From 148cbd8d2a2d3cab6815fc100a4e635c0e6a10ed Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 9 Jul 2013 12:47:41 -0400 Subject: [PATCH 1/5] ENH: heavier debugging -- log split date/log line even for no match. Log matching regex upon match --- server/failregex.py | 3 ++- server/filter.py | 7 ++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/server/failregex.py b/server/failregex.py index 957c77db..d302370b 100644 --- a/server/failregex.py +++ b/server/failregex.py @@ -50,7 +50,8 @@ class Regex: except sre_constants.error: raise RegexException("Unable to compile regular expression '%s'" % regex) - + def __str__(self): + return "%s(%r)" % (self.__class__.__name__, self._regex) ## # Gets the regular expression. # diff --git a/server/filter.py b/server/filter.py index d0390e62..54efb619 100644 --- a/server/filter.py +++ b/server/filter.py @@ -294,7 +294,7 @@ class Filter(JailThread): l = line l = l.rstrip('\r\n') - logSys.log(5, "Working on line %r", l) + logSys.log(7, "Working on line %r", l) timeMatch = self.dateDetector.matchTime(l) if timeMatch: # Lets split into time part and log part of the line @@ -349,19 +349,20 @@ class Filter(JailThread): # @return a dict with IP and timestamp. def findFailure(self, timeLine, logLine, returnRawHost=False): + logSys.log(5, "Date: %r, message: %r", timeLine, logLine) failList = list() # Checks if we must ignore this line. if self.ignoreLine(logLine): # The ignoreregex matched. Return. + logSys.log(7, "Matched ignoreregex and was ignored") return failList # Iterates over all the regular expressions. for failRegex in self.__failRegex: failRegex.search(logLine) if failRegex.hasMatched(): # The failregex matched. + logSys.log(7, "Matched %s", failRegex) date = self.dateDetector.getUnixTime(timeLine) - logSys.log(7, "Date: %r, message: %r", - timeLine, logLine) if date is None: logSys.debug("Found a match for %r but no valid date/time " "found for %r. Please file a detailed issue on" From 8add63c733f997feb0a3dd321cdf205ce22c3f04 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 9 Jul 2013 12:48:12 -0400 Subject: [PATCH 2/5] ENH: anchor roundcube-auth at the beginning as well --- config/filter.d/roundcube-auth.conf | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/config/filter.d/roundcube-auth.conf b/config/filter.d/roundcube-auth.conf index 7b153f44..77d872fb 100644 --- a/config/filter.d/roundcube-auth.conf +++ b/config/filter.d/roundcube-auth.conf @@ -4,6 +4,10 @@ # # +[INCLUDES] + +before = common.conf + [Definition] # Option: failregex @@ -13,7 +17,7 @@ # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = (FAILED login|Login failed) for .* from \s*$ +failregex = ^\s*(\[(\s\+[0-9]{4})?\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .* from \s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. From 0a02cfe9e8e65e68ec438bcd1c10fb7493f3e842 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 16 Jul 2013 14:39:42 -0400 Subject: [PATCH 3/5] ENH: must end with alphanumeric \w (not a dot or a dash etc) Otherwise regexp might swallow period in the sentence right after the address. I have decided to enforce alphanumeric instead of switching to non-greedy +? ... because I think it is closer to what we actually want here --- server/failregex.py | 2 +- testcases/servertestcase.py | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/server/failregex.py b/server/failregex.py index d302370b..bfa50575 100644 --- a/server/failregex.py +++ b/server/failregex.py @@ -41,7 +41,7 @@ class Regex: self._matchCache = None # Perform shortcuts expansions. # Replace "" with default regular expression for host. - regex = regex.replace("", "(?:::f{4,6}:)?(?P[\w\-.^_]+)") + regex = regex.replace("", "(?:::f{4,6}:)?(?P[\w\-.