From a51f82770bf26745f67b877021bd2d8b0ee020af Mon Sep 17 00:00:00 2001 From: CrazyMax Date: Sat, 24 Nov 2018 22:44:44 +0100 Subject: [PATCH 1/8] New filter `traefik-auth` --- ChangeLog | 1 + config/filter.d/traefik-auth.conf | 56 ++++++++++++++++++++++++++ config/jail.conf | 8 ++++ fail2ban/tests/files/logs/traefik-auth | 3 ++ 4 files changed, 68 insertions(+) create mode 100644 config/filter.d/traefik-auth.conf create mode 100644 fail2ban/tests/files/logs/traefik-auth diff --git a/ChangeLog b/ChangeLog index a45de141..c3aec224 100644 --- a/ChangeLog +++ b/ChangeLog @@ -42,6 +42,7 @@ ver. 0.10.5-dev-1 (20??/??/??) - development edition ### New Features * new failregex-flag tag `` for failregex, signaled that the access to service was gained (ATM used similar to tag ``, but it does not add the log-line to matches, gh-2279) +* `filter.d/traefik-auth.conf`: used to ban hosts, that were failed through traefik ### Enhancements diff --git a/config/filter.d/traefik-auth.conf b/config/filter.d/traefik-auth.conf new file mode 100644 index 00000000..4ebab0e9 --- /dev/null +++ b/config/filter.d/traefik-auth.conf @@ -0,0 +1,56 @@ +# Fail2ban filter configuration for traefik :: auth +# used to ban hosts, that were failed through traefik +# +# Author: CrazyMax +# +# To use 'traefik-auth' filter you have to configure your Traefik instance to write +# the access logs as describe in https://docs.traefik.io/configuration/logs/#access-logs +# into a log file on host and specifiy users for Basic Authentication +# https://docs.traefik.io/configuration/entrypoints/#basic-authentication +# +# Example: +# +# version: "3.2" +# +# services: +# traefik: +# image: traefik:latest +# command: +# - "--loglevel=INFO" +# - "--accesslog=true" +# - "--accessLog.filePath=/var/log/access.log" +# # - "--accessLog.filters.statusCodes=400-499" +# - "--defaultentrypoints=http,https" +# - "--entryPoints=Name:http Address::80" +# - "--entryPoints=Name:https Address::443 TLS" +# - "--docker.domain=example.com" +# - "--docker.watch=true" +# - "--docker.exposedbydefault=false" +# - "--api=true" +# - "--api.dashboard=true" +# ports: +# - target: 80 +# published: 80 +# protocol: tcp +# mode: host +# - target: 443 +# published: 443 +# protocol: tcp +# mode: host +# labels: +# - "traefik.enable=true" +# - "traefik.port=8080" +# - "traefik.backend=traefik" +# - "traefik.frontend.rule=Host:traefik.example.com" +# - "traefik.frontend.auth.basic.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/" +# volumes: +# - "/var/log/traefik:/var/log" +# - "/var/run/docker.sock:/var/run/docker.sock" +# restart: always +# + +[Definition] + +failregex = ^ \- \S+ \[\] \"(GET|POST|HEAD) .+\" 401 .+$ + +ignoreregex = diff --git a/config/jail.conf b/config/jail.conf index 8b7d3d9b..8fdd1ab2 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -888,3 +888,11 @@ backend = %(syslog_backend)s port = http,https logpath = %(apache_error_log)s +# To use 'traefik-auth' filter you have to configure your Traefik instance to write +# the access logs as describe in https://docs.traefik.io/configuration/logs/#access-logs +# into a log file on host and specifiy users for Basic Authentication +# https://docs.traefik.io/configuration/entrypoints/#basic-authentication +# Service example in 'config/filter.d/traefik-auth.conf' +[traefik-auth] +port = http,https +logpath = /var/log/traefik/access.log diff --git a/fail2ban/tests/files/logs/traefik-auth b/fail2ban/tests/files/logs/traefik-auth new file mode 100644 index 00000000..6f8be2ea --- /dev/null +++ b/fail2ban/tests/files/logs/traefik-auth @@ -0,0 +1,3 @@ + +# failJSON: { "time": "2018-11-18T21:34:34", "match": true , "host": "10.0.0.2" } +10.0.0.2 - - [18/Nov/2018:21:34:34 +0000] "GET /dashboard/ HTTP/2.0" 401 17 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0" 72 "Auth for frontend-Host-traefik-0" "/dashboard/" 0ms From a8fbdd6a872fe6d2c49c27c924c0c71442a3b771 Mon Sep 17 00:00:00 2001 From: CrazyMax Date: Sat, 24 Nov 2018 23:13:50 +0100 Subject: [PATCH 2/8] Fix UTC Time mismatch --- fail2ban/tests/files/logs/traefik-auth | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/tests/files/logs/traefik-auth b/fail2ban/tests/files/logs/traefik-auth index 6f8be2ea..9164d35c 100644 --- a/fail2ban/tests/files/logs/traefik-auth +++ b/fail2ban/tests/files/logs/traefik-auth @@ -1,3 +1,3 @@ -# failJSON: { "time": "2018-11-18T21:34:34", "match": true , "host": "10.0.0.2" } +# failJSON: { "time": "2018-11-18T20:34:34", "match": true , "host": "10.0.0.2" } 10.0.0.2 - - [18/Nov/2018:21:34:34 +0000] "GET /dashboard/ HTTP/2.0" 401 17 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0" 72 "Auth for frontend-Host-traefik-0" "/dashboard/" 0ms From a160c38211877029461d11d1614d6c37a6a2d2ad Mon Sep 17 00:00:00 2001 From: CrazyMax Date: Sat, 24 Nov 2018 23:16:27 +0100 Subject: [PATCH 3/8] Fix UTC Time mismatch --- fail2ban/tests/files/logs/traefik-auth | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/tests/files/logs/traefik-auth b/fail2ban/tests/files/logs/traefik-auth index 9164d35c..f3e2cdfc 100644 --- a/fail2ban/tests/files/logs/traefik-auth +++ b/fail2ban/tests/files/logs/traefik-auth @@ -1,3 +1,3 @@ -# failJSON: { "time": "2018-11-18T20:34:34", "match": true , "host": "10.0.0.2" } +# failJSON: { "time": "2018-11-18T22:34:34", "match": true , "host": "10.0.0.2" } 10.0.0.2 - - [18/Nov/2018:21:34:34 +0000] "GET /dashboard/ HTTP/2.0" 401 17 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0" 72 "Auth for frontend-Host-traefik-0" "/dashboard/" 0ms From 90516d6b671aa35897d5affa1655e99569a448e3 Mon Sep 17 00:00:00 2001 From: CrazyMax Date: Wed, 28 Nov 2018 00:37:24 +0100 Subject: [PATCH 4/8] Add login success example for traefik-auth --- fail2ban/tests/files/logs/traefik-auth | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fail2ban/tests/files/logs/traefik-auth b/fail2ban/tests/files/logs/traefik-auth index f3e2cdfc..fbd7732f 100644 --- a/fail2ban/tests/files/logs/traefik-auth +++ b/fail2ban/tests/files/logs/traefik-auth @@ -1,3 +1,5 @@ # failJSON: { "time": "2018-11-18T22:34:34", "match": true , "host": "10.0.0.2" } 10.0.0.2 - - [18/Nov/2018:21:34:34 +0000] "GET /dashboard/ HTTP/2.0" 401 17 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0" 72 "Auth for frontend-Host-traefik-0" "/dashboard/" 0ms +# failJSON: { "match": false } +10.0.0.2 - username [27/Nov/2018:23:33:31 +0000] "GET /dashboard/ HTTP/2.0" 200 716 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0" 118 "Host-traefik-0" "http://172.16.0.3:8080" 4ms \ No newline at end of file From 7cdabdd7aed3fea525529c364d5d9f628741f548 Mon Sep 17 00:00:00 2001 From: CrazyMax Date: Fri, 14 Dec 2018 19:06:09 +0100 Subject: [PATCH 5/8] Update traefik-auth failregex --- config/filter.d/traefik-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/traefik-auth.conf b/config/filter.d/traefik-auth.conf index 4ebab0e9..9a9b90a7 100644 --- a/config/filter.d/traefik-auth.conf +++ b/config/filter.d/traefik-auth.conf @@ -51,6 +51,6 @@ [Definition] -failregex = ^ \- \S+ \[\] \"(GET|POST|HEAD) .