Sergey G. Brester
514cca9ade
filter.d/sendmail-auth.conf: detect failures without user part
2022-08-01 09:20:28 +02:00
Sergey G. Brester
fbfc85d8c0
common.conf: fixed typo in comment (rfc5424 for logtype)
...
no functional changes; closes #3274
2022-05-12 18:09:09 +02:00
László Károlyi
f380d6202d
cherry pick #3210 from master
2022-02-09 15:43:21 +01:00
sebres
498e473a10
filter.d/courier-auth.conf: consider optional port after IP, regex is rewritten without catch-all's and right anchor, so it is more stable against further modifications now;
...
closes #3211
2022-02-09 12:18:23 +01:00
sebres
810386a265
filter.d/dovecot.conf: parse everything in parenthesis by auth-worker info, e. g. can match (pid=...,uid=...) too
...
(amend to 92f90038fa
2022-02-08 19:21:37 +01:00
sebres
bf689c27b8
filter.d/sshd.conf: ddos mode extended - recognizes messages "kex_exchange_identification: Connection closed / reset by pear" (fixed possible regression of f77398c49d);
...
closes gh-3086
2022-01-18 15:42:35 +01:00
sebres
8bf15db688
filter.d/sshd.conf: ddos mode extended - recognizes new message "banner exchange: invalid format" generated by port scanner, https payload on ssh port;
...
closes gh-3169
2022-01-18 15:41:27 +01:00
sebres
4b54a07d71
Revert "action.d/firewallcmd-*.conf (multiport only): fixed port range selector, replacing : with -;"
...
This reverts the incompatibility #3047 introduced by commit a038fd5dfe#2821 ).
2021-11-01 11:45:40 +01:00
Sergey G. Brester
ba839af8ad
filter.d/lighttpd-auth.conf: adjusted to the current source code + avoiding catch-all's, etc (gh-3116)
2021-10-01 15:03:24 +02:00
sebres
410a6ce5c8
fixed possible RCE vulnerability, unset escape variable (default tilde) stops consider "~" char after new-line as composing escape sequence
2021-06-21 17:12:53 +02:00
sebres
92f90038fa
filter.d/dovecot.conf: extended to match prefix like conn unix:auth-worker (uid=143): auth-worker<13247>: (authenticate from external service like exim), gh-2553
2021-05-29 21:12:34 +02:00
sebres
8b984a0135
filter.d\exim-common.conf: pid-prefix extended to match mx1 exim[...]: (gh-2553)
2021-05-29 20:47:56 +02:00
sebres
6be1a5a0b1
filter.d/dovecot.conf: fixed "Authentication failure" regex, matches "Password mismatch" in title case (gh-2880)
2021-05-29 20:25:28 +02:00
sebres
8afea37494
filter.d/sendmail-auth.conf: covering several "authentication failure" messages, sendmail 8.16.1 (gh-2757)
2021-05-29 20:09:57 +02:00
sebres
c5f1598a21
filter.d/postfix.conf: extended to cover new vectors:
...
- reject: BDAT/DATA from (gh-2927)
- (since regex is more precise now) token selector changed to `[A-Z]{4}`, e. g. no matter what a command is supplied now (RCPT, EHLO, VRFY, DATA, BDAT or something else)
- matches "Command rejected" and "Data command rejected" now
2021-05-29 19:48:24 +02:00
sebres
ae3e9b9149
filter.d/postfix.conf: extended to cover 2 new vectors:
...
- RCPT from unknown, 504 5.5.2, need fully-qualified hostname, gh-2995
- 550 5.7.25 Client host rejected, gh-2996
review combining several regex to single one
2021-05-29 19:21:27 +02:00
sebres
87f717e0e0
filter.d/sendmail-reject.conf: fix reverse DNS for ... (gh-3012)
2021-05-29 18:45:59 +02:00
sebres
1627d4f573
filter.d/sendmail-auth.conf: user not found, closes gh-3030
2021-05-25 23:16:29 +02:00
sebres
f0214b3d36
filter.d/sendmail-reject.conf: fixed regex to consider "Connection rate limit exceeded" with different combination of arguments
2021-04-20 18:13:40 +02:00
sebres
a45b1c974c
filter.d/ignorecommands/apache-fakegooglebot: added timeout parameter (default 55 seconds) - avoid fail with timeout (default 1 minute) by reverse lookup on some slow DNS services (googlebots must be resolved fast);
...
closes gh-2951
2021-03-02 19:35:27 +01:00
sebres
63acc862b1
action.d/nginx-block-map.conf: reload nginx only if it is running (also avoid error in nginx-errorlog, gh-2949) and better test coverage for the action
2021-02-24 18:21:42 +01:00
sebres
6f4b6ec8cc
action.d/badips.* removed (badips.com is no longer active, gh-2889)
2021-02-24 13:05:04 +01:00
sebres
c75748c5d3
fail2ban.conf: added new fail2ban configuration option "allowipv6" (default auto), can be used to allow or disallow IPv6 interface in fail2ban immediately by start (e. g. if fail2ban starts before network interfaces).
