?)?\[\](:\d+)? (I=\[\S+\](:\d+)? )?(U=\S+ )?(P=e?smtp )? -pid = ( \[\d+\])? +host_info = (?:H=([\w.-]+ )?(?:\(\S+\) )?)?\[\](?::\d+)? (?:I=\[\S+\](:\d+)? )?(?:U=\S+ )?(?:P=e?smtp )? +pid = (?: \[\d+\])? # DEV Notes: # From exim source code: ./src/receive.c:add_host_info_for_log diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf index 517e3de7..1ef74b01 100644 --- a/config/filter.d/exim.conf +++ b/config/filter.d/exim.conf @@ -14,13 +14,13 @@ before = exim-common.conf [Definition] failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$ - ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$ - ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$ - ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$ + ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[\](?::\d+)?(?: I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$ + ^%(pid)s %(host_info)sF=(?:<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (?:relay not permitted|Sender verify failed|Unknown user)\s*$ + ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (?:connection from|"\S+") %(host_info)s(?:next )?input=".*"\s*$ ^%(pid)s SMTP call from \S+ %(host_info)sdropped: too many nonmail commands \(last was "\S+"\)\s*$ - ^%(pid)s SMTP protocol error in "AUTH \S*(| \S*)" %(host_info)sAUTH command used when not advertised\s*$ - ^%(pid)s no MAIL in SMTP connection from (|\S* )(|\(\S*\) )%(host_info)sD=\d+s(| C=\S*)\s*$ - ^%(pid)s \S+ SMTP connection from (|\S* )(|\(\S*\) )%(host_info)sclosed by DROP in ACL\s*$ + ^%(pid)s SMTP protocol error in "AUTH \S*(?:| \S*)" %(host_info)sAUTH command used when not advertised\s*$ + ^%(pid)s no MAIL in SMTP connection from (?:|\S* )(?:|\(\S*\) )%(host_info)sD=\d+s(?:| C=\S*)\s*$ + ^%(pid)s \S+ SMTP connection from (?:|\S* )(?:|\(\S*\) )%(host_info)sclosed by DROP in ACL\s*$ ignoreregex = From 64346614804e91285bfb1fcbb407d0e1cdff618e Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 30 May 2016 12:12:53 -0400 Subject: [PATCH 51/70] RF: for consistency use (?:XXX)? instead of (?:|XXX) --- config/filter.d/exim.conf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf index 1ef74b01..a1d699c0 100644 --- a/config/filter.d/exim.conf +++ b/config/filter.d/exim.conf @@ -18,9 +18,9 @@ failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user| ^%(pid)s %(host_info)sF=(?:<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (?:relay not permitted|Sender verify failed|Unknown user)\s*$ ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (?:connection from|"\S+") %(host_info)s(?:next )?input=".*"\s*$ ^%(pid)s SMTP call from \S+ %(host_info)sdropped: too many nonmail commands \(last was "\S+"\)\s*$ - ^%(pid)s SMTP protocol error in "AUTH \S*(?:| \S*)" %(host_info)sAUTH command used when not advertised\s*$ - ^%(pid)s no MAIL in SMTP connection from (?:|\S* )(?:|\(\S*\) )%(host_info)sD=\d+s(?:| C=\S*)\s*$ - ^%(pid)s \S+ SMTP connection from (?:|\S* )(?:|\(\S*\) )%(host_info)sclosed by DROP in ACL\s*$ + ^%(pid)s SMTP protocol error in "AUTH \S*(?: \S*)?" %(host_info)sAUTH command used when not advertised\s*$ + ^%(pid)s no MAIL in SMTP connection from (?:\S* )?(?:\(\S*\) )?%(host_info)sD=\d+s(?: C=\S*)?\s*$ + ^%(pid)s \S+ SMTP connection from (?:\S* )?(?:\(\S*\) )?%(host_info)sclosed by DROP in ACL\s*$ ignoreregex = From b3bb8b20bfe92d1391af510635cd4200d7089622 Mon Sep 17 00:00:00 2001 From: sebres Date: Tue, 31 May 2016 17:45:44 +0200 Subject: [PATCH 52/70] amend for new option of `usedns=raw` - forgotten validation fix inside setUseDns --- fail2ban/server/filter.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/server/filter.py b/fail2ban/server/filter.py index 3901fae9..45ae7704 100644 --- a/fail2ban/server/filter.py +++ b/fail2ban/server/filter.py @@ -168,7 +168,7 @@ class Filter(JailThread): if isinstance(value, bool): value = {True: 'yes', False: 'no'}[value] value = value.lower() # must be a string by now - if not (value in ('yes', 'no', 'warn')): + if not (value in ('yes', 'warn', 'no', 'raw')): logSys.error("Incorrect value %r specified for usedns. " "Using safe 'no'" % (value,)) value = 'no' From ced6c8307b66e1959a8fd4262b561229cb9fef60 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Thu, 2 Jun 2016 20:56:28 -0400 Subject: [PATCH 53/70] BF: finalize that sample log line for exim4 was intended in 743a531eb59a4f3704dda68557fb34481538e159 to be an entry without a port after the [host] --- fail2ban/tests/files/logs/exim | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/tests/files/logs/exim b/fail2ban/tests/files/logs/exim index 9da5ff22..9053bf8d 100644 --- a/fail2ban/tests/files/logs/exim +++ b/fail2ban/tests/files/logs/exim @@ -55,7 +55,7 @@ # failJSON: { "time": "2016-03-21T06:57:36", "match": true , "host": "122.165.71.116" } 2016-03-21 06:57:36 [5908] no MAIL in SMTP connection from [122.165.71.116]:2056 I=[172.89.0.6]:25 D=10s # failJSON: { "time": "2016-03-21T06:57:36", "match": true , "host": "122.165.71.116" } -2016-03-21 06:57:36 [5908] no MAIL in SMTP connection from [122.165.71.116]:2056 I=[172.89.0.6]:25 D=10s +2016-03-21 06:57:36 [5908] no MAIL in SMTP connection from [122.165.71.116] I=[172.89.0.6]:25 D=10s # failJSON: { "time": "2016-03-21T04:07:49", "match": true , "host": "174.137.147.204" } 2016-03-21 04:07:49 [25874] 1ahr79-0006jK-G9 SMTP connection from (voyeur.webair.com) [174.137.147.204]:44884 I=[172.89.0.6]:25 closed by DROP in ACL # failJSON: { "time": "2016-03-21T04:33:13", "match": true , "host": "206.214.71.53" } From f85fb45b29768f687546ba25f805977cf00b6e43 Mon Sep 17 00:00:00 2001 From: Ludovic Gasc Date: Tue, 7 Jun 2016 11:40:35 +0200 Subject: [PATCH 54/70] Asterisk pjsip (#1456) * Improve PJSIP log support for Asterisk 13+ * Update changelog: filter.d/asterisk.conf - fix security log support for PJSIP and Asterisk 13+ * Change pjsip regexp with sebres observation, thanks to @nturcksin --- ChangeLog | 1 + config/filter.d/asterisk.conf | 1 + fail2ban/tests/files/logs/asterisk | 4 ++++ 3 files changed, 6 insertions(+) diff --git a/ChangeLog b/ChangeLog index 76719f16..21b8adfc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -25,6 +25,7 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released added new parameter `__date_ambit` * gentoo-initd fixed --pidfile bug: `--pidfile` is option of start-stop-daemon, not argument of fail2ban (see gh-1434) + * filter.d/asterisk.conf - fix security log support for PJSIP and Asterisk 13+ - New Features: * New Actions: diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf index 01063efa..f6ccdd4f 100644 --- a/config/filter.d/asterisk.conf +++ b/config/filter.d/asterisk.conf @@ -27,6 +27,7 @@ failregex = ^%(__prefix_line)s%(log_prefix)s Registration from '[^']*' failed fo ^%(__prefix_line)s%(log_prefix)s hacking attempt detected ''$ ^%(__prefix_line)s%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="([\d-]+|%(iso8601)s)",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="(\d*|)",SessionID=".+",LocalAddress="IPV[46]/(UDP|TCP|WS)/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UDP|TCP|WS)//\d+"(,Challenge="[\w/]+")?(,ReceivedChallenge="\w+")?(,Response="\w+",ExpectedResponse="\w*")?(,ReceivedHash="[\da-f]+")?(,ACLName="\w+")?$ ^%(__prefix_line)s%(log_prefix)s "Rejecting unknown SIP connection from "$ + ^%(__prefix_line)s%(log_prefix)s Request from '[^']*' failed for '(?::\d+)?' \(callid: \w*\) - No matching endpoint found$ ignoreregex = diff --git a/fail2ban/tests/files/logs/asterisk b/fail2ban/tests/files/logs/asterisk index aa32a290..3f49beec 100644 --- a/fail2ban/tests/files/logs/asterisk +++ b/fail2ban/tests/files/logs/asterisk @@ -67,3 +67,7 @@ Nov 4 18:30:40 localhost asterisk[32229]: NOTICE[32257]: chan_sip.c:23417 in han [2016-01-28 10:34:31] NOTICE[3477][C-000003c3] chan_sip.c: Call from '' (1.2.3.4:10836) to extension '0+441772285407' rejected because extension not found in context 'default'. # failJSON: { "time": "2016-01-28T10:34:33", "match": true , "host": "1.2.3.4" } [2016-01-28 10:34:33] NOTICE[3477][C-000003c3] chan_sip.c: Call from '' (1.2.3.4:10836) to extension '' rejected because extension not found in context 'my-context'. + +# Failed authentication with pjsip on Asterisk 13+ +# failJSON: { "time": "2016-05-23T10:18:16", "match": true , "host": "1.2.3.4" } +[2016-05-23 10:18:16] NOTICE[19388] res_pjsip/pjsip_distributor.c: Request from '"1000" ' failed for '1.2.3.4:48336' (callid: 276666022) - No matching endpoint found \ No newline at end of file From 11f7cf5ad82b26c59f5d62c35b38343264483980 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 7 Jun 2016 21:38:39 -0400 Subject: [PATCH 55/70] DOC: changelog for recent exim filters tune up --- ChangeLog | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 21b8adfc..3f985b20 100644 --- a/ChangeLog +++ b/ChangeLog @@ -30,6 +30,7 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released - New Features: * New Actions: - action.d/firewallcmd-rich-rules and action.d/firewallcmd-rich-logging (gh-1367) + - Enhancements: * Extreme speedup of all sqlite database operations (gh-1436), by using of following sqlite options: @@ -38,7 +39,9 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released - (temp_store = MEMORY) temporary tables and indices are kept in memory * journald journalmatch for pure-ftpd (gh-1362) * Add additional regex filter for dovecot ldap authentication failures (gh-1370) - * added additional regex filters for exim (gh-1371) + * filter.d/exim*conf + - added additional regexes (gh-1371) + - made port entry optional ver. 0.9.4 (2016/03/08) - for-you-ladies From af8b650a371da68d1a35d2ad326dfddc5a6af7f6 Mon Sep 17 00:00:00 2001 From: "Serg G. Brester" Date: Mon, 13 Jun 2016 12:56:53 +0200 Subject: [PATCH 56/70] badip timeout option introduced, set to 30 seconds in our test cases (#1463) cherry-picked from 0.10 (little bit modified in test_badips.py, because no --fast option in test cases) --- config/action.d/badips.py | 11 +++++++---- fail2ban/tests/action_d/test_badips.py | 1 + 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/config/action.d/badips.py b/config/action.d/badips.py index 025289ca..4bc879a1 100644 --- a/config/action.d/badips.py +++ b/config/action.d/badips.py @@ -80,14 +80,17 @@ class BadIPsAction(ActionBase): If invalid `category`, `score`, `banaction` or `updateperiod`. """ + TIMEOUT = 10 _badips = "http://www.badips.com" def _Request(self, url, **argv): return Request(url, headers={'User-Agent': self.agent}, **argv) def __init__(self, jail, name, category, score=3, age="24h", key=None, - banaction=None, bancategory=None, bankey=None, updateperiod=900, agent="Fail2Ban"): + banaction=None, bancategory=None, bankey=None, updateperiod=900, agent="Fail2Ban", + timeout=TIMEOUT): super(BadIPsAction, self).__init__(jail, name) + self.timeout = timeout self.agent = agent self.category = category self.score = score @@ -119,7 +122,7 @@ class BadIPsAction(ActionBase): """ try: response = urlopen( - self._Request("/".join([self._badips, "get", "categories"])), None, 3) + self._Request("/".join([self._badips, "get", "categories"])), timeout=self.timeout) except HTTPError as response: messages = json.loads(response.read().decode('utf-8')) self._logSys.error( @@ -173,7 +176,7 @@ class BadIPsAction(ActionBase): urlencode({'age': age})]) if key: url = "&".join([url, urlencode({'key': key})]) - response = urlopen(self._Request(url)) + response = urlopen(self._Request(url), timeout=self.timeout) except HTTPError as response: messages = json.loads(response.read().decode('utf-8')) self._logSys.error( @@ -358,7 +361,7 @@ class BadIPsAction(ActionBase): url = "/".join([self._badips, "add", self.category, aInfo['ip']]) if self.key: url = "?".join([url, urlencode({'key': self.key})]) - response = urlopen(self._Request(url)) + response = urlopen(self._Request(url), timeout=self.timeout) except HTTPError as response: messages = json.loads(response.read().decode('utf-8')) self._logSys.error( diff --git a/fail2ban/tests/action_d/test_badips.py b/fail2ban/tests/action_d/test_badips.py index a7f148b1..3f71b7a3 100644 --- a/fail2ban/tests/action_d/test_badips.py +++ b/fail2ban/tests/action_d/test_badips.py @@ -37,6 +37,7 @@ if sys.version_info >= (2,7): self.jail.actions.add("badips", pythonModule, initOpts={ 'category': "ssh", 'banaction': "test", + 'timeout': 30, }) self.action = self.jail.actions["badips"] From b2e3affaa0d3d59f6c982ab4e4052f82349aa0cb Mon Sep 17 00:00:00 2001 From: Andrii Melnyk Date: Fri, 8 Jul 2016 04:50:57 +0300 Subject: [PATCH 57/70] adding openldap slapd filter --- ChangeLog | 2 ++ config/filter.d/slapd.conf | 17 +++++++++++++++++ config/jail.conf | 5 +++++ 3 files changed, 24 insertions(+) create mode 100644 config/filter.d/slapd.conf diff --git a/ChangeLog b/ChangeLog index 3f985b20..ad64ab78 100644 --- a/ChangeLog +++ b/ChangeLog @@ -30,6 +30,8 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released - New Features: * New Actions: - action.d/firewallcmd-rich-rules and action.d/firewallcmd-rich-logging (gh-1367) + * New filters: + - slapd - ban hosts, that were failed to connect with invalid credentials: error code 49 - Enhancements: * Extreme speedup of all sqlite database operations (gh-1436), diff --git a/config/filter.d/slapd.conf b/config/filter.d/slapd.conf new file mode 100644 index 00000000..9a4e14c5 --- /dev/null +++ b/config/filter.d/slapd.conf @@ -0,0 +1,17 @@ +# slapd (Stand-alone LDAP Daemon) openldap daemon filter +# +# Detecting invalid credentials: error code 49 +# http://www.openldap.org/doc/admin24/appendix-ldap-result-codes.html#invalidCredentials (49) + +[Definition] + +failregex = ^.* conn=(?P\d+) fd=\d+ ACCEPT from IP=\:\d+ .+$^.+ conn=(?P=pid) .* RESULT .* err=49 .