+\" 401 .+$ +failregex = ^ \- (?!- )\S+ \[\] \"(GET|POST|HEAD) .+\" 401 .+$ ignoreregex = From c540babfb6ca5cab5277f621b5fcb035d8d973d6 Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Mon, 17 Dec 2018 12:30:46 +0100 Subject: [PATCH 6/8] matches not empty username only --- fail2ban/tests/files/logs/traefik-auth | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fail2ban/tests/files/logs/traefik-auth b/fail2ban/tests/files/logs/traefik-auth index fbd7732f..3e7a8987 100644 --- a/fail2ban/tests/files/logs/traefik-auth +++ b/fail2ban/tests/files/logs/traefik-auth @@ -1,5 +1,6 @@ - -# failJSON: { "time": "2018-11-18T22:34:34", "match": true , "host": "10.0.0.2" } -10.0.0.2 - - [18/Nov/2018:21:34:34 +0000] "GET /dashboard/ HTTP/2.0" 401 17 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0" 72 "Auth for frontend-Host-traefik-0" "/dashboard/" 0ms # failJSON: { "match": false } -10.0.0.2 - username [27/Nov/2018:23:33:31 +0000] "GET /dashboard/ HTTP/2.0" 200 716 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0" 118 "Host-traefik-0" "http://172.16.0.3:8080" 4ms \ No newline at end of file +10.0.0.2 - - [18/Nov/2018:21:34:30 +0000] "GET /dashboard/ HTTP/2.0" 401 17 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0" 72 "Auth for frontend-Host-traefik-0" "/dashboard/" 0ms +# failJSON: { "time": "2018-11-18T22:34:34", "match": true , "host": "10.0.0.2" } +10.0.0.2 - username [18/Nov/2018:21:34:34 +0000] "GET /dashboard/ HTTP/2.0" 401 17 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0" 72 "Auth for frontend-Host-traefik-0" "/dashboard/" 0ms +# failJSON: { "match": false } +10.0.0.2 - username [27/Nov/2018:23:33:31 +0000] "GET /dashboard/ HTTP/2.0" 200 716 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0" 118 "Host-traefik-0" "/dashboard/" 4ms From d84fb8a4b1111e2730a4e5d1adff3356e055d10f Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Thu, 21 Feb 2019 22:19:04 +0100 Subject: [PATCH 7/8] regex rewritten (more secure now, resolves catch-all vulni) --- config/filter.d/traefik-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/traefik-auth.conf b/config/filter.d/traefik-auth.conf index 9a9b90a7..8321a138 100644 --- a/config/filter.d/traefik-auth.conf +++ b/config/filter.d/traefik-auth.conf @@ -51,6 +51,6 @@ [Definition] -failregex = ^ \- (?!- )\S+ \[\] \"(GET|POST|HEAD) .+\" 401 .+$ +failregex = ^ \- (?!- )\S+ \[\] \"(GET|POST|HEAD) [^\"]+\" 401\b ignoreregex = From dcede9b3f144e92b80908a6e111bb7d827cdc0bf Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Thu, 21 Feb 2019 22:26:28 +0100 Subject: [PATCH 8/8] comment rewritten (belongs to the filter) --- config/jail.conf | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/config/jail.conf b/config/jail.conf index 8fdd1ab2..e486ebbc 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -888,11 +888,8 @@ backend = %(syslog_backend)s port = http,https logpath = %(apache_error_log)s -# To use 'traefik-auth' filter you have to configure your Traefik instance to write -# the access logs as describe in https://docs.traefik.io/configuration/logs/#access-logs -# into a log file on host and specifiy users for Basic Authentication -# https://docs.traefik.io/configuration/entrypoints/#basic-authentication -# Service example in 'config/filter.d/traefik-auth.conf' [traefik-auth] +# to use 'traefik-auth' filter you have to configure your Traefik instance, +# see `filter.d/traefik-auth.conf` for details and service example. port = http,https logpath = /var/log/traefik/access.log