From 1fa8f9fa709964bc9e26391255dbf48388b831bf Mon Sep 17 00:00:00 2001 From: Steven Hiscocks Date: Thu, 15 May 2014 22:18:07 +0100 Subject: [PATCH 01/12] DOC: Tweak ChangeLog and THANKS --- ChangeLog | 3 ++- THANKS | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 69cbe909..0505e468 100644 --- a/ChangeLog +++ b/ChangeLog @@ -27,7 +27,8 @@ ver. 0.9.1 (2014/xx/xx) - better, faster, stronger * Database now returns persistent bans on restart (bantime < 0) * Recursive action tags now fully processed. Fixes issue with bsd-ipfw action - * Correct times for non-timezone date times formats - Thanks sebres + * Correct times for non-timezone date times formats during DST. + Thanks Serg G. Brester - New features: - Added monit filter thanks Jason H Martin. diff --git a/THANKS b/THANKS index 2c5b65bf..0151122a 100644 --- a/THANKS +++ b/THANKS @@ -86,7 +86,7 @@ Rolf Fokkens Roman Gelfand Russell Odom Sebastian Arcus -sebres +Serg G. Brester Sireyessire silviogarbes Stefan Tatschner From eb2487986c3a9699d9c67bdd474ee2e57828d360 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Thu, 15 May 2014 21:17:43 -0400 Subject: [PATCH 02/12] ENH: minor -- print time which was used to process lines --- bin/fail2ban-regex | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/bin/fail2ban-regex b/bin/fail2ban-regex index 3a887867..d8b3d287 100755 --- a/bin/fail2ban-regex +++ b/bin/fail2ban-regex @@ -25,11 +25,11 @@ This tools can test regular expressions for "fail2ban". """ -__author__ = "Cyril Jaquier, Yaroslav Halchenko" -__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2013 Yaroslav Halchenko" +__author__ = "Fail2Ban Developers" +__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko" __license__ = "GPL" -import getopt, sys, time, logging, os, locale, shlex, urllib +import getopt, sys, time, logging, os, locale, shlex, time, urllib from optparse import OptionParser, Option from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError @@ -223,6 +223,7 @@ class Fail2banRegex(object): self._filter = Filter(None) self._ignoreregex = list() self._failregex = list() + self._time_elapsed = None self._line_stats = LineStats() if opts.maxlines: @@ -348,7 +349,7 @@ class Fail2banRegex(object): return line, ret def process(self, test_lines): - + t0 = time.time() for line_no, line in enumerate(test_lines): if isinstance(line, tuple): line_datetimestripped, ret = fail2banRegex.testRegex( @@ -383,6 +384,7 @@ class Fail2banRegex(object): if line_no % 10 == 0 and self._filter.dateDetector is not None: self._filter.dateDetector.sortTemplate() + self._time_elapsed = time.time() - t0 @@ -456,7 +458,10 @@ class Fail2banRegex(object): template.hits, template.name)) pprint_list(out, "[# of hits] date format") - print "\nLines: %s" % self._line_stats + print "\nLines: %s" % self._line_stats, + if self._time_elapsed is not None: + print "[processed in %.2f sec]" % self._time_elapsed, + print if self._print_all_matched: self.printLines('matched') From 46d6e93800ddeb5ad34d2fb62e0aa1f7e3e7d9b0 Mon Sep 17 00:00:00 2001 From: pmarrapese Date: Sun, 18 May 2014 22:12:54 -0700 Subject: [PATCH 03/12] adjusted sshd filter regex to catch more verbose lines --- config/filter.d/sshd.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index 195744f2..f634d27e 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -32,7 +32,7 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|erro ^%(__prefix_line)sUser .+ from not allowed because none of user's groups are listed in AllowGroups\s*$ ^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked(?P=__prefix)(?:error: )?Received disconnect from : 11: .+ \[preauth\]$ ^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\](?P=__prefix)(?:error: )?Connection closed by \[preauth\]$ - ^(?P<__prefix>%(__prefix_line)s)Connection from port \d+(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$ + ^(?P<__prefix>%(__prefix_line)s)Connection from port \d+.