*$ + +ignoreregex = + +[Init] + +# "maxlines" is number of log lines to buffer for multi-line regex searches +maxlines = 20 + +# Author: Andrii Melnyk diff --git a/config/jail.conf b/config/jail.conf index 941737ff..41d8d3b8 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -840,3 +840,8 @@ logencoding = utf-8 # See "haproxy-http-auth" filter for a brief cautionary note when setting # maxretry and findtime. logpath = /var/log/haproxy.log + +[slapd] +port = ldap,ldaps +filter = slapd +logpath = /var/log/slapd.log From c9ab669851ae8aeb7a11efc385bed5c1d61389f1 Mon Sep 17 00:00:00 2001 From: Andrii Melnyk Date: Fri, 8 Jul 2016 04:56:29 +0300 Subject: [PATCH 58/70] added sample log lines for slapd --- fail2ban/tests/files/logs/slapd | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 fail2ban/tests/files/logs/slapd diff --git a/fail2ban/tests/files/logs/slapd b/fail2ban/tests/files/logs/slapd new file mode 100644 index 00000000..19e78882 --- /dev/null +++ b/fail2ban/tests/files/logs/slapd @@ -0,0 +1,9 @@ +Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 fd=21 ACCEPT from IP=8.8.8.8:45011 (IP=0.0.0.0:636) +Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 fd=21 TLS established tls_ssf=256 ssf=256 +Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 op=0 EXT oid=1.3.6.1.4.1.6.1 +Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 op=0 STARTTLS +Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 op=0 RESULT oid= err=1 text=TLS already started +Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=1 BIND dn="uid=gipson,ou=people,dc=example,dc=com" method=128 +Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=1 RESULT tag=97 err=49 text= +Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=2 UNBIND +Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 fd=21 closed From c335663395d08267b6a4e562f3a3801ba5854d2e Mon Sep 17 00:00:00 2001 From: Andrii Melnyk Date: Fri, 8 Jul 2016 05:12:25 +0300 Subject: [PATCH 59/70] add info to log file --- fail2ban/tests/files/logs/slapd | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fail2ban/tests/files/logs/slapd b/fail2ban/tests/files/logs/slapd index 19e78882..c4758dfb 100644 --- a/fail2ban/tests/files/logs/slapd +++ b/fail2ban/tests/files/logs/slapd @@ -1,9 +1,18 @@ +# failJSON: { "match": false } Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 fd=21 ACCEPT from IP=8.8.8.8:45011 (IP=0.0.0.0:636) +# failJSON: { "match": false } Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 fd=21 TLS established tls_ssf=256 ssf=256 +# failJSON: { "match": false } Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 op=0 EXT oid=1.3.6.1.4.1.6.1 +# failJSON: { "match": false } Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 op=0 STARTTLS +# failJSON: { "match": false } Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 op=0 RESULT oid= err=1 text=TLS already started +# failJSON: { "match": false } Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=1 BIND dn="uid=gipson,ou=people,dc=example,dc=com" method=128 +# failJSON: { "time": "2016-07-08T01:47:20", "match": true , "host": "8.8.8.8", "desc": "Multiline match for invalid credentials" } Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=1 RESULT tag=97 err=49 text= +# failJSON: { "match": false } Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=2 UNBIND +# failJSON: { "match": false } Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 fd=21 closed From dcb69b024221fb6a947cb18d6ec576490e165362 Mon Sep 17 00:00:00 2001 From: Andrii Melnyk Date: Fri, 8 Jul 2016 05:29:51 +0300 Subject: [PATCH 60/70] * add `__prefix_line` to regex * fix time in log file --- config/filter.d/slapd.conf | 10 +++++++++- fail2ban/tests/files/logs/slapd | 2 +- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/config/filter.d/slapd.conf b/config/filter.d/slapd.conf index 9a4e14c5..0af6a4ea 100644 --- a/config/filter.d/slapd.conf +++ b/config/filter.d/slapd.conf @@ -3,9 +3,17 @@ # Detecting invalid credentials: error code 49 # http://www.openldap.org/doc/admin24/appendix-ldap-result-codes.html#invalidCredentials (49) +[INCLUDES] + +# Read common prefixes. If any customizations available -- read them from +# common.local +before = common.conf + [Definition] -failregex = ^.* conn=(?P\d+) fd=\d+ ACCEPT from IP=\:\d+ .+$^.+ conn=(?P=pid) .* RESULT .* err=49 .*$ +_daemon = slapd + +failregex = ^(?P<__prefix>%(__prefix_line)s).* conn=(?P\d+) fd=\d+ ACCEPT from IP=\:\d+ .+$(?P=__prefix).+ conn=(?P=pid) .* RESULT .* err=49 .*$ ignoreregex = diff --git a/fail2ban/tests/files/logs/slapd b/fail2ban/tests/files/logs/slapd index c4758dfb..db7cda87 100644 --- a/fail2ban/tests/files/logs/slapd +++ b/fail2ban/tests/files/logs/slapd @@ -10,7 +10,7 @@ Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 op=0 STARTTLS Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 op=0 RESULT oid= err=1 text=TLS already started # failJSON: { "match": false } Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=1 BIND dn="uid=gipson,ou=people,dc=example,dc=com" method=128 -# failJSON: { "time": "2016-07-08T01:47:20", "match": true , "host": "8.8.8.8", "desc": "Multiline match for invalid credentials" } +# failJSON: { "time": "2005-07-08T01:47:20", "match": true , "host": "8.8.8.8", "desc": "Multiline match for invalid credentials" } Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=1 RESULT tag=97 err=49 text= # failJSON: { "match": false } Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=2 UNBIND From 72a157b8f23240bee09c559a13cc8eb5aeb015f0 Mon Sep 17 00:00:00 2001 From: nturcksin Date: Wed, 8 Jun 2016 14:23:54 +0200 Subject: [PATCH 61/70] Improve PJSIP log support for asterisk 13+ with different callID (Squash gh-1458) Change the asterisk pjsip filter to don't take the callId part Add optional part between "Request" and "from" Listed all log message from asterisk --- config/filter.d/asterisk.conf | 9 +++++++-- fail2ban/tests/files/logs/asterisk | 13 ++++++++++++- 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf index f6ccdd4f..535c3e0d 100644 --- a/config/filter.d/asterisk.conf +++ b/config/filter.d/asterisk.conf @@ -27,8 +27,13 @@ failregex = ^%(__prefix_line)s%(log_prefix)s Registration from '[^']*' failed fo ^%(__prefix_line)s%(log_prefix)s hacking attempt detected ''$ ^%(__prefix_line)s%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="([\d-]+|%(iso8601)s)",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="(\d*|)",SessionID=".+",LocalAddress="IPV[46]/(UDP|TCP|WS)/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UDP|TCP|WS)//\d+"(,Challenge="[\w/]+")?(,ReceivedChallenge="\w+")?(,Response="\w+",ExpectedResponse="\w*")?(,ReceivedHash="[\da-f]+")?(,ACLName="\w+")?$ ^%(__prefix_line)s%(log_prefix)s "Rejecting unknown SIP connection from "$ - ^%(__prefix_line)s%(log_prefix)s Request from '[^']*' failed for '(?::\d+)?' \(callid: \w*\) - No matching endpoint found$ - + ^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '[^']*' failed for '(?::\d+)?'\s\(callid: [^']*\) - No matching endpoint found + ^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '[^']*' failed for '(?::\d+)?'\s\(callid: [^']*\) - Not match Endpoint ACL + ^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '[^']*' failed for '(?::\d+)?'\s\(callid: [^']*\) - Not match Endpoint Contact ACL + ^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '[^']*' failed for '(?::\d+)?'\s\(callid: [^']*\) - Failed to authenticate + ^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '[^']*' failed for '(?::\d+)?'\s\(callid: [^']*\) - Error to authenticate + + ignoreregex = diff --git a/fail2ban/tests/files/logs/asterisk b/fail2ban/tests/files/logs/asterisk index 3f49beec..d17d93a1 100644 --- a/fail2ban/tests/files/logs/asterisk +++ b/fail2ban/tests/files/logs/asterisk @@ -70,4 +70,15 @@ Nov 4 18:30:40 localhost asterisk[32229]: NOTICE[32257]: chan_sip.c:23417 in han # Failed authentication with pjsip on Asterisk 13+ # failJSON: { "time": "2016-05-23T10:18:16", "match": true , "host": "1.2.3.4" } -[2016-05-23 10:18:16] NOTICE[19388] res_pjsip/pjsip_distributor.c: Request from '"1000" ' failed for '1.2.3.4:48336' (callid: 276666022) - No matching endpoint found \ No newline at end of file +[2016-05-23 10:18:16] NOTICE[19388] res_pjsip/pjsip_distributor.c: Request from '"1000" ' failed for '1.2.3.4:48336' (callid: 276666022) - No matching endpoint found +# failJSON: { "time": "2016-05-23T10:18:16", "match": true , "host": "1.2.3.4" } +[2016-05-23 10:18:16] NOTICE[19388] res_pjsip/pjsip_distributor.c: Request from '"1000" ' failed for '1.2.3.4:48336' (callid: 276666022) - Not match Endpoint ACL +# failJSON: { "time": "2016-05-23T10:18:16", "match": true , "host": "1.2.3.4" } +[2016-05-23 10:18:16] NOTICE[19388] res_pjsip/pjsip_distributor.c: Request from '"1000" ' failed for '1.2.3.4:48336' (callid: 276666022) - Not match Endpoint Contact ACL +# failJSON: { "time": "2016-05-23T10:18:16", "match": true , "host": "1.2.3.4" } +[2016-05-23 10:18:16] NOTICE[19388] res_pjsip/pjsip_distributor.c: Request from '"1000" ' failed for '1.2.3.4:48336' (callid: 276666022) - Failed to authenticate +# failJSON: { "time": "2016-05-23T10:18:16", "match": true , "host": "1.2.3.4" } +[2016-05-23 10:18:16] NOTICE[19388] res_pjsip/pjsip_distributor.c: Request from '"1000" ' failed for '1.2.3.4:48336' (callid: 276666022) - Error to authenticate +# Failed authentication with pjsip on Asterisk 13+ +# failJSON: { "time": "2016-06-08T23:40:26", "match": true , "host": "2.3.4.5" } +[2016-06-08 23:40:26] NOTICE[32497] res_pjsip/pjsip_distributor.c: Request from '"317" ' failed for '2.3.4.5:5089' (callid: 206f178f-896564cb-57573f49@1.2.3.4) - No matching endpoint found From f5f204ca7ce0b78030c5539fbb1d1d54d7fca97a Mon Sep 17 00:00:00 2001 From: sebres Date: Fri, 8 Jul 2016 11:44:16 +0200 Subject: [PATCH 62/70] Improved changes of gh-1458: `[^']*` after callid was wrong, changed to `[^\)]*`; regexp anchored at the end; almost the same regex grouped to one; Closes #1458 --- ChangeLog | 4 +++- config/filter.d/asterisk.conf | 9 ++------- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3f985b20..b0bffb05 100644 --- a/ChangeLog +++ b/ChangeLog @@ -25,7 +25,9 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released added new parameter `__date_ambit` * gentoo-initd fixed --pidfile bug: `--pidfile` is option of start-stop-daemon, not argument of fail2ban (see gh-1434) - * filter.d/asterisk.conf - fix security log support for PJSIP and Asterisk 13+ + * filter.d/asterisk.conf + - fix security log support for PJSIP and Asterisk 13+ (gh-1456) + - improved log support for PJSIP and Asterisk 13+ with different callID (gh-1458) - New Features: * New Actions: diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf index 535c3e0d..6af452e2 100644 --- a/config/filter.d/asterisk.conf +++ b/config/filter.d/asterisk.conf @@ -27,13 +27,8 @@ failregex = ^%(__prefix_line)s%(log_prefix)s Registration from '[^']*' failed fo ^%(__prefix_line)s%(log_prefix)s hacking attempt detected ''$ ^%(__prefix_line)s%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="([\d-]+|%(iso8601)s)",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="(\d*|)",SessionID=".+",LocalAddress="IPV[46]/(UDP|TCP|WS)/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UDP|TCP|WS)//\d+"(,Challenge="[\w/]+")?(,ReceivedChallenge="\w+")?(,Response="\w+",ExpectedResponse="\w*")?(,ReceivedHash="[\da-f]+")?(,ACLName="\w+")?$ ^%(__prefix_line)s%(log_prefix)s "Rejecting unknown SIP connection from "$ - ^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '[^']*' failed for '(?::\d+)?'\s\(callid: [^']*\) - No matching endpoint found - ^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '[^']*' failed for '(?::\d+)?'\s\(callid: [^']*\) - Not match Endpoint ACL - ^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '[^']*' failed for '(?::\d+)?'\s\(callid: [^']*\) - Not match Endpoint Contact ACL - ^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '[^']*' failed for '(?::\d+)?'\s\(callid: [^']*\) - Failed to authenticate - ^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '[^']*' failed for '(?::\d+)?'\s\(callid: [^']*\) - Error to authenticate - - + ^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '[^']*' failed for '(?::\d+)?'\s\(callid: [^\)]*\) - (?:No matching endpoint found|Not match Endpoint(?: Contact)? ACL|(?:Failed|Error) to authenticate)\s*$ + ignoreregex = From 48c094f6125665dc17b2c7a6e51a928ef6eb9b86 Mon Sep 17 00:00:00 2001 From: Andrii Melnyk Date: Fri, 8 Jul 2016 13:45:10 +0300 Subject: [PATCH 63/70] improved failregex according to @sebres recomendations --- config/filter.d/slapd.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/slapd.conf b/config/filter.d/slapd.conf index 0af6a4ea..23d9ee2d 100644 --- a/config/filter.d/slapd.conf +++ b/config/filter.d/slapd.conf @@ -13,7 +13,7 @@ before = common.conf _daemon = slapd -failregex = ^(?P<__prefix>%(__prefix_line)s).* conn=(?P\d+) fd=\d+ ACCEPT from IP=\:\d+ .+$(?P=__prefix).+ conn=(?P=pid) .* RESULT .* err=49 .*$ +failregex = ^(?P<__prefix>%(__prefix_line)s)conn=(?P<_conn_>\d+) fd=\d+ ACCEPT from IP=[^\n]+(?P=__prefix)conn=(?P=_conn_) op=\d+ RESULT(?:\s(?!err)\S+=\S*)* err=49\s ignoreregex = From 2c5a489bc77077775b9790d31a3ce5f89ca7f202 Mon Sep 17 00:00:00 2001 From: Andrii Melnyk Date: Fri, 8 Jul 2016 13:55:58 +0300 Subject: [PATCH 64/70] add PR id to ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index ad64ab78..ccac9a9d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,7 +31,7 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released * New Actions: - action.d/firewallcmd-rich-rules and action.d/firewallcmd-rich-logging (gh-1367) * New filters: - - slapd - ban hosts, that were failed to connect with invalid credentials: error code 49 + - slapd - ban hosts, that were failed to connect with invalid credentials: error code 49 (gh-1478) - Enhancements: * Extreme speedup of all sqlite database operations (gh-1436), From ec9c4a27f3e3d5dc8a511cae5732aac65eb88ad3 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sun, 10 Jul 2016 18:40:20 -0400 Subject: [PATCH 65/70] DOC: tuned up ChangeLog entries for 0.9.5 unified capitalized beginning of each entry no trailing spaces or dots etc --- ChangeLog | 41 +++++++++++++++++++++++------------------ 1 file changed, 23 insertions(+), 18 deletions(-) diff --git a/ChangeLog b/ChangeLog index b0bffb05..7c15175e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -11,27 +11,32 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released - Fixes: * filter.d/monit.conf - - extended failregex with new monit "access denied" version (gh-1355); - - failregex of previous monit version merged as single expression. + - Extended failregex with new monit "access denied" version (gh-1355) + - failregex of previous monit version merged as single expression * filter.d/postfix.conf, filter.d/postfix-sasl.conf - - extended failregex daemon part, matching also `postfix/smtps/smtpd` now (gh-1391) - * fixed a grave bug within tags substitutions because of incorrect detection of recursion - in case of multiple inline substitutions of the same tag (affected actions: `bsd-ipfw`, etc). - Now tracks the actual list of the already substituted tags (per tag instead of single list) + - Extended failregex daemon part, matching also `postfix/smtps/smtpd` + now (gh-1391) + * Fixed a grave bug within tags substitutions because of incorrect + detection of recursion in case of multiple inline substitutions + of the same tag (affected actions: `bsd-ipfw`, etc). Now tracks + the actual list of the already substituted tags (per tag instead + of single list) * filter.d/common.conf - - unexpected extra regex-space in generic `__prefix_line` (gh-1405) - - all optional spaces normalized in `common.conf`, test covered now - - generic `__prefix_line` extended with optional brackets for the date ambit (gh-1421), - added new parameter `__date_ambit` - * gentoo-initd fixed --pidfile bug: `--pidfile` is option of start-stop-daemon, - not argument of fail2ban (see gh-1434) + - Unexpected extra regex-space in generic `__prefix_line` (gh-1405) + - All optional spaces normalized in `common.conf`, test covered now + - Generic `__prefix_line` extended with optional brackets for the + date ambit (gh-1421), added new parameter `__date_ambit` + * gentoo-initd fixed --pidfile bug: `--pidfile` is option of + start-stop-daemon, not argument of fail2ban (see gh-1434) * filter.d/asterisk.conf - - fix security log support for PJSIP and Asterisk 13+ (gh-1456) - - improved log support for PJSIP and Asterisk 13+ with different callID (gh-1458) + - Fixed security log support for PJSIP and Asterisk 13+ (gh-1456) + - Improved log support for PJSIP and Asterisk 13+ with different + callID (gh-1458) - New Features: * New Actions: - - action.d/firewallcmd-rich-rules and action.d/firewallcmd-rich-logging (gh-1367) + - action.d/firewallcmd-rich-rules and action.d/firewallcmd-rich-logging + (gh-1367) - Enhancements: * Extreme speedup of all sqlite database operations (gh-1436), @@ -40,10 +45,10 @@ ver. 0.9.5 (2016/XX/XXX) - wanna-be-released - (journal_mode = MEMORY) use memory for the transaction logging - (temp_store = MEMORY) temporary tables and indices are kept in memory * journald journalmatch for pure-ftpd (gh-1362) - * Add additional regex filter for dovecot ldap authentication failures (gh-1370) + * Added additional regex filter for dovecot ldap authentication failures (gh-1370) * filter.d/exim*conf - - added additional regexes (gh-1371) - - made port entry optional + - Added additional regexes (gh-1371) + - Made port entry optional ver. 0.9.4 (2016/03/08) - for-you-ladies From 33ed71b3dea3b368d8c2c3ee67840adeafd1b711 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sun, 10 Jul 2016 19:53:54 -0400 Subject: [PATCH 66/70] DOC: Reformatted ChangeLog into legit Markdown (Closes #962) --- ChangeLog | 1639 +++++++++++++++++++++++++++-------------------------- 1 file changed, 822 insertions(+), 817 deletions(-) diff --git a/ChangeLog b/ChangeLog index 7c15175e..37b60b66 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,6 @@ - __ _ _ ___ _ - / _|__ _(_) |_ ) |__ __ _ _ _ - | _/ _` | | |/ /| '_ \/ _` | ' \ + __ _ _ ___ _ + / _|__ _(_) |_ ) |__ __ _ _ _ + | _/ _` | | |/ /| '_ \/ _` | ' \ |_| \__,_|_|_/___|_.