mirror of https://github.com/fail2ban/fail2ban
MRG: merge from master
Daniel Black
commit
1ac7b53cad
78
ChangeLog
78
ChangeLog
|
|
@ -4,7 +4,7 @@
|
|||
|_| \__,_|_|_/___|_.__/\__,_|_||_|
|
||||
|
||||
================================================================================
|
||||
Fail2Ban (version 0.9.0a1) 20??/??/??
|
||||
Fail2Ban (version 0.9.0a1) 2013/??/??
|
||||
================================================================================
|
||||
|
||||
|
||||
|
|
@ -50,35 +50,41 @@ code-review and minor additions from Yaroslav Halchenko.
|
|||
Some filters have been change as required to capture these elements in the
|
||||
right timezone correctly.
|
||||
|
||||
ver. 0.8.11 (2013/11/XXX) - loves-unittests and tight, DoS free, filter regexes
|
||||
ver. 0.8.11 (2013/11/13) - loves-unittests-and-tight-DoS-free-filter-regexes
|
||||
|
||||
In light of CVE-2013-2178 that triggered our last release we have put a
|
||||
significant effort into tightening all of the regexs of our filters to avoid
|
||||
another similar vulnerability. All filters have been updated and some to
|
||||
include more failure regexs supporting previously unbanned failures and
|
||||
support for newer application versions too. There are test cases for most log
|
||||
In light of CVE-2013-2178 that triggered our last release we have put
|
||||
a significant effort into tightening all of the regexs of our filters
|
||||
to avoid another similar vulnerability. All filters have been updated
|
||||
and some to catch more login/authentication failures and to support
|
||||
for newer application versions. There are test cases for most log
|
||||
cases of failures now.
|
||||
|
||||
As usual if you have other examples that demonstrate that a filter is
|
||||
insufficient please give us an example log line on the github issue tracker
|
||||
http://github.com/fail2ban/fail2ban/issues and NOT on a random blog in some
|
||||
obscure corner of the Internet.
|
||||
As usual, if you have other examples that demonstrate that a filter is
|
||||
insufficient, or if we have inadvertently introduced a regression,
|
||||
please provide us with example log lines on the github issue tracker
|
||||
http://github.com/fail2ban/fail2ban/issues and NOT on a random blog in
|
||||
some obscure corner of the Internet.
|
||||
|
||||
During the tightening of the regexs to avoid DoS vulnerabilities there is the
|
||||
possibility that we have inadvertently, despite our best intentions,
|
||||
incorrectly allowed a failure to continue. We will fix this as quickly as
|
||||
humanly possible.
|
||||
Many thanks to our contributors for this release Daniel Black, Yaroslav
|
||||
Halchenko, Steven Hiscocks, Mark McKinstry, Andy Fragen, Orion Poplawski,
|
||||
Alexander Dietrich, JP Espinosa, Jamyn Shanley, Beau Raines, François
|
||||
Boulogne and others who have helped on IRC and mailing list, logged issues
|
||||
and bug requests.
|
||||
|
||||
IMPORTANT incompatible changes:
|
||||
Filter name changes:
|
||||
* 'lighttpd-fastcgi' filter has been renamed to 'suhosin'
|
||||
* 'sasl' has been renamed to 'postfix-sasl'
|
||||
These will require changing in jail.{conf,local} if using these filters.
|
||||
Exim filter has been split into an spam and a relay/auth filter.
|
||||
- IMPORTANT incompatible changes:
|
||||
Filter name changes:
|
||||
* 'lighttpd-fastcgi' filter has been renamed to 'suhosin'
|
||||
* 'sasl' has been renamed to 'postfix-sasl'
|
||||
* 'exim' spam catching failregexes was split out into 'exim-spam'
|
||||
These changes will require changing jail.{conf,local} if any of
|
||||
those filters were used.
|
||||
|
||||
- Fixes:
|
||||
Jonathan Lanning
|
||||
* filter.d/asterisk -- identified another regex for blocking. Also channel
|
||||
ID is hex not decimal as noted in sample logs provided.
|
||||
Daniel Black & Marcel Dopita
|
||||
* filter.d/apache-auth -- fixed and apache auth samples provide. closes #286
|
||||
* filter.d/apache-auth -- fixed and apache auth samples provide. Closes gh-286
|
||||
Yaroslav Halchenko
|
||||
* filter.d/common.conf -- make colon after [daemon] optional. Closes gh-267
|
||||
* filter.d/apache-common.conf -- support apache 2.4 more detailed error
|
||||
|
|
@ -104,10 +110,12 @@ IMPORTANT incompatible changes:
|
|||
* filter.d/asterisk -- more regexes
|
||||
Daniel Black
|
||||
* action.d/hostsdeny -- NOTE: new dependancy 'ed'. Switched to use 'ed' across
|
||||
all platforms to ensure permissions are the same before and after a ban -
|
||||
closes gh-266. hostsdeny supports daemon_list now too.
|
||||
all platforms to ensure permissions are the same before and after a ban.
|
||||
Closes gh-266. hostsdeny supports daemon_list now too.
|
||||
* action.d/bsd-ipfw - action option unsed. Change blocktype to port unreach
|
||||
instead of deny for consistancy.