*(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$ ignoreregex = From 96918acee4d96a7d83992e6ce993faa9d900a97c Mon Sep 17 00:00:00 2001 From: pmarrapese Date: Mon, 19 May 2014 20:47:16 -0700 Subject: [PATCH 04/12] more explicit match for sshd filter & added test --- THANKS | 1 + config/filter.d/sshd.conf | 2 +- fail2ban/tests/files/logs/sshd | 5 +++++ 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/THANKS b/THANKS index 27165492..1741df0f 100644 --- a/THANKS +++ b/THANKS @@ -76,6 +76,7 @@ Michael Hanselmann Mika (mkl) Nick Munger onorua +Paul Marrapese Noel Butler Patrick Börjesson Raphaël Marichez diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index f634d27e..6589e21b 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -32,7 +32,7 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|erro ^%(__prefix_line)sUser .+ from not allowed because none of user's groups are listed in AllowGroups\s*$ ^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked(?P=__prefix)(?:error: )?Received disconnect from : 11: .+ \[preauth\]$ ^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\](?P=__prefix)(?:error: )?Connection closed by \[preauth\]$ - ^(?P<__prefix>%(__prefix_line)s)Connection from port \d+.*(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$ + ^(?P<__prefix>%(__prefix_line)s)Connection from port \d+(?: on \S+ port \d+)?(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$ ignoreregex = diff --git a/fail2ban/tests/files/logs/sshd b/fail2ban/tests/files/logs/sshd index b9d1b9b4..a6e54196 100644 --- a/fail2ban/tests/files/logs/sshd +++ b/fail2ban/tests/files/logs/sshd @@ -137,6 +137,11 @@ Feb 12 04:09:18 localhost sshd[26713]: Connection from 115.249.163.77 port 51353 # failJSON: { "time": "2005-02-12T04:09:21", "match": true , "host": "115.249.163.77", "desc": "from gh-457" } Feb 12 04:09:21 localhost sshd[26713]: Disconnecting: Too many authentication failures for root [preauth] +# failJSON: { "match": false } +Feb 12 04:09:18 localhost sshd[26713]: Connection from 115.249.163.77 port 51353 on 127.0.0.1 port 22 +# failJSON: { "time": "2005-02-12T04:09:21", "match": true , "host": "115.249.163.77", "desc": "Multiline match with interface address" } +Feb 12 04:09:21 localhost sshd[26713]: Disconnecting: Too many authentication failures for root [preauth] + # failJSON: { "match": false } Apr 27 13:02:04 host sshd[29116]: User root not allowed because account is locked # failJSON: { "match": false } From 9b7c35810ab1dc8f3e5afb29c1e742bc0b3e5527 Mon Sep 17 00:00:00 2001 From: JoelSnyder Date: Mon, 2 Jun 2014 22:55:59 -0700 Subject: [PATCH 05/12] Create oracleims.conf in filter.d for new filter Created oracleims.conf to catch messages from Sun/Oracle Communications Messaging Server v6.3 and above (including v7) --- config/filter.d/oracleims.conf | 59 ++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 config/filter.d/oracleims.conf diff --git a/config/filter.d/oracleims.conf b/config/filter.d/oracleims.conf new file mode 100644 index 00000000..e80d0b96 --- /dev/null +++ b/config/filter.d/oracleims.conf @@ -0,0 +1,59 @@ +# Fail2Ban configuration file +# for Oracle IMS with XML logging +# +# Author: Joel Snyder/jms@opus1.com/2014-June-01 +# +# + + +[INCLUDES] + +# Read common prefixes. +# If any customizations available -- read them from +# common.local +before = common.conf + + +[Definition] + +# Option: failregex +# Notes.: regex to match the password failures messages +# in the logfile. The host must be matched by a +# group named "host". The tag "" can +# be used for standard IP/hostname matching and is +# only an alias for +# (?:::f{4,6}:)?(?P[\w\-.