__/\__,_|_||_| Fail2Ban: Changelog @@ -9,203 +9,203 @@ Fail2Ban: Changelog ver. 0.9.5 (2016/XX/XXX) - wanna-be-released ----------- -- Fixes: - * filter.d/monit.conf - - Extended failregex with new monit "access denied" version (gh-1355) - - failregex of previous monit version merged as single expression - * filter.d/postfix.conf, filter.d/postfix-sasl.conf - - Extended failregex daemon part, matching also `postfix/smtps/smtpd` - now (gh-1391) - * Fixed a grave bug within tags substitutions because of incorrect - detection of recursion in case of multiple inline substitutions - of the same tag (affected actions: `bsd-ipfw`, etc). Now tracks - the actual list of the already substituted tags (per tag instead - of single list) - * filter.d/common.conf - - Unexpected extra regex-space in generic `__prefix_line` (gh-1405) - - All optional spaces normalized in `common.conf`, test covered now - - Generic `__prefix_line` extended with optional brackets for the - date ambit (gh-1421), added new parameter `__date_ambit` - * gentoo-initd fixed --pidfile bug: `--pidfile` is option of - start-stop-daemon, not argument of fail2ban (see gh-1434) - * filter.d/asterisk.conf - - Fixed security log support for PJSIP and Asterisk 13+ (gh-1456) - - Improved log support for PJSIP and Asterisk 13+ with different - callID (gh-1458) +### Fixes +* `filter.d/monit.conf` + - Extended failregex with new monit "access denied" version (gh-1355) + - failregex of previous monit version merged as single expression +* `filter.d/postfix.conf`, `filter.d/postfix-sasl.conf` + - Extended failregex daemon part, matching also `postfix/smtps/smtpd` + now (gh-1391) +* Fixed a grave bug within tags substitutions because of incorrect + detection of recursion in case of multiple inline substitutions + of the same tag (affected actions: `bsd-ipfw`, etc). Now tracks + the actual list of the already substituted tags (per tag instead + of single list) +* `filter.d/common.conf` + - Unexpected extra regex-space in generic `__prefix_line` (gh-1405) + - All optional spaces normalized in `common.conf`, test covered now + - Generic `__prefix_line` extended with optional brackets for the + date ambit (gh-1421), added new parameter `__date_ambit` +* `gentoo-initd` fixed `--pidfile` bug: `--pidfile` is option of + `start-stop-daemon`, not argument of fail2ban (see gh-1434) +* `filter.d/asterisk.conf` + - Fixed security log support for PJSIP and Asterisk 13+ (gh-1456) + - Improved log support for PJSIP and Asterisk 13+ with different + callID (gh-1458) -- New Features: - * New Actions: - - action.d/firewallcmd-rich-rules and action.d/firewallcmd-rich-logging - (gh-1367) +### New Features +* New Actions: + - `action.d/firewallcmd-rich-rules` and `action.d/firewallcmd-rich-logging` + (gh-1367) -- Enhancements: - * Extreme speedup of all sqlite database operations (gh-1436), - by using of following sqlite options: - - (synchronous = OFF) write data through OS without syncing - - (journal_mode = MEMORY) use memory for the transaction logging - - (temp_store = MEMORY) temporary tables and indices are kept in memory - * journald journalmatch for pure-ftpd (gh-1362) - * Added additional regex filter for dovecot ldap authentication failures (gh-1370) - * filter.d/exim*conf - - Added additional regexes (gh-1371) - - Made port entry optional +### Enhancements +* Extreme speedup of all sqlite database operations (gh-1436), + by using of following sqlite options: + - (synchronous = OFF) write data through OS without syncing + - (journal_mode = MEMORY) use memory for the transaction logging + - (temp_store = MEMORY) temporary tables and indices are kept in memory +* journald journalmatch for pure-ftpd (gh-1362) +* Added additional regex filter for dovecot ldap authentication failures (gh-1370) +* `filter.d/exim*conf` + - Added additional regexes (gh-1371) + - Made port entry optional ver. 0.9.4 (2016/03/08) - for-you-ladies ----------- -- Fixes: - * roundcube-auth jail typo for logpath - * Fix dnsToIp resolver for fqdn with large list of IPs (gh-1164) - * filter.d/apache-badbots.conf - - Updated useragent string regex adding escape for `+` - * filter.d/mysqld-auth.conf - - Updated "Access denied ..." regex for MySQL 5.6 and later (gh-1211, gh-1332) - * filter.d/sshd.conf - - Updated "Auth fail" regex for OpenSSH 5.9 and later - * Treat failed and killed execution of commands identically (only - different log messages), which addresses different behavior on different - exit codes of dash and bash (gh-1155) - * Fix jail.conf.5 man's section (gh-1226) - * Fixed default banaction for allports jails like pam-generic, recidive, etc - with new default variable `banaction_allports` (gh-1216) - * Fixed `fail2ban-regex` stops working on invalid (wrong encoded) character - for python version < 3.x (gh-1248) - * Use postfix_log logpath for postfix-rbl jail - * filters.d/postfix.conf - add 'Sender address rejected: Domain not found' failregex - * use `fail2ban_agent` as user-agent in actions badips, blocklist_de, etc (gh-1271) - * Fix ignoring the sender option by action_mw, action_mwl and action_c_mwl - * Changed filter.d/asterisk regex for "Call from ..." (few vulnerable now) - * Removed compression and rotation count from logrotate (inherit them from - the global logrotate config) +### Fixes +* `roundcube-auth` jail typo for logpath +* Fix dnsToIp resolver for fqdn with large list of IPs (gh-1164) +* `filter.d/apache-badbots.conf` + - Updated useragent string regex adding escape for `+` +* `filter.d/mysqld-auth.conf` + - Updated "Access denied ..." regex for MySQL 5.6 and later (gh-1211, gh-1332) +* `filter.d/sshd.conf` + - Updated "Auth fail" regex for OpenSSH 5.9 and later +* Treat failed and killed execution of commands identically (only + different log messages), which addresses different behavior on different + exit codes of dash and bash (gh-1155) +* Fix jail.conf.5 man's section (gh-1226) +* Fixed default banaction for allports jails like pam-generic, recidive, etc + with new default variable `banaction_allports` (gh-1216) +* Fixed `fail2ban-regex` stops working on invalid (wrong encoded) character + for python version < 3.x (gh-1248) +* Use postfix_log logpath for postfix-rbl jail +* `filters.d/postfix.conf` - add 'Sender address rejected: Domain not found' failregex +* use `fail2ban_agent` as user-agent in actions badips, blocklist_de, etc (gh-1271) +* Fix ignoring the sender option by action_mw, action_mwl and action_c_mwl +* Changed `filter.d/asterisk` regex for "Call from ..." (few vulnerable now) +* Removed compression and rotation count from logrotate (inherit them from + the global logrotate config) -- New Features: - * New interpolation feature for definition config readers - `` - (means last known init definition of filters or actions with name `parameter`). - This interpolation makes possible to extend a parameters of stock filter or - action directly in jail inside jail.local file, without creating a separately - filter.d/*.local file. - As extension to interpolation `%(known/parameter)s`, that does not works for - filter and action init parameters - * New actions: - - nftables-multiport and nftables-allports - filtering using nftables - framework. Note: it requires a pre-existing chain for the filtering rule. - * New filters: - - openhab - domotic software authentication failure with the - rest api and web interface (gh-1223) - - nginx-limit-req - ban hosts, that were failed through nginx by limit - request processing rate (ngx_http_limit_req_module) - - murmur - ban hosts that repeatedly attempt to connect to - murmur/mumble-server with an invalid server password or certificate. - - haproxy-http-auth - filter to match failed HTTP Authentications against a - HAProxy server - * New jails: - - murmur - bans TCP and UDP from the bad host on the default murmur port. - * sshd filter got new failregex to match "maximum authentication - attempts exceeded" (introduced in openssh 6.8) - * Added filter for Mac OS screen sharing (VNC) daemon +### New Features +* New interpolation feature for definition config readers - `` + (means last known init definition of filters or actions with name `parameter`). + This interpolation makes possible to extend a parameters of stock filter or + action directly in jail inside jail.local file, without creating a separately + `filter.d/*.local` file. + As extension to interpolation `%(known/parameter)s`, that does not works for + filter and action init parameters +* New actions: + - `nftables-multiport` and `nftables-allports` - filtering using nftables + framework. Note: it requires a pre-existing chain for the filtering rule. +* New filters: + - `openhab` - domotic software authentication failure with the + rest api and web interface (gh-1223) + - `nginx-limit-req` - ban hosts, that were failed through nginx by limit + request processing rate (ngx_http_limit_req_module) + - `murmur` - ban hosts that repeatedly attempt to connect to + murmur/mumble-server with an invalid server password or certificate. + - `haproxy-http-auth` - filter to match failed HTTP Authentications against a + HAProxy server +* New jails: + - `murmur` - bans TCP and UDP from the bad host on the default murmur port. +* `sshd` filter got new failregex to match "maximum authentication + attempts exceeded" (introduced in openssh 6.8) +* Added filter for Mac OS screen sharing (VNC) daemon -- Enhancements: - * Do not rotate empty log files - * Added new date pattern with year after day (e.g. Sun Jan 23 2005 21:59:59) - http://bugs.debian.org/798923 - * Added openSUSE path configuration (Thanks Johannes Weberhofer) - * Allow to split ignoreip entries by ',' as well as by ' ' (gh-1197) - * Added a timeout (3 sec) to urlopen within badips.py action - (Thanks M. Maraun) - * Added check against atacker's Googlebot PTR fake records - (Thanks Pablo Rodriguez Fernandez) - * Enhance filter against atacker's Googlebot PTR fake records - (gh-1226) - * Nginx log paths extended (prefixed with "*" wildcard) (gh-1237) - * Added filter for openhab domotic software authentication failure with the - rest api and web interface (gh-1223) - * Add *_backend options for services to allow distros to set the default - backend per service, set default to systemd for Fedora as appropriate - * Performance improvements while monitoring large number of files (gh-1265). - Use associative array (dict) for monitored log files to speed up lookup - operations. Thanks @kshetragia - * Specified that fail2ban is PartOf iptables.service firewalld.service in - .service file -- would reload fail2ban if those services are restarted - * Provides new default `fail2ban_version` and interpolation variable - `fail2ban_agent` in jail.conf - * Enhance filter 'postfix' to ban incoming SMTP client with no fqdn hostname, - and to support multiple instances of postfix having varying suffix (gh-1331) - (Thanks Tom Hendrikx) - * files/gentoo-initd to use start-stop-daemon to robustify restarting the service +### Enhancements +* Do not rotate empty log files +* Added new date pattern with year after day (e.g. `Sun Jan 23 2005 21:59:59`) + http://bugs.debian.org/798923 +* Added openSUSE path configuration (Thanks Johannes Weberhofer) +* Allow to split ignoreip entries by ',' as well as by ' ' (gh-1197) +* Added a timeout (3 sec) to urlopen within badips.py action + (Thanks M. Maraun) +* Added check against atacker's Googlebot PTR fake records + (Thanks Pablo Rodriguez Fernandez) +* Enhance filter against atacker's Googlebot PTR fake records + (gh-1226) +* Nginx log paths extended (prefixed with "*" wildcard) (gh-1237) +* Added filter for openhab domotic software authentication failure with the + rest api and web interface (gh-1223) +* Add `*_backend` options for services to allow distros to set the default + backend per service, set default to systemd for Fedora as appropriate +* Performance improvements while monitoring large number of files (gh-1265). + Use associative array (dict) for monitored log files to speed up lookup + operations. Thanks @kshetragia +* Specified that fail2ban is PartOf iptables.service `firewalld.service` in + `.service` file -- would reload fail2ban if those services are restarted +* Provides new default `fail2ban_version` and interpolation variable + `fail2ban_agent` in jail.conf +* Enhance filter 'postfix' to ban incoming SMTP client with no fqdn hostname, + and to support multiple instances of postfix having varying suffix (gh-1331) + (Thanks Tom Hendrikx) +* `files/gentoo-initd` to use `start-stop-daemon` to robustify restarting the service ver. 0.9.3 (2015/08/01) - lets-all-stay-friends ---------- -- IMPORTANT incompatible changes: - * filter.d/roundcube-auth.conf - - Changed logpath to 'errors' log (was 'userlogins') - * action.d/iptables-common.conf - - All calls to iptables command now use -w switch introduced in - iptables 1.4.20 (some distribution could have patched their - earlier base version as well) to provide this locking mechanism - useful under heavy load to avoid contesting on iptables calls. - If you need to disable, define 'action.d/iptables-common.local' - with empty value for 