|
||||
* filter.d/dovecot - added to support different dovecot failure
|
||||
"..disallowed plaintext auth". Closes Debian bug #709324
|
||||
* filter.d/roundcube-auth - timezone offset can be positive or negative
|
||||
* action.d/bsd-ipfw - action option unsed. Fixed to blocktype for
|
||||
consistency. default to port unreach instead of deny
|
||||
|
|
@ -121,13 +129,15 @@ IMPORTANT incompatible changes:
|
|||
* filter.d/recidive -- support f2b syslog target and anchor regex at start
|
||||
* filter.d/mysqld-auth.conf - mysql can use syslog
|
||||
* filter.d/sshd - regex enhancements to support openssh-6.3. Closes Debian
|
||||
bug #722970
|
||||
bug #722970. Thanks Colin Watson for the regex analysis.
|
||||
* filter.d/wuftpd - regex enhancements to support pam and wuftpd. Closes
|
||||
Debian bug #665925
|
||||
Rolf Fokkens
|
||||
* action.d/dshield.conf and complain.conf -- reorder mailx arguments.
|
||||
https://bugzilla.redhat.com/show_bug.cgi?id=998020
|
||||
John Doe (ache)
|
||||
* action.d/bsd-ipfw.conf - invert actionstop logic to make exist status 0.
|
||||
closes gh-343.
|
||||
Closes gh-343.
|
||||
JP Espinosa (Reviewed by O.Poplawski)
|
||||
* files/redhat-initd - rewritten to use stock init.d functions thus
|
||||
avoiding problems with getpid. Also $network and iptables moved
|
||||
|
|
@ -137,8 +147,9 @@ IMPORTANT incompatible changes:
|
|||
|
||||
- New Features:
|
||||
Edgar Hoch
|
||||
* action.d/firewall-cmd-direct-new.conf - action for firewalld
|
||||
* action.d/firewall-cmd-direct-new.conf - action for firewalld
|
||||
from https://bugzilla.redhat.com/show_bug.cgi?id=979622
|
||||
NOTE: requires firewalld-0.3.8+
|
||||
Andy Fragen and Daniel Black
|
||||
* filter.d/osx-ipfw.conf - ipfw action for OSX based on random rule
|
||||
numbers.
|
||||
|
|
@ -147,11 +158,13 @@ IMPORTANT incompatible changes:
|
|||
Daniel Black & ykimon
|
||||
* filter.d/3proxy.conf -- filter added
|
||||
* fail2ban-regex - now generates http://www.debuggex.com urls for debugging
|
||||
regular expressions with the -D parameter.
|
||||
regular expressions with the -D parameter.
|
||||
Daniel Black
|
||||
* filter.d/exim-spam.conf -- a splitout of exim's spam regexes
|
||||
with additions for greater control over filtering spam.
|
||||
* add date expression for apache-2.4 - milliseconds
|
||||
* filter.d/nginx-http-auth -- filter added for http basic authentication
|
||||
failures in nginx. Partially fulfills gh-405.
|
||||
Christophe Carles & Daniel Black
|
||||
* filter.d/perdition.conf -- filter added
|
||||
Mark McKinstry
|
||||
|
|
@ -168,8 +181,8 @@ IMPORTANT incompatible changes:
|
|||
* reorder parsing of jail.conf, jail.d/*.conf, jail.local, jail.d/*.local
|
||||
and likewise for fail2ban.{conf|local|d/*.conf|d/*.local}. Closes gh-392
|
||||
* jail.conf now has asterisk jail - no need for asterisk-tcp and
|
||||
asterisk-udp. Users should replace existing jails with asterisk to
|
||||
reduce duplicate parsing of the asterisk log file.
|
||||
asterisk-udp. Users should replace existing jails with asterisk to
|
||||
reduce duplicate parsing of the asterisk log file.
|
||||
* filter.d/{suhosin,pam-generic,gssftpd,sogo-auth,webmin}- regex anchor at
|
||||
start
|
||||
* filter.d/vsftpd - anchored regex at start. disable old pam format regex
|
||||
|
|
@ -189,6 +202,9 @@ IMPORTANT incompatible changes:
|
|||
* filter.d/roundcube-auth.conf -- anchored version
|
||||
* date matching - for standard asctime formats prefer more detailed
|
||||
first (thus use year if available)
|
||||
* files/gen_badbots was added and filter.d/apache-badbots.conf was
|
||||
regenerated to get updated (although now still an old) list of
|
||||
"bad" bots
|
||||
Alexander Dietrich
|
||||
* action.d/sendmail-common.conf -- added common sendmail settings file
|
||||
and made the sender display name configurable
|
||||
|
|
@ -200,7 +216,7 @@ IMPORTANT incompatible changes:
|
|||
* filter.d/{courier{login,smtp},proftpd,sieve,wuftpd,xinetd} - General
|
||||
regex impovements
|
||||
Zurd
|
||||
* filter.d/postfix - add filter for VRFY failures. closes gh-322.
|
||||
* filter.d/postfix - add filter for VRFY failures. Closes gh-322.
