1053 commits

Author	SHA1	Message	Date
Bill	6120a731d9	update nginx limit-req filter again (#4048) ... amend to #4047 - removes unused ngx_limit_con_zones parameter.	2025-08-04 21:16:26 +02:00
Sergey G. Brester	e16e982a45	Merge pull request #4047 from billfor/nginx ... Update nginx-limit-req filter (extended to ban hosts failed by limit connection in ngx_http_limit_conn_module); closes gh-3674	2025-08-04 11:34:35 +02:00
Sergey G. Brester	e6516fd2b3	combine 2 REs to single regex ... closes gh-3674	2025-08-04 11:24:51 +02:00
bill	0a91bf69a5	add filter for delayed requests and connection limiting	2025-08-04 00:27:45 -04:00
sebres	d86a7aecca	amend to #3979: removed mistaken double pipes in group matches	2025-07-31 17:38:28 +02:00
Sergey G. Brester	6d3bfa8781	revert RE back, but relive the end-anchor a bit (ignore any text without single quote, so also preventing false match by injection on foreign data)	2025-07-20 15:04:15 +02:00
177ac	e97df4672a	filter.d/asterisk: fix regex to match "No matching endpoint found" with retry info	2025-07-20 18:05:35 +09:00
sebres	b710d5b6c7	filter.d/sendmail-reject.conf - also recognize "Domain of sender address ... does not resolve"; ... closes gh-4035	2025-07-13 01:03:53 +02:00
Sergey G. Brester	8a4f373617	integrate new RE in already existing (combine new and old format)	2025-06-15 18:07:43 +02:00
Nic Boet	04ff4c060c	Dovecot 2.4 filter support ... Dovecot 2.4 release is a major upgrade Logger event structure has changed, all messages are now prefixed with: "Login aborted: " <reason> "auth failed" Maintain 2.3 support as many folks have yet to migrate, community edition is still receiving cretial security patches Dovecot 2.4.1 Python 3.12.10 Signed-off-by: Nic Boet <nic@boet.cc>	2025-06-13 16:44:57 -05:00
Sergey G. Brester	f7aaaf50b8	filter.d/exim.conf: colon must be outside of F-RCPT group	2025-04-27 23:00:09 +02:00
sebres	c76e90fbb1	* Merge pull request #3940 from exim-pr-mode-more ... `filter.d/exim.conf` - fewer REs by default, introduces mode `more`	2025-04-02 15:11:38 +02:00
Sergey G. Brester	6104444bb4	improve regex (anchored from left, no catch-alls, <ADDR> for IP, etc)	2025-04-01 17:28:58 +02:00
Rajib Sharia	c7f7bc55bb	Create vaultwarden.conf ... Filter for unsuccessful Vaultwarden authentication attempts	2025-04-01 20:36:53 +08:00
sebres	ee421dfbd6	filter.d/apache-noscript.conf - consider new log-format with "AH02811: stderr from /..."; ... closes gh-3900	2025-03-28 22:52:51 +01:00
sebres	8ae6eaf39a	filter.d/postfix.conf - default _daemon in prefix-line is loosened - can match everything starting with word postfix, like postfix-example.com/smtpd; ... closes gh-3297	2025-03-10 22:35:26 +01:00
Sergey G. Brester	c035428535	Merge pull request #3954 from luckylittle/feature/systemd-journal-vsftpd ... `filter.d/vsftpd.conf` - fixed regex (if failures generated by systemd-journal)	2025-03-04 14:20:01 +01:00
sebres	94fe9cf4a8	more fixes, capture user names, more tests... ... since line 7 matches successfully now (it was disabled in gh-358 because of obsolete format), it is marked as match:true (line can be removed later if unneeded)	2025-03-04 14:13:07 +01:00
sebres	1e06ab68b4	fixed filter (new regex is unneeded), tests format of failures produced by system journal	2025-03-04 13:47:59 +01:00
Sergey G. Brester	13a74feaad	2nd RE unneeded, fix single RE - bypass everything before open parenthesis	2025-03-04 13:02:50 +01:00
Lucian Maly	6e3bfd800c	Added author	2025-03-04 12:26:14 +11:00
Lucian Maly	9d7646e6c0	Added author	2025-03-04 12:25:27 +11:00
Lucian Maly	fd1d0d25a8	Added regex for systemd-journal matches of lighttpd-auth	2025-03-04 12:20:24 +11:00
Lucian Maly	65d473fc8e	Added regex for systemd-journal matches of vsftpd	2025-03-04 11:43:38 +11:00
Sergey G. Brester	c88967df2d	filter.d/exim.conf - introduces mode more (several rules moved from mode normal to more), because: ... - they have basically nothing with authentication; - they can cause false positives (e. g. someone sends several mails from google mailing server to wrong recipients and if they would cause "rejected RCPT - Unknown user", the google host gets banned; - to avoid occasional ban of legitimate servers one'd need create large white-list for `ignoreip` or construct complex `ignorecommands` to exclude all legitimate servers of big players (like google, microsoft, GMX, etc);	2025-02-13 21:30:04 +01:00
sebres	882e6d5e00	filter.d/exim.conf - mode aggressive extended to catch dropped by ACL failures, e.g. "ACL: Country is banned"	2025-02-10 17:30:07 +01:00
Sergey G. Brester	6fb3532c45	Merge pull request #3931 from brianjmurrell/patch-2 ... `from '[^']*'` is not always present …	2025-01-30 14:06:00 +01:00