'lockingopt' in `[Init]` section. - * mail-whois-lines, sendmail-geoip-lines and sendmail-whois-lines - actions now include by default only the first 1000 log lines in - the emails. Adjust to augment the behavior. +### IMPORTANT incompatible changes +* `filter.d/roundcube-auth.conf` + - Changed logpath to 'errors' log (was 'userlogins') +* `action.d/iptables-common.conf` + - All calls to iptables command now use -w switch introduced in + iptables 1.4.20 (some distribution could have patched their + earlier base version as well) to provide this locking mechanism + useful under heavy load to avoid contesting on iptables calls. + If you need to disable, define `action.d/iptables-common.local` + with empty value for 'lockingopt' in `[Init]` section. +* `mail-whois-lines`, `sendmail-geoip-lines` and `sendmail-whois-lines` + actions now include by default only the first 1000 log lines in + the emails. Adjust `` to augment the behavior. -- Fixes: - * reload in interactive mode appends all the jails twice (gh-825) - * reload server/jail failed if database used (but was not changed) and - some jail active (gh-1072) - * filter.d/dovecot.conf - also match unknown user in passwd-file. - Thanks Anton Shestakov - * Fix fail2ban-regex not parsing journalmatch correctly from filter config - * filter.d/asterisk.conf - fix security log support for Asterisk 12+ - * filter.d/roundcube-auth.conf +### Fixes +* reload in interactive mode appends all the jails twice (gh-825) +* reload server/jail failed if database used (but was not changed) and + some jail active (gh-1072) +* `filter.d/dovecot.conf` - also match unknown user in passwd-file. + Thanks Anton Shestakov +* Fix fail2ban-regex not parsing journalmatch correctly from filter config +* `filter.d/asterisk.conf` - fix security log support for Asterisk 12+ +* `filter.d/roundcube-auth.conf` - Updated regex to work with 'errors' log (1.0.5 and 1.1.1) - Added regex to work with 'userlogins' log - * action.d/sendmail*.conf - use LC_ALL (superseeding LC_TIME) to override - locale on systems with customized LC_ALL - * performance fix: minimizes connection overhead, close socket only at - communication end (gh-1099) - * unbanip always deletes ip from database (independent of bantime, also if - currently not banned or persistent) - * guarantee order of dbfile to be before dbpurgeage (gh-1048) - * always set 'dbfile' before other database options (gh-1050) - * kill the entire process group of the child process upon timeout (gh-1129). - Otherwise could lead to resource exhaustion due to hanging whois - processes. - * resolve /var/run/fail2ban path in setup.py to help installation - on platforms with /var/run -> /run symlink (gh-1142) +* `action.d/sendmail*.conf` - use LC_ALL (superseeding LC_TIME) to override + locale on systems with customized LC_ALL +* performance fix: minimizes connection overhead, close socket only at + communication end (gh-1099) +* unbanip always deletes ip from database (independent of bantime, also if + currently not banned or persistent) +* guarantee order of dbfile to be before dbpurgeage (gh-1048) +* always set 'dbfile' before other database options (gh-1050) +* kill the entire process group of the child process upon timeout (gh-1129). + Otherwise could lead to resource exhaustion due to hanging whois + processes. +* resolve `/var/run/fail2ban` path in setup.py to help installation + on platforms with `/var/run` -> /run symlink (gh-1142) -- New Features: - * RETURN iptables target is now a variable: - * New type of operation: pass2allow, use fail2ban for "knocking", - opening a closed port by swapping blocktype and returntype - * New filters: +### New Features +* RETURN iptables target is now a variable: `` +* New type of operation: pass2allow, use fail2ban for "knocking", + opening a closed port by swapping blocktype and returntype +* New filters: - froxlor-auth - Thanks Joern Muehlencord - apache-pass - filter Apache access log for successful authentication - * New actions: +* New actions: - shorewall-ipset-proto6 - using proto feature of the Shorewall. Still requires manual pre-configuration of the shorewall. See the action file for detail. - * New jails: +* New jails: - pass2allow-ftp - allows FTP traffic after successful HTTP authentication -- Enhancements: - * action.d/cloudflare.conf - improved documentation on how to allow - multiple CF accounts, and jail.conf got new compound action - definition action_cf_mwl to submit cloudflare report. - * Check access to socket for more detailed logging on error (gh-595) - * fail2ban-testcases man page - * filter.d/apache-badbots.conf, filter.d/nginx-botsearch.conf - add - HEAD method verb - * Revamp of Travis and coverage automated testing - * Added a space between IP address and the following colon - in notification emails for easier text selection - * Character detection heuristics for whois output via optional setting - in mail-whois*.conf. Thanks Thomas Mayer. - Not enabled by default, if _whois_command is set to be - %(_whois_convert_charset)s (e.g. in action.d/mail-whois-common.local), - it +### Enhancements +* `action.d/cloudflare.conf` - improved documentation on how to allow + multiple CF accounts, and jail.conf got new compound action + definition action_cf_mwl to submit cloudflare report. +* Check access to socket for more detailed logging on error (gh-595) +* fail2ban-testcases man page +* `filter.d/apache-badbots.conf`, `filter.d/nginx-botsearch.conf` - add + HEAD method verb +* Revamp of Travis and coverage automated testing +* Added a space between IP address and the following colon + in notification emails for easier text selection +* Character detection heuristics for whois output via optional setting + in mail-whois*.conf. Thanks Thomas Mayer. + Not enabled by default, if _whois_command is set to be + %(_whois_convert_charset)s (e.g. in `action.d/mail-whois-common.local`), + it - detects character set of whois output (which is undefined by RFC 3912) via heuristics of the file command - converts whois data to UTF-8 character set with iconv @@ -217,161 +217,162 @@ ver. 0.9.3 (2015/08/01) - lets-all-stay-friends ver. 0.9.2 (2015/04/29) - better-quick-now-than-later ---------- -- Fixes: - * Fix ufw action commands - * infinite busy loop on _escapedTags match in substituteRecursiveTags gh-907. - Thanks TonyThompson - * port[s] typo in jail.conf/nginx-http-auth gh-913. Thanks Frederik Wagner - (fnerdwq) - * $ typo in jail.conf. Thanks Skibbi. Debian bug #767255 - * grep'ing for IP in *mail-whois-lines.conf should now match also - at the beginning and EOL. Thanks Dean Lee - * jail.conf - - php-url-fopen: separate logpath entries by newline - * failregex declared direct in jail was joined to single line (specifying of - multiple expressions was not possible). - * filters.d/exim.conf - cover different settings of exim logs - details. Thanks bes.internal - * filter.d/postfix-sasl.conf - failregex is now case insensitive - * filters.d/postfix.conf - add 'Client host rejected error message' failregex - * fail2ban/__init__.py - add strptime thread safety hack-around - * recidive uses iptables-allports banaction by default now. - Avoids problems with iptables versions not understanding 'all' for - protocols and ports - * filter.d/dovecot.conf +### Fixes +* Fix ufw action commands +* infinite busy loop on _escapedTags match in substituteRecursiveTags gh-907. + Thanks TonyThompson +* port[s] typo in jail.conf/nginx-http-auth gh-913. Thanks Frederik Wagner + (fnerdwq) +* $ typo in jail.conf. Thanks Skibbi. Debian bug #767255 +* grep'ing for IP in *mail-whois-lines.conf should now match also + at the beginning and EOL. Thanks Dean Lee +* `jail.conf` + - `php-url-fopen`: separate logpath entries by newline +* failregex declared direct in jail was joined to single line (specifying of + multiple expressions was not possible). +* `filters.d/exim.conf` - cover different settings of exim logs + details. Thanks bes.internal +* `filter.d/postfix-sasl.conf` - failregex is now case insensitive +* `filters.d/postfix.conf` - add 'Client host rejected error message' failregex +* `fail2ban/__init__.py` - add strptime thread safety hack-around +* recidive uses `iptables-allports` banaction by default now. + Avoids problems with iptables versions not understanding 'all' for + protocols and ports +* `filter.d/dovecot.conf` - match pam_authenticate line from EL7 - match unknown user line from EL7 - * Use use_poll=True for Python 2.7 and >=3.4 to overcome "Bad file - descriptor" msgs issue (gh-161) - * filter.d/postfix-sasl.conf - tweak failregex and add ignoreregex to ignore - system authentication issues - * fail2ban-regex reads filter file(s) completely, incl. '.local' file etc. - (gh-954) - * firewallcmd-* actions: split output into separate lines for grepping (gh-908) - * Guard unicode encode/decode issues while storing records in the database. - Fixes "binding parameter error (unsupported type)" (gh-973), thanks to kot - for reporting - * filter.d/sshd added regex for matching openSUSE ssh authentication failure - * filter.d/asterisk.conf: +* Use `use_poll=True` for Python 2.7 and >=3.4 to overcome "Bad file + descriptor" msgs issue (gh-161) +* `filter.d/postfix-sasl.conf` - tweak failregex and add ignoreregex to ignore + system authentication issues +* fail2ban-regex reads filter file(s) completely, incl. '.local' file etc. + (gh-954) +* firewallcmd-* actions: split output into separate lines for grepping (gh-908) +* Guard unicode encode/decode issues while storing records in the database. + Fixes "binding parameter error (unsupported type)" (gh-973), thanks to kot + for reporting +* `filter.d/sshd` added regex for matching openSUSE ssh authentication failure +* `filter.d/asterisk.conf`: - Dropped "Sending fake auth rejection" failregex since it incorrectly targets the asterisk server itself - match "hacking attempt detected" logs -- New Features: - - New filters: - - postfix-rbl Thanks Lee Clemens - - apache-fakegooglebot.conf Thanks Lee Clemens - - nginx-botsearch Thanks Frantisek Sumsal - - drupal-auth Thanks Lee Clemens - - New recursive embedded substitution feature added: - - `<HOST>` becomes `` for PREF=`IPV4`; - - `<HOST>` becomes `1.2.3.4` for PREF=`IPV4` and IPV4HOST=`1.2.3.4`; - - New interpolation feature for config readers - `%(known/parameter)s`. - (means last known option with name `parameter`). This interpolation makes - possible to extend a stock filter or jail regexp in .local file - (opposite to simply set failregex/ignoreregex that overwrites it), - see gh-867. - - Monit config for fail2ban in files/monit/ - - New actions: - - action.d/firewallcmd-multiport and action.d/firewallcmd-allports Thanks Donald Yandt - - action.d/sendmail-geoip-lines.conf - - action.d/nsupdate to update DNSBL. Thanks Andrew St. Jean - - New status argument for fail2ban-client -- flavor: - fail2ban-client status [flavor] - - empty or "basic" works as-is - - "cymru" additionally prints (ASN, Country RIR) per banned IP - (requires dnspython or dnspython3) - - Flush log at USR1 signal +### New Features +* New filters: + - postfix-rbl Thanks Lee Clemens + - apache-fakegooglebot.conf Thanks Lee Clemens + - nginx-botsearch Thanks Frantisek Sumsal + - drupal-auth Thanks Lee Clemens +* New recursive embedded substitution feature added: + - `<HOST>` becomes `` for PREF=`IPV4`; + - `<HOST>` becomes `1.2.3.4` for PREF=`IPV4` and IPV4HOST=`1.2.3.4`; +* New interpolation feature for config readers - `%(known/parameter)s`. + (means last known option with name `parameter`). This interpolation makes + possible to extend a stock filter or jail regexp in .local file + (opposite to simply set failregex/ignoreregex that overwrites it), + see gh-867. +* Monit config for fail2ban in `files/monit/` +* New actions: + - `action.d/firewallcmd-multiport` and `action.d/firewallcmd-allports` Thanks Donald Yandt + - `action.d/sendmail-geoip-lines.conf` + - `action.d/nsupdate` to update DNSBL. Thanks Andrew St. Jean +* New status argument for fail2ban-client -- flavor: + `fail2ban-client status [flavor]` + - empty or "basic" works as-is + - "cymru" additionally prints (ASN, Country RIR) per banned IP + (requires dnspython or dnspython3) +* Flush log at USR1 signal -- Enhancements: - * Enable multiport for firewallcmd-new action. Closes gh-834 - * files/debian-initd migrated from the debian branch and should be - suitable for manual installations now (thanks Juan Karlo de Guzman) - * Define empty ignoreregex in filters which didn't have it to avoid - warnings (gh-934) - * action.d/{sendmail-*,xarf-login-attack}.conf - report local - timezone not UTC time/zone. Closes gh-911 - * Conditionally log Ignore IP with reason (dns, ip, command). Closes gh-916 - * Absorbed DNSUtils.cidr into addr2bin in filter.py, added unittests - * Added syslogsocket configuration to fail2ban.conf - * Note in the jail.conf for the recidive jail to increase dbpurgeage (gh-964) +### Enhancements +* Enable multiport for firewallcmd-new action. Closes gh-834 +* files/debian-initd migrated from the debian branch and should be + suitable for manual installations now (thanks Juan Karlo de Guzman) +* Define empty ignoreregex in filters which didn't have it to avoid + warnings (gh-934) +* `action.d/{sendmail-*,xarf-login-attack}.conf` - report local + timezone not UTC time/zone. Closes gh-911 +* Conditionally log Ignore IP with reason (dns, ip, command). Closes gh-916 +* Absorbed DNSUtils.cidr into addr2bin in filter.py, added unittests +* Added syslogsocket configuration to fail2ban.conf +* Note in the `jail.conf` for the recidive jail to increase dbpurgeage (gh-964) ver. 0.9.1 (2014/10/29) - better, faster, stronger ---------- -- Refactoring (IMPORTANT -- Please review your setup and configuration): - * iptables-common.conf replaced iptables-blocktype.conf - (iptables-blocktype.local should still be read) and now also - provides defaults for the chain, port, protocol and name tags +### Refactoring (IMPORTANT -- Please review your setup and configuration) +* `iptables-common.conf` replaced `iptables-blocktype.conf` + (`iptables-blocktype.local` should still be read) and now also + provides defaults for the chain, port, protocol and name tags -- Fixes: - * start of file2ban aborted (on slow hosts, systemd considers the server has - been timed out and kills him), see gh-824 - * UTF-8 fixes in pure-ftp thanks to Johannes Weberhofer. Closes gh-806. - * systemd backend error on bad utf-8 in python3 - * badips.py action error when logging HTTP error raised with badips request - * fail2ban-regex failed to work in python3 due to space/tab mix - * recidive regex samples incorrect log level - * journalmatch for recidive incorrect PRIORITY - * loglevel couldn't be changed in fail2ban.conf - * Handle case when no sqlite library is available for persistent database - * Only reban once per IP from database on fail2ban restart - * Nginx filter to support missing server_name. Closes gh-676 - * fail2ban-regex assertion error caused by miscount missed