prehistoric-systems/fail2ban
1
0
Fork 0
mirror of https://github.com/fail2ban/fail2ban.git synced 2026-03-11 08:55:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

squid-filter: recognize 407 responses in failregex

Browse source 
407 is the HTTP status code for Proxy Authentication Required, and in
Squid such denied requests are results of proxy authentication failures.
This commit is contained in:
Timothy Gu 2016-11-20 17:33:37 -08:00
parent b5433f48b7
commit db9baf3735
3 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ChangeLog
View file

@ -43,6 +43,8 @@ releases.
- optimized failregex to match all of "Failed any-method for ... from <HOST>" (gh-1479)
- eliminated possible complex injections (on user-name resp. auth-info, see gh-1479)
- optional port part after host (see gh-1533, gh-1581)
* `filter.d/squid.conf`
- Recognize 407 Proxy Authentication Required as failures (gh-1615)
### New Features

4
config/filter.d/squid.conf
View file

@ -1,10 +1,10 @@
# Fail2Ban filter for Squid attempted proxy bypasses
# Fail2Ban filter for Squid attempted proxy bypasses and bruteforcing
#
#
[Definition]
failregex = ^\s+\d\s<HOST>\s+[A-Z_]+_DENIED/403 .*$
failregex = ^\s+\d\s<HOST>\s+[A-Z_]+_DENIED/40[37] .*$
^\s+\d\s<HOST>\s+NONE/405 .*$
ignoreregex =

3
fail2ban/tests/files/logs/squid
View file

@ -11,3 +11,6 @@
# failJSON: { "time": "2013-12-09T00:09:06.000", "match": true , "host": "175.42.91.151" }
1386544146.000 1 175.42.91.151 TCP_DENIED/403 3745 GET http://pkfsp.ru/wp-content/uploads/proxyc/engine.php - HIER_NONE/- text/html
# failJSON: { "time": "2016-11-21T01:12:54.000", "match": true, "host": "98.189.78.228" }
1479687174.000 1 98.189.78.228 TCP_DENIED/407 4259 CONNECT www.google.com:443 tgu1 HIER_NONE/- text/html