sebres	b55c20594e	paths-common.conf: changed default mysql_log path (default logpath of mysqld-auth jail without maintainer overrides); adjusted comments (log_error_verbosity = 3 instead of log-warnings = 2) ... closes gh-3932	2025-01-30 14:00:43 +01:00
sebres	d2c60a168f	combine several regexes to single RE	2025-01-30 01:13:49 +01:00
sebres	e1fc569291	normalize jail (defaults, etc); added missing tests for all REs; common prefix for failregex, no catch-alls, etc	2025-01-30 01:13:48 +01:00
Philipp Burndorfer	88385eb6c1	New openvpn jail.	2025-01-30 01:13:46 +01:00
Brian J. Murrell	325613a8f8	from '[^']*' is not always present … ... In the message from asterisk. Signed-off-by: Brian J. Murrell <brian@interlinx.bc.ca>	2025-01-28 13:09:29 -05:00
sebres	a796cc9b91	filter.d/dropbear.conf: failregex extended to match different format of "Exit before auth" message; ... closes gh-3791	2024-12-27 16:43:33 +01:00
MichaIng	eb8b44370a	Make Dropbear regex more compatible and simpler ... Dropbear uses `strftime` `"%b %d %H:%M:%S` to print its timestamps, hence we know the day and time format, but the month could be localized. We hence allow any 3 word characters for it, and additionally simplify the day and time pattern into a single group. Signed-off-by: MichaIng <micha@dietpi.com>	2024-12-27 14:00:36 +07:00
MichaIng	dd9f359f5c	Fix Dropbear filter when logging to STDOUT ... Since Debian Bookworm, the distribution ships Dropbear with a native systemd service instead of the default upstream init.d service, and accordingly uses the `-F` and `-E` flags, to run it in foreground and have it logging to STDOUT instead of syslog. As usual, timestamps and also the PID are now included by the log message emitted by Dropbear, in addition to the systemd journal log prefix. The Dropbear filter hence does not match anymore. This commit adds the PID and timestamp as optional pattern between prefix and fail log text, to support Dropbear on Debian Bookworm and newer (and likely new versions of other distros) without breaking the old pattern when running Dropbear without `-E` flag. Additionally, for performance reasons, this commit adds a `journalmatch` entry, matching Debian's and Fedora's `dropbear.service` with `dropbear` executable/identifier, the most likely match for a Dropbear systemd service. Signed-off-by: MichaIng <micha@dietpi.com>	2024-12-27 13:59:35 +07:00
sebres	89b5f3bb1e	filter.d/sshd.conf: ddos and aggressive modes, regex extended for timeout before authentication (optional connection from part); ... closes gh-3907	2024-12-26 14:24:15 +01:00
sebres	91c27d0600	filter.d/freeswitch.conf: bypass some new info in prefix before [WARNING] (changed default _pref_line); ... closes gh-3143	2024-12-04 16:56:23 +01:00
sebres	54c0effceb	filter.d/sshd.conf: amend to #3747/#3812 (new ssh version would log with _COMM=sshd-session)	2024-08-11 12:10:12 +02:00
sebres	c769046a1f	Revert "filterd./sshd.conf: fixed journalmatch (sshd.service seems to be renamed to ssh.service)" - it'd patched in debian branch. ... This reverts commit 6fce23e7ba.	2024-08-11 11:55:39 +02:00
sebres	8e0a2366f0	Fixes unmatched tag (caused unmatched brace); review: combined to single regex, simple case without injection attempts faster, <HOST> replaced with <ADDR> (faster and fewer vulnerable on complex cases, since doesn't match text as hostname) etc.	2024-08-10 13:20:18 +02:00
Maksim Usmanov | Maks	35afe20ea0	Roundcube 1.4 change log format ... From roundcube 1.4 log change format -> e92d8e31a3/program/lib/Roundcube/rcube_imap.php (L194)	2024-08-09 22:53:45 +02:00
sebres	9a558589d7	review (anchoring RE, etc)	2024-07-30 19:16:40 +02:00
Jose	83f2d59eee	match numbers	2024-07-30 19:05:56 +02:00
Jose	07a7da8d8e	Remove greedy catch-all before HOST	2024-07-30 19:05:55 +02:00
Jose	ca45671db2	Add support to Proxmox Web GUI	2024-07-30 19:04:00 +02:00
sebres	93810fff75	consider CONNECT and other rejected commands as a valid _pref; ... closes gh-3800	2024-07-26 19:25:36 +02:00
Sergey G. Brester	50ff131a0f	filter.d/sshd.conf: ungroup (unneeded for _daemon)	2024-07-03 19:35:28 +02:00
Fabian Dellwing	2fed408c05	Adjust sshd filter for OpenSSH 9.8 new daemon name	2024-07-02 08:51:51 +02:00
sebres	59c5e78ce9	filter.d/apache-overflows.conf - consider AH10244: invalid URI path; ... closes gh-3778	2024-06-28 12:50:14 +02:00
sebres	a7f3a04b0e	filter.d/recidive.conf - restore possibility to set jail name in the filter, _jailname is positive now (but by default it uses now negative lookahead to exclude recidive jail); ... closes gh-3769	2024-06-21 13:24:46 +02:00