lines with - multiline regex - * Fix actions failing to execute for Python 3.4.0. Workaround for - http://bugs.python.org/issue21207 - * Database now returns persistent bans on restart (bantime < 0) - * Recursive action tags now fully processed. Fixes issue with bsd-ipfw - action - * Fixed TypeError with "ipfailures" and "ipjailfailures" action tags. - Thanks Serg G. Brester - * Correct times for non-timezone date times formats during DST - * Pass a copy of, not original, aInfo into actions to avoid side-effects - * Per-distribution paths to the exim's main log - * Ignored IPs are no longer banned when being restored from persistent - database - * Manually unbanned IPs are now removed from persistent database, such they - wont be banned again when Fail2Ban is restarted - * Pass "bantime" parameter to the actions in default jail's action - definition(s) - * filters.d/sieve.conf - fixed typo in _daemon. Thanks Jisoo Park - * cyrus-imap -- also catch also failed logins via secured (imaps/pop3s). - Regression was introduced while strengthening failregex in 0.8.11 (bd175f) - Debian bug #755173 - * postfix-sasl - added journalmatch. Thanks Luc Maisonobe - * postfix* - match with a new daemon string (postfix/submission/smtpd). - Closes gh-804 . Thanks Paul Traina - * apache - added filter for AH01630 client denied by server configuration. +### Fixes +* start of file2ban aborted (on slow hosts, systemd considers the server has + been timed out and kills him), see gh-824 +* UTF-8 fixes in pure-ftp thanks to Johannes Weberhofer. Closes gh-806. +* systemd backend error on bad utf-8 in python3 +* badips.py action error when logging HTTP error raised with badips request +* fail2ban-regex failed to work in python3 due to space/tab mix +* recidive regex samples incorrect log level +* journalmatch for recidive incorrect PRIORITY +* loglevel couldn't be changed in fail2ban.conf +* Handle case when no sqlite library is available for persistent database +* Only reban once per IP from database on fail2ban restart +* Nginx filter to support missing server_name. Closes gh-676 +* fail2ban-regex assertion error caused by miscount missed lines with + multiline regex +* Fix actions failing to execute for Python 3.4.0. Workaround for + http://bugs.python.org/issue21207 +* Database now returns persistent bans on restart (bantime < 0) +* Recursive action tags now fully processed. Fixes issue with bsd-ipfw + action +* Fixed TypeError with "ipfailures" and "ipjailfailures" action tags. + Thanks Serg G. Brester +* Correct times for non-timezone date times formats during DST +* Pass a copy of, not original, aInfo into actions to avoid side-effects +* Per-distribution paths to the exim's main log +* Ignored IPs are no longer banned when being restored from persistent + database +* Manually unbanned IPs are now removed from persistent database, such they + wont be banned again when Fail2Ban is restarted +* Pass "bantime" parameter to the actions in default jail's action + definition(s) +* `filters.d/sieve.conf` - fixed typo in _daemon. Thanks Jisoo Park +* cyrus-imap -- also catch also failed logins via secured (imaps/pop3s). + Regression was introduced while strengthening failregex in 0.8.11 (bd175f) + Debian bug #755173 +* postfix-sasl - added journalmatch. Thanks Luc Maisonobe +* postfix* - match with a new daemon string (postfix/submission/smtpd). + Closes gh-804 . Thanks Paul Traina +* apache - added filter for AH01630 client denied by server configuration. -- New features: - - New filters: - - monit Thanks Jason H Martin - - directadmin Thanks niorg - - apache-shellshock Thanks Eugene Hopkinson (SlowRiot) - - New actions: - - symbiosis-blacklist-allports for Bytemark symbiosis firewall - - fail2ban-client can fetch the running server version - - Added Cloudflare API action +### New Features +* New filters: + - monit Thanks Jason H Martin + - directadmin Thanks niorg + - apache-shellshock Thanks Eugene Hopkinson (SlowRiot) +* New actions: + - symbiosis-blacklist-allports for Bytemark symbiosis firewall + - fail2ban-client can fetch the running server version + - Added Cloudflare API action + +### Enhancements +* Start performance of fail2ban-client (and tests) increased, start time + and cpu usage rapidly reduced. Introduced a shared storage logic, to + bypass reading lots of config files (see gh-824). + Thanks to Joost Molenaar for good catch (reported gh-820). +* Fail2ban-regex - add print-all-matched option. Closes gh-652 +* Suppress fail2ban-client warnings for non-critical config options +* Match non "Bye Bye" disconnect messages for sshd locked account regex +* courier-smtp filter: + - match lines with user names + - match lines containing "535 Authentication failed" attempts +* Add `` tag to iptables-ipsets +* Realign fail2ban log output with white space to improve readability. Does + not affect SYSLOG output +* Log unhandled exceptions +* cyrus-imap: catch "user not found" attempts +* Add support for Portsentry -- Enhancements - * Start performance of fail2ban-client (and tests) increased, start time - and cpu usage rapidly reduced. Introduced a shared storage logic, to - bypass reading lots of config files (see gh-824). - Thanks to Joost Molenaar for good catch (reported gh-820). - * Fail2ban-regex - add print-all-matched option. Closes gh-652 - * Suppress fail2ban-client warnings for non-critical config options - * Match non "Bye Bye" disconnect messages for sshd locked account regex - * courier-smtp filter: - - match lines with user names - - match lines containing "535 Authentication failed" attempts - * Add tag to iptables-ipsets - * Realign fail2ban log output with white space to improve readability. Does - not affect SYSLOG output - * Log unhandled exceptions - * cyrus-imap: catch "user not found" attempts - * Add support for Portsentry ver. 0.9.0 (2014/03/14) - beta ---------- @@ -391,94 +392,94 @@ Nearly all development is thanks to Steven Hiscocks (THANKS!), merging, testcases and timezone support from Daniel Black, and code-review and minor additions from Yaroslav Halchenko. -- Refactoring (IMPORTANT -- Please review your setup and configuration): - * [..bddbf1e] jail.conf was heavily refactored and now is similar - to how it looked on Debian systems: +### Refactoring (IMPORTANT -- Please review your setup and configuration): +* [..bddbf1e] jail.conf was heavily refactored and now is similar + to how it looked on Debian systems: - default action could be configured once for all jails - jails definitions only provide customizations (port, logpath) - no need to specify 'filter' if name matches jail name - * [..5aef036] Core functionality moved into fail2ban/ module. - Closes gh-26 +* [..5aef036] Core functionality moved into fail2ban/ module. + Closes gh-26 - tests included in module to aid testing and debugging - * Added fail2ban persistent database - - default location at /var/lib/fail2ban/fail2ban.sqlite3 +* Added fail2ban persistent database + - default location at `/var/lib/fail2ban/fail2ban.sqlite3` - allows active bans to be reinstated on restart - log files read from last position after restart - * Added systemd journal backend +* Added systemd journal backend - Dependency on python-systemd - New "journalmatch" option added to filter configs files - New "systemd-journal" option added to fail2ban-regex - * Added python3 support - * Support %z (Timezone offset) and %f (sub-seconds) support for - datedetector. Enhanced existing date/time have been updated patterns to - support these. ISO8601 now defaults to localtime unless specified otherwise. - Some filters have been change as required to capture these elements in the - right timezone correctly. - * Log levels are now set by Syslog style strings e.g. DEBUG, ERROR. +* Added python3 support +* Support %z (Timezone offset) and %f (sub-seconds) support for + datedetector. Enhanced existing date/time have been updated patterns to + support these. ISO8601 now defaults to localtime unless specified otherwise. + Some filters have been change as required to capture these elements in the + right timezone correctly. +* Log levels are now set by Syslog style strings e.g. DEBUG, ERROR. - Log level INFO is now more verbose - * Optionally can read log files starting from "head" or "tail". +* Optionally can read log files starting from "head" or "tail". - See "logpath" option in jail.conf(5) man page. - * Can now set log encoding for files per jail. +* Can now set log encoding for files per jail. - Default uses systemd locale. -- New features: - * [..c7ae460] Multiline failregex. Close gh-54 - * [8af32ed] Guacamole filter and support for Apache Tomcat date - format - * [..b6059f4] 'timeout' option for actions Close gh-60 and Debian bug - #410077. Also it would now capture and include stdout and stderr - into logging messages in case of error or at DEBUG loglevel. - * Added action xarf-login-attack to report formatted attack messages - according to the XARF standard (v0.2). Close gh-105 - * Support PyPy - * Add filter for apache-botsearch - * Add filter for kerio. Thanks Tony Lawrence for blog of regexs and - providing samples. Close gh-120 - * Filter for stunnel - * Filter for Counter Strike 1.6. Thanks to onorua for logs. - Close gh-347 - * Filter for squirrelmail. Close gh-261 - * Filter for tine20. Close gh-583 - * Custom date formats (strptime) can now be set in filters and jail.conf - * Python based actions can now be created. +### New Features +* [..c7ae460] Multiline failregex. Close gh-54 +* [8af32ed] Guacamole filter and support for Apache Tomcat date + format +* [..b6059f4] 'timeout' option for actions Close gh-60 and Debian + bug #410077. Also it would now capture and include stdout and stderr + into logging messages in case of error or at DEBUG loglevel. +* Added action xarf-login-attack to report formatted attack messages + according to the XARF standard (v0.2). Close gh-105 +* Support PyPy +* Add filter for apache-botsearch +* Add filter for kerio. Thanks Tony Lawrence for blog of regexs and + providing samples. Close gh-120 +* Filter for stunnel +* Filter for Counter Strike 1.6. Thanks to onorua for logs. + Close gh-347 +* Filter for squirrelmail. Close gh-261 +* Filter for tine20. Close gh-583 +* Custom date formats (strptime) can now be set in filters and jail.conf +* Python based actions can now be created. - SMTP action for sending emails on jail start, stop and ban. - * Added action to use badips.com reporting and blacklist +* Added action to use badips.com reporting and blacklist - Requires Python 2.7+ -- Enhancements - * Fail2ban-regex - don't accumulate lines if not printing them. - add options to suppress output of missed/ignored lines. Close gh-644 - * Asterisk now supports syslog format - * Jail names increased to 26 characters and iptables prefix reduced - from fail2ban- to f2b- as suggested by buanzo in gh-462. - * Multiline filter for sendmail-spam. Close gh-418 - * Multiline regex for Disconnecting: Too many authentication failures for - root [preauth]\nConnection closed by 6X.XXX.XXX.XXX [preauth] - * Multiline regex for Disconnecting: Connection from 61.XX.XX.XX port - 51353\nToo many authentication failures for root [preauth]. Thanks - Helmut Grohne. Close gh-457 - * Replacing use of deprecated API (.warning, .assertEqual, etc) - * [..a648cc2] Filters can have options now too which are substituted into - failregex / ignoreregex - * [..e019ab7] Multiple instances of the same action are allowed in the - same jail -- use actname option to disambiguate. - * Add honeypot email address to exim-spam filter as argument - * Properties and methods of actions accessible from fail2ban-client +### Enhancements +* Fail2ban-regex - don't accumulate lines if not printing them. + add options to suppress output of missed/ignored lines. Close gh-644 +* Asterisk now supports syslog format +* Jail names increased to 26 characters and iptables prefix reduced + from fail2ban- to f2b- as suggested by buanzo in gh-462. +* Multiline filter for sendmail-spam. Close gh-418 +* Multiline regex for Disconnecting: Too many authentication failures for + root [preauth]\nConnection closed by 6X.XXX.XXX.XXX [preauth] +* Multiline regex for Disconnecting: Connection from 61.XX.XX.XX port + 51353\nToo many authentication failures for root [preauth]. Thanks + Helmut Grohne. Close gh-457 +* Replacing use of deprecated API (.warning, .assertEqual, etc) +* [..a648cc2] Filters can have options now too which are substituted into + failregex / ignoreregex +* [..e019ab7] Multiple instances of the same action are allowed in the + same jail -- use actname option to disambiguate. +* Add honeypot email address to exim-spam filter as argument +* Properties and methods of actions accessible from fail2ban-client - Use of properties replaces command actions "cinfo" interface ver. 0.8.13 (2014/03/15) - maintenance-only-from-now-on ----------- -- Fixes: +### Fixes - action firewallcmd-ipset had non-working actioncheck. Removed. redhat bug #1046816. - filter pureftpd - added _daemon which got removed. Added -- New Features: +### New Features - filter nagios - detects unauthorized access to the nrpe daemon (Ivo Truxa) - filter sendmail-{auth,reject} (jserrachinha and cepheid666 and fab23). -- Enhancements: +### Enhancements - filter asterisk now supports syslog format - filter pureftpd - added all translations of "Authentication failed for user" @@ -494,7 +495,7 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better - mysqld-syslog-iptables jailname was too long. Renamed to mysqld-syslog. Part of gh-447. -- Fixes: +### Fixes - allow for ",milliseconds" in the custom date format of proftpd.log - allow for ", referer ..." in apache-* filter for apache error logs. - allow for spaces at the beginning of kernel messages. Closes gh-448 @@ -517,7 +518,7 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better - A single bad failregex or command syntax in configuration files won't stop fail2ban from starting. Thanks Tomasz Ciolek. Closes gh-585. -- Enhancements: +### Enhancements - long names on jails documented based on iptables limit of 30 less len("fail2ban-"). - remove indentation of name and loglevel while logging to SYSLOG to @@ -527,32 +528,32 @@ ver. 0.8.12 (2014/01/22) - things-can-only-get-better Thanks dani. Closes gh-503 - exim-spam filter to match spamassassin log entry for option SAdevnull. Thanks Ivo Truxa. Closes gh-533 - - filter.d/nsd.conf -- also amended Unix date template to match nsd format - - Added to sshd filter expression for "Received disconnect from : 3: - ...: Auth fail". Thanks Marcel Dopita. Closes gh-289 + - `filter.d/nsd.conf` -- also amended Unix date template to match nsd format + - Added to sshd filter expression for `Received disconnect from : 3: + ...: Auth fail`. Thanks Marcel Dopita. Closes gh-289 - loglines now also report "[PID]" after the name portion - - Added filter.d/ejabberd-auth + - Added `filter.d/ejabberd-auth` - Improved ACL-handling for Asterisk - loglines now also report "[PID]" after the name portion - Added improper command pipelining to postfix filter. -- New Features: +### New Features - - filter.d/solid-pop3d -- added thanks to Jacques Lav!gnotte on mailinglist. + - `filter.d/solid-pop3d` -- added thanks to Jacques Lav!gnotte on mailinglist. - Add filter for apache-modsecurity. - - filter.d/nsd.conf -- also amended Unix date template to match nsd format + - `filter.d/nsd.conf` -- also amended Unix date template to match nsd format - Added openwebmail filter thanks Ivo Truxa. Closes gh-543 - - Added filter for freeswitch. Thanks Jim and editors and authors of + - Added filter for freeswitch. Thanks Jim and editors and authors of http://wiki.freeswitch.org/wiki/Fail2ban - Added groupoffice filter thanks to logs from Merijn Schering. Closes gh-566 - Added filter for horde - Added filter for squid. Thanks Roman Gelfand. - Added filter for ejabberd-auth. - - Added filter.d/openwebmail filter thanks Ivo Truxa. Closes gh-543 - - Added filter.d/groupoffice filter thanks to logs from Merijn Schering. + - Added `filter.d/openwebmail` filter thanks Ivo Truxa. Closes gh-543 + - Added `filter.d/groupoffice` filter thanks to logs from Merijn Schering. Closes gh-566 - - Added action.d/badips. Thanks to Amy for making a nice API. + - Added `action.d/badips`. Thanks to Amy for making a nice API. - Added firewallcmd-ipset action. - Added ufw action. Thanks Guilhem Lettron. lp-#701522 - Added blocklist_de action. @@ -580,155 +581,156 @@ Alexander Dietrich, JP Espinosa, Jamyn Shanley, Beau Raines, François Boulogne and others who have helped on IRC and mailing list, logged issues and bug requests. -- IMPORTANT incompatible changes: - Filter name changes: - * 'lighttpd-fastcgi' filter has been renamed to 'suhosin' - * 'sasl' has been renamed to 'postfix-sasl' - * 'exim' spam catching failregexes was split out into 'exim-spam' - These changes will require changing jail.