|
||||
Orion Poplawski
|
||||
* fail2ban.d/ and jail.d/ directories are added to etc/fail2ban to facilitate
|
||||
their use
|
||||
|
|
|
|||
107
DEVELOP
107
DEVELOP
|
|
@ -289,15 +289,19 @@ TIP: Some applications log spaces at the end. If you are not sure add \s*$ as
|
|||
the end part of the regex.
|
||||
|
||||
If your regex is not matching, http://www.debuggex.com/?flavor=python can help
|
||||
to tune it:
|
||||
to tune it. fail2ban-regex -D ... will present Debuggex URLs for the regexs
|
||||
and sample log files that you pass into it.
|
||||
|
||||
In general use when using regex debuggers for generating fail2ban filters:
|
||||
* use regex from the ./fail2ban-regex output (to ensure all substitutions are
|
||||
done) and replace <HOST> with (?&.ipv4). Make sure that regex type set to
|
||||
Python;
|
||||
* for the test data put your log output with the time removed;
|
||||
- when you have fixed the regex put it back into your filter file.
|
||||
done)
|
||||
* replace <HOST> with (?&.ipv4)
|
||||
* make sure that regex type set to Python
|
||||
* for the test data put your log output with the date/time removed
|
||||
|
||||
Please spread the good word about debuggex - Serge Toarca is kindly continuing
|
||||
When you have fixed the regex put it back into your filter file.
|
||||
|
||||
Please spread the good word about Debuggex - Serge Toarca is kindly continuing
|
||||
its free availability to Open Source developers.
|
||||
|
||||
Finishing up:
|
||||
|
|
@ -327,7 +331,7 @@ failregex, while matching inserted text to the <HOST> part, they have the
|
|||
ability to deny any host they choose.
|
||||
|
||||
So the <HOST> part must be anchored on text generated by the application, and
|
||||
not the user, to a extent sufficient to prevent user inserting the entire text
|
||||
not the user, to an extent sufficient to prevent user inserting the entire text
|
||||
matching this or any other failregex.
|
||||
|
||||
Ideally filter regex should anchor at the beginning and at the end of log line.
|
||||
|
|
@ -377,7 +381,7 @@ Note if we'd just had the expression:
|
|||
Then provided the user put a space in their command they would have never been
|
||||
banned.
|
||||
|
||||
2. Filter regex can match other user injected data
|
||||
2. Unanchored regex can match other user injected data
|
||||
|
||||
From the Apache vulnerability CVE-2013-2178
|
||||
( original ref: https://vndh.net/note:fail2ban-089-denial-service ).
|
||||
|
|
@ -398,7 +402,82 @@ Now the log line will be:
|
|||
As this log line doesn't match other expressions hence it matches the above
|
||||
regex and blocks 192.168.33.1 as a denial of service from the HTTP requester.
|
||||
|
||||
3. Application generates two identical log messages with different meanings
|
||||
3. Over greedy pattern matching
|
||||
|
||||
From: https://github.com/fail2ban/fail2ban/pull/426
|
||||
|
||||
An example ssh log (simplified)
|
||||
|
||||
Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser remoteuser
|
||||
|
||||
As we assume username can include anything including spaces its prudent to put
|
||||
.* here. The remote user can also exist as anything so lets not make assumptions again.
|
||||
|
||||
failregex = ^%(__prefix_line)sFailed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
|
||||
|
||||
So this works. The problem is if the .* after remote user is injected by the
|
||||
user to be 'from 1.2.3.4'. The resultant log line is.
|
||||
|
||||
Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4
|
||||
|
||||
Testing with:
|
||||
|
||||
fail2ban-regex -v 'Sep 29 17:15:02 Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4' '^ Failed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$'
|
||||
|
||||
TIP: I've removed the bit that matches __prefix_line from the regex and log.
|
||||
|
||||
Shows:
|
||||
|
||||
1) [1] ^ Failed \S+ for .* from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
|
||||
1.2.3.4 Sun Sep 29 17:15:02 2013
|
||||
|
||||
It should of matched 127.0.0.1. So the first greedy part of the greedy regex
|
||||
matched until the end of the string. The was no "from <HOST>" so the regex
|
||||
engine worked backwards from the end of the string until this was matched.
|
||||
|
||||
The result was that 1.2.3.4 was matched, injected by the user, and the wrong IP
|
||||
was banned.
|
||||
|
||||
The solution here is to make the first .* non-greedy with .*?. Here it matches
|
||||
as little as required and the fail2ban-regex tool shows the output:
|
||||
|
||||
fail2ban-regex -v 'Sep 29 17:15:02 Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4' '^ Failed \S+ for .*? from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$'
|
||||
|
||||
1) [1] ^ Failed \S+ for .*? from <HOST>( port \d*)?( ssh\d+)?(: ruser .*)?$
|
||||
127.0.0.1 Sun Sep 29 17:15:02 2013
|
||||
|
||||
So the general case here is a log line that contains:
|
||||
|
||||
(fixed_data_1)<HOST>(fixed_data_2)(user_injectable_data)
|
||||
|
||||
Where the regex that matches fixed_data_1 is gready and matches the entire
|
||||
string, before moving backwards and user_injectable_data can match the entire
|
||||
string.
