From 4c67a269bf9d3186201c72305cead1820fc1fbaa Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 13 Jun 2013 22:11:05 +1000 Subject: [PATCH 1/3] ENH: proftp regex hardening and log messages --- ChangeLog | 2 ++ config/filter.d/proftpd.conf | 17 ++++++++++++----- testcases/files/logs/proftpd | 3 +++ 3 files changed, 17 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 590edfa6..ef5ab555 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released - New Features: - Enhancements: + Daniel Black + * filter.d/proftpd -- harden and anchor regex and add two testcases ver. 0.8.10 (2013/06/12) - wanna-be-secure diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf index f28e2d4b..3a16b877 100644 --- a/config/filter.d/proftpd.conf +++ b/config/filter.d/proftpd.conf @@ -1,8 +1,15 @@ # Fail2Ban configuration file # # Author: Yaroslav Halchenko +# Daniel Black - hardening of regex # -# + +[INCLUDES] + +# Read common prefixes. If any customizations available -- read them from +# common.local +before = common.conf + [Definition] @@ -13,10 +20,10 @@ # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = \(\S+\[\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+ *$ - \(\S+\[\]\)[: -]+ USER \S+ \(Login failed\): .*$ - \(\S+\[\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\. *$ - \(\S+\[\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$ +failregex = ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+ *$ + ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[\]\)[: -]+ USER \S+ \(Login failed\): .*$ + ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\. *$ + ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/testcases/files/logs/proftpd b/testcases/files/logs/proftpd index def8a83e..5c88c1c1 100644 --- a/testcases/files/logs/proftpd +++ b/testcases/files/logs/proftpd @@ -1,5 +1,8 @@ Jan 10 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username (Login failed): User in /etc/ftpusers Feb 1 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username: no such user found from 123.123.123.123 [123.123.123.123] to 234.234.234.234:21 +Jun 09 07:30:58 platypus.ace-hosting.com.au proftpd[11864] platypus.ace-hosting.com.au (mail.bloodymonster.net[::ffff:67.227.224.66]): USER username (Login failed): Incorrect password. +Jun 09 11:15:43 platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.com.au (::ffff:101.71.143.238[::ffff:101.71.143.238]): USER god: no such user found from ::ffff:101.71.143.238 [::ffff:101.71.143.238] to ::ffff:123.212.99.194:21 +Jun 13 22:07:23 platypus.ace-hosting.com.au proftpd[15719] platypus.ace-hosting.com.au (::ffff:59.167.242.100[::ffff:59.167.242.100]): SECURITY VIOLATION: root login attempted. From 2e2ec5d1f515cb6dc02eb0d40c665fc6b992fb34 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Fri, 14 Jun 2013 00:17:41 +1000 Subject: [PATCH 2/3] ENH: injection of fail data into USER field --- testcases/files/logs/proftpd | 1 + 1 file changed, 1 insertion(+) diff --git a/testcases/files/logs/proftpd b/testcases/files/logs/proftpd index 5c88c1c1..aaaf0295 100644 --- a/testcases/files/logs/proftpd +++ b/testcases/files/logs/proftpd @@ -3,6 +3,7 @@ Feb 1 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123. Jun 09 07:30:58 platypus.ace-hosting.com.au proftpd[11864] platypus.ace-hosting.com.au (mail.bloodymonster.net[::ffff:67.227.224.66]): USER username (Login failed): Incorrect password. Jun 09 11:15:43 platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.com.au (::ffff:101.71.143.238[::ffff:101.71.143.238]): USER god: no such user found from ::ffff:101.71.143.238 [::ffff:101.71.143.238] to ::ffff:123.212.99.194:21 Jun 13 22:07:23 platypus.ace-hosting.com.au proftpd[15719] platypus.ace-hosting.com.au (::ffff:59.167.242.100[::ffff:59.167.242.100]): SECURITY VIOLATION: root login attempted. +Jun 14 00:09:59 platypus.ace-hosting.com.au proftpd[17839] platypus.ace-hosting.com.au (::ffff:59.167.242.100[::ffff:59.167.242.100]): USER platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.com.au (hihoinjection[1.2.3.44]): no such user found from ::ffff:59.167.242.100 [::ffff:59.167.242.100] to ::ffff:113.212.99.194:21 From 9940cd1b6b0146c2a088edab611e8d77e1d2984d Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Fri, 14 Jun 2013 00:29:43 +1000 Subject: [PATCH 3/3] ENH: proftpd chan accept usernames with spaces --- config/filter.d/proftpd.conf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf index 3a16b877..13080fcc 100644 --- a/config/filter.d/proftpd.conf +++ b/config/filter.d/proftpd.conf @@ -20,9 +20,9 @@ before = common.conf # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+ *$ - ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[\]\)[: -]+ USER \S+ \(Login failed\): .*$ - ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\. *$ +failregex = ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[\]\)[: -]+ USER .*: no such user found from \S+ \[\S+\] to \S+:\S+ *$ + ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[\]\)[: -]+ USER .* \(Login failed\): .*$ + ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[\]\)[: -]+ SECURITY VIOLATION: .* login attempted\. *$ ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$ # Option: ignoreregex