{conf,local} if any of - those filters were used. +### IMPORTANT incompatible changes -- Fixes: - Jonathan Lanning - * filter.d/asterisk -- identified another regex for blocking. Also channel - ID is hex not decimal as noted in sample logs provided. - Daniel Black & Marcel Dopita - * filter.d/apache-auth -- fixed and apache auth samples provide. Closes gh-286 - Yaroslav Halchenko - * filter.d/common.conf -- make colon after [daemon] optional. Closes gh-267 - * filter.d/apache-common.conf -- support apache 2.4 more detailed error - log format. Closes gh-268 - * Backends changes detection and parsing. Close gh-223 and gh-103: - - Polling backend: detect changes in the files not only based on - mtime, but also on the size and inode. It should allow for - better detection of changes and log rotations on busy servers, - older python 2.4, and file systems with precision of mtime only - up to a second (e.g. ext3). - - All backends, possible race condition: do not read from a file - initially reported empty. Originally could have lead to - accounting for detected log lines multiple times. - - Do not crash if executing a command in fail2ban-client interactive - mode has failed (e.g. due to incorrect syntax). Closes gh-353 - Daniel Black & Мернов Георгий - * filter.d/dovecot.conf -- Fix when no TLS enabled - line doesn't end in , - Daniel Black & Georgiy Mernov & ftoppi & Мернов Георгий - * filter.d/exim.conf -- regex hardening and extra failure examples in - sample logs - * filter.d/named-refused.conf - BIND 9.9.3 regex changes - Daniel Black & Sebastian Arcus - * filter.d/asterisk -- more regexes - Daniel Black - * action.d/hostsdeny -- NOTE: new dependency 'ed'. Switched to use 'ed' across - all platforms to ensure permissions are the same before and after a ban. - Closes gh-266. hostsdeny supports daemon_list now too. - * action.d/bsd-ipfw - action option unused. Change blocktype to port unreach - instead of deny for consistancy. - * filter.d/dovecot - added to support different dovecot failure - "..disallowed plaintext auth". Closes Debian bug #709324 - * filter.d/roundcube-auth - timezone offset can be positive or negative - * action.d/bsd-ipfw - action option unused. Fixed to blocktype for - consistency. default to port unreach instead of deny - * filter.d/dropbear - fix regexs to match standard dropbear and the patched - http://www.unchartedbackwaters.co.uk/files/dropbear/dropbear-0.52.patch - and add PAM is it in dropbear-2013.60 source code. - * filter.d/{asterisk,assp,dovecot,proftpd}.conf -- regex hardening - and extra failure examples in sample logs - * filter.d/apache-auth - added expressions for mod_authz, mod_auth and - mod_auth_digest failures. - * filter.d/recidive -- support f2b syslog target and anchor regex at start - * filter.d/mysqld-auth.conf - mysql can use syslog - * filter.d/sshd - regex enhancements to support openssh-6.3. Closes Debian - bug #722970. Thanks Colin Watson for the regex analysis. - * filter.d/wuftpd - regex enhancements to support pam and wuftpd. Closes - Debian bug #665925 - Rolf Fokkens - * action.d/dshield.conf and complain.conf -- reorder mailx arguments. - https://bugzilla.redhat.com/show_bug.cgi?id=998020 - John Doe (ache) - * action.d/bsd-ipfw.conf - invert actionstop logic to make exist status 0. - Closes gh-343. - JP Espinosa (Reviewed by O.Poplawski) - * files/redhat-initd - rewritten to use stock init.d functions thus - avoiding problems with getpid. Also $network and iptables moved - to Should- rc init fields - Rick Mellor - * filter.d/vsftp - fix capture with tty=ftp +Filter name changes: + * 'lighttpd-fastcgi' filter has been renamed to 'suhosin' + * 'sasl' has been renamed to 'postfix-sasl' + * 'exim' spam catching failregexes was split out into 'exim-spam' +These changes will require changing jail.{conf,local} if any of +those filters were used. -- New Features: - Edgar Hoch - * action.d/firewall-cmd-direct-new.conf - action for firewalld - from https://bugzilla.redhat.com/show_bug.cgi?id=979622 - NOTE: requires firewalld-0.3.8+ - Andy Fragen and Daniel Black - * filter.d/osx-ipfw.conf - ipfw action for OSX based on random rule - numbers. - Anonymous: - * action.d/osx-afctl - an action based on afctl for osx - Daniel Black & ykimon - * filter.d/3proxy.conf -- filter added - * fail2ban-regex - now generates http://www.debuggex.com urls for debugging - regular expressions with the -D parameter. - Daniel Black - * filter.d/exim-spam.conf -- a splitout of exim's spam regexes - with additions for greater control over filtering spam. - * add date expression for apache-2.4 - milliseconds - * filter.d/nginx-http-auth -- filter added for http basic authentication - failures in nginx. Partially fulfills gh-405. - Christophe Carles & Daniel Black - * filter.d/perdition.conf -- filter added - Mark McKinstry - * action.d/apf.conf - add action for Advanced Policy Firewall (apf) - Amir Caspi and kjohnsonecl - * filter.d/uwimap-auth - filter for uwimap-auth IMAP/POP server - Steven Hiscocks and Daniel Black - * filter.d/selinux-{common,ssh} -- add SELinux date and ssh filter +### Fixes +- Jonathan Lanning + * `filter.d/asterisk` -- identified another regex for blocking. Also channel + ID is hex not decimal as noted in sample logs provided. +- Daniel Black & Marcel Dopita + * `filter.d/apache-auth` -- fixed and apache auth samples provide. Closes gh-286 +- Yaroslav Halchenko + * `filter.d/common.conf` -- make colon after [daemon] optional. Closes gh-267 + * `filter.d/apache-common.conf` -- support apache 2.4 more detailed error + log format. Closes gh-268 + * Backends changes detection and parsing. Close gh-223 and gh-103: + - Polling backend: detect changes in the files not only based on + mtime, but also on the size and inode. It should allow for + better detection of changes and log rotations on busy servers, + older python 2.4, and file systems with precision of mtime only + up to a second (e.g. ext3). + - All backends, possible race condition: do not read from a file + initially reported empty. Originally could have lead to + accounting for detected log lines multiple times. + - Do not crash if executing a command in fail2ban-client interactive + mode has failed (e.g. due to incorrect syntax). Closes gh-353 +- Daniel Black & Мернов Георгий + * `filter.d/dovecot.conf` -- Fix when no TLS enabled - line doesn't end in , +- Daniel Black & Georgiy Mernov & ftoppi & Мернов Георгий + * `filter.d/exim.conf` -- regex hardening and extra failure examples in + sample logs + * `filter.d/named-refused.conf` - BIND 9.9.3 regex changes +- Daniel Black & Sebastian Arcus + * `filter.d/asterisk` -- more regexes +- Daniel Black + * `action.d/hostsdeny` -- NOTE: new dependency 'ed'. Switched to use 'ed' across + all platforms to ensure permissions are the same before and after a ban. + Closes gh-266. hostsdeny supports daemon_list now too. + * `action.d/bsd-ipfw` - action option unused. Change blocktype to port unreach + instead of deny for consistancy. + * `filter.d/dovecot` - added to support different dovecot failure + "..disallowed plaintext auth". Closes Debian bug #709324 + * `filter.d/roundcube-auth` - timezone offset can be positive or negative + * `action.d/bsd-ipfw` - action option unused. Fixed to blocktype for + consistency. default to port unreach instead of deny + * `filter.d/dropbear` - fix regexs to match standard dropbear and the patched + http://www.unchartedbackwaters.co.uk/files/dropbear/dropbear-0.52.patch + and add PAM is it in dropbear-2013.60 source code. + * `filter.d/{asterisk,assp,dovecot,proftpd}.conf` -- regex hardening + and extra failure examples in sample logs + * `filter.d/apache-auth` - added expressions for mod_authz, mod_auth and + mod_auth_digest failures. + * `filter.d/recidive` -- support f2b syslog target and anchor regex at start + * `filter.d/mysqld-auth.conf` - mysql can use syslog + * `filter.d/sshd` - regex enhancements to support openssh-6.3. Closes Debian + bug #722970. Thanks Colin Watson for the regex analysis. + * `filter.d/wuftpd` - regex enhancements to support pam and wuftpd. Closes + Debian bug #665925 +- Rolf Fokkens + * `action.d/dshield.conf` and complain.conf -- reorder mailx arguments. + https://bugzilla.redhat.com/show_bug.cgi?id=998020 +- John Doe (ache) + * `action.d/bsd-ipfw.conf` - invert actionstop logic to make exist status 0. + Closes gh-343. +- JP Espinosa (Reviewed by O.Poplawski) + * files/redhat-initd - rewritten to use stock init.d functions thus + avoiding problems with getpid. Also $network and iptables moved + to Should- rc init fields +- Rick Mellor + * `filter.d/vsftp` - fix capture with tty=ftp -- Enhancements: - François Boulogne and Frédéric - * filter.d/lighttpd - auth regexs for lighttpd-1.4.31 - Daniel Black - * reorder parsing of jail.conf, jail.d/*.conf, jail.local, jail.d/*.local - and likewise for fail2ban.{conf|local|d/*.conf|d/*.local}. Closes gh-392 - * jail.conf now has asterisk jail - no need for asterisk-tcp and - asterisk-udp. Users should replace existing jails with asterisk to - reduce duplicate parsing of the asterisk log file. - * filter.d/{suhosin,pam-generic,gssftpd,sogo-auth,webmin}- regex anchor at - start - * filter.d/vsftpd - anchored regex at start. disable old pam format regex - * filter.d/pam-generic - added syslog prefix. Disabled support for - linux-pam before version 0.99.2.0 (2005) - * filter.d/postfix-sasl - renamed from sasl, anchor at start and base on - syslog - * filter.d/qmail - rewrote regex to anchor at start. Added regex for - another "in the wild" patch to rblsmtp. - Yaroslav Halchenko - * fail2ban-regex -- refactored to provide more details (missing and - ignored lines, control over logging, etc) while maintaining look&feel - * fail2ban-client -- log to standard error. Closes gh-264 - * Fail to configure if not a single log file was found for an - enabled jail. Closes gh-63 - * is now enforced to end with an alphanumeric - * filter.d/roundcube-auth.conf -- anchored version - * date matching - for standard asctime formats prefer more detailed - first (thus use year if available) - * files/gen_badbots was added and filter.d/apache-badbots.conf was - regenerated to get updated (although now still an old) list of - "bad" bots - Alexander Dietrich - * action.d/sendmail-common.conf -- added common sendmail settings file - and made the sender display name configurable - Steven Hiscocks - * filter.d/dovecot - Addition of session, time values and possible blank - user - Zurd and Daniel Black - * filter/named-refused - added refused on zone transfer - * filter.d/{courier{login,smtp},proftpd,sieve,wuftpd,xinetd} - General - regex impovements - Zurd - * filter.d/postfix - add filter for VRFY failures. Closes gh-322. - Orion Poplawski - * fail2ban.d/ and jail.d/ directories are added to etc/fail2ban to facilitate - their use +### New Features +- Edgar Hoch + * `action.d/firewall-cmd-direct-new.conf` - action for firewalld + from https://bugzilla.redhat.com/show_bug.cgi?id=979622 + NOTE: requires firewalld-0.3.8+ +- Andy Fragen and Daniel Black + * `filter.d/osx-ipfw.conf` - ipfw action for OSX based on random rule + numbers. +- Anonymous: + * `action.d/osx-afctl` - an action based on afctl for osx +- Daniel Black & ykimon + * `filter.d/3proxy.conf` -- filter added + * fail2ban-regex - now generates http://www.debuggex.com urls for debugging + regular expressions with the -D parameter. +- Daniel Black + * `filter.d/exim-spam.conf` -- a splitout of exim's spam regexes + with additions for greater control over filtering spam. + * add date expression for apache-2.4 - milliseconds + * `filter.d/nginx-http-auth` -- filter added for http basic authentication + failures in nginx. Partially fulfills gh-405. +- Christophe Carles & Daniel Black + * `filter.d/perdition.conf` -- filter added +- Mark McKinstry + * `action.d/apf.conf` - add action for Advanced Policy Firewall (apf) +- Amir Caspi and kjohnsonecl + * `filter.d/uwimap-auth` - filter for uwimap-auth IMAP/POP server +- Steven Hiscocks and Daniel Black + * `filter.d/selinux-{common,ssh`} -- add SELinux date and ssh filter + +### Enhancements +- François Boulogne and Frédéric + * `filter.d/lighttpd` - auth regexs for lighttpd-1.4.31 +- Daniel Black + * reorder parsing of jail.conf, `jail.d/*.conf`, `jail.local`, `jail.d/*.local` + and likewise for `fail2ban.