|
||||
|
||||
Another case:
|
||||
|
||||
ref: https://www.debuggex.com/r/CtAbeKMa2sDBEfA2/0
|
||||
|
||||
A webserver logs the following without URL escaping:
|
||||
|
||||
[error] 2865#0: *66647 user "xyz" was not found in "/file", client: 1.2.3.1, server: www.host.com, request: "GET ", client: 3.2.1.1, server: fake.com, request: "GET exploited HTTP/3.3", host: "injected.host", host: "www.myhost.com"
|
||||
|
||||
regex:
|
||||
|
||||
failregex = ^ \[error\] \d+#\d+: \*\d+ user "\S+":? (?:password mismatch|was not found in ".*"), client: <HOST>, server: \S+, request: "\S+ .+ HTTP/\d+\.\d+", host: "\S+"
|
||||
|
||||
The .* matches to the end of the string. Finds that it can't continue to match
|
||||
", client ... so it moves from the back and find that the user injected web URL:
|
||||
|
||||
", client: 3.2.1.1, server: fake.com, request: "GET exploited HTTP/3.3", host: "injected.host
|
||||
|
||||
In this case there is a fixed host: "www.myhost.com" at the end so the solution
|
||||
is to anchor the regex at the end with a $.
|
||||
|
||||
If this wasn't the case then first .* needed to be made so it didn't capture
|
||||
beyond <HOST>.
|
||||
|
||||
4. Application generates two identical log messages with different meanings
|
||||
|
||||
If the application generates the following two messages under different
|
||||
circumstances:
|
||||
|
|
@ -707,7 +786,7 @@ Which indicates that testcases/files/logs/mysqld.log has been moved or is a dire
|
|||
|
||||
To generate a list of committers use e.g.
|
||||
|
||||
git shortlog -sn 0.8.10.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
|
||||
git shortlog -sn 0.8.11.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
|
||||
|
||||
Ensure the top of the ChangeLog has the right version and current date.
|
||||
|
||||
|
|
@ -730,14 +809,20 @@ Which indicates that testcases/files/logs/mysqld.log has been moved or is a dire
|
|||
http://packages.qa.debian.org/f/fail2ban.html
|
||||
* FreeBSD: Christoph Theis theis@gmx.at>, Nick Hilliard <nick@foobar.org>
|
||||
http://svnweb.freebsd.org/ports/head/security/py-fail2ban/Makefile?view=markup
|
||||
http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
|
||||
* Fedora: Axel Thimm <Axel.Thimm@atrpms.net>
|
||||
https://apps.fedoraproject.org/packages/fail2ban
|
||||
http://pkgs.fedoraproject.org/cgit/fail2ban.git
|
||||
https://admin.fedoraproject.org/pkgdb/acls/bugs/fail2ban
|
||||
* Gentoo: netmon@gentoo.org
|
||||
http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/metadata.xml?view=markup
|
||||
https://bugs.gentoo.org/buglist.cgi?quicksearch=fail2ban
|
||||
* openSUSE: Stephan Kulow <coolo@suse.com>
|
||||
https://build.opensuse.org/package/users?package=fail2ban&project=openSUSE%3AFactory
|
||||
https://build.opensuse.org/package/show/openSUSE:Factory/fail2ban
|
||||
* Mac Ports: @Malbrouck on github (gh-49)
|
||||
https://trac.macports.org/browser/trunk/dports/security/fail2ban/Portfile
|
||||
* Mageia:
|
||||
https://bugs.mageia.org/buglist.cgi?quicksearch=fail2ban
|
||||
An potentially to the fail2ban-users directory.