...
closes gh-2804
2021-01-27 17:06:14 +01:00
Sergey G. Brester
5f3f4d1e2f
action.d/cloudflare.conf: better IPv6 capability
...
closes gh-2891
2021-01-11 15:23:40 +01:00
sebres
9df332fdef
filter.d/apache-overflows.conf: extended to match AH00126 error (Invalid URI ...);
...
closes gh-2908
2021-01-11 15:10:53 +01:00
sebres
73b39e0894
filter.d/named-refused.conf: fixes prefix for messages from systemd journal (no mandatory space ahead, because don't have timestamp)
...
closes gh-2899
2020-12-29 21:22:47 +01:00
sebres
7965d652a1
filter.d/dovecot.conf: allow more verbose logging
...
closes #2573
2020-11-23 18:17:29 +01:00
sebres
a6de9459fc
typo
2020-11-23 18:08:38 +01:00
RyuaNerin
bba8844af8
typo
2020-11-23 18:07:49 +01:00
mpoliwczak834
595ee7ed74
add submission
2020-11-23 17:42:12 +01:00
mpoliwczak834
0c12cb7970
add managesieve support dovecot filter
2020-11-23 17:42:11 +01:00
sebres
cc64ef25f6
filter.d/apache-noscript.conf: extended to match "script not found" with error AH02811 (and cgi-bin path segment in script)
...
closes gh-2805
2020-11-23 17:25:41 +01:00
Sergey G. Brester
1c1a9b868c
no catch-alls, user name and error message stored in ticket
2020-11-09 15:36:30 +01:00
benrubson
840f0ff10a
Add Grafana jail
2020-11-09 15:31:06 +01:00
sebres
25e006e137
review and small tweaks (more precise and safe RE)
2020-11-09 13:43:59 +01:00
Mart124
df659a0cbc
Add Bitwarden syslog support
2020-11-09 13:34:39 +01:00
Sergey G. Brester
472bdc437b
Merge pull request #2723 from benrubson/softether
...
Add SoftEtherVPN jail
2020-11-09 13:23:25 +01:00
Sergey G. Brester
010e76406f
small tweaks (both 2nd time and facility are optional, avoid catch-all, etc)
2020-11-09 13:19:25 +01:00
sebres
d4adec7797
Merge branch '0.9' into 0.10
2020-11-09 12:44:07 +01:00
sebres
5430091acb
jail counter-strike: removed link to site with redirect to malicious page (gh-2868)
2020-11-09 12:43:34 +01:00
benrubson
ec873e2dc3
Add SoftEtherVPN jail
2020-11-05 23:56:30 +01:00
sebres
02525d7b6f
filter.d/sshd.conf: mode ddos (and aggressive) extended with new rule closing flood attack vector, matching:
...
error: kex_exchange_identification: Connection closed by remote host
(gh-2850)
2020-10-08 21:07:51 +02:00
sebres
2817a8144c
action.d/bsd-ipfw.conf: small amend (gh-2836) simplifying awk condition/code (position starts from <lowest_rule_num> and increases whilst used)
2020-09-29 13:33:40 +02:00
sebres
1418bcdf5b
action.d/bsd-ipfw.conf: fixed selection of rule-no by large list or initial lowest_rule_num, exit code can't be larger than 255 (gh-2836)
2020-09-29 12:35:49 +02:00
Sergey G. Brester
d977d81ef7
action.d/abuseipdb.conf: removed broken link, simplified usage example, fixed typos
2020-09-17 12:39:08 +02:00
sebres
a038fd5dfe
action.d/firewallcmd-*.conf (multiport only): fixed port range selector, replacing : with -;
...
small optimizations on `firewallcmd-rich-rules.conf` and `firewallcmd-rich-logging.conf` simplifying both and provide a dependency (rich-logging is a derivative of rich-rules);
closes gh-2821
2020-09-03 16:41:23 +02:00
sebres
ed20d457b2
jail.conf: removed action parameter name that set on jail-name (name=%(__name__)s is default in action reader)
2020-09-02 20:14:31 +02:00
sebres
db1f3477cc
amend to 3f04cba9f9: sendmail-auth has 2 failregex now, so rewritten with prefregex
2020-08-27 18:07:42 +02:00
sebres
3f04cba9f9
filter sendmail-auth extended to follow new authentication failure message introduced in sendmail 8.16.1, AUTH_FAIL_LOG_USER (gh-2757)
2020-08-27 17:44:25 +02:00
sebres
07fa9f2912
fixes gh-2787: allow to match did not issue MAIL/EXPN/VRFY/ETRN during connection non-anchored with extra mode (default names may deviate);
...
additionally provides common addr-tag for IPv4/IPv6 (`(?:IPv6:<IP6>|<IP4>)`) and test-coverage for IPv6
2020-08-27 17:04:19 +02:00