^_]+) +# Values: TEXT +# +# +# CONFIGURATION REQUIREMENTS FOR ORACLE IMS v6 and ABOVE: +# +# In OPTION.DAT you must have LOG_FORMAT=4 and +# bit 5 of LOG_CONNECTION must be set. +# +# Many of these sub-fields are optional and can be turned on and off +# by the system manager. We need the "tr" field +# (transport information (present if bit 5 of LOG_CONNECTION is +# set and transport information is available)). +# "di" should be there by default if you have LOG_FORMAT=4. +# Do not use "mi" as this is not included by default. +# +# Typical line IF YOU ARE USING TAGGING ! ! ! is: +# +# +# All that would be on one line. +# Note that you MUST have LOG_FORMAT=4 for this to work! +# + +failregex = ^.*tr=".*\|.*\|\d+\|\|\d+" .+ Bad username or password.*"/>$ + +# Option: ignoreregex +# Notes.: regex to ignore. If this regex matches, the line is ignored. +# Values: TEXT +# +ignoreregex = From 54317d7c3b1c35de63f909cf16bf2de531030533 Mon Sep 17 00:00:00 2001 From: JoelSnyder Date: Mon, 2 Jun 2014 22:58:39 -0700 Subject: [PATCH 06/12] Create test for oracleims filter This test file shows configuration information for the application, three log lines that DO match the pattern, and one log line that does NOT match the pattern (the first one). --- fail2ban/tests/files/logs/oracleims | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 fail2ban/tests/files/logs/oracleims diff --git a/fail2ban/tests/files/logs/oracleims b/fail2ban/tests/files/logs/oracleims new file mode 100644 index 00000000..aafb27af --- /dev/null +++ b/fail2ban/tests/files/logs/oracleims @@ -0,0 +1,19 @@ +# CONFIGURATION REQUIREMENTS FOR ORACLE IMS v6.3 and ABOVE: +# +# In OPTION.DAT you must have LOG_FORMAT=4 and +# bit 5 of LOG_CONNECTION must be set. +# +# Many of these sub-fields are optional and can be turned on and off +# by the system manager. We need the "tr" field +# (transport information (present if bit 5 of LOG_CONNECTION is +# set and transport information is available)). +# "di" should be there by default if you have LOG_FORMAT=4. +# +# failJSON: { "time": "2014-06-02T22:02:13", "match": false , "host": "23.122.129.179" } + +# failJSON: { "time": "2014-06-02T16:06:33", "match": true , "host": "89.96.245.78" } + +# failJSON: { "time": "2014-06-02T10:08:07", "match": true , "host": "71.95.206.106" } + +# failJSON: { "time": "2014-06-02T09:54:58", "match": true , "host": "151.1.71.144" } + From db023be09bae14b3ae23b476791bed79d6e71e36 Mon Sep 17 00:00:00 2001 From: Steven Hiscocks Date: Sat, 7 Jun 2014 20:51:53 +0100 Subject: [PATCH 07/12] BF: Fix bad syntax in badips.py action Taken from https://bugzilla.redhat.com/attachment.cgi?id=895966&action=diff --- config/action.d/badips.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/action.d/badips.py b/config/action.d/badips.py index a3f0883c..250b1dc3 100644 --- a/config/action.d/badips.py +++ b/config/action.d/badips.py @@ -161,7 +161,7 @@ class BadIPsAction(ActionBase): "/".join([self._badips, "get", "list", category, str(score)]), urlencode({'age': age})]) if key: - url = "&".join([url, urlencode({"key", key})]) + url = "&".join([url, urlencode({'key': key})]) response = urlopen(self._Request(url)) except HTTPError as response: messages = json.loads(response.read().decode('utf-8')) @@ -346,7 +346,7 @@ class BadIPsAction(ActionBase): try: url = "/".join([self._badips, "add", self.category, aInfo['ip']]) if self.key: - url = "?".join([url, urlencode({"key", self.key})]) + url = "?".join([url, urlencode({'key': self.key})]) response = urlopen(self._Request(url)) except HTTPError as response: messages = json.loads(response.read().decode('utf-8')) From 70ed93d8cc389f3a6ae01bcb8f6bbbf9c31c409f Mon Sep 17 00:00:00 2001 From: JoelSnyder Date: Mon, 9 Jun 2014 18:37:31 -0700 Subject: [PATCH 08/12] Update jail.conf for oracleims filter. This is the jail.conf update. Hopefully this will go into pull request #734. --- config/jail.conf | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/config/jail.conf b/config/jail.conf index 7f7a7cbe..c42952d8 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -701,3 +701,11 @@ action = %(banaction)s[name=%(__name__)s-tcp, port="%(tcpport)s", protocol="tcp enabled = false logpath = /var/log/messages ; nrpe.cfg may define a different log_facility maxretry = 1 + + +[oracleims] +# see "oracleims" filter file for configuration requirement for Oracle IMS v6 and above +enabled = false +logpath = /opt/sun/comms/messaging64/log/mail.log_current +maxretry = 6 +banaction = iptables-allports From c325e88634f9b0c933d279f32e61e1935e6260d2 Mon Sep 17 00:00:00 2001 From: JoelSnyder Date: Mon, 9 Jun 2014 18:38:22 -0700 Subject: [PATCH 09/12] Update THANKS Per Steven. --- THANKS | 1 + 1 file changed, 1 insertion(+) diff --git a/THANKS b/THANKS index 27165492..891dba32 100644 --- a/THANKS +++ b/THANKS @@ -49,6 +49,7 @@ John Thoe Jacques Lav!gnotte Ioan Indreias Jason H Martin +Joel M Snyder Jonathan Kamens Jonathan Lanning Jonathan Underwood From 5165d2f6ea19a7781902b1ca7c32ca2f6f0238d1 Mon Sep 17 00:00:00 2001 From: JoelSnyder Date: Mon, 9 Jun 2014 18:44:27 -0700 Subject: [PATCH 10/12] Update oracleims.conf to be 'less greedy' This assumes that the protocol is always a string, which it always is, and that the other four fields in the "tr" are always numeric (which they always are). See port_access documentation at http://docs.oracle.com/cd/E19563-01/819-4428/bgaur/index.html --- config/filter.d/oracleims.conf | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/config/filter.d/oracleims.conf b/config/filter.d/oracleims.conf index e80d0b96..083702ce 100644 --- a/config/filter.d/oracleims.conf +++ b/config/filter.d/oracleims.conf @@ -45,12 +45,14 @@ before = common.conf # mi="Bad password" # us="01ko8hqnoif09qx0np@imap.opus1.com" # di="535 5.7.8 Bad username or password (Authentication failed)."/> +# Format is generally documented in the PORT_ACCESS mapping +# at http://docs.oracle.com/cd/E19563-01/819-4428/bgaur/index.html # # All that would be on one line. # Note that you MUST have LOG_FORMAT=4 for this to work! # -failregex = ^.*tr=".*\|.*\|\d+\|\|\d+" .+ Bad username or password.*"/>$ +failregex = ^.*tr="[A-Z]+\|[0-9.]+\|\d+\|\|\d+" .+ Bad username or password.*"/>$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. From 2a51a0176a3161ff9e64be61f32e52f955a10ce8 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 27 May 2014 08:57:43 -0400 Subject: [PATCH 11/12] BF: minor type for delignoreregex in bash completions --- files/bash-completion | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/bash-completion b/files/bash-completion index ecb13986..57ec15b3 100644 --- a/files/bash-completion +++ b/files/bash-completion @@ -154,7 +154,7 @@ _fail2ban () { fi return 0 ;; - delfailregex|delignoregex) + delfailregex|delignoreregex) COMPREPLY=( $( compgen -W \ "$( "$1" get "$jail" "${prev/del/}" 2>/dev/null | awk -F"[][]" '{print $2}')" \ -- "$cur" ) ) From 994fe77e599c36eef8530429aedfbe6c73fd81b3 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 10 Jun 2014 03:52:16 -0400 Subject: [PATCH 12/12] ENH: make oracleims failregex better anchored (more explicit) --- config/filter.d/oracleims.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/oracleims.conf b/config/filter.d/oracleims.conf index 083702ce..e951ff5d 100644 --- a/config/filter.d/oracleims.conf +++ b/config/filter.d/oracleims.conf @@ -52,7 +52,7 @@ before = common.conf # Note that you MUST have LOG_FORMAT=4 for this to work! # -failregex = ^.*tr="[A-Z]+\|[0-9.]+\|\d+\|\|\d+" .+ Bad username or password.*"/>$ +failregex = ^.*tr="[A-Z]+\|[0-9.]+\|\d+\|\|\d+" ap="[^"]*" mi="Bad password" us="[^"]*" di="535 5.7.8 Bad username or password( \(Authentication failed\))?\."/>$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored.