prehistoric-systems/fail2ban
1
0
Fork 0
mirror of https://github.com/fail2ban/fail2ban.git synced 2026-03-11 08:55:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
6114 commits 34 branches 230 tags 22 MiB
Commit graph

1994 commits

Author SHA1 Message Date
sebres
6b90ca820f filter.d/traefik-auth.conf: filter extended with parameter mode (normal, ddos, aggressive) to handle the match of username differently: 
- `normal`: matches 401 with supplied username only
  - `ddos`: matches 401 without supplied username only
  - `aggressive`: matches 401 and any variant (with and without username)
closes gh-2693
 2020-04-23 13:08:24 +02:00
sebres
affd9cef5f filter.d/courier-smtp.conf: prefregex extended to consider port in log-message (closes gh-2697) 2020-04-21 13:32:17 +02:00
sebres
06b46e92eb jail.conf: don't specify action directly in jails (use action_ or banaction instead); 
no mails-action added per default anymore (e. g. to allow that `action = %(action_mw)s` should be specified per jail or in default section in jail.local), closes gh-2357;
ensure we've unique action name per jail (also if parameter `actname` is not set but name deviates from standard name, gh-2686);
don't use %(banaction)s interpolation because it can be complex value (containing `[...]`), so would bother the action interpolation.
 2020-04-15 19:00:49 +02:00
benrubson
2912bc640b New Gitlab jail 2020-04-09 16:42:08 +02:00
sebres
136781d627 filter.d/sshd.conf: fixed regex for mode extra - "No authentication methods available" (supported seems to be optional now, gh-2682) 2020-04-08 12:17:59 +02:00
Jordi Sanfeliu
ede2009708 added new jail (and filter) Monitorix 2020-04-03 12:52:19 +02:00
sebres
38b32a9a72 Merge branch '0.10' into 0.11 2020-03-18 19:53:55 +01:00
sebres
22a04dae05 Merge branch '0.9' into 0.10 (gh-2246) 2020-03-18 16:11:53 +01:00
Sergey G. Brester
b1e1cab4b7
Merge pull request #2246 from shaneforsythe/shaneforsythe-patch-2 
Improve regex in proftpd.conf
 2020-03-18 15:49:18 +01:00
sebres
606bf110c9 filter.d/sshd.conf (mode ddos): fixed "connection reset" regex (seems to have same syntax now as closed), so both regex's combined now to single RE 
(closes gh-2662)
 2020-03-16 17:31:39 +01:00
sebres
32f02ef3b3 Merge branch '0.10' into 0.11 2020-03-05 14:01:14 +01:00
sebres
42714d0849 filter.d/common.conf: closes gh-2650, avoid substitute of default values in related lt_* section, __prefix_line should be interpolated in definition section (after the config considers all sections that can overwrite it); 
amend to 62b1712d22 (PR #2387, backend-related option `logtype`);
testSampleRegexsZZZ-GENERIC-EXAMPLE covering now negative case also (other daemon in prefix line)
 2020-03-05 13:47:11 +01:00
sebres
e6ca04ca9d Merge branch '0.10' into 0.11 + version bump (back to dev) 2020-02-25 16:10:31 +01:00
sebres
ab3a7fc6d2 filter.d/sshd.conf: mode ddos (and aggressive) extended to detect port scanner sending unexpected ident string after connect 2020-02-17 16:24:42 +01:00
Brian J. Murrell
2fd6b478a9
FreeIPA renames named to named-pkcs11 
FreeIPA renames the BIND9 named daemon to named-pkcs11, so extend the
REGEX match to look for either variant.