|
||||
|
||||
# Wait for feedback from distributors
|
||||
|
|
|
|||
2
MANIFEST
2
MANIFEST
|
|
@ -106,6 +106,7 @@ config/filter.d/apache-badbots.conf
|
|||
config/filter.d/apache-nohome.conf
|
||||
config/filter.d/apache-noscript.conf
|
||||
config/filter.d/apache-overflows.conf
|
||||
config/filter.d/nginx-http-auth.conf
|
||||
config/filter.d/courierlogin.conf
|
||||
config/filter.d/couriersmtp.conf
|
||||
config/filter.d/cyrus-imap.conf
|
||||
|
|
@ -206,3 +207,4 @@ files/bash-completion
|
|||
files/fail2ban-tmpfiles.conf
|
||||
files/fail2ban.service
|
||||
files/ipmasq-ZZZzzz_fail2ban.rul
|
||||
files/gen_badbots
|
||||
|
|
|
|||
2
THANKS
2
THANKS
|
|
@ -34,6 +34,7 @@ Guillaume Delvit
|
|||
Hanno 'Rince' Wagner
|
||||
Iain Lea
|
||||
Jonathan Kamens
|
||||
Jonathan Lanning
|
||||
Jonathan Underwood
|
||||
Joël Bertrand
|
||||
JP Espinosa
|
||||
|
|
@ -54,6 +55,7 @@ Michael Hanselmann
|
|||
Nick Munger
|
||||
Patrick Börjesson
|
||||
Raphaël Marichez
|
||||
RealRancor
|
||||
René Berber
|
||||
Robert Edeker
|
||||
Rolf Fokkens
|
||||
|
|
|
|||
|
|
@ -3,7 +3,8 @@
|
|||
# Author: Edgar Hoch
|
||||
# Copied from iptables-new.conf and modified for use with firewalld by Edgar Hoch.
|
||||
# It uses "firewall-cmd" instead of "iptables".
|
||||
# firewall-cmd is based on the command of version firewalld-0.3.4-1.fc19.
|
||||
#
|
||||
# Because of the --remove-rules in stop this action requires firewalld-0.3.8+
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
|
|
@ -15,15 +16,8 @@ actionstart = firewall-cmd --direct --add-chain ipv4 filter fail2ban-<name>
|
|||
firewall-cmd --direct --add-rule ipv4 filter fail2ban-<name> 1000 -j RETURN
|
||||
firewall-cmd --direct --add-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
|
||||
|
||||
# The following rule does not work, because firewalld keeps its own database of firewall rules.
|
||||
# firewall-cmd --direct --passthrough ipv4 -F fail2ban-<name>
|
||||
# The better rule would be the following, but firewall-cmd has not implemented this command with firewalld-0.3.3-2.fc19 .
|
||||
# firewall-cmd --direct --flush-chain ipv4 filter fail2ban-<name>
|
||||
# The following is a workaround using a loop to implement the --flush-chain command.
|
||||
# https://fedorahosted.org/firewalld/ticket/10
|
||||
|
||||
actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state --state NEW -p <protocol> --dport <port> -j fail2ban-<name>
|
||||
( IFS='|' ; for r in $( firewall-cmd --direct --get-rules ipv4 filter fail2ban-<name> | tr '\n' '|' ) ; do eval firewall-cmd --direct --remove-rule ipv4 filter fail2ban-<name> $r ; done )
|
||||
firewall-cmd --direct --remove-rules ipv4 filter fail2ban-<name>
|
||||
firewall-cmd --direct --remove-chain ipv4 filter fail2ban-<name>
|
||||
|
||||
actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -q 'fail2ban-<name>[ \t]'
|
||||
|
|
|
|||
|
|
@ -3,12 +3,12 @@
|
|||
# Regexp to catch known spambots and software alike. Please verify
|
||||
# that it is your intent to block IPs which were driven by
|
||||
# above mentioned bots.
|
||||
|
||||
|
||||
|
||||
[Definition]
|
||||
|
||||
badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou music spider
|
||||
badbots = atSpider/1\.0|autoemailspider|China Local Browse 2\.6|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|MVAClient|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|sogou spider|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|WebVulnCrawl\.blogspot\.com/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
|
||||
badbots = Atomic_Email_Hunter/4\.0|atSpider/1\.0|autoemailspider|bwh3_user_agent|China Local Browse 2\.6|ContactBot/0\.2|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailSpider|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Guestbook Auto Submitter|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LMQueueBot/0\.2|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|MVAClient|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/3\.0 \(compatible; scan4mail \(advanced version\) http\://www\.peterspages\.net/?scan4mail\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|NameOfAgent \(CMS Spider\)|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|ShablastBot 1\.0|snap\.com beta crawler v0|Snapbot/1\.0|Snapbot/1\.0 \(Snap Shots, +http\://www\.snap\.com\)|sogou develop spider|Sogou Orion spider/3\.0\(+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sogou spider|Sogou web spider/3\.0\(+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|VadixBot|WebVulnCrawl\.unknown/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
|
||||
|
||||
failregex = ^<HOST> -.*"(GET|POST).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
|
||||
|
||||
|
|
@ -16,6 +16,6 @@ ignoreregex =
|
|||
|
||||
# DEV Notes:
|
||||
# List of bad bots fetched from http://www.user-agents.org
|
||||
# Generated on Sun Feb 11 01:09:15 EST 2007 by ./badbots.sh
|
||||
# Generated on Thu Nov 7 14:23:35 PST 2013 by files/gen_badbots.
|
||||
#
|
||||
# Author: Yaroslav Halchenko
|
||||
|
|
|
|||
|
|
@ -9,10 +9,16 @@ before = apache-common.conf
|
|||
|
||||
[Definition]
|
||||
|
||||
failregex = ^%(_apache_error_client)s (File does not exist|script not found or unable to stat): /\S*(\.php|\.asp|\.exe|\.pl)\s*$
|
||||
failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): /\S*(\.php|\.asp|\.exe|\.pl)\s*$
|
||||
^%(_apache_error_client)s script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat\s*$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# https://wiki.apache.org/httpd/ListOfErrors for apache error IDs
|
||||
#
|
||||
# Second regex, script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat\s*$ is Before http-2.2
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
|
|
|
|||
|
|
@ -8,8 +8,29 @@ before = apache-common.conf
|
|||
|
||||
[Definition]
|
||||
|
||||
failregex = ^%(_apache_error_client)s (Invalid (method|URI) in request|request failed: URI too long|erroneous characters after protocol string)
|
||||
failregex = ^%(_apache_error_client)s ((AH0013[456]: )?Invalid (method|URI) in request .*( - possible attempt to establish SSL connection on non-SSL port)?|(AH00565: )?request failed: URI too long \(longer than \d+\)|request failed: erroneous characters after protocol string: .*|AH00566: request failed: invalid characters in URI)$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# fgrep -r 'URI too long' httpd-2.*