{conf|local|d/*.conf|d/*.local`}. Closes gh-392 + * jail.conf now has asterisk jail - no need for asterisk-tcp and + asterisk-udp. Users should replace existing jails with asterisk to + reduce duplicate parsing of the asterisk log file. + * `filter.d/{suhosin,pam-generic,gssftpd,sogo-auth,webmin`}- regex anchor at + start + * `filter.d/vsftpd` - anchored regex at start. disable old pam format regex + * `filter.d/pam-generic` - added syslog prefix. Disabled support for + linux-pam before version 0.99.2.0 (2005) + * `filter.d/postfix-sasl` - renamed from sasl, anchor at start and base on + syslog + * `filter.d/qmail` - rewrote regex to anchor at start. Added regex for + another "in the wild" patch to rblsmtp. +- Yaroslav Halchenko + * fail2ban-regex -- refactored to provide more details (missing and + ignored lines, control over logging, etc) while maintaining look&feel + * fail2ban-client -- log to standard error. Closes gh-264 + * Fail to configure if not a single log file was found for an + enabled jail. Closes gh-63 + * `` is now enforced to end with an alphanumeric + * `filter.d/roundcube-auth.conf` -- anchored version + * date matching - for standard asctime formats prefer more detailed + first (thus use year if available) + * files/gen_badbots was added and `filter.d/apache-badbots.conf` was + regenerated to get updated (although now still an old) list of + "bad" bots +- Alexander Dietrich + * `action.d/sendmail-common.conf` -- added common sendmail settings file + and made the sender display name configurable +- Steven Hiscocks + * `filter.d/dovecot` - Addition of session, time values and possible blank + user +- Zurd and Daniel Black + * `filter.d/named-refused` - added refused on zone transfer + * `filter.d/{courier{login,smtp},proftpd,sieve,wuftpd,xinetd`} - General + regex improvements +- Zurd + * `filter.d/postfix` - add filter for VRFY failures. Closes gh-322. +- Orion Poplawski + * `fail2ban.d/` and `jail.d/` directories are added to `etc/fail2ban` to facilitate + their use ver. 0.8.10 (2013/06/12) - wanna-be-secure ----------- @@ -738,23 +740,24 @@ apache- filters. If you are relying on listed below apache- filters, upgrade asap and seek your distributions to patch their fail2ban distribution with [6ccd5781]. -- Fixes: Yaroslav Halchenko - * [6ccd5781] filter.d/apache-{auth,nohome,noscript,overflows} - anchor - failregex at the beginning (and where applicable at the end). - Addresses a possible DoS. Closes gh-248 - * action.d/{route,shorewall}.conf - blocktype must be defined - within [Init]. Closes gh-232 -- Enhancements - Yaroslav Halchenko - * jail.conf -- assure all jails have actions and remove unused - ports specifications - Terence Namusonge - * config/filter.d/roundcube-auth.conf -- support roundcube 0.9+ - Daniel Black - * files/suse-initd -- update to the copy from stock SUSE - silviogarbes & Daniel Black +### Fixes +- Yaroslav Halchenko + * [6ccd5781] `filter.d/apache-{auth,nohome,noscript,overflows`} - anchor + failregex at the beginning (and where applicable at the end). + Addresses a possible DoS. Closes gh-248 + * `action.d/{route,shorewall}.conf` - blocktype must be defined + within [Init]. Closes gh-232 +### Enhancements +- Yaroslav Halchenko + * jail.conf -- assure all jails have actions and remove unused + ports specifications +- Terence Namusonge + * `filter.d/roundcube-auth.conf` -- support roundcube 0.9+ +- Daniel Black + * `files/suse-initd` -- update to the copy from stock SUSE + silviogarbes & Daniel Black * Updates to asterisk filter. Closes gh-227/gh-230. - Carlos Alberto Lopez Perez +- Carlos Alberto Lopez Perez * Updates to asterisk to include AUTH_UNKNOWN_DOMAIN. Closes gh-244. ver. 0.8.9 (2013/05/13) - wanna-be-stable @@ -774,258 +777,262 @@ Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom Hendrikx, Yehuda Katz and other TBN heroes supporting users on fail2ban-users mailing list and IRC. -- Fixes: Yaroslav Halchenko - * [6f4dad46] python-2.4 is the minimal version. - * [1eb23cf8] do not rely on scripts being under /usr -- might differ e.g. - on Fedora. Closes gh-112. Thanks to Camusensei for the bug report. - * [bf4d4af1] Changes for atomic writes. Thanks to Steven Hiscocks for - insight. Closes gh-103. - * [ab044b75] delay check for the existence of config directory until read. - * [3b4084d4] fixing up for handling of TAI64N timestamps. - * [154aa38e] do not shutdown logging until all jails stop. - * [f2156604] pyinotify -- monitor IN_MOVED_TO events. Closes gh-184. - Thanks to Jon Foster for report and troubleshooting. - Orion Poplawski - * [e4aedfdc00] pyinotify - use bitwise op on masks and do not try tracking - newly created directories. - Nicolas Collignon - * [39667ff6] Avoid leaking file descriptors. Closes gh-167. - Sergey Brester - * [b6bb2f88 and d17b4153] invalid date recognition, irregular because of - sorting template list. - Steven Hiscocks - * [7a442f07] When changing log target with python2.{4,5} handle KeyError. - Closes gh-147, gh-148. - * [b6a68f51] Fix delaction on server side. Closes gh-124. - Daniel Black - * [f0610c01] Allow more that a one word command when changing and Action via - the fail2ban-client. Closes gh-134. - * [945ad3d9] Fix dates on email actions to work in different locals. Closes - gh-70. Thanks to iGeorgeX for the idea. - blotus - * [96eb8986] ' and " should also be escaped in action tags Closes gh-109 - Christoph Theis, Nick Hilliard, Daniel Black - * [b3bd877d,cde71080] Make syslog -v and syslog -vv formats work on FreeBSD -- New features: - Yaroslav Halchenko - * [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile} - to provide additional flexibility to system adminstrators. Thanks to - beilber for the idea. Closes gh-114. - * [3ce53e87] Add exim filter. - Erwan Ben Souiden - * [d7d5228] add nagios integration documentation and script to ensure - fail2ban is running. Closes gh-166. - Artur Penttinen - * [29d0df5] Add mysqld filter. Closes gh-152. - ArndRaphael Brandes - * [bba3fd8] Add Sogo filter. Closes gh-117. - Michael Gebetsriother - * [f9b78ba] Add action route to block at routing level. - Teodor Micu & Yaroslav Halchenko - * [5f2d383] Add roundcube auth filter. Closes Debian bug #699442. - Daniel Black - * [be06b1b] Add action for iptables-ipsets. Closes gh-102. - Nick Munger, Ken Menzel, Daniel Black, Christoph Theis & Fabian Wenk - * [b6d0e8a] Add and enhance the bsd-ipfw action from - FreeBSD ports. - Soulard Morgan - * [f336d9f] Add filter for webmin. Closes gh-99. - Steven Hiscocks - * [..746c7d9] bash interactive shell completions for fail2ban-*'s - Nick Hilliard - * [0c5a9c5] Add pf action. -- Enhancements: - Enrico Labedzki - * [24a8d07] Added new date format for ASSP SMTP Proxy. - Steven Hiscocks - * [3d6791f] Ensure restart of Actions after a check fails occurs - consistently. Closes gh-172. - * [MANY] Improvements to test cases, travis, and code coverage (coveralls). - * [b36835f] Add get cinfo to fail2ban-client. Closes gh-124. - * [ce3ab34] Added ability to specify PID file. - Orion Poplawski - * [ddebcab] Enhance fail2ban.service definition dependencies and Pidfile. - Closes gh-142. - Yaroslav Halchenko - * [MANY] Lots of improvements to log messages, man pages and test cases. - * [91d5736] Postfix filter improvements - empty helo, from and rcpt to. - Closes gh-126. Bug report by Michael Heuberger. - * [40c5a2d] adding more of diagnostic messages into -client while starting - the daemon. - * [8e63d4c] Compare against None with 'is' instead of '=='. - * [6fef85f] Strip CR and LF while analyzing the log line - Daniel Black - * [3aeb1a9] Add jail.conf manual page. Closes gh-143. - * [MANY] man page edits. - * [7cd6dab] Added help command to fail2ban-client. - * [c8c7b0b,23bbc60] Better logging of log file read errors. - * [3665e6d] Added code coverage to development process. - * [41b9f7b,32d10e9,39750b8] More complete ssh filter rules to match openssh - source. Also include BSD changes. - * [1d9abd1] Action files can have tags in definition that refer to other - tags. - * [10886e7,cec5da2,adb991a] Change actions to response with ICMP port - unreachable rather than just a drop of the packet. - Pascal Borreli - * [a2b29b4] Fixed lots of typos in config files and documentation. - hamilton5 - * [7ede1e8] Update dovecot filter config. - Romain Riviere - * [0ac8746] Enhance named-refused filter for views. - James Stout - * [..2143cdf] Solaris support enhancements: - - README.Solaris - - failregex'es tune ups (sshd.conf) - - hostsdeny: do not rely on support of '-i' in sed +### Fixes +- Yaroslav Halchenko + * [6f4dad46] python-2.4 is the minimal version. + * [1eb23cf8] do not rely on scripts being under /usr -- might differ e.g. + on Fedora. Closes gh-112. Thanks to Camusensei for the bug report. + * [bf4d4af1] Changes for atomic writes. Thanks to Steven Hiscocks for + insight. Closes gh-103. + * [ab044b75] delay check for the existence of config directory until read. + * [3b4084d4] fixing up for handling of TAI64N timestamps. + * [154aa38e] do not shutdown logging until all jails stop. + * [f2156604] pyinotify -- monitor IN_MOVED_TO events. Closes gh-184. + Thanks to Jon Foster for report and troubleshooting. +- Orion Poplawski + * [e4aedfdc00] pyinotify - use bitwise op on masks and do not try tracking + newly created directories. +- Nicolas Collignon + * [39667ff6] Avoid leaking file descriptors. Closes gh-167. +- Sergey Brester + * [b6bb2f88 and d17b4153] invalid date recognition, irregular because of + sorting template list. +- Steven Hiscocks + * [7a442f07] When changing log target with python2.{4,5} handle KeyError. + Closes gh-147, gh-148. + * [b6a68f51] Fix delaction on server side. Closes gh-124. +- Daniel Black + * [f0610c01] Allow more that a one word command when changing and Action via + the fail2ban-client. Closes gh-134. + * [945ad3d9] Fix dates on email actions to work in different locals. Closes + gh-70. Thanks to iGeorgeX for the idea. +- blotus + * [96eb8986] ' and " should also be escaped in action tags Closes gh-109 +- Christoph Theis, Nick Hilliard, Daniel Black + * [b3bd877d,cde71080] Make `syslog -v` and `syslog -vv` formats work on FreeBSD + +### New Features +- Yaroslav Halchenko + * [9ba27353] Add support for `jail.d/{confilefile}` and `fail2ban.d/{configfile}` + to provide additional flexibility to system adminstrators. Thanks to + beilber for the idea. Closes gh-114. + * [3ce53e87] Add exim filter. +- Erwan Ben Souiden + * [d7d5228] add nagios integration documentation and script to ensure + fail2ban is running. Closes gh-166. +- Artur Penttinen + * [29d0df5] Add mysqld filter. Closes gh-152. +- ArndRaphael Brandes + * [bba3fd8] Add Sogo filter. Closes gh-117. +- Michael Gebetsriother + * [f9b78ba] Add action route to block at routing level. +- Teodor Micu & Yaroslav Halchenko + * [5f2d383] Add roundcube auth filter. Closes Debian bug #699442. +- Daniel Black + * [be06b1b] Add action for iptables-ipsets. Closes gh-102. +- Nick Munger, Ken Menzel, Daniel Black, Christoph Theis & Fabian Wenk + * [b6d0e8a] Add and enhance the bsd-ipfw action from + FreeBSD ports. +- Soulard Morgan + * [f336d9f] Add filter for webmin. Closes gh-99. +- Steven Hiscocks + * [..746c7d9] bash interactive shell completions for fail2ban-*'s +- Nick Hilliard + * [0c5a9c5] Add pf action. + +### Enhancements +- Enrico Labedzki + * [24a8d07] Added new date format for ASSP SMTP Proxy. +- Steven Hiscocks + * [3d6791f] Ensure restart of Actions after a check fails occurs + consistently. Closes gh-172. + * [MANY] Improvements to test cases, travis, and code coverage (coveralls). + * [b36835f] Add get cinfo to fail2ban-client. Closes gh-124. + * [ce3ab34] Added ability to specify PID file. +- Orion Poplawski + * [ddebcab] Enhance fail2ban.service definition dependencies and Pidfile. + Closes gh-142. +- Yaroslav Halchenko + * [MANY] Lots of improvements to log messages, man pages and test cases. + * [91d5736] Postfix filter improvements - empty helo, from and rcpt to. + Closes gh-126. Bug report by Michael Heuberger. + * [40c5a2d] adding more of diagnostic messages into -client while starting + the daemon. + * [8e63d4c] Compare against None with 'is' instead of '=='. + * [6fef85f] Strip CR and LF while analyzing the log line +- Daniel Black + * [3aeb1a9] Add jail.conf manual page. Closes gh-143. + * [MANY] man page edits. + * [7cd6dab] Added help command to fail2ban-client. + * [c8c7b0b,23bbc60] Better logging of log file read errors. + * [3665e6d] Added code coverage to development process. + * [41b9f7b,32d10e9,39750b8] More complete ssh filter rules to match openssh + source. Also include BSD changes. + * [1d9abd1] Action files can have tags in definition that refer to other + tags. + * [10886e7,cec5da2,adb991a] Change actions to response with ICMP port + unreachable rather than just a drop of the packet. +- Pascal Borreli + * [a2b29b4] Fixed lots of typos in config files and documentation. +- hamilton5 + * [7ede1e8] Update dovecot filter config. +- Romain Riviere + * [0ac8746] Enhance named-refused filter for views. +- James Stout + * [..2143cdf] Solaris support enhancements: + - `README.Solaris` + - failregex'es tune ups (`sshd.conf`) + - hostsdeny: do not rely on support of '-i' in sed ver. 0.8.8 (2012/12/06) - stable ---------- -- Fixes: - Alan Jenkins - * [8c38907] Removed 'POSSIBLE BREAK-IN ATTEMPT' from sshd filter to avoid - banning due to misconfigured DNS. Closes gh-64 - Yaroslav Halchenko - * [83109bc] IMPORTANT: escape the content of (if used in - custom action files) since its value could contain arbitrary - symbols. Thanks for discovery go to the NBS System security - team - * [0935566,5becaf8] Various python 2.4 and 2.5 compatibility fixes. Closes gh-83 - * [b159eab] do not enable pyinotify backend if pyinotify < 0.8.3 - * [37a2e59] store IP as a base, non-unicode str to avoid spurious messages - in the console. Closes gh-91 -- New features: - David Engeset - * [2d672d1,6288ec2] 'unbanip' command for the client + avoidance of touching - the log file to take 'banip' or 'unbanip' in effect. Closes gh-81, gh-86 - Yaroslav Halchenko -- Enhancements: - * [2d66f31] replaced uninformative "Invalid command" message with warning log - exception why command actually failed - * [958a1b0] improved failregex to "support" auth.backend = "htdigest" - * [9e7a3b7] until we make it proper module -- adjusted sys.path only if - system-wide run - * [f52ba99] downgraded "already banned" from WARN to INFO level. Closes gh-79 - * [f105379] added hints into the log on some failure return codes (e.g. 0x7f00 - for this gh-87) - * Various others: travis-ci integration, script to run tests - against all available Python versions, etc +### Fixes +- Alan Jenkins + * [8c38907] Removed 'POSSIBLE BREAK-IN ATTEMPT' from sshd filter to avoid + banning due to misconfigured DNS. Closes gh-64 +- Yaroslav Halchenko + * [83109bc] IMPORTANT: escape the content of (if used in + custom action files) since its value could contain arbitrary + symbols. Thanks for discovery go to the NBS System security + team + * [0935566,5becaf8] Various python 2.4 and 2.5 compatibility fixes. Closes gh-83 + * [b159eab] do not enable pyinotify backend if pyinotify < 0.8.3 + * [37a2e59] store IP as a base, non-unicode str to avoid spurious messages + in the console. Closes gh-91 + +### New Features +- David Engeset + * [2d672d1,6288ec2] 'unbanip' command for the client + avoidance of touching + the log file to take 'banip' or 'unbanip' in effect. Closes gh-81, gh-86 + +### Enhancements +* [2d66f31] replaced uninformative "Invalid command" message with warning log + exception why command actually failed +* [958a1b0] improved failregex to "support" auth.backend = "htdigest" +* [9e7a3b7] until we make it proper module -- adjusted sys.path only if + system-wide run +* [f52ba99] downgraded "already banned" from WARN to INFO level. Closes gh-79 +* [f105379] added hints into the log on some failure return codes (e.g. 0x7f00 + for this gh-87) +* Various others: travis-ci integration, script to run tests + against all available Python versions, etc ver. 0.8.7.1 (2012/07/31) - stable ---------- -- Fixes: - Yaroslav Halchenko - * [e9762f3] Removed sneaked in comment on sys.path.insert +### Fixes +* [e9762f3] Removed sneaked in comment on sys.path.insert ver. 0.8.7 (2012/07/31) - stable ---------- -- Fixes: - Tom Hendrikx & Jeremy Olexa - * [0eaa4c2,444e4ac] Fix Gentoo init script: $opts variable is deprecated. - See http://forums.gentoo.org/viewtopic-t-899018.html - Chris Reffett - * [a018a26] Fixed addBannedIP to add enough failures to trigger a ban, - rather than just one failure. - Yaroslav Halchenko - * [4c76fb3] allow trailing white-spaces in lighttpd-auth.conf - * [25f1e8d] allow trailing whitespace in few missing it regexes for sshd.conf - * [ed16ecc] enforce "ip" field returned as str, not unicode so that log - message stays non-unicode. Close gh-32 - * [b257be4] added %m-%d-%Y pattern + do not add %Y for Feb 29 fix if - already present in the pattern - * [47e956b] replace "|" with "_" in ipmasq-ZZZzzz|fail2ban.rul to be - friend to developers stuck with Windows (Closes gh-66) - * [80b191c] anchor grep regexp in actioncheck to not match partial names - of the jails (Closes: #672228) (Thanks Szépe Viktor for the report) -- New features: - François Boulogne - * [a7cb20e..] add lighttpd-auth filter/jail - Lee Clemens & Yaroslav Halchenko - * [e442503] pyinotify backend (default if backend='auto' and pyinotify - is available) - * [d73a71f,3989d24] usedns parameter for the jails to allow disabling - use of DNS - Tom Hendrikx - * [f94a121..] 