Signed-off-by: Brian J. Murrell <brian@interlinx.bc.ca>
 2020-02-16 10:38:36 -05:00
sebres
ceeba99f25 replace internals of several iptables-ipset actions using internals of iptables include: 
- better check mechanism (using `-C`, option `--check` is available long time);
- additionally iptables-ipset is a common action for iptables-ipset-proto6-* now (which become obsolete now);
- many features of different iptables actions are combinable as single chain/rule (can be supplied to action as parameters);
- tests adjusted.
 2020-02-14 12:16:26 +01:00
sebres
d26209e2c6 first attempt to make certain standard actions breakdown safe starting with iptables: 
- better check mechanism (using `-C`, option `--check` is available long time);
- additionally iptables is a replacement for iptables-common now, several actions using this as include now become obsolete;
- many features of different iptables actions are combinable as single chain/rule (can be supplied to action as parameters);
 2020-02-14 12:16:25 +01:00
sebres
7282cf91b0 Merge branch '0.10' into 0.11 2020-02-14 12:13:29 +01:00
sebres
9137c7bb23 filter processing: 
- avoid duplicates in "matches" (previously always added matches of pending failures to every next real failure, or nofail-helper recognized IP, now first failure only);
  - several optimizations of merge mechanism (multi-line parsing);
fail2ban-regex: better output handling, extended with tag substitution (ex.: `-o 'fail <ip>, user <F-USER>: <msg>'`); consider a string containing new-line as multi-line log-excerpt (not as a single log-line)
filter.d/sshd.conf: introduced parameter `publickey` (allowing change behavior of "Failed publickey" failures):
  - `nofail` (default) - consider failed publickey (legitimate users) as no failure (helper to get IP and user-name only)
  - `invalid` - consider failed publickey for invalid users only;
  - `any` - consider failed publickey for valid users too;
  - `ignore` - ignore "Failed publickey ..." failures (don't consider failed publickey at all)
tests/samplestestcase.py: SampleRegexsFactory gets new failJSON option `constraint` to allow ignore of some tests depending on filter name, options and test parameters
 2020-02-13 12:28:07 +01:00
sebres
1492ab2247 improve processing of pending failures (lines without ID/IP) - fail2ban-regex would show those in matched lines now (as well as increase count of matched RE); 
avoid overwrite of data with empty tags by ticket constructed from multi-line failures;
amend to d1b7e2b5fb: better output (as well as ignoring of pending lines) using `--out msg`;
filter.d/sshd.conf: don't forget mlf-cache on "disconnecting: too many authentication failures" - message does not have IP (must be followed by "closed [preauth]" to obtain host-IP).
 2020-02-11 18:44:36 +01:00
Sergey G. Brester
774dda6105
filter.d/postfix.conf: extended mode ddos and aggressive covering multiple disconnects without auth 2020-02-10 13:29:16 +01:00
Sergey G. Brester
34d63fccfe
close gh-2629 - jail.conf (action_blocklist_de interpolation): replace service parameter (use jail name instead of filter, which can be empty) 2020-02-10 13:03:55 +01:00
Mihail Politaev
303861d7c7
Using native firewalld ipset implementation 
By creating additional action file firewallcmd-ipset-native.conf
 2020-01-30 21:17:32 +02:00
sebres
a7c68ea19f Merge branch '0.10' into 0.11 2020-01-28 21:47:55 +01:00
sebres
569dea2b19 filter.d/mysqld-auth.conf: capture user name in filter (can be more strict if user switched, used in action or fail2ban-regex output); 
also add coverage for mariadb 10.4 log format (gh-2611)
 2020-01-22 17:24:40 +01:00
sebres
70e47c9621 Merge branch '0.10' into 0.11 2020-01-14 11:44:35 +01:00
sebres
ec37b1942c action.d/nginx-block-map.conf: fixed backslash substitution (different echo behavior in some shells, gh-2596) 2020-01-14 11:39:13 +01:00
sebres
4860d69909 Merge branch '0.10' into 0.11 2020-01-09 20:55:00 +01:00
sebres
f77398c49d filter.d/sshd.conf: captures Disconnected from ... [preauth], preauth phase only, different handling by extra (with supplied user only) and ddos/aggressive mode (normal mode is not affected, used there just as a helper with <F-NOFAIL> to capture IP for multiline failures without IP); 
closes gh-2115, gh-2362.
 2020-01-09 20:53:53 +01:00
sebres
587e4ff573 Merge branch '0.10' into 0.11 
(conflicts resolved)
 2020-01-08 21:27:23 +01:00
sebres
67fd75c88e pass2allow-ftp: inverted handling - action should prohibit access per default for any IP, so reset start on demand parameter for this action (will be started immediately). 2020-01-06 21:13:40 +01:00
sebres
8f6ba15325 avoid unhandled exception during flush, better invariant check (and repair), avoid repair by unban/stop etc... 2019-12-27 21:30:41 +01:00
Mart124
e763c657c4
Let's get back to WRN 2019-11-27 00:32:10 +01:00
Mart124
d7b707b09d
Update bitwarden.conf 2019-11-27 00:09:22 +01:00
Mart124
869327e9b1
Update bitwarden.conf 2019-11-25 22:17:58 +01:00
Mart124
79caeaa520
Create bitwarden.conf 2019-11-25 22:05:29 +01:00
Mart124
30e742a849
Update jail.conf 2019-11-25 21:57:41 +01:00
Mart124
ef394b3cf0
Update jail.conf 2019-11-25 21:55:45 +01:00
sebres
24d1ea9aa2 Merge branch '0.10' into 0.11 2019-11-25 01:58:55 +01:00
Sergey G. Brester
e4c2f303bd
Merge pull request #2550 from CPbN/centreonjail 
Add Centreon jail
 2019-11-15 01:53:20 +01:00
sebres
0e8a8edb5e filter.d/sendmail-*.conf: both filters have same __prefix_line now (and same RE for ID, 14-20 chars long, optional) + adjusted test cases (gh-2563) 2019-11-08 13:15:40 +01:00
Henry van Megen
548e2e0054 sendmail-auth.conf: filter updated for longer mail IDs (up to 20, see gh-2562) 2019-11-08 12:42:09 +01:00
sebres
5cf064a112 monit: accepting both logpath's: monit and monit.log, closes gh-2495 2019-11-04 12:18:12 +01:00
CPbN
9e699646f8 Add Centreon jail 2019-10-24 14:37:18 +02:00
CPbN
18ba714f97 Add Centreon jail 2019-10-23 09:14:26 +02:00
sebres
3515d06979 Merge branch '0.10' into 0.11 2019-10-18 19:19:21 +02:00
sebres
85ec605358 nftables: amend to gh-2254 - implemented shutdown of action (proper clean-up) - at stop it checks now the last set was deleted and removes table completely (if table does not contain any set); 
this is avoided if some sets were added manually or can be avoided via overwriting of parameter `_nft_shutdown_table`, for example:
banaction = nftables[_nft_shutdown_table=''][...]
 2019-10-18 19:01:16 +02:00
sebres
51af193402 nftables: add options allowing to specify own table (default f2b-table) and chain (default f2b-chain) 2019-10-18 18:54:02 +02:00
sebres
955d690e56 regrouping expressions with curly braces, added more escapes (better handling in posix shell) 2019-10-18 18:34:48 +02:00
sebres
0824ad0d73 Merge branch '0.10' into 0.11 2019-10-18 12:04:38 +02:00
Sergey G. Brester
54298fe761
Merge pull request #2254 
Nftables: isolate fail2ban rules into a dedicated table and chain
 2019-10-18 11:43:38 +02:00
sebres
d1a73d3004 filter.d/apache-auth.conf: 
- ignore errors from mod_evasive in `normal` mode (mode-controlled now) (gh-2548);
  - extended with option `mode` - `normal` (default) and `aggressive`
close gh-2548
 2019-10-18 11:26:19 +02:00
sebres
8c6a547215 Merge branch '0.10' into 0.11 2019-10-11 03:01:46 +02:00
sebres
50595b70fd filter.d/mysqld-auth.conf: ISO timestamp format (dual time) within log message 
(https://serverfault.com/questions/982126/fail2ban-fails-to-recognize-ip)
 2019-10-11 01:31:07 +02:00
sebres
9e28b6c65f filter.d/asterisk.conf: relaxing protocol RE-part before IP in RemoteAddress (gh-2531) 2019-09-26 21:46:26 +02:00
sebres
8ea00c1d5d fixed mistake in config (semicolon after space as comment in configs?) and coverage, suppress errors by unsupported flush, better space handling in helper _nft_get_handle_id, etc 2019-09-25 13:47:29 +02:00
sebres
492205d30e action.d/nftables.conf: implemented actionflush (allows flushing nftables sets resp. fast unban of all jail tickets at all) 2019-09-24 20:00:29 +02:00
sebres
abc4d9fe37 allow to use multiple protocols in multiport (single set with multiple rules in chain): 
`banaction = nftables[type=multiport]` with `protocol="tcp,udp,sctp"` in jail replace 3 separate actions.
more robust if deleting multiple references to set (rules in chain)
 2019-09-24 19:44:59 +02:00
sebres
c753ffb11d combine nftables actions to single action: 
- nftables-common is removed
- nftables-allports  is obsolete, replaced by nftables[type=allports]
- nftables-multiport is obsolete, replaced by nftables[type=multiport]
 2019-09-24 18:53:38 +02:00
sebres
c59d49da22 nftables-allports: support multiple protocols in single rule; 
tests/servertestcase.py: added coverage for nftables actions
 2019-09-24 18:46:41 +02:00
Ririsoft
dde51b4682 fix actionban/unban ip definition syntax 2019-09-24 13:01:14 +02:00
Monson Shao
1cda50ce05 Rewrite nftables variables based on nftables' logic. 
Add an example for redirecting.
 2019-09-24 13:01:13 +02:00
sebres
990c410877 Merge branch '0.10' into 0.11 
# Conflicts (resolved):
#	fail2ban/client/jailreader.py
 2019-09-11 16:18:09 +02:00
sebres
a36b70c7b5 filter.d/znc-adminlog.conf: support logging format of systemd-journal, bypass port after address (optional, removed end-anchor, see gh-2520) 2019-09-10 21:02:26 +02:00
sebres
1cdd618232 Merge branch '0.10' into 0.11 2019-07-29 13:26:37 +02:00
sebres
5d5253dd70 Merge branch '0.10' into 0.11 2019-07-29 13:25:49 +02:00
sebres
91923b5c07 don't need to match identifier exactly (@ is precise enough as prefix), not capturing group; 
`prefregex` extended, more selective now (denied/NOTAUTH suffix moved from `failregex`, so no catch-all there anymore);
update ChangeLog
 2019-07-29 13:21:00 +02:00
Joe Horn
4395469226 Update named-refused.conf 
Log format changed since ver. 9.11.0
Ref. ftp://ftp.isc.org/isc/bind9/9.11.0/RELEASE-NOTES-bind-9.11.0.html
"The logging format used for querylog has been altered. It now includes an additional field indicating the address in memory of the client object processing the query."
 2019-07-29 13:06:49 +02:00
Sergey G. Brester
a395361de8
Merge pull request #2467 from sebres/logtype-option-rfc5424 
New option `logtype` value - `rfc5424`
 2019-07-24 00:02:04 +02:00
sebres
581f13c2db Merge branch '0.10' into 0.11 2019-07-22 19:07:15 +02:00
Sergey G. Brester
0dfd4f1f41
Merge pull request #2404 from benrubson/badprotocol 
filter.d/sshd.conf: matches "Bad protocol version identification" in ddos and aggressive modes.
 2019-07-22 12:47:39 +02:00
Sergey G. Brester
119401fced
Merge pull request #2452 from benrubson/badips 
Badips key is only used to retrieve list
 2019-07-20 12:08:22 +02:00
sebres
af611db859 Merge branch '0.10' into 0.11 2019-07-10 12:47:03 +02:00
sebres
5e980afbb8 filter.d/apache-noscript.conf: closes #2466 - matches "Primary script unknown" without "\n" (optional now) 2019-07-10 12:45:53 +02:00
sebres
62b1712d22 amend to #2387: 
- common.conf: rewritten using section-based handling round about option logtype;
- option `logtype` extended with `rfc5424` to cover RFC 5424 log-format (see #2309);
 2019-07-09 21:48:43 +02:00
Sergey G. Brester
846b3316db
amend, remove NL 2019-06-29 12:04:02 +02:00
Sergey G. Brester
4ae00485b0
revert acktionban back, use norestored option 2019-06-29 12:03:01 +02:00
Noel Kuntze
9327218843
Improved blocklist_de action to not resend bans that were already reported 2019-06-29 01:39:38 +02:00
benrubson
8b171f7d25 Badips key is only used to retrieve list 2019-06-26 18:34:20 +02:00
sebres
80f97eaf02 Merge branch '0.10' into 0.11 2019-06-26 17:29:08 +02:00
sebres
e751be2c13 normalize, simplify and fix several mail actions (mail and sendmail actions are more similar now, sendmail is configurable via parameter mailcmd, etc); 
added test covering sendmail-whois-lines
 2019-06-15 23:14:41 +02:00
sebres
5045c4bb00 Merge branch '0.10' into 0.11 2019-06-12 16:28:57 +02:00
girst
a7dc3614c4 znc-adminlog: use <ADDR> instead of <HOST> 2019-06-12 16:26:34 +02:00
girst
b288ccd6b6 new filter: znc-adminlog 2019-06-12 16:25:50 +02:00
sebres
2e7a600851 Merge branch '0.10' into 0.11 2019-06-12 11:44:05 +02:00
sebres
22b9304562 action.d/badips.py: fix start of banaction on demand (which may be IP-family related), supplied action info with ticket instead of simulating it with dict; 
(closes gh-2390)
 2019-06-12 11:23:52 +02:00
sebres
0ed3a63151 Merge branch '0.10' into 0.11 2019-06-07 16:29:38 +02:00
sebres
e5ae113215 filter.d/postfix.conf: extended with new postfix filter mode errors to match "too many errors" (gh-2439), 
also included within modes `normal`, `more` (`extra` and `aggressive`), since postfix
  parameter `smtpd_hard_error_limit` is default 20 (additionally consider `maxretry`)
 2019-06-07 16:14:02 +02:00
sebres
3b2f75414c filter.d/postfix.conf: extended regexp's to accept variable suffix code in status of postfix for precise messages (gh-2442) 2019-06-07 15:40:55 +02:00
sebres
3d4044084a Merge branch '0.10' into 0.11 2019-06-07 14:48:10 +02:00
Sergey G. Brester
7dbd3a07eb cut comment to limit documented on abuseipdb, additionally use curl in quiet mode 2019-06-07 14:39:55 +02:00
Carlos Ferreira
7b73cb7639 Switch to AbuseIPDB API v2 2019-06-07 14:39:52 +02:00
sebres
5137cd2ec8 Merge branch '0.10' into 0.11 2019-05-14 21:40:50 +02:00
sebres
49bf6132cc amend for 3036ed1889: eliminate "invalid sequence" warnings 2019-05-14 21:40:33 +02:00
sebres
f69a8693fc Merge branch '0.10' into 0.11 2019-05-14 20:19:29 +02:00
sebres
0426a24719 filter.d/postfix.conf: (closes gh-2426) filter extended to catch "5.1.1" (Recipient address rejected: User unknown in local recipient table) with RCPT (and some session-id instead of "NOQUEUE") 2019-05-14 15:27:20 +02:00
sebres
ca85ddc866 Merge branch '0.10' into 0.11 2019-05-10 16:23:50 +02:00
sebres
d8d71c5a22 action.d/helpers-common.conf: grep arguments are rewritten - using options -wF to match only whole words and fixed string (not as pattern) 2019-05-10 16:17:13 +02:00
chtheis
fa727586ff Fix grep pattern to deal with Apache's error log 
Apache's error log appends the port to the IP address, other logs don't.
 2019-05-10 16:04:27 +02:00
sebres
74eac6c94f Merge branch '0.10' into 0.11 2019-05-02 15:28:44 +02:00
sebres
23d2281e57 action.d/nginx-block-map.conf: small fix with better RE-rule for removal of ID (token/session) via sed (anchored now) 2019-05-02 15:22:45 +02:00
benrubson
5b2b680bfe SSHd add Bad protocol version message 2019-05-02 11:42:45 +02:00
Sergey G. Brester
b318eb7e33
closes gh-2408: prevent execution of action abuseipdb for restored tickets 2019-04-29 10:45:37 +02:00
sebres
c47bb523b7 Merge branch '0.10' into 0.11 2019-04-24 21:58:27 +02:00
Holston
422a2de7fe updated 2019-04-24 21:35:19 +02:00
Holston
a581bf3f08 Fixed filter for Apache mod_security 2019-04-24 21:35:17 +02:00
Holston
5d6a84ba78 Updated to correct logging option 2019-04-24 21:35:15 +02:00
sebres
f0c5bd56f4 Merge branch '0.10' into 0.11 (conflicts resolved) 2019-04-19 13:20:38 +02:00
sebres
25f1aa334e fail2ban.conf: move default settings into DEFAULT section (to be more similar to jail.conf, Definition section overwrites the options, so it is backwards compatible) 2019-04-18 20:53:11 +02:00
sebres
0386df0042 introduced new options: dbmaxmatches (fail2ban.conf) and maxmatches (jail.conf); 
setting `maxmatches` and `dbmaxmatches` to 0 saves memory usage and database size (closes gh-2118).
 2019-04-18 20:31:39 +02:00
sebres
337be4b36c Merge remote-tracking branch 'remotes/gh-upstream/0.10' into 0.11 2019-04-18 13:47:44 +02:00
Sergey G. Brester
28c1da33dc
Merge pull request #2387 from sebres/logtype-option-journal 
New backend-related option `logtype` (`journal` or `file`)
 2019-04-18 13:27:42 +02:00
Sergey G. Brester
6c7093c66d
minor amend, refolding branches (SP|SA -> S[PA]) 2019-04-04 02:28:50 +02:00
Amir Caspi
ffd5d0db78
Update sendmail-reject.conf 
On some distros (e.g., CentOS 7), sendmail default config labels port 465 as TLSMTA and port 587 as MSA. Update failregex to reflect. Relevant loglines included in 9e1fa4ff73
 2019-03-29 17:39:27 -06:00
sebres
ced9828d04 filter.d/sendmail-reject.conf: fixed gh-2385 for some systems (e. g. CentOS): if only identifier set to sm-mta (no unit sendmail) for some messages. 2019-03-29 14:24:06 +01:00
sebres
ec681a3363 backend systemd sets logtype to journal automatically; 
sshd-journal: new test covering sshd journal logging format (matches short prefix-line simulating output of formatJournalEntry);
samplestestcase-factory extended with new option `fileOptions` to set common filter/test options for whole test-file
 2019-03-29 14:24:00 +01:00
sebres
e268bf97d4 introduces new configuration parameter "logtype" (default "file" for file-backends, and "journal" for journal-backends); 
common.conf: differentiate "__prefix_line" for file/journal logtype's (speedup and fix parsing of systemd-journal);
samplestestcase.py: extends testSampleRegexsFactory to allow coverage of journal logtype;
closes gh-2383: asterisk can log timestamp if logs into systemd-journal (regex extended with optional part matching this)
 2019-03-29 14:23:57 +01:00
sebres
17a4f81e23 Merge branch '0.10' into 0.11 2019-03-27 13:46:56 +01:00
sebres
e8401a7e65 action.d/xarf-login-attack.conf: fixes gh-2372, correction for split of addresses, interpolation is shell-independent now, etc; 
extended with option `boundary`, additionally dynamic boundary part is used (is not so predictable as it was previously);
 2019-03-16 00:05:06 +01:00
Sergey G. Brester
7a7a905ab2
0.9 - Merge pull request #2339 from cFire/master 
Add override for dovecot failed logins on debian
 2019-03-14 11:45:46 +01:00
sebres
4e2c7b9fdd Merge branch '0.10' into 0.11 2019-03-12 17:01:03 +01:00
sebres
741cf8fb0e Merge branch 'master-0.9' into 0.10 2019-03-12 16:58:08 +01:00
sebres
1a9527e6a4 fixed catch-all on user (and simplifying) 2019-03-12 16:53:36 +01:00
jim
a7f3ba87f6 filter.d/sogo-auth.conf: fixes gh-2289 - matching auth-failures when behind a proxy; 
(broken by commit 72b06479a5), replacement for gh-2290.
 2019-03-12 16:50:04 +01:00
sebres
324f0ed7cc Merge branch '0.10' into 0.11 2019-03-01 12:36:07 +01:00
sebres
3c70fe298a closes gh-969: introduces new section [Thread] and option stacksize to configure default stack-size of the threads running in fail2ban. Example: 
```ini
[Thread]
stacksize = 32
```
 2019-02-24 16:45:14 +01:00
sebres
5126068099 loglevel and shortloglevel combined to single parameter loglevel, below an example logging summary with NOTICE and rest with DEBUG log-levels: 
action = badips.py[... , loglevel="debug, notice"]
 2019-02-22 14:05:19 +01:00
benrubson
689938ee99 Add a shortloglevel badips.py option 2019-02-22 13:32:46 +01:00
sebres
a3b7a0525a Merge branch '0.10' into 0.11 2019-02-22 13:22:52 +01:00
sebres
140243328f coverage: try to avoid sporadic "coverage decreased" in CI 2019-02-22 13:20:40 +01:00
Sergey G. Brester
d3f6d6ffdd
Merge pull request #2286 from crazy-max/0.10 
New filter `traefik-auth`
 2019-02-21 22:27:04 +01:00
Sergey G. Brester
dcede9b3f1
comment rewritten (belongs to the filter) 2019-02-21 22:26:28 +01:00
Sergey G. Brester
d84fb8a4b1
regex rewritten (more secure now, resolves catch-all vulni) 2019-02-21 22:19:04 +01:00
sebres
9ed35c423a Merge branch '0.9' into 0.10 (gh-2317) 2019-02-21 20:13:54 +01:00
Yaroslav Halchenko
31e6ec3c5b
Merge pull request #2323 from todgru/fix-spelling-abuseipdb-conf 
fix: correct spelling category
 2019-02-15 17:08:45 -05:00
Cool Fire
27526e431b Changes static logfile string to variable 
Since we don't want to re-declare a log file name we already
have a varialbe for, use the existing variable to set dovecot_log.
 2019-02-13 10:10:24 +01:00
Cool Fire
b31a018e7c Add override for dovecot failed logins on debian 2019-02-13 10:01:14 +01:00
sebres
1647d0090e Merge branch '0.10' into 0.11 2019-02-11 19:19:44 +01:00
sebres
e651bc7866 amend to #1622: jail-reader supports now multi-line option for multi-line action parameter: 
logpath = a.log
            b.log
            c.log
  action  = ban[...]
          = log[logpath="%(logpath)s"]
closes gh-2341, ultimate fix for gh-976
 2019-02-11 11:54:58 +01:00
todgru
39ed016a1e fix: correct spelling category 2019-01-14 22:08:38 -08:00
sebres
d88ce7181c Merge branch '0.10' into 0.11 2019-01-07 01:51:59 +01:00
sebres
a13fdcf4f7 closes gh-2314: extended regex for mysql 8.0.13 if used logging with details (e. g. log-error-verbosity = 3, so log output has few additional words enclosed in brackets after "[Note]"). 2019-01-07 01:34:12 +01:00
Yannik Sembritzki
6b4404b1bc
Fix asterisk filter not catching attackers when port is logged (Fixes #2316) 2019-01-03 23:55:42 +01:00
CrazyMax
7cdabdd7ae
Update traefik-auth failregex 2018-12-14 19:06:09 +01:00
CrazyMax
a51f82770b
New filter traefik-auth 2018-11-24 22:44:44 +01:00
sebres
b49c1ab4b3 Merge branch '0.10' into 0.11 2018-11-21 13:06:44 +01:00
sebres
555b29e8e6 Merge remote-tracking branch 'remotes/gh-upstream/master' into 0.10 2018-11-21 13:05:42 +01:00
sebres
1c1d2cc435 introduces new failregex-flag tag <F-MLFGAINED> signaled that the access to service was gained (ATM used similar to <F-NOFAIL>, but does not added to matches); 
filter.d/sshd.conf: extended with new rules:
- Disconnecting ...: Change of username or service not allowed
- Disconnected from ... [preauth] (extra/aggressive mode only)
 2018-11-19 21:19:57 +01:00
dienteperro
0df221b54b
"be" instead of "me" in shorewall.conf 2018-11-15 14:34:51 -05:00
sebres
f9f7e29295 Merge branch '0.10' into 0.11 (version bump after r.0.10.4) 2018-10-04 13:08:25 +02:00
Shane Forsythe
8614ca8c41
Update proftpd.conf 
proftpd 1.3.5e can leave inconsistent error message if ftp or mod_sftp is used

Oct  2 15:45:31 ftp01 proftpd[5516]: 10.10.2.13 (10.10.2.189[10.10.2.189]) - SECURITY VIOLATION: Root login attempted
Oct  2 15:45:44 ftp01 proftpd[5517]: 10.10.2.13 (10.10.2.189[10.10.2.189]) - SECURITY VIOLATION: Root login attempted.

Fix regex to make trailing period optional, otherwise brute force attacks against root account using ftp are not blocked correctly.
 2018-10-02 17:24:33 -04:00
Sergey G. Brester
1752c19b6f
Merge pull request #2205 from benrubson/patch-1 
Add loglevel option to badips.py
 2018-10-02 13:12:03 +02:00
Sergey G. Brester
65676baf8c fixed py3 incompatibility (for some reasons this file seems to be excluded from 2to3), anyway not needed, because int-type is already checked in str2LogLevel 2018-10-02 13:00:20 +02:00
Sergey G. Brester
4b751c84c3
badips.py: Rewrite new bool option "log" as "loglevel" and revert default to log-level (DEBUG). 2018-10-02 12:32:15 +02:00
sebres
6b52f90ad6 Merge branch '0.10' into 0.11 2018-09-21 15:54:16 +02:00
sebres
58b510a5be filter.d/domino-smtp.conf: 
- recognizes failures logged using another format (something like session-id, IP enclosed in square brackets);
  - failregex extended to catch connections rejected for policy reasons (gh-2228);
 2018-09-21 14:14:00 +02:00
Michele Bologna
7e88ae0ee6 Feat: add forbidden to jail.conf 2018-09-14 23:08:12 +02:00
Michele Bologna
1fb7ffe759 Feat: ban nginx forbidden accesses 
If you have configured nginx to forbid some paths in your webserver, e.g.:

    location ~ /\. {
      deny all;
    }

if a client tries to access https://yoursite/.user.ini then you will see
in nginx error log:

    2018/09/14 19:03:05 [error] 2035#2035: *9134 access forbidden by rule, client: 10.20.30.40, server: www.example.net, request: "GET /.user.ini HTTP/1.1", host: "www.example.net", referrer: "https://www.example.net"

By carefully setting this filter we ban every IP that tries too many times to
access forbidden resources.