|
||||
# httpd-2.2.25/server/protocol.c: "request failed: URI too long (longer than %d)", r->server->limit_req_line);
|
||||
# httpd-2.4.4/server/protocol.c: "request failed: URI too long (longer than %d)",
|
||||
#
|
||||
# fgrep -r 'in request' ../httpd-2.* | fgrep Invalid
|
||||
# httpd-2.2.25/server/core.c: "Invalid URI in request %s", r->the_request);
|
||||
# httpd-2.2.25/server/core.c: "Invalid method in request %s", r->the_request);
|
||||
# httpd-2.2.25/docs/manual/rewrite/flags.html.fr:avertissements 'Invalid URI in request'.
|
||||
# httpd-2.4.4/server/core.c: "Invalid URI in request %s", r->the_request);
|
||||
# httpd-2.4.4/server/core.c: "Invalid method in request %s - possible attempt to establish SSL connection on non-SSL port", r->the_request);
|
||||
# httpd-2.4.4/server/core.c: "Invalid method in request %s", r->the_request);
|
||||
#
|
||||
# fgrep -r 'invalid characters in URI' httpd-2.*
|
||||
# httpd-2.4.4/server/protocol.c: "request failed: invalid characters in URI");
|
||||
#
|
||||
# http://svn.apache.org/viewvc/httpd/httpd/trunk/server/core.c?r1=739382&r2=739620&pathrev=739620
|
||||
# ...possible attempt to establish SSL connection on non-SSL port
|
||||
#
|
||||
# https://wiki.apache.org/httpd/ListOfErrors
|
||||
# Author: Tim Connors
|
||||
|
|
|
|||
|
|
@ -6,15 +6,9 @@
|
|||
__pid_re = (?:\[\d+\])
|
||||
|
||||
# All Asterisk log messages begin like this:
|
||||
log_prefix= \[\]\s*(?:NOTICE|SECURITY)%(__pid_re)s:?(?:\[\S+\d*\])? \S+:\d*
|
||||
log_prefix= \[\]\s*(?:NOTICE|SECURITY)%(__pid_re)s:?(?:\[C-[\da-f]*\])? \S+:\d*
|
||||
|
||||
failregex = ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Wrong password$
|
||||
^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - No matching peer found$
|
||||
^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Username/auth name mismatch$
|
||||
^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Device does not match ACL$
|
||||
^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Peer is not supposed to register$
|
||||
^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - ACL error \(permit/deny\)$
|
||||
^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Not a local domain$
|
||||
failregex = ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - (Wrong password|No matching peer found|Username/auth name mismatch|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$
|
||||
^%(log_prefix)s Call from '[^']*' \(<HOST>:\d+\) to extension '\d+' rejected because extension not found in context 'default'\.$
|
||||
^%(log_prefix)s Host <HOST> failed to authenticate as '[^']*'$
|
||||
^%(log_prefix)s No registration for peer '[^']*' \(from <HOST>\)$
|
||||
|
|
@ -22,6 +16,7 @@ failregex = ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?'
|
|||
^%(log_prefix)s Failed to authenticate (user|device) [^@]+@<HOST>\S*$
|
||||
^%(log_prefix)s (?:handle_request_subscribe: )?Sending fake auth rejection for (device|user) \d*<sip:[^@]+@<HOST>>;tag=\w+\S*$
|
||||
^%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"(,Challenge="\w+",ReceivedChallenge="\w+")?(,ReceivedHash="[\da-f]+")?$
|
||||
^\[\]\s*WARNING%(__pid_re)s:?(?:\[C-[\da-f]*\])? Ext\. s: "Rejecting unknown SIP connection from <HOST>"$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ before = common.conf
|
|||
_daemon = (auth|dovecot(-auth)?|auth-worker)
|
||||
|
||||
failregex = ^%(__prefix_line)s(pam_unix(\(dovecot:auth\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
|
||||
^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((no auth attempts|auth failed, \d+ attempts)( in \d+ secs)?|tried to use disabled \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>, lip=(\d{1,3}\.){3}\d{1,3}(, session=<\w+>)?(, TLS( handshaking)?(: Disconnected)?)?\s*$
|
||||
^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((no auth attempts|auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>, lip=(\d{1,3}\.){3}\d{1,3}(, session=<\w+>)?(, TLS( handshaking)?(: Disconnected)?)?\s*$
|
||||
^%(__prefix_line)s(Info|dovecot: auth\(default\)): pam\(\S+,<HOST>\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$
|
||||
|
||||
ignoreregex =
|
||||
|
|
|
|||
|
|
@ -23,8 +23,8 @@ before = common.conf
|
|||
|
||||
_daemon = dropbear
|
||||
|
||||
failregex = ^%(__prefix_line)s[Ll]ogin attempt for nonexistent user ('.*' )?from <HOST>:.*$
|
||||
^%(__prefix_line)s[Bb]ad (PAM )?password attempt for .+ from <HOST>.*$
|
||||
failregex = ^%(__prefix_line)s[Ll]ogin attempt for nonexistent user ('.*' )?from <HOST>:\d+$
|
||||
^%(__prefix_line)s[Bb]ad (PAM )?password attempt for .+ from <HOST>(:\d+)?$
|
||||
^%(__prefix_line)s[Ee]xit before auth \(user '.+', \d+ fails\): Max auth tries reached - user '.+' from <HOST>:\d+\s*$
