github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity
fail2ban/testcases/files/logs/roundcube-auth

25 lines
2.1 KiB
Plaintext
Raw Normal View History

TST: Test sample logs' entries are matched by filter regexs
2013-07-13 22:03:01 +00:00
# failJSON: { "time": "2013-01-22T22:28:21", "match": true , "host": "192.0.43.10" }
NF: roundcube-auth filter (to close Debian #699442, needing debian/jail.conf section)
2013-01-31 19:39:59 +00:00
[22-Jan-2013 22:28:21 +0200]: FAILED login for user1 from 192.0.43.10
TST: Test sample logs' entries are matched by filter regexs
2013-07-13 22:03:01 +00:00
# failJSON: { "time": "2005-05-26T07:12:40", "match": true , "host": "10.1.1.47" }
failregex when roundcube log driver is set to 'syslog'
2013-05-26 05:46:29 +00:00
May 26 07:12:40 hamster roundcube: IMAP Error: Login failed for sales@example.com from 10.1.1.47
ENH: roundcube-auth - adopt for current format with trailing error message. thanks @kwirk for the review/feedback I also used non-greedy .*? for the login portion since not sure if space could be there and trying to minimize possibility of reacting on injected "from <HOST>" somewhere within the trailing .*
2013-07-16 18:45:59 +00:00
# failJSON: { "time": "2005-07-11T03:06:37", "match": true , "host": "1.2.3.4" }
Jul 11 03:06:37 myhostname roundcube: IMAP Error: Login failed for admin from 1.2.3.4. AUTHENTICATE PLAIN: A0002 NO Login failed. in /usr/share/roundcube/program/include/rcube_imap.php on line 205 (POST /wmail/?_task=login&_action=login)
BF/ENH: DoS resistant roundcube-auth with test cases and more variation in IMAP error given
2013-11-12 07:57:01 +00:00
# Made up to attempts to inject a DoS on the server. Assume the user can manipulate the IMAP error response
#
# user = admin from 127.0.0.1
# failJSON: { "time": "2005-07-11T03:06:37", "match": true , "host": "1.2.3.4" }
Jul 11 03:06:37 myhostname roundcube: IMAP Error: Login failed for admin from 127.0.0.1 from 1.2.3.4. AUTHENTICATE PLAIN: A0002 NO Login failed. in /usr/share/roundcube/program/include/rcube_imap.php on line 205 (POST /wmail/?_task=login&_action=login)
#
# IMAP server logs user=${username}
# failJSON: { "time": "2005-07-11T03:06:37", "match": true , "host": "1.2.3.4" }
Jul 11 03:06:37 myhostname roundcube: IMAP Error: Login failed for admin from 127.0.0.1 from 1.2.3.4. AUTHENTICATE PLAIN: A0002 NO Login failed. user=admin from 127.0.0.1 in /usr/share/roundcube/program/include/rcube_imap.php on line 205 (POST /wmail/?_task=login&_action=login)
#
# Old roundcube version - no IMAP response
# failJSON: { "time": "2005-07-11T03:06:37", "match": true , "host": "1.2.3.4" }
Jul 11 03:06:37 myhostname roundcube: IMAP Error: Login failed for admin from 127.0.0.1 from 1.2.3.4
#
# user = admin from 127.0.0.1 in
# failJSON: { "time": "2005-07-11T03:06:37", "match": true , "host": "1.2.3.4" }
Jul 11 03:06:37 myhostname roundcube: IMAP Error: Login failed for admin from 127.0.0.1 in from 1.2.3.4. AUTHENTICATE PLAIN: A0002 NO Login failed. user=admin from 127.0.0.1 in in /usr/share/roundcube/program/include/rcube_imap.php on line 205 (POST /wmail/?_task=login&_action=login)