Author: Michele Bologna https://www.michelebologna.net/
 2018-09-14 22:21:24 +02:00
sebres
8a0c06ba9e Merge branch '0.10' into 0.11 2018-09-14 11:01:40 +02:00
sebres
d01fe9d22a action.d/*.conf: correct comments for actionstart/actionstop 2018-09-12 16:01:57 +02:00
Ben RUBSON
9d7c0e00c1
Also log number of IPs removed/added 2018-09-08 09:28:42 +02:00
Ben RUBSON
70e53b55c5
Typo 2018-08-19 22:39:18 +02:00
Ben RUBSON
ec4c4b12c1
Add yes/no log option to badips.py 2018-08-19 22:35:09 +02:00
sebres
714fd8c915 Merge branch '0.10' into 0.11 2018-08-14 16:01:00 +02:00
Sergey G. Brester
ee207d8c31
Merge pull request #2151 from benrubson/merge 
Apache SNI error / misredirect attempts rules are combined in one regex
 2018-08-14 14:56:49 +02:00
Ben RUBSON
77b35b8db7
Improvement 2018-08-14 14:07:32 +02:00
sebres
addd26ae55 Merge branch '0.10' into 0.11 2018-08-14 11:13:15 +02:00
sebres
e2a255d104 fixed typo in comments by "ignoreself" parameter 2018-08-14 11:11:19 +02:00
sebres
606761b3c7 Merge branch '0.10' into 0.11 2018-08-03 12:06:13 +02:00
sebres
e995d5a0b6 filter.d/freeswitch.conf: provide mode parameter, allows to avoid matching of messages like auth challenge (REGISTER) (see gh-2163) (currently extra as default to be backwards-compatible), see comments in filter how to set it to mode normal. 2018-08-03 11:42:15 +02:00
sebres
bc2dbacc9a filter.d/freeswitch.conf: provide compatibility for log-format from gh-2193: 
- extended with new default date-pattern `^(?:%%Y-)?%%m-%%d[ T]%%H:%%M:%%S(?:\.%%f)?` to cover
    `YYYY-mm-dd HH:MM::SS.ms` as well as `mm-dd HH:MM::SS.ms` (so year is optional);
  - more optional arguments in log-line (so accept [WARN] as well as [WARNING] and optional [SOFIA] hereafter);
 2018-08-03 11:22:30 +02:00
sebres
eb1156b099 Merge branch '0.10' into 0.11 2018-07-18 15:57:39 +02:00
sebres
22d37cdce2 sshd: fixed failregex for ddos (resp. aggressive) mode, to cover "authenticating user" case in log-message: 
Connection closed by authenticating user root 192.0.2.10 ... [preauth]
tests extended (also with few injection tries).
closes gh-2185.
 2018-07-18 15:31:04 +02:00
sebres
6a81cc9d8c Merge branch '0.10' into 0.11 2018-07-17 15:18:44 +02:00
sebres
8fe07e29ad filter.d/dovecot.conf: failregex enhancement to catch disconnected with "proxy dest auth failed"; 
closes gh-2184
 2018-07-17 15:06:42 +02:00
sebres
57f2d9e31c Merge branch '0.10' into 0.11 2018-07-06 18:06:54 +02:00
Sergey G. Brester
75330568d9
Merge pull request #2168 from dpavlin/dovecot-add-F-USER 
dovecot: collect F-USER and variants
 2018-07-06 17:16:43 +02:00
sebres
9de1657aab Merge branch '0.10' into 0.11 2018-07-06 11:43:56 +02:00
sebres
6ce67a6d21 coverage 2018-07-05 16:27:36 +02:00
Dobrica Pavlinusic
6f1e789f31 dovecot: collect F-USER and variants 
We are prefering ruser= if availble because this are credentials
presented to dovecot from remote client.
 2018-06-30 16:16:03 +02:00
sebres
0eaa0ecd86 Merge branch '0.10' into 0.11 2018-06-14 12:36:22 +02:00
sebres
8cbe1e6b13 Merge pull request #2155 2018-06-14 12:35:57 +02:00
cheese1
43db4411de small typo 2018-06-14 12:35:04 +02:00
sebres
9fdc6e0e82 Merge branch '0.10' into 0.11 2018-06-11 14:36:35 +02:00
Boris Gulay
a923cd209b filter.d/dovecot.conf: failregex enhancement to catch sql password mismatch errors; 2018-06-11 14:30:10 +02:00
benrubson
f54f6caece Merge Apache SNI error / misredirect attempts rules 2018-06-09 10:19:27 +02:00
sebres
0d40dd42b1 Merge branch '0.10' into 0.11 2018-04-26 13:43:15 +02:00
sebres
bba7a6c5cf amend to (gh-2067) / b34ae5999e: fix parameter in config (dynamic parameters stating with '_' are protected and don't allowed in command-actions); 
the interpolation of hostsdeny is test-covered now;
closes gh-2114.
 2018-04-17 18:59:24 +02:00
sebres
0707695146 Merge branch '0.10' into 0.11, version bump 
# Conflicts resolved:
#	fail2ban/server/database.py
 2018-04-05 12:58:11 +02:00
sebres
8069eef50c badips: try to fix sporadic test errors if badips-server timed out resp. not available (502 bad gateway or similar). 2018-04-05 12:31:29 +02:00
sebres
70d099bbd6 Merge branch '0.10' into 0.11 2018-04-04 18:59:44 +02:00
Michael Grant
57bc502d5c Update sendmail-reject.conf 2018-04-04 18:52:36 +02:00
Michael Grant
2ab6a5ae62 Update sendmail-auth.conf 2018-04-04 18:52:35 +02:00
Michael Grant
87520e8008 Sendmail logs IPv6 addresses with the prefix 'IPv6:'. Added (IPv6:)? before all <HOST> regexes to match the IPv6 address (but not the prefix). 2018-04-04 18:52:33 +02:00
sebres
1fdad90b4d Merge branch '0.10' into 0.11 2018-04-04 16:49:57 +02:00
Luis Aranguren
fc76ccf192 Fixes abuseipdb curl cypher error and comment $f2bV_matches 
Fixed https://github.com/fail2ban/fail2ban/issues/2044 #2044
and used https://github.com/fail2ban/fail2ban/issues/2039 to fix comment in abuseipdb.com only showing $f2bV_matches
 2018-04-04 16:39:16 +02:00
Sergey G. Brester
7bbc26d67e
Merge pull request #2097 from benrubson/sni 
Detect Apache SNI error / misredirect attempts
 2018-04-04 16:31:38 +02:00
benrubson
bd74f7ba8b Detect Apache SNI error / misredirect attempts, typos 2018-04-04 00:20:58 +02:00
sebres
7dfd61f462 Merge branch '0.10' into 0.11-2 2018-04-03 14:14:44 +02:00
sebres
8423f017e7 Merge branch 'sshd-ddos-mode-closed-preauth' into 0.10 2018-04-03 14:12:35 +02:00
sebres
4ee07adde6 Merge branch '0.10' into fix-sshd-filter-suff 
# Conflicts resolved:
#	fail2ban/server/filter.py
 2018-04-03 13:30:57 +02:00
benrubson
30dc22fb2e Detect Apache SNI error / misredirect attempts 2018-03-29 11:36:49 +02:00
sebres
4f6532f810 filter.d/sshd.conf: mode ddos (and aggressive) extended to catch Connection closed by ... [preauth], so in DDOS mode it causes failure now on closed within preauth stage; 
at least using both modes can ban port-scanners and prevent for other annoying "intruders", closing connection within preauth-stage (see gh-2085 for example).
 2018-03-20 18:54:22 +01:00
sebres
cd7f1354c6 remove end-anchors for expressions that are precise enough (with clear flow, simple branches, without catch-all's, etc.) 2018-03-20 18:47:42 +01:00
sebres
c31eb1c562 quick optimization: normalizes pam-generic prefregex (more similar to the same regex within sshd-filter) + datepattern anchored now; 2018-03-20 16:00:21 +01:00
sebres
25cc42129a hold all user names affected by interim attempts in order to avoid forget a failures after success login: 
intruder (as legitimate user) firstly tries to login with another user-name (brute-force), so hopes to reset failure counter by succeeded login;
this is fixed and covered in tests now;
sshd-filter extended to cover multiple-login attempts (also fully implements gh-2070);
 2018-03-20 13:09:05 +01:00
sebres
a9c94686b6 fixed multiple regexs matched 2018-03-20 09:09:42 +01:00
sebres
8028d3940d amend with better match of optional suffix-groups; 
remove end-anchors for expressions are precise enough (with clear flow, simple branches, without catch-all's, etc.);
 2018-03-19 17:29:26 +01:00
sebres
66d2436f21 filter.d/sshd.conf: extend suffix with optional port, move it to prefregex at end outside of the content 2018-03-19 16:50:49 +01:00
sebres
7b3442c4e2 amend to 185cb998e7: capture error prefix outside of the failure content; 2018-03-19 14:53:56 +01:00
sebres
185cb998e7 make prefregex more precise in order to avoid catch the content for non failure lines 2018-03-19 14:38:47 +01:00
sebres
e8ffab28fb filter.d/apache-noscript.conf: extended to match "Primary script unknown", got from php-fpm module. 2018-03-19 14:23:24 +01:00
sebres
a6fb33bdec filter.d/recidive.conf: fixed if logging into systemd-journal (SYSLOG) with daemon name in prefix, gh-2069 2018-03-09 13:56:38 +01:00
Sergey G. Brester
b34ae5999e
action.d/hostdeny.conf: fixes IPv6 syntax 
differentiate the IPv4 and IPv6 syntax (where it is enclosed in square brackets)
 2018-03-05 19:35:10 +01:00
sebres
2b282ead09 Merge branch '0.10' into 0.11 2018-03-02 19:48:15 +01:00
sebres
caa2bdfee6 amendment for gh-2061: it looks like the port was added here also 2018-03-02 19:24:47 +01:00
sebres
a3bcbe2d1b backwards-compatibility, test-cases and ChangeLog update 2018-03-02 19:15:10 +01:00
MatthieuBarbu
6b5516b851 fix sshd rule #2 
in line 58, rule don't match with "%(__suff)s" but work fine if I replace with "%(__on_port_opt)s"
Debian 9 stretch : fail2ban 0.10.3
 2018-03-02 18:40:36 +01:00
sebres
1d7aa2ff21 filter.d/sshd.conf: rewrite fix (for new ssh log-format) backwards compatible + test-cases extended to cover both cases 2018-03-02 18:17:17 +01:00
MatthieuBarbu
9f5c873526 fix sshd rule 
just remove the space before ":11" line 52 because don't match on my Debian 9 stretch...
I don't know if this is wrong on all OS
 2018-03-02 17:53:35 +01:00
sebres
5ea76789c6 Merge branch '0.10' into 0.11 2018-03-02 17:18:37 +01:00
sebres
8c291cad38 filter.d/asterisk.conf: fixed failregex prefix by log over remote syslog server (gh-2060) 2018-03-02 09:17:04 +01:00
Ben RUBSON
b112250ef0 (Free)BSD IPFW does not allow 2 identical rules (#2054) 
ipfw actionban fixed to allow same rule added several times (and actionunban to ignore error by deletion of missing rule)
 2018-02-27 10:18:59 +01:00
Ben RUBSON
857767f04b Add 'any' badips.py bancategory (#2056) 
action.d/badips.py: allow `any` as bancategory to retrieve IPs from all categories
 2018-02-27 10:12:22 +01:00
sebres
47a7f83a0b Merge branch '0.10' into 0.11 2018-02-26 19:30:54 +01:00
sebres
07fcb24ff6 Merge pull request #2057 from benrubson/https 
Use httpS with badips
 2018-02-26 18:50:35 +01:00
sebres
f52c67238a action.d/badips.py: code review, ban command covered, debug log-messages, etc; 2018-02-26 18:16:20 +01:00
benrubson
fce2a50165 badips.py, solve a str() issue under FreeBSD 2018-02-26 15:55:21 +01:00
benrubson
e2665d39fd Use httpS with badips 2018-02-26 09:58:37 +01:00
sebres
a5155f55e7 Merge branch '0.10' into 0.11 2018-02-21 09:31:35 +01:00
sebres
e636567d23 filter.d/exim.conf: failregex extended with SMTP call dropped: too many syntax or protocol errors. 2018-02-19 09:50:46 +01:00
sebres
19a5a2f8c0 filter.d/murmur.conf: fixed detection of failures reading from journal (systemd-backend only): 
- extended with optional prefix for the systemd-journal (with second date-pattern as optional match);
- added `journalmatch` filtering;
closes gh-2043
 2018-02-09 11:43:55 +01:00
sebres
201ae0dac2 Merge branch '0.10' into 0.11 2018-01-31 12:20:34 +01:00
sebres
0be0e43d47 amend to 03b577d7b9: add new-line after matches via tag <br> without usage of interim variable 2018-01-30 12:52:26 +01:00
sebres
03b577d7b9 action.d/blocklist_de.conf: fixed tag substitution (in 0.10 it can be variables supplied via shell-arguments), expand <matches> with trailing newline; 
tests extended;
closes gh-2028
 2018-01-30 12:27:03 +01:00
sebres
faab77cc79 Merge branch '0.10' into 0.11, with resolved conflicts. 2018-01-24 17:56:58 +01:00
Yaroslav Halchenko
527bb9a7c3 dos2unix for helpers-common.conf 
Original report: http://bugs.debian.org/888110
 2018-01-23 08:48:36 -05:00
sebres
1ca3df877b Merge branch '0.10' into 0.11 2018-01-18 14:32:00 +01:00
sebres
f69e28adfc action.d/pf.conf: compatibility fix - recognizes that parameter port specified as empty, with or without braces (should be more backwards compatible to 0.9 now). 2018-01-18 14:05:22 +01:00
sebres
38b3290516 Merge branch '0.10' into 0.11 2018-01-17 16:43:45 +01:00
sebres
ed22ddbbbb Merge remote-tracking branch 'remotes/gh-upstream/master' into 0.10 2018-01-17 16:42:56 +01:00
sebres
63e906b2c1 regex rewritten: a bit fewer vulnerable now and using non-capturing groups, test-cases extended in order to cover trying of injection on user name 2018-01-17 16:35:32 +01:00
Benedikt Seidl
fed6c49c2d nginx-http-auth: match usernames with spaces 
# Conflicts:
#	ChangeLog
 2018-01-17 16:35:31 +01:00
Sergey G. Brester
b6c6565a7e
regex updated using non-capturing groups 2018-01-16 14:23:47 +01:00
riceru
6a1bbbf101
Update lighttpd-auth.conf 
I have lighttpd 1.4.45 (Debian 9) and auth error log is different.
Now printing mod_auth and not http_auth.
I think that the change was in Lighttp 1.4.42
 2018-01-16 12:39:55 +00:00
sebres
576eeb70dd Merge branch '0.10' into 0.11 2018-01-15 18:17:18 +01:00
sebres
2b7b0da943 Merge remote-tracking branch 'remotes/gh-upstream/master' into 0.10 2018-01-15 18:16:43 +01:00
Serg G. Brester
7e05976ead
action.d/hostsdeny.conf: actionunban rewritten using sed, also dots in IP were escaped now. 
Closes  #2000
 2018-01-11 12:38:34 +01:00
sebres
039ac7c7c4 Merge branch '0.10' into 0.11 2018-01-11 10:29:46 +01:00
sebres
2112145eb4 stop ban of legitimate users with multiple public keys (e. g. git, etc), thereby 
differentiate between "invalid user" (going banned earlier) and valid users with public keys, for which the rejects of not valid public keys (failures) will be retarded up to "Too many authentication failures" resp. disconnect without success (accepted public key).
 2018-01-10 19:07:20 +01:00
sebres
314e402fe0 filter.d/sendmail-auth.conf - extended daemon for Fedora 24/RHEL - the daemon name is "sendmail" (gh-1632) 2018-01-10 14:49:06 +01:00
sebres
0e68c9a720 Merge branch '0.10' into 0.11 2018-01-10 12:22:31 +01:00
sebres
c30144b37a Merge branch '0.9' into 0.10 
# Conflicts:
#	config/action.d/firewallcmd-ipset.conf
#	config/filter.d/asterisk.conf
# Merge-point after cherry-pick, no changes:
#	fail2ban/client/jailreader.py
#	fail2ban/helpers.py
 2018-01-10 12:05:26 +01:00
sebres
131b94e11e firewallcmd-ipset-allports: implemented in action.d/firewallcmd-ipset.conf now (action.d/firewallcmd-ipset-allports.conf removed), usage: 
banaction = firewallcmd-ipset[actiontype="<allports>"]
 2018-01-10 10:58:03 +01:00
Danila Vershinin
c190631f88 New ban action firewallcmd-ipset-allports. Closes #1167 2018-01-10 10:58:01 +01:00
Yannik Sembritzki
94f0b15c32
Allow faster parsing of hosts without ' characters in them 2018-01-08 14:54:32 +01:00
Yannik Sembritzki
b28dfb965a
Fix filter not catching asterisk requests with quote character in username (fixes #2010) 2018-01-03 18:39:30 +01:00
sebres
5028f17f64 Merge branch '0.10' into 0.11, rewrite updateDb because it can be executed after repair, and some tables can be missing. 
# Conflicts:
#	fail2ban/server/database.py
#	fail2ban/tests/fail2banclienttestcase.py
#	fail2ban/tests/sockettestcase.py
 2017-12-22 17:05:45 +01:00
root
79f414c6a2 fix <family> typo 2017-12-09 15:55:45 +01:00
root
7c63eb2378 In the CentOS7 and epel environment, result of "firewall-cmd -direct -get -chains ipv4 filter" is displayed one line 
Changed to be multiple lines with reference to firewallcmd-multiport.conf
 2017-12-09 15:55:45 +01:00
sebres
309a1cb337 restore timeout for ipset-based actions: on some systems ipset created without default timeout may cause "Kernel error received: Unknown error -1" (gh-1994); 
thus new option `default-timeout` introduced (because of dynamical bantime in 0.10, it cannot be used here).
 2017-12-06 02:38:10 +01:00
sebres
6ccaa03e00 action.d/firewallcmd-ipset.conf: extended with actionflush to bulk unban resp. flush ipset 2017-12-06 01:10:56 +01:00
sebres
7e5d8f37fd Merge branch '0.10' into 0.11 
# Conflicts:
#	config/action.d/firewallcmd-ipset.conf
#	fail2ban/server/jail.py
#	fail2ban/tests/servertestcase.py
 2017-12-06 00:14:23 +01:00
sebres
2712f72650 Merge remote-tracking branch 'master' into 0.10 2017-12-06 00:09:52 +01:00
sebres
e384acca5f action.d/firewallcmd-ipset.conf: fixed create of set for ipv6 (missing family inet6) 2017-12-05 23:34:03 +01:00
Kevin Maradona
6c705d572b filter.d/nginx-limit-req.conf: nginx limit-req log-level can be set to warn or error therefore having this regex will include both of them. 2017-12-05 22:31:54 +01:00
sebres
ffd6b9f6de jail.conf: extended with new parameter mode for the filters supporting it; 2017-12-05 16:09:18 +01:00
sebres
2b68882502 filter.d/exim.conf: provides mode "aggressive" to ban flood resp. DDOS-similar failures; 
Closes #1983
 2017-12-05 16:07:53 +01:00
sebres
cc153888d5 Merge branch '0.10' into 0.11 2017-12-01 15:55:10 +01:00
sebres
7f89fbc33f Merge remote-tracking branch 'remotes/gh-upstream/master' into 0.10 2017-12-01 15:53:11 +01:00
Serg G. Brester
4f63180611
Avoid injection using quotes after auth command; 
Added non-greedy fallback for quoted something (with lookahead simulated possessive greedy catch of non-quoted parts `[^"]*(?=")`).
Note that because host-info's are hereafter (with foreign input in-between), we would not use greedy or non-greedy catch-alls (`.*` or `.*?`) here (preventing performance losses).
 2017-11-30 12:32:24 +01:00
Serg G. Brester
f59df2e156
Avoid any injecting on protocol (e. g. tries using camel-case) 
The phrase "AUTH command used when not advertised" is precise enough as anchor here, so prevent by any foreign-input (any auth protocol error).
 2017-11-29 20:55:48 +01:00
Peter Nowee
aa158ac05f
Exim failregex: Include lower/mixed case AUTH 
When reporting the error `AUTH command used when not advertised`, Exim
starts with `SMTP protocol error in "........."`. Here, Exim logs the
SMTP command as it was provided by the connecting client.
https://github.com/Exim/exim/blob/exim-4_89+fixes/src/src/smtp_in.c#L2850