|
||||
|
||||
ignoreregex =
|
||||
|
|
@ -37,5 +37,12 @@ ignoreregex =
|
|||
#
|
||||
# The second last failregex line we need to match with the modified dropbear.
|
||||
#
|
||||
# For the second regex the following apply:
|
||||
#
|
||||
# http://www.netmite.com/android/mydroid/external/dropbear/svr-authpam.c
|
||||
# http://svn.dd-wrt.com/changeset/16642#file64
|
||||
#
|
||||
# http://svn.dd-wrt.com/changeset/16642/src/router/dropbear/svr-authpasswd.c
|
||||
#
|
||||
# Author: Francis Russell
|
||||
# Zak B. Elep
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ before = exim-common.conf
|
|||
failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
|
||||
^%(pid)s (plain|login) authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
|
||||
^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$
|
||||
^%(pid)s SMTP protocol synchronization error \(.*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
|
||||
^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
|
||||
^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\]:\d+ )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
|
||||
|
||||
ignoreregex =
|
||||
|
|
@ -24,5 +24,9 @@ ignoreregex =
|
|||
# DEV Notes:
|
||||
# The %(host_info) defination contains a <HOST> match
|
||||
#
|
||||
# SMTP protocol synchronization error \([^)]*\) <- This needs to be non-greedy
|
||||
# to void capture beyond ")" to avoid a DoS Injection vulnerabilty as input= is
|
||||
# user injectable data.
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
# Daniel Black (rewrote with strong regexs)
|
||||
|
|
|
|||
|
|
@ -0,0 +1,15 @@
|
|||
# fail2ban filter configuration for nginx
|
||||
|
||||
|
||||
[Definition]
|
||||
|
||||
|
||||
failregex = ^ \[error\] \d+#\d+: \*\d+ user "\S+":? (password mismatch|was not found in ".*"), client: <HOST>, server: \S+, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"\s*$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# DEV NOTES:
|
||||
# Based on samples in https://github.com/fail2ban/fail2ban/pull/43/files
|
||||
# Extensive search of all nginx auth failures not done yet.
|
||||
#
|
||||
# Author: Daniel Black
|
||||
|
|
@ -9,8 +9,21 @@ before = common.conf
|
|||
|
||||
[Definition]
|
||||
|
||||
failregex = ^\s*(\[\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. AUTHENTICATE .*)?\s*$
|
||||
failregex = ^\s*(\[\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. .* in .*?/rcube_imap\.php on line \d+ \(\S+ \S+\))?$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# Author: Teodor Micu & Yaroslav Halchenko & terence namusonge
|
||||
# DEV Notes:
|
||||
#
|
||||
# Source: https://github.com/roundcube/roundcubemail/blob/master/program/lib/Roundcube/rcube_imap.php#L180
|
||||
#
|
||||
# Part after <HOST> comes straight from IMAP server up until the " in ....."
|
||||
# Earlier versions didn't log the IMAP response hence optional.
|
||||
#
|
||||
# DoS resistance:
|
||||
#
|
||||
# Assume that the user can inject "from <HOST>" into the imap response
|
||||
# somehow. Write test cases around this to ensure that the combination of
|
||||
# arbitary user input and IMAP response doesn't inject the wrong IP for
|
||||
# fail2ban
|
||||
#
|
||||
# Author: Teodor Micu & Yaroslav Halchenko & terence namusonge & Daniel Black
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ _daemon = sshd
|
|||
|
||||
failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|error) for .* from <HOST>( via \S+)?\s*$
|
||||
^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
|
||||
^%(__prefix_line)sFailed \S+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?(: (ruser .{0,100}|(\S+ ID \S+ \(serial \d+\) CA )?\S+ %(__md5hex)s(, client user ".{0,100}", client host ".{0,100}")?))?\s*$
|
||||
^%(__prefix_line)sFailed \S+ for .*? from <HOST>(?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ \(serial \d+\) CA )?\S+ %(__md5hex)s(, client user ".*", client host ".*")?))?\s*$
|
||||
^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
|
||||
^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
|
||||
^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*$
|
||||
|
|
@ -33,5 +33,12 @@ maxlines = 10
|
|||
|
||||
journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# "Failed \S+ for .*? from <HOST>..." failregex uses non-greedy catch-all because
|
||||
# it is coming before use of <HOST> which is not hard-anchored at the end as well,
|
||||
# and later catch-all's could contain user-provided input, which need to be greedily
|
||||
# matched away first.
|
||||
#
|
||||
# Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black
|
||||
|
||||
|
|
|
|||
|
|
@ -11,8 +11,11 @@ before = common.conf
|
|||
[Definition]
