prehistoric-systems/fail2ban
1
0
Fork 0
mirror of https://github.com/fail2ban/fail2ban.git synced 2026-03-11 08:55:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
3307 commits 34 branches 230 tags 22 MiB
Commit graph

555 commits

Author SHA1 Message Date
Yaroslav Halchenko
26dd6d7425 Merge pull request #1258 from aleksandrs-ledovskis/feature/postfix-domain-not-found-failregex 
Add 'Sender address rejected: Domain not found' Postfix failregex
 2015-12-18 09:23:54 -05:00
Ross Brown
8d12dba245 Merge remote-tracking branch 'upstream/master' 2015-12-17 18:01:17 +00:00
Ross Brown
ead2d509dc Updated 'murmur' filter to use new double-anchored regex based on @yarikoptic's suggestions. 2015-12-17 17:45:24 +00:00
Yaroslav Halchenko
5d6cead996 ENH: sshd filter -- match new "maximum auth attempts exceeded" (Closes #1269) 2015-12-13 23:21:04 -05:00
Ross Brown
106c3eab9a Added filter and jail for murmur/mumble-server. 2015-11-29 15:56:56 +00:00
Aleksandrs Ļedovskis
fa59a6850f Add 'Sender address rejected: Domain not found' Postfix failregex 
Signed-off-by: Aleksandrs Ļedovskis <aleksandrs@ledovskis.lv>
 2015-11-22 12:01:15 +02:00
sebres
53b39162a1 Shortly, much faster and stable version of regexp (possible because expression is start-anchored and does not contains closely to catch-all sub expressions) 2015-10-29 23:55:23 +01:00
sebres
6884593ab8 New filter nginx-limit-req ban hosts, that were failed through nginx by limit request processing rate (ngx_http_limit_req_module) 2015-10-29 23:15:20 +01:00
1technophile
2861a957a9 filter for openhab domotic software authentication failure with the rest api and web interface + test cases; 
closes gh-1223
 2015-10-26 15:48:23 +01:00
Pablo Rodriguez Fernandez
2c576c64f8 Change domain filter regex 
Change domain filter regex since there are other Google crawlers.
See "Google crawlers"
<https://support.google.com/webmasters/answer/1061943?hl=en>
 2015-10-20 10:46:00 +02:00
Pablo Rodriguez Fernandez
74fcb219ab Enhanced Google domain detection in apache-fakegooglebot 
Previously, an attacker could fake a domain like
crawl-1-1-1-1.googlebot.com.fake.net and get resolved. This change
avoids to resolve fake Google domains.
 2015-10-20 10:45:53 +02:00
Pablo Rodriguez Fernandez
a28e6b442e Add check in apache-fakegooglebot to protect against PTR fake record 
An attacker may return a PTR record which fakes a Googlebot's domain
name. This modification resolves the PTR records to verify it.

See "Verifying Googlebot":
<https://support.google.com/webmasters/answer/80553?vid=1-635800030504666679-1963774919>
 2015-10-13 17:11:49 +02:00
sebres
2696ede251 mysqld-auth: Updated "Access denied ..." regex for MySQL 5.6 and later 
closes gh-1211
 2015-10-07 14:34:13 +02:00
Kevin Locke
36919d9f97 ssh.conf: Fix disconnect "Auth fail" matching 
The regex for matching against "Auth fail" disconnect log message does
not match against current versions of ssh.  OpenSSH 5.9 introduced
privilege separation of the pre-auth process, which included
[logging through monitor.c](http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/monitor.c.diff?r1=1.113&r2=1.114)
which adds " [preauth]" to the end of each message and causes the log
level to be prepended to each message.

It also fails to match against clients which send a disconnect message
with a description that is either empty or includes a space, since this
is the content in the log message after the disconnect code, per
[packet.c:1785](http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/packet.c?annotate=1.215),
which was matched by \S+.  Although I have not observed this yet, I
couldn't find anything which would preclude it in [RFC
4253](https://tools.ietf.org/html/rfc4253#section-11.1) and since the
message is attacker-controlled it provides a way to avoid getting
banned.

This commit fixes both issues.

Signed-off-by: Kevin Locke <kevin@kevinlocke.name>
 2015-10-02 15:46:29 -07:00
Edward Beckett
835b3ff483 Update apache-badbots.conf 
Useragent strings including `+http` need to be escaped to be valid.
 2015-09-05 00:12:28 -04:00
Viktor Szépe
5d60700c0c Added pass2allow (knocking with fail2ban) 2015-07-10 16:22:43 +02:00
Viktor Szépe
a3b8257b73 Add HEAD method verb to apache-badbots, nginx-badbots 2015-07-07 17:45:40 +02:00
Lee Clemens
f7444f16b8 Add optional session id prefix for roundcube 1.1.1 2015-07-04 11:06:51 -04:00
Lee Clemens
2796534a5d Update regex to work with roundcube 1.0.5 on CentOS 6 2015-07-04 11:02:04 -04:00
Yaroslav Halchenko
345820d2aa Merge pull request #1056 from ipoddubny/asterisk_security_log 
Fix support for Asterisk security log
 2015-05-25 12:50:13 -04:00
Yaroslav Halchenko
f41872f034 Merge pull request #1013 from szepeviktor/patch-4 
Non-US locale warning for proftpd
 2015-05-25 10:51:51 -04:00
Yaroslav Halchenko
eb091d9b8c Merge remote-tracking branch 'origin/master' into pr-1039 
* origin/master:
  minor: no tripple empty lines
  add froxlor-auth filter and jail
  add froxlor-auth filter and jail 0
  add froxlor-auth filter and jail
  BF: Fix fail2ban-regex not parsing journalmatch correctly
 2015-05-25 10:50:34 -04:00
Joern Muehlencord
964cdb5d9b add froxlor-auth filter and jail 2015-05-25 13:44:50 +02:00
Ivan Poddubny
7a4e6fa6e5 Asterisk security log: add support for websocket protocol events 
Thanks to @kcormier.
 2015-05-25 08:13:30 +03:00
Ivan Poddubny
988d9a08da Asterisk security log: accept events containing Response/ExpectedResponse 
Event containing Challenge may come without ReceivedChallenge, but with
Response and ExpectedResponse.
Also Challenge now accepts '/' character, since it is used at least by PJSIP.
 2015-05-25 08:12:51 +03:00
Ivan Poddubny
189265a323 Asterisk security log: accept SessionID of PJSIP events 
Unlike chan_sip and manager, PJSIP populates SessionID using
Call-Id header of a related SIP message.
As Call-Id of a SIP message can contain almost anything,
the regular expression for SessionID has been loosened.
 2015-05-25 08:11:34 +03:00
Ivan Poddubny
ab2ac1a367 Asterisk security log: accept <unknown> in AccountID 2015-05-24 12:47:55 +03:00
Ivan Poddubny
977f9955e7 Asterisk security log: accept EventTV in ISO8601 
Asterisk uses ISO8601 dates in security log since version 12.

Closes #988
 2015-05-24 12:46:54 +03:00
Anton Shestakov
56e5821c06 Match unknown user in dovecot's passwd-file auth database 2015-04-30 16:53:10 +08:00
Lee Clemens
8f792f52fb Add drupal-auth filter and jail 2015-04-27 13:10:27 -04:00
Lee Clemens
b530d88eca Merge remote-tracking branch 'upstream/master' into bf/1000-asteriskBlocksSelf 
Conflicts:
	ChangeLog
 2015-04-26 15:13:59 -04:00
Markus Oesterle
f8c7247f42 added \s after host 2015-04-17 10:22:01 +02:00
Markus Oesterle
5f2807b41f replaced .* before rhost with regex matching all the previous fields 2015-04-17 10:04:35 +02:00
Markus Oesterle
8825a5f31b updated filter.d/sshd.conf 
Added line to match sshd auth errors on OpenSuSE systems
 2015-04-16 19:48:28 +02:00
Viktor Szépe
e776a4e1ab Update proftpd.conf 2015-04-08 15:57:39 +02:00
Viktor Szépe
f9e8a99a79 Non-US locale warning for proftpd 2015-04-06 17:04:41 +02:00
Lee Clemens
72f4bcfbff Match hacking attempt IP instead of asterisk server IP (closes #1000) 2015-03-24 19:03:26 -04:00
František Šumšal
eb0d086ed0 Merge branch 'master' into nginx-botsearch 2015-02-04 02:13:33 +01:00
Orion Poplawski
e7ff7e90b7 [postfix-sasl] update regexes 
- Add : to match "SASL LOGIN authentication failed: Password:"
- Add ignoreregex to ignore system authentication issues:
  "warning: unknown[1.1.1.1]: SASL LOGIN authentication failed: Connection lost to authentication server"
- Add test log messages for both
 2015-02-03 11:30:16 -07:00
František Šumšal
fb0f463eac Include consistency 2015-02-03 15:54:05 +01:00
František Šumšal
705718be52 Filter apache-botsearch.conf now loads variables from botsearch-common.conf 2015-02-03 04:44:33 +01:00
František Šumšal
18778d9174 Created botsearch-common.conf 
File contains variables used in -botsearch filters
 2015-02-03 04:25:47 +01:00
Yaroslav Halchenko
73af02ffc6 Merge pull request #940 from leeclemens/ENH/ApacheFakeGoogleBot 
New jail: apache-fakegooglebot
 2015-02-02 21:44:04 -05:00
Yaroslav Halchenko
df581fe6e2 Merge pull request #929 from opoplawski/pam_auth 
Add filter variable __pam_auth to allow customize for setups with multiple authorization schemes (Close #928)
 2015-02-02 21:42:10 -05:00
Yaroslav Halchenko
7ada96b4e9 Merge pull request #932 from opoplawski/dovecot 
Dovecot - dovecot auth failure from EL7
 2015-02-02 21:37:28 -05:00
František Šumšal
f8fe165cd2 Switched from tabs to spaces for indents 2015-02-03 03:35:22 +01:00
Lee Clemens
841c476045 Merge branch 'enh/fakegooglebot' of https://github.com/yarikoptic/fail2ban into yarikoptic-enh/fakegooglebot 
Conflicts:
	config/filter.d/ignorecommands/apache-fakegooglebot
 2015-02-02 13:01:23 -05:00
Yaroslav Halchenko
15b65c7ad2 NF: apache-fakegooglebot ignorecommand + DNSUtils.ipToName 2015-02-02 12:19:20 -05:00
Lee Clemens
7e94ba6f0c Remove implementation specific suffix 2015-02-02 11:43:05 -05:00
Lee Clemens
af078532ac New jail: apache-fakegooglebot 
Detects fake googlebot user agents in apache access log
 2015-02-02 00:42:01 -05:00