According to RFC 5321 (SMTP) "[..] a command verb [..] MAY be encoded
in upper case, lower case, or any mixture of upper and lower case with
no impact on its meaning."
https://tools.ietf.org/html/rfc5321#section-2.4

Lower case `auth login` brute-force attempts were seen in the wild and
were not caught by the current failregex.

This commit makes the failregex case-insensitive for the `AUTH`
command, so that lower case (`auth`) or mixed case (`aUtH`) now also
match. The failregex was already case-insensitive for the command
arguments (e.g. `AUTH login` already matched).
 2017-11-29 15:14:43 +01:00
SlowRiot
660d57e6ba updating my email address 2017-11-29 10:43:15 +01:00
sebres
5cc0abbb02 Merge branch '0.10' into 0.11 
# Conflicts:
#	fail2ban/tests/fail2banclienttestcase.py
 2017-11-28 16:37:51 +01:00
sebres
76f2865883 implemented new action "action.d/nginx-block-map.conf", used in order to ban not IP-related tickets via nginx (session blacklisting in nginx-location with map-file); 2017-11-28 13:42:41 +01:00
sebres
12b55bb8cc Merge remote-tracking branch '0.10' into 0.11 2017-11-27 12:02:46 +01:00
sebres
f31195a4fc added new logtarget "SYSOUT" to log from fail2ban working in foreground as systemd-service (in opposite to "STDOUT" don't log time-stamps). 2017-11-26 23:03:29 +01:00
sebres
8aeaaf06ee Merge branch '0.10' into 0.11 2017-11-23 22:57:21 +01:00
sebres
159957ab88 filter.d/sshd.conf: extended failregex for modes "extra"/"aggressive": now finds all possible (also future) forms of "no matching (cipher|mac|MAC|compression method|key exchange method|host key type) found", see "ssherr.c" for all possible SSH_ERR_..._ALG_MATCH errors; 
obsolete (multi-line buffered) variant extended also.

Closes gh-1943, gh-1944
 2017-11-23 22:21:42 +01:00
sebres
70b933f405 Merge branch '0.10' into 0.11 2017-11-06 18:57:53 +01:00
sebres
7e756da2b9 Merge remote-tracking branch 'remotes/gh-upstream/master' into 0.10 2017-11-06 18:56:31 +01:00
sebres
eba68a8f37 config/paths-common.conf: Added initial values for syslog_authpriv, syslog_mail in order to avoid errors while parsing/interpolating configuration; 
Note the systemd-backend does not need the logpath at all;
Some defaults normalized (minimized configs, don't need to overwrite values in distribution-related path if equal).
 2017-11-03 14:15:07 +01:00
Serg G. Brester
9876dd44f9 replace port imap3 with imap everywhere, since imap3 is not a standard port and old rarely (if ever) used and missing on some systems 
(see gh-1942)
 2017-11-03 14:03:06 +01:00
Jeff Potter
4a2fc8b7e8 Include imap (port 143) in courier-auth ports 
imap was missing from the list of ports, preventing fail2ban from blocking connections on standard IMAP port 143.
 2017-11-03 14:01:19 +01:00
sebres
12419b75f2 Merge branch '0.10' into 0.11 
# Conflicts:
#	fail2ban/tests/servertestcase.py
 2017-10-30 14:02:41 +01:00
sebres
b615a98540 jail.conf: avoid overwriting of default value of the parameter chain of several actions (where default chain != INPUT); 
test-cases extended to cover the same logic (use `<known/chain>` instead of fix value `INPUT`);
Closes gh-1949
 2017-10-30 13:32:52 +01:00
Serg G. Brester
e07a8cda07 Update jail.conf 
Documentation of parameters for action blocklist_de, closes gh-1940
 2017-10-27 15:26:17 +02:00
Serg G. Brester
1a8fb6290d Merge pull request #1926 from sebres/0.10-pf-actionflush 
action.d/pf.conf: wildcard anchoring example + bulk-unban with command `actionflush`
 2017-10-19 16:35:46 +02:00
sebres
76f5e3659e Merge branch '0.10' into 0.11 2017-10-18 19:03:08 +02:00
sebres
0e66e3cc57 Merge branch 'master' into 0.10 
# Conflicts:
#	config/filter.d/asterisk.conf
 2017-10-18 19:00:23 +02:00
Michael Newton
d5d1fe679f Remove invalid regex 
Resolves #1927
 2017-10-17 14:44:23 -07:00
sebres
a1b863fcf6 action.d/pf.conf: extended with bulk-unban, command actionflush in order to flush all bans at once (by stop jail, resp. shutdown of fail2ban) 2017-10-17 20:12:48 +02:00
sebres
8726c9fb0a pf.conf: enclose ports in braces, multiple ports expecting this syntax ... any port {http, https}. 
Note this would be backwards-incompatible change (for the people already enclosing multiports in braces in jail.local).
closes gh-1915
 2017-10-17 13:46:29 +02:00
Łukasz Wąsikowski
a4f94d2619 Update pf.conf 
Fix comment, because current one won't work:

cat /etc/pf.conf
anchor f2b {
  sshd
}

# service pf reload
Reloading pf rules.
/etc/pf.conf:2: syntax error

New version:

