filter.d/ignorecommands/apache-fakegooglebot: added timeout parameter (default 55 seconds) - avoid fail with timeout (default 1 minute) by reverse lookup on some slow DNS services (googlebots must be resolved fast);
2021-03-02 19:35:27 +01:00
added possibility to specify more precise default date pattern:
2016-10-17 11:18:30 +02:00
[DATALAD RUNCMD] run codespell throughout fixing typo automagically
2023-11-18 10:04:04 -05:00
Merge remote-tracking branch 'upstream/master' into 0.10
2017-09-08 11:11:05 +02:00
Merge branch 'master' into 0.10
2017-10-18 19:00:23 +02:00
filter.d/apache-common.conf: remote besides client, gh-3622
2024-03-15 22:36:40 +01:00
filter.d/apache-fakegooglebot.conf: better, more precise regex and datepattern (closes possible weakness like #3013 )
2021-05-11 13:47:48 +02:00
updated
2019-04-24 21:35:19 +02:00
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page
2013-10-31 00:02:59 +11:00
filter.d/apache-noscript.conf: extended to match "script not found" with error AH02811 (and cgi-bin path segment in script)
2020-11-23 17:25:41 +01:00
filter.d/apache-overflows.conf - consider AH10244: invalid URI path;
2024-06-28 12:50:14 +02:00
more precise date template handling (WARNING: this commit creates possible incompatibilities):
2016-10-17 11:20:27 +02:00
Merge remote-tracking branch 'remotes/gh-upstream/master' into 0.10
2017-12-01 15:53:11 +01:00
Merge branch '0.9-fix-regex-using-journal' into 0.10-fix-regex-using-journal (merge point against 0.9 after back-porting gh-1660 from 0.10)
2017-01-10 11:25:41 +01:00
Add transport to asterisk RE
2021-01-31 15:22:16 +01:00
review and small tweaks (more precise and safe RE)
2020-11-09 13:43:59 +01:00
Update botsearch-common.conf ( #1759 )
2017-04-26 20:14:39 +02:00
Add Centreon jail
2019-10-24 14:37:18 +02:00
common.conf: fixed typo in comment (rfc5424 for logtype)
2022-05-12 18:09:09 +02:00
added possibility to specify more precise default date pattern:
2016-10-17 11:18:30 +02:00
filter.d/courier-auth.conf: consider optional port after IP, regex is rewritten without catch-all's and right anchor, so it is more stable against further modifications now;
2022-02-09 12:18:23 +01:00
filter.d/courier-smtp.conf: prefregex extended to consider port in log-message (closes gh-2697)
2020-04-21 13:32:17 +02:00
filter.d/cyrus-imap.conf: fixed failregex - accept entries without login-info resp. hostname before IP address
2017-03-09 16:13:45 +01:00
IPv6 fix (second IP logged in form for IPv6); pam authentication failure (part of gh-3410)
2023-12-30 15:10:37 +01:00
added possibility to specify more precise default date pattern:
2016-10-17 11:18:30 +02:00
filter.d/domino-smtp.conf:
2018-09-21 14:14:00 +02:00
fixes gh-3370: resolve extremely long search by repeated apply of non-greedy RE (?:: (?:[^\(]+|\w+\([^\)]*\))+)? with following branches (it may be extremely slow up to infinite search depending on message); added new regression tests
2022-10-04 14:10:45 +02:00
Fix Dropbear filter when logging to STDOUT
2024-12-27 13:59:35 +07:00
more precise RE (avoids weakness with catch-all's and is injection safe)
2021-02-11 18:32:32 +01:00
small amend to gh-1850: removed greedy catch-all at end.
2017-08-07 15:24:16 +02:00
bypass additional pid in prefix (may be logged by syslog-ng, gh-3060); matches protocol error with authentication mechanism not supported
2024-03-25 15:52:06 +01:00
filter.d/exim.conf:
2024-03-25 15:31:23 +01:00
bypass additional pid in prefix (may be logged by syslog-ng, gh-3060); matches protocol error with authentication mechanism not supported
2024-03-25 15:52:06 +01:00
filter.d/freeswitch.conf: bypass some new info in prefix before [WARNING] (changed default _pref_line);
2024-12-04 16:56:23 +01:00
Several filters optimized with pre-filtering using new option prefregex
2017-02-21 15:54:59 +01:00
New Gitlab jail
2020-04-09 16:42:08 +02:00
no catch-alls, user name and error message stored in ticket
2020-11-09 15:36:30 +01:00
ENH: define ignoreregex for all filters explicitly, to avoid warnings ( Closes #934 )
2015-01-30 10:38:28 -05:00
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page
2013-10-31 00:02:59 +11:00
Enhance Guacamole jail
2020-08-25 13:01:50 +02:00
Update haproxy-http-auth.conf
2017-04-11 09:11:08 +02:00
MRG: horde filter from master
2014-01-03 10:34:59 +11:00
Merge remote-tracking branch 'remotes/gh-upstream/master' into 0.10
2017-06-12 13:11:45 +02:00
filter.d/lighttpd-auth.conf: adjusted to the current source code + avoiding catch-all's, etc (gh-3116)
2021-10-01 15:03:24 +02:00
[DATALAD RUNCMD] run codespell throughout fixing typo automagically
2023-11-18 10:04:04 -05:00
filter.d/common.conf: closes gh-2650, avoid substitute of default values in related lt_* section, __prefix_line should be interpolated in definition section (after the config considers all sections that can overwrite it);
2020-03-05 13:47:11 +01:00
more precise anchored RE (also combining all 3 REs in a single regex)
2021-04-14 13:06:58 +02:00
precise regex (left anchor and fewer catch-all's); fixed tests (added failJSON and more tests for some corner-cases around new RE)
2021-04-03 20:16:47 +02:00
filter.d/murmur.conf: fixed detection of failures reading from journal (systemd-backend only):