'recidive' filter/jail to monitor fail2ban.conf to ban - repeated offenders. Close gh-19 - Xavier Devlamynck - * [7d465f9..] Add asterisk support - Zbigniew Jędrzejewski-Szmek - * [de502cf..] allow running fail2ban as non-root user (disabled by - default) via xt_recent. See doc/run-rootless.txt -- Enhancements - Lee Clemens - * [47c03a2] files/nagios - spelling/grammar fixes - * [b083038] updated Free Software Foundation's address - * [9092a63] changed TLDs to invalid domains, in accordance with RFC 2606 - * [642d9af,3282f86] reformated printing of jail's name to be consistent - with init's info messages - * [3282f86] uniform use of capitalized Jail in the messages - Leonardo Chiquitto - * [4502adf] Fix comments in dshield.conf and mynetwatchman.conf - to reflect code - * [a7d47e8] Update Free Software Foundation's address - Petr Voralek - * [4007751] catch failed ssh logins due to being listed in DenyUsers. - Close gh-47 (Closes: #669063) - Yaroslav Halchenko - * [MANY] extended and robustified unittests: test different backends - * [d9248a6] refactored Filter's to avoid duplicate functionality - * [7821174] direct users to issues on github - * [d2ffee0..] re-factored fail2ban-regex -- more condensed output by - default with -v to control verbosity - * [b4099da] adjusted header for config/*.conf to mention .local and way - to comment (Thanks Stefano Forli for the note) - * [6ad55f6] added failregex for wu-ftpd to match against syslog instead - of DoS-prone auth.log's rhost (Closes: #514239) - * [2082fee] match possibly present "pam_unix(sshd:auth):" portion for - sshd filter (Closes: #648020) - Yehuda Katz & Yaroslav Halchenko - * [322f53e,bd40cc7] ./DEVELOP -- documentation for developers +### Fixes +- Tom Hendrikx & Jeremy Olexa + * [0eaa4c2,444e4ac] Fix Gentoo init script: $opts variable is deprecated. + See http://forums.gentoo.org/viewtopic-t-899018.html +- Chris Reffett + * [a018a26] Fixed addBannedIP to add enough failures to trigger a ban, + rather than just one failure. +- Yaroslav Halchenko + * [4c76fb3] allow trailing white-spaces in lighttpd-auth.conf + * [25f1e8d] allow trailing whitespace in few missing it regexes for sshd.conf + * [ed16ecc] enforce "ip" field returned as str, not unicode so that log + message stays non-unicode. Close gh-32 + * [b257be4] added %m-%d-%Y pattern + do not add %Y for Feb 29 fix if + already present in the pattern + * [47e956b] replace "|" with "_" in ipmasq-ZZZzzz|fail2ban.rul to be + friend to developers stuck with Windows (Closes gh-66) + * [80b191c] anchor grep regexp in actioncheck to not match partial names + of the jails (Closes: #672228) (Thanks Szépe Viktor for the report) +### New Features +- François Boulogne + * [a7cb20e..] add lighttpd-auth filter/jail +- Lee Clemens & Yaroslav Halchenko + * [e442503] pyinotify backend (default if backend='auto' and pyinotify + is available) + * [d73a71f,3989d24] usedns parameter for the jails to allow disabling + use of DNS +- Tom Hendrikx + * [f94a121..] 'recidive' filter/jail to monitor fail2ban.conf to ban + repeated offenders. Close gh-19 +- Xavier Devlamynck + * [7d465f9..] Add asterisk support +- Zbigniew Jędrzejewski-Szmek + * [de502cf..] allow running fail2ban as non-root user (disabled by + default) via xt_recent. See doc/run-rootless.txt +### Enhancements +- Lee Clemens + * [47c03a2] files/nagios - spelling/grammar fixes + * [b083038] updated Free Software Foundation's address + * [9092a63] changed TLDs to invalid domains, in accordance with RFC 2606 + * [642d9af,3282f86] reformated printing of jail's name to be consistent + with init's info messages + * [3282f86] uniform use of capitalized Jail in the messages +- Leonardo Chiquitto + * [4502adf] Fix comments in dshield.conf and mynetwatchman.conf + to reflect code + * [a7d47e8] Update Free Software Foundation's address +- Petr Voralek + * [4007751] catch failed ssh logins due to being listed in DenyUsers. + Close gh-47 (Closes: #669063) +- Yaroslav Halchenko + * [MANY] extended and robustified unittests: test different backends + * [d9248a6] refactored Filter's to avoid duplicate functionality + * [7821174] direct users to issues on github + * [d2ffee0..] re-factored fail2ban-regex -- more condensed output by + default with -v to control verbosity + * [b4099da] adjusted header for config/*.conf to mention .local and way + to comment (Thanks Stefano Forli for the note) + * [6ad55f6] added failregex for wu-ftpd to match against syslog instead + of DoS-prone auth.log's rhost (Closes: #514239) + * [2082fee] match possibly present "pam_unix(sshd:auth):" portion for + sshd filter (Closes: #648020) +- Yehuda Katz & Yaroslav Halchenko + * [322f53e,bd40cc7] ./DEVELOP -- documentation for developers ver. 0.8.6 (2011/11/28) - stable ---------- -- Fixes: - Markos Chandras & Yaroslav Halchenko - * [492d8e5,bd658fc] Use hashlib (instead of deprecated md5) where available - Robert Trace & Michael Lorant - * [c48c2b1] gentoo-initd cleanup and fixes: assure /var/run + remove stale - sock file - Michael Saavedra - * [3a58d0e] Lock server's executeCmd to prevent racing among iptables calls: - see http://bugs.debian.org/554162 - Yaroslav Halchenko - * [3eb5e3b] Allow for trailing spaces in sasl logs - * [1632244] Stop server-side communication before stopping the - jails (prevents lockup if actions use fail2ban-client upon - unban): see https://github.com/fail2ban/fail2ban/issues/7 - * [5a2d518] Various changes to reincarnate unittests - Yehuda Katz - * Wiki was cleaned from SPAM -- Enhancements: - Adam Spiers - * [3152afb] Recognise time-stamped kernel messages - Guido Bozzetto - * [713fea6] Added ipmasq rule file to restart fail2ban when iptables are - wiped out: see http://bugs.debian.org/461417 - Łukasz - * [5f23542] Matching of month names in Polish (thanks michaelberg79 - for QA) - Tom Hendrikx - * [9fa54cf] Added Date: header for sendmail*.conf actions - Yaroslav Halchenko & Tom Hendrikx - * [b52d420..22b7007] in action files now can be used - to provide matched loglines which triggered action - Yaroslav Halchenko - * [ed0bf3a] Removed duplicate entry for DataCha0s/2\.0 in badbots: - see http://bugs.debian.org/519557 - * [dad91f7] sshd.conf: allow user names to have spaces and - trailing spaces in the line - * [a9be451] removed expansions for few Date and Revision SVN keywords - * [a33135c] set/getFile for ticket.py -- found in source distribution - of 0.8.4 - * [fbce415] additional logging while stopping the jails +### Fixes +- Markos Chandras & Yaroslav Halchenko + * [492d8e5,bd658fc] Use hashlib (instead of deprecated md5) where available +- Robert Trace & Michael Lorant + * [c48c2b1] gentoo-initd cleanup and fixes: assure `/var/run` + remove stale + sock file +- Michael Saavedra + * [3a58d0e] Lock server's executeCmd to prevent racing among iptables calls: + see http://bugs.debian.org/554162 +- Yaroslav Halchenko + * [3eb5e3b] Allow for trailing spaces in sasl logs + * [1632244] Stop server-side communication before stopping the + jails (prevents lockup if actions use fail2ban-client upon + unban): see https://github.com/fail2ban/fail2ban/issues/7 + * [5a2d518] Various changes to reincarnate unittests +- Yehuda Katz + * Wiki was cleaned from SPAM + +### Enhancements +- Adam Spiers + * [3152afb] Recognise time-stamped kernel messages +- Guido Bozzetto + * [713fea6] Added ipmasq rule file to restart fail2ban when iptables are + wiped out: see http://bugs.debian.org/461417 +- Łukasz + * [5f23542] Matching of month names in Polish (thanks michaelberg79 + for QA) +- Tom Hendrikx + * [9fa54cf] Added Date: header for sendmail*.conf actions +- Yaroslav Halchenko & Tom Hendrikx + * [b52d420..22b7007] in action files now can be used + to provide matched loglines which triggered action +- Yaroslav Halchenko + * [ed0bf3a] Removed duplicate entry for DataCha0s/2\.0 in badbots: + see http://bugs.debian.org/519557 + * [dad91f7] sshd.conf: allow user names to have spaces and + trailing spaces in the line + * [a9be451] removed expansions for few Date and Revision SVN keywords + * [a33135c] set/getFile for ticket.py -- found in source distribution + of 0.8.4 + * [fbce415] additional logging while stopping the jails ver. 0.8.5 (2011/07/28) - stable ---------- @@ -1039,7 +1046,7 @@ ver. 0.8.5 (2011/07/28) - stable - Fix: escaped () in pure-ftpd filter. Thanks to Teodor - Fix: allowed space in the trailing of failregex for sasl.conf: see http://bugs.debian.org/573314 -- Fix: use /var/run/fail2ban instead of /tmp for temp files in actions: +- Fix: use `/var/run/fail2ban` instead of `/tmp` for temp files in actions: see http://bugs.debian.org/544232 - Fix: Tai64N stores time in GMT, needed to convert to local time before returning @@ -1053,10 +1060,10 @@ ver. 0.8.5 (2011/07/28) - stable in the regexp - Enhancement: proftpd filter -- if login failed -- count regardless of the reason for failure -- Enhancement: added to action.d/iptables*. Thanks to Matthijs Kooijman: +- Enhancement: added to `action.d/iptables*`. Thanks to Matthijs Kooijman: see http://bugs.debian.org/515599 -- Enhancement: added filter.d/dovecot.conf from Martin Waschbuesch -- Enhancement: made filter.d/apache-overflows.conf catch more: +- Enhancement: added `filter.d/dovecot.conf` from Martin Waschbuesch +- Enhancement: made `filter.d/apache-overflows.conf` catch more: see http://bugs.debian.org/574182 - Enhancement: added dropbear filter from Francis Russell and Zak B. Elep: see http://bugs.debian.org/546913 @@ -1090,16 +1097,14 @@ ver. 0.8.4 (2009/09/07) - stable - Added nagios script. Thanks to Sebastian Mueller. - Added CPanel date format. Thanks to David Collins. Tracker #1967610. - Improved SASL filter. Thanks to Loic Pefferkorn. Tracker #2310410. -- Added NetBSD ipfilter (ipf command) action. Thanks to Ed Ravin. Tracker - #2484115. +- Added NetBSD ipfilter (ipf command) action. Thanks to Ed Ravin. Tracker #2484115. - Added cyrus-imap and sieve filters. Thanks to Jan Wagner. Debian bug #513953. -- Changed template to be more restrictive. Debian bug #514163. +- Changed `` template to be more restrictive. Debian bug #514163. - Use timetuple instead of utctimetuple for ISO 8601. Maybe not a 100% correct fix but seems to work. Tracker #2500276. - Made the named-refused regex a bit less restrictive in order to match logs with "view". Thanks to Stephen Gildea. -- Fixed maxretry/findtime rate. Many thanks to Christos Psonis. Tracker - #2019714. +- Fixed maxretry/findtime rate. Many thanks to Christos Psonis. Tracker #2019714 ver. 0.8.3 (2008/07/17) - stable ---------- @@ -1109,7 +1114,7 @@ ver. 0.8.3 (2008/07/17) - stable - Fixed socket path in redhat and suse init script. Thanks to Jim Wight. - Fixed PID file while started in daemon mode. Thanks to Christian Jobic who submitted a similar patch. -- Fixed "fail2ban-client get logpath". Bug #1916986. +- Fixed `fail2ban-client get logpath`. Bug #1916986. - Added gssftpd filter. Thanks to Kevin Zembower. - Added "Day/Month/Year Hour:Minute:Second" date template. Thanks to Dennis Winter. @@ -1131,16 +1136,16 @@ ver. 0.8.2 (2008/03/06) - stable - Removed date from logging message when using SYSLOG. Thanks to Iain Lea - Fixed "ignore IPs". Only the first value was taken into account. Thanks to Adrien Clerc -- Moved socket to /var/run/fail2ban. +- Moved socket to `/var/run/fail2ban`. - Rewrote the communication server. - Refactoring. Reduced number of files. - Removed Python 2.4. Minimum required version is now Python 2.3. - New log rotation detection algorithm. - Print monitored files in status. -- Create a PID file in /var/run/fail2ban/. Thanks to Julien Perez. +- Create a PID file in `/var/run/fail2ban/`. Thanks to Julien Perez. - Fixed "Feb 29" bug. Thanks to James Andrewartha who pointed this out. Thanks to Yaroslav Halchenko for the fix. -- "reload " reloads a single jail and the parameters in fail2ban.conf. +- `reload ` reloads a single jail and the parameters in fail2ban.conf. - Added Mac OS/X startup script. Thanks to Bill Heaton. - Absorbed some Debian patches. Thanks to Yaroslav Halchenko. - Replaced "echo" with "printf" in actions. Fix #1839673 @@ -1200,7 +1205,7 @@ ver. 0.7.7 (2007/02/08) - release candidate ver. 0.7.6 (2007/01/04) - beta ---------- - Added a "sleep 1" in redhat-initd. Thanks to Jim Wight -- Use /dev/log for SYSLOG output. Thanks to Joerg Sommrey +- Use `/dev/log` for SYSLOG output. Thanks to Joerg Sommrey - Use numeric output for iptables in "actioncheck" - Fixed removal of host in hosts.deny. Thanks to René Berber - Added new date format (2006-12-21 06:43:20) and Exim4 filter. Thanks to mEDI @@ -1209,25 +1214,25 @@ ver. 0.7.6 (2007/01/04) - beta - Added license in COPYING. Thanks to Axel Thimm - Allow comma in action options. The value of the option must be escaped with " or '. Thanks to Yaroslav Halchenko -- Now Fail2ban goes in /usr/share/fail2ban instead of /usr/lib/fail2ban. This is +- Now Fail2ban goes in `/usr/share/fail2ban` instead of `/usr/lib/fail2ban`. This is more compliant with FHS. Thanks to Axel Thimm and Yaroslav Halchenko ver. 0.7.5 (2006/12/07) - beta ---------- - Do not ban a host that is currently banned. Thanks to Yaroslav Halchenko -- The supported tags in "action(un)ban" are , and