cat /etc/pf.conf
anchor f2b {
  anchor sshd
}

# service pf reload
Reloading pf rules.
 2017-10-17 12:39:25 +02:00
Harry Wood
ea1b663f85 typo 
spell "positive" (...but also somebody should finish this sentence)
 2017-10-16 01:15:58 +01:00
sebres
6c1d481135 Merge branch '0.10' into 0.11 2017-10-04 09:57:43 +02:00
sebres
e71f16f6ba Merge branch 'master' into 0.10 
# Conflicts resolved:
#	config/filter.d/dovecot.conf
 2017-10-04 09:57:18 +02:00
sebres
ea36e1b3fc filter.d/dovecot.conf: fixed failregex to recognize pam_authenticate failures with "Permission denied" (gh-1897) 2017-10-04 09:55:37 +02:00
sebres
037a0be3ae Merge branch '0.10' into 0.11 2017-10-02 15:43:55 +02:00
sebres
8c804a2290 Merge branch 'master' into 0.10 
# Conflicts resolved:
#	config/filter.d/postfix-rbl.conf
#	config/filter.d/postfix-sasl.conf
#	config/filter.d/postfix.conf
#	fail2ban/tests/files/logs/postfix-sasl
 2017-10-02 15:41:30 +02:00
sebres
a2120a9de5 filter.d/postfix-*.conf - added optional port regex (closes gh-1902) 2017-10-02 15:31:55 +02:00
Louis Sautier
152c9d27d5
Fix nftables actions for IPv6 addresses, fixes #1893 
* add [Init?family=inet6] to nftables-common.conf and make nftable
  expressions more modular
* change "ip protocol" to "meta l4proto" in nftables-allports.conf
  since the former only works for IPv4
 2017-09-11 23:32:53 +02:00
sebres
e0fede621e Merge branch '0.10' into 0.11 2017-09-08 11:33:19 +02:00
sebres
b185e7cb04 Merge remote-tracking branch 'upstream/master' into 0.10 2017-09-08 11:11:05 +02:00
Serg G. Brester
fd83260bd8 jail "pass2allow-ftp" should supply blocktype to action 
closes gh-1884
 2017-09-07 18:51:08 +02:00
Serg G. Brester
bb97e66627 Merge pull request #1882 from coderua/patch-1 
Add Jorgee Vulnerability Scanner protect
 2017-09-07 15:52:31 +02:00
Serg G. Brester
2cd02b731b filter.d/exim.conf: fixed failregex for case of D=0s 
Closes gh-1886
 2017-09-07 15:28:46 +02:00
sebres
4bc226a692 optimized regex 2017-09-05 10:59:16 +02:00
Vladimir Chumak
fafefc0293 Add Jorgee Vulnerability Scanner protect 
Details for Jorgee Vulnerability Scanner: https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=30164
 2017-09-05 10:56:43 +02:00
sebres
4163f32968 small review, prefix replaced with %(_apache_error_client)s from apache-common.conf include 2017-09-04 11:48:01 +02:00
john
ac95449bbb changed zoneminder regex as per Sebres and yarikoptic recommendations 2017-09-04 11:37:09 +02:00
john
7013729a1f removed redundant options for zoneminder from jail.conf 2017-09-04 11:37:05 +02:00
john
5c3a666380 fixed incomplete regex after adding anchors 2017-09-04 11:37:03 +02:00
john
3d45fd2713 implemented yarikoptic's suggestions in fail2ban pull request #1376 2017-09-04 11:37:00 +02:00
john
08878d22dd added zoneminder.conf filter 2017-09-04 11:36:50 +02:00
john
a90f6c4ae8 added zoneminder jail and filter 
# Conflicts:
#	config/jail.conf
 2017-09-04 11:36:47 +02:00
sebres
c312962029 filter.d/dovecot.conf: partially cherry-pick to 0.9 PR #1880 from sebres/0.10-fix-dovecot-regex (d926e11a5c) 
fixed failregex (without new mode aggressive)
 2017-09-01 10:57:41 +02:00
sebres
32058ed268 Merge remote-tracking branch 'remotes/gh-upstream/0.10' into 0.11 2017-09-01 10:37:52 +02:00
sebres
2cfc53c08e remove capturing groups 2017-09-01 10:25:09 +02:00
sebres
9b8563f35e - fixes regex for message imap-login: Disconnected (auth failed, X attempts) ... has to many variations on additional info after <HOST>, 
leave it end-anchored because variable part `user=<[^>]*>` (before `<HOST>`) to avoid injecting, but can be safe rewritten using `[^>]*` in opposite to "greedy" `user=<[^>]*>`.
- introduces mode `aggressive` and extends regex for this mode to match:
  * no auth attempts (previously removed in gh-601, because of lots of false positives on misconfigured MTAs)
  * disconnected before auth was ready
  * client didn't finish SASL auth
 2017-09-01 09:56:21 +02:00
Serg G. Brester
a287d0a05c Merge pull request #1872 from kmzby/master 
Added filter for phpMyAdmin+syslog
 2017-08-25 12:22:58 +02:00
Pavel Mihadyuk
4c1abe1cbf phpmyadmin-syslog: removed excess file, fixed test, updated failregex 2017-08-23 16:56:18 +03:00
Pavel Mihadyuk
d09304b897 phpmyadmin-syslog: added default jail config 2017-08-22 19:00:48 +03:00
Pavel Mihadyuk
5b4bc2aafd Added filter for phpMyAdmin+syslog (>=4.7.0). Closes #1713 2017-08-22 18:20:01 +03:00
sebres
b80692f602 Merge branch '0.10' into 0.11 2017-08-18 15:44:43 +02:00
sebres
1d5fbb95ae Merge remote-tracking branch 'remotes/gh-upstream/master' into 0.10 2017-08-18 15:44:22 +02:00
Serg G. Brester
b0e5efb631 bsd-ipfw.conf: sh-compliant redirect of stderr together with stdout 2017-08-18 15:26:09 +02:00
sebres
3be32adefb Replace not posix-compliant grep option: fgrep with -q option can cause 141 exit code in some cases (see gh-1389). 2017-08-18 14:37:29 +02:00
Jacques Distler
f84e58e769 Tweaks to action.d/pf.conf 
Document recent changes.
Add an option to customize the pf block rule (surely, what the user
really wants, here, is "block quick").
 2017-08-18 13:31:34 +02:00
Jacques Distler
d646d06e91 Tweaks to action.d/pf.conf 
Document recent changes.
Add an option to customize the pf block rule (surely, what the user
really wants, here, is "block quick").
 2017-08-17 09:13:32 -05:00
sebres
33874d6e53 action.d/pf.conf: anchored call arguments combined as <pfctl> parameter; 
test cases fixed;
 2017-08-16 17:51:07 +02:00
Alexander Köppe
f6ccede2f1 Update pf.conf fixing #1863 
Fix #1863
Introduce own PF anchors for fail2ban rules.
 2017-08-16 17:51:05 +02:00
sebres
3f83b22de2 action.d/pf.conf: anchored call arguments combined as <pfctl> parameter; 
test cases fixed;
 2017-08-16 11:58:39 +02:00
Alexander Köppe
55baf93635 Update pf.conf fixing #1863 
Fix #1863
Introduce own PF anchors for fail2ban rules.
 2017-08-16 11:33:45 +02:00
Serg G. Brester
b5dd5adb08 Merge pull request #1460 from sebres/0.10-full 
0.11 ban-time-incr
 2017-08-10 15:23:18 +02:00
sebres
30219b54c4 Merge remote-tracking branch 'remotes/gh-upstream/master' into 0.10 2017-08-09 16:38:29 +02:00
Serg G. Brester
c0eb7752a8 Merge pull request #1651 from szepeviktor/patch-9 
Introduce Cloudflare API v4
 2017-08-09 16:28:52 +02:00
Serg G. Brester
2ed8a38eca Update cloudflare.conf 
Switch to API v1 to API v4 per default
 2017-08-09 16:27:53 +02:00
Serg G. Brester
da7072d40e Merge pull request #1846 from Chocobozzz/patch-3 
Fix empty logfile.log in xarf login attack action
 2017-08-09 16:21:47 +02:00
sebres
94b163936a Merge remote-tracking branch 'remotes/gh-upstream/master' into 0.10 
Removed init section (not needed in filter for 0.10).

# Conflicts:
#	config/filter.d/sendmail-reject.conf
 2017-08-09 16:16:31 +02:00
Serg G. Brester
af25a9d203 Merge pull request #1566 from opoplawski/journalmatch 
Add sendmail journalmatch options
 2017-08-09 16:14:10 +02:00
Orion Poplawski
84f552881c Add sendmail journalmatch options 2017-08-09 16:03:34 +02:00
Serg G. Brester
5b7375c614 Merge pull request #1638 from roedie/shorewall-ipv6 
Add shorewall IPv6 support
 2017-08-09 15:54:57 +02:00
sebres
e52f483557 Config reader's: introduced new syntax %(section/option)s, in opposite to extended interpolation of python 3 ${section:option} work with all supported python version in fail2ban and this syntax is like our another features like %(known/option)s, etc.; 
Variable `default_backend` switched to `%(default/backend)s`, so totally backwards compatible now, but now the setting of parameter `backend` in default section of `jail.local` can overwrite default backend also.
Test cases extended: test targeted section options "section/option" (default and cross sections options);
 2017-08-08 20:21:44 +02:00
sebres
5ce8d4f741 fixes default backend handling (as default used value of known/backend, which can now be overridden in default section of jail.local); 
introduces fallback for `known/option`: interpolate missing `known/option` as `option` from default section
 2017-08-08 18:41:15 +02:00
sebres
2fe1479484 Merge branch '_0.9/gh-1849' into 0.10 2017-08-07 18:07:36 +02:00
sebres
5c538fb658 Recognize "unknown user" for additional auth-methods (pam, passwd-file, ldap, sql, etc); simplifying regular expressions (put "unknown user" and "invalid credentials" together as one regex). 2017-08-07 18:04:09 +02:00
sebres
0ef5b7c4d4 small amend to gh-1850: removed greedy catch-all at end. 2017-08-07 15:24:16 +02:00
Marcel Waldvogel
daf57547c6 Parse ejabberd 17.06 output 
E.g.:
2017-07-29 08:24:04.773 [info] <0.6668.0>@ejabberd_c2s:handle_auth_failure:433 (http_bind|ejabberd_bosh) Failed c2s PLAIN authentication for test@example.ch from ::FFFF:192.0.2.3: Invalid username or password
 2017-07-29 19:58:06 +02:00