2018-02-09 11:43:55 +01:00
[DATALAD RUNCMD] run codespell throughout fixing typo automagically
2023-11-18 10:04:04 -05:00
removing the second failregex
2014-02-06 00:22:05 +01:00
loosening for denied suffix (would match no matter which reason in parenthesis);
2024-03-25 16:35:20 +01:00
fix: add journalmatch to nginx filters
2021-04-03 19:20:50 +02:00
fix: add journalmatch to nginx filters
2021-04-03 19:20:50 +02:00
more filters for nginx error-log supporting journal format now, added generalized include and __prefix_line
2023-12-10 15:21:20 +01:00
more filters for nginx error-log supporting journal format now, added generalized include and __prefix_line
2023-12-10 15:21:20 +01:00
more filters for nginx error-log supporting journal format now, added generalized include and __prefix_line
2023-12-10 15:21:20 +01:00
more filters for nginx error-log supporting journal format now, added generalized include and __prefix_line
2023-12-10 15:21:20 +01:00
restore anchor (e. g. catch all in the middle), dot is optional now, RE rewritten a bit more precise
2021-04-03 21:00:14 +02:00
added possibility to specify more precise default date pattern:
2016-10-17 11:18:30 +02:00
ENH: stronger regex for failregex
2013-12-31 08:22:52 +11:00
added possibility to specify more precise default date pattern:
2016-10-17 11:18:30 +02:00
quick optimization: normalizes pam-generic prefregex (more similar to the same regex within sshd-filter) + datepattern anchored now;
2018-03-20 16:00:21 +01:00
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page
2013-10-31 00:02:59 +11:00
more precise date template handling (WARNING: this commit creates possible incompatibilities):
2016-10-17 11:20:27 +02:00
typo
2020-11-23 18:08:38 +01:00
more precise date template handling (WARNING: this commit creates possible incompatibilities):
2016-10-17 11:20:27 +02:00
consider CONNECT and other rejected commands as a valid _pref;
2024-07-26 19:25:36 +02:00
typo
2020-11-23 18:07:49 +01:00
review (anchoring RE, etc)
2024-07-30 19:16:40 +02:00
define journalmatch setting for pure-ftps
2016-03-11 18:19:53 +01:00
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page
2013-10-31 00:02:59 +11:00
filter.d/recidive.conf - restore possibility to set jail name in the filter, _jailname is positive now (but by default it uses now negative lookahead to exclude recidive jail);
2024-06-21 13:24:46 +02:00
Fixes unmatched tag (caused unmatched brace); review: combined to single regex, simple case without injection attempts faster, <HOST> replaced with <ADDR> (faster and fewer vulnerable on complex cases, since doesn't match text as hostname) etc.
2024-08-10 13:20:18 +02:00
New filter: routeros-auth.conf ( Closes #3469 )
2023-03-02 09:25:24 +01:00
small amend: sport after saddr is optional
2021-04-03 23:29:16 +02:00
Removed old svn revision comment
2015-11-02 09:08:47 -08:00
small amend (non capturing group)
2022-11-14 18:56:01 +01:00
[DATALAD RUNCMD] run codespell throughout fixing typo automagically
2023-11-18 10:04:04 -05:00
filter.d/sendmail-auth.conf: detect failures without user part
2022-08-01 09:20:28 +02:00
filter.d/sendmail-reject.conf: fix reverse DNS for ... (gh-3012)
2021-05-29 18:45:59 +02:00
Fix sieve filter to use correct option
2014-07-28 23:42:02 +09:00
gh-3604: filter.d/slapd.conf - switched to single-line processing
2023-10-18 16:06:56 +02:00
small tweaks (both 2nd time and facility are optional, avoid catch-all, etc)
2020-11-09 13:19:25 +01:00
[DATALAD RUNCMD] run codespell throughout fixing typo automagically
2023-11-18 10:04:04 -05:00
Fix a few typos
2014-03-24 13:16:52 +00:00
more precise date template handling (WARNING: this commit creates possible incompatibilities):
2016-10-17 11:20:27 +02:00
added possibility to specify more precise default date pattern:
2016-10-17 11:18:30 +02:00
filter.d/sshd.conf: ddos and aggressive modes, regex extended for timeout before authentication (optional connection from part);
2024-12-26 14:24:15 +01:00
ENH: define ignoreregex for all filters explicitly, to avoid warnings ( Closes #934 )
2015-01-30 10:38:28 -05:00
suhosin.conf: removed greedy match
2017-01-21 16:26:07 +01:00
more precise date template handling (WARNING: this commit creates possible incompatibilities):
2016-10-17 11:20:27 +02:00
[DATALAD RUNCMD] run codespell throughout fixing typo automagically
2023-11-18 10:04:04 -05:00
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page
2013-10-31 00:02:59 +11:00
filter.d/vsftpd.conf: optional reason message after FAIL LOGIN, closes #1543
2016-09-09 09:20:15 +02:00
BF: remove duplication definition secion in webmin-auth
2013-11-04 17:54:36 +11:00
Add filter variable __pam_auth to allow easier changing of pam auth backend
2015-01-27 14:34:27 -07:00
Several filters optimized with pre-filtering using new option prefregex
2017-02-21 15:54:59 +01:00
filter.d/znc-adminlog.conf: support logging format of systemd-journal, bypass port after address (optional, removed end-anchor, see gh-2520)
2019-09-10 21:02:26 +02:00
padding with space, prefregex, regex review (simplifying, capture user name, consider possible space char in user name)
2021-05-21 13:00:24 +02:00
dd9f359f5c