^_]*\w)") if regex.lstrip() == '': raise RegexException("Cannot add empty regex") try: diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py index 0a5593e3..07cc373c 100644 --- a/testcases/servertestcase.py +++ b/testcases/servertestcase.py @@ -334,9 +334,9 @@ class Transmitter(TransmitterBase): "failed attempt from again", ], [ - "user john at (?:::f{4,6}:)?(?P[\w\-.^_]+)", - "Admin user login from (?:::f{4,6}:)?(?P[\w\-.^_]+)", - "failed attempt from (?:::f{4,6}:)?(?P[\w\-.^_]+) again", + "user john at (?:::f{4,6}:)?(?P[\w\-.^_]*\\w)", + "Admin user login from (?:::f{4,6}:)?(?P[\w\-.^_]*\\w)", + "failed attempt from (?:::f{4,6}:)?(?P[\w\-.^_]*\\w) again", ], self.jailName ) @@ -359,7 +359,7 @@ class Transmitter(TransmitterBase): ], [ "user john", - "Admin user login from (?:::f{4,6}:)?(?P[\w\-.^_]+)", + "Admin user login from (?:::f{4,6}:)?(?P[\w\-.^_]*\\w)", "Dont match me!", ], self.jailName From f6a8a04cf34b11e317ac8b90970f9ae6518980e9 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 16 Jul 2013 14:45:59 -0400 Subject: [PATCH 4/5] ENH: roundcube-auth - adopt for current format with trailing error message. thanks @kwirk for the review/feedback I also used non-greedy .*? for the login portion since not sure if space could be there and trying to minimize possibility of reacting on injected "from " somewhere within the trailing .* --- config/filter.d/roundcube-auth.conf | 2 +- testcases/files/logs/roundcube-auth | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/config/filter.d/roundcube-auth.conf b/config/filter.d/roundcube-auth.conf index 77d872fb..fe669f66 100644 --- a/config/filter.d/roundcube-auth.conf +++ b/config/filter.d/roundcube-auth.conf @@ -17,7 +17,7 @@ before = common.conf # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = ^\s*(\[(\s\+[0-9]{4})?\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .* from \s*$ +failregex = ^\s*(\[(\s\+[0-9]{4})?\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .*? from (\. AUTHENTICATE .*)?\s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/testcases/files/logs/roundcube-auth b/testcases/files/logs/roundcube-auth index dec8051e..7c16efbd 100644 --- a/testcases/files/logs/roundcube-auth +++ b/testcases/files/logs/roundcube-auth @@ -2,3 +2,5 @@ [22-Jan-2013 22:28:21 +0200]: FAILED login for user1 from 192.0.43.10 # failJSON: { "time": "2005-05-26T07:12:40", "match": true , "host": "10.1.1.47" } May 26 07:12:40 hamster roundcube: IMAP Error: Login failed for sales@example.com from 10.1.1.47 +# failJSON: { "time": "2005-07-11T03:06:37", "match": true , "host": "1.2.3.4" } +Jul 11 03:06:37 myhostname roundcube: IMAP Error: Login failed for admin from 1.2.3.4. AUTHENTICATE PLAIN: A0002 NO Login failed. in /usr/share/roundcube/program/include/rcube_imap.php on line 205 (POST /wmail/?_task=login&_action=login) From 90ec82669c696894dfeb0d1c71dc01f415be15e7 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 16 Jul 2013 15:10:41 -0400 Subject: [PATCH 5/5] DOC: changelog entries for preceeding changes --- ChangeLog | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 16c93db1..a6a6ab23 100644 --- a/ChangeLog +++ b/ChangeLog @@ -29,7 +29,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests Daniel Black * action.d/hostsdeny -- NOTE: new dependancy 'ed'. Switched to use 'ed' across all platforms to ensure permissions are the same before and after a ban - - closes gh-266 + closes gh-266 - New Features: Daniel Black & ykimon * filter.d/3proxy.conf -- filter added @@ -51,6 +51,8 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests * fail2ban-client -- log to standard error. Closes gh-264 * Fail to configure if not a single log file was found for an enabled jail. Closes gh-63 + * is now enforced to end with an alphanumeric + * filter.d/roundcube-auth.conf -- anchored version Alexander Dietrich * action.d/sendmail-common.conf -- added common sendmail settings file and made the sender display name configurable