|
||||
|
||||
_daemon = wu-ftpd
|
||||
__pam_re=\(?pam_unix(?:\(wu-ftpd:auth\))?\)?:?
|
||||
|
||||
failregex = ^%(__prefix_line)sfailed login from \S+ \[<HOST>\]\s*$
|
||||
^%(__prefix_line)s%(__pam_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=(ftp)? ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
|
||||
|
||||
|
||||
ignoreregex =
|
||||
|
||||
|
|
|
|||
|
|
@ -306,18 +306,27 @@ logpath = /var/log/apache*/*access.log
|
|||
bantime = 172800
|
||||
maxretry = 1
|
||||
|
||||
|
||||
[apache-noscript]
|
||||
|
||||
port = http,https
|
||||
logpath = /var/log/apache*/*error.log
|
||||
maxretry = 6
|
||||
|
||||
|
||||
[apache-overflows]
|
||||
|
||||
port = http,https
|
||||
logpath = /var/log/apache*/*error.log
|
||||
maxretry = 2
|
||||
|
||||
|
||||
[nginx-http-auth]
|
||||
|
||||
ports = http,https
|
||||
logpath = /var/log/nginx/error.log
|
||||
|
||||
|
||||
# Ban attackers that try to use PHP's URL-fopen() functionality
|
||||
# through GET/POST variables. - Experimental, with more than a year
|
||||
# of usage in production environments.
|
||||
|
|
@ -349,12 +358,19 @@ logpath = /var/log/roundcube/userlogins
|
|||
|
||||
[sogo-auth]
|
||||
# Monitor SOGo groupware server
|
||||
|
||||
port = http,https
|
||||
# without proxy this would be:
|
||||
# port = 20000
|
||||
|
||||
port = http,https
|
||||
logpath = /var/log/sogo/sogo.log
|
||||
|
||||
|
||||
[3proxy]
|
||||
|
||||
port = 3128
|
||||
logpath = /var/log/3proxy.log
|
||||
|
||||
|
||||
[guacamole]
|
||||
|
||||
port = http,https
|
||||
|
|
@ -378,16 +394,13 @@ action = hostsdeny
|
|||
logpath = /var/log/apache*/*error.log
|
||||
maxretry = 6
|
||||
|
||||
[3proxy]
|
||||
|
||||
port = 3128
|
||||
logpath = /var/log/3proxy.log
|
||||
|
||||
#
|
||||
# FTP servers
|
||||
#
|
||||
|
||||
|
||||
# The hosts.deny path can be defined with the "file" argument if it is
|
||||
# not in /etc.
|
||||
[proftpd]
|
||||
|
||||
port = ftp,ftp-data,ftps,ftps-data
|
||||
|
|
|
|||
|
|
@ -1,4 +1,25 @@
|
|||
# http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=574182
|
||||
# failJSON: { "time": "2010-03-16T15:39:29", "match": true , "host": "58.179.109.179" }
|
||||
[Tue Mar 16 15:39:29 2010] [error] [client 58.179.109.179] Invalid URI in request \xf9h\xa9\xf3\x88\x8cXKj \xbf-l*4\x87n\xe4\xfe\xd4\x1d\x06\x8c\xf8m\\rS\xf6n\xeb\x8
|
||||
# failJSON: { "time": "2010-03-15T15:44:47", "match": true , "host": "121.222.2.133" }
|
||||
[Mon Mar 15 15:44:47 2010] [error] [client 121.222.2.133] Invalid URI in request n\xed*\xbe*\xab\xefd\x80\xb5\xae\xf6\x01\x10M?\xf2\xce\x13\x9c\xd7\xa0N\xa7\xdb%0\xde\xe0\xfc\xd2\xa0\xfe\xe9w\xee\xc4`v\x9b[{\x0c:\xcb\x93\xc6\xa0\x93\x9c`l\\\x8d\xc9
|
||||
|
||||
# http://forum.nconf.org/viewtopic.php?f=14&t=427&p=1488
|
||||
# failJSON: { "time": "2010-07-30T11:23:54", "match": true , "host": "10.85.6.69" }
|
||||
[Fri Jul 30 11:23:54 2010] [error] [client 10.85.6.69] request failed: URI too long (longer than 8190)
|
||||
# failJSON: { "time": "2010-10-27T23:16:37", "match": true , "host": "187.117.240.164" }
|
||||
[Wed Oct 27 23:16:37 2010] [error] [client 187.117.240.164] Invalid URI in request x\xb2\xa1:SMl\xcc{\xfd"\xd1\x91\x84!d\x0e~\xf6:\xfbVu\xdf\xc3\xdb[\xa9\xfe\xd3lpz\x92\xbf\x9f5\xa3\xbbvF\xbc\xee\x1a\xb1\xb0\xf8K\xecE\xbc\xe8r\xacx=\xc7>\xb5\xbd\xa3\xda\xe9\xf09\x95"fd\x1c\x05\x1c\xd5\xf3#:\x91\xe6WE\xdb\xadN;k14;\xdcr\xad\x9e\xa8\xde\x95\xc3\xebw\xa0\xb1N\x8c~\xf1\xcfSY\xd5zX\xd7\x0f\vH\xe4\xb5(\xcf,3\xc98\x19\xefYq@\xd2I\x96\xfb\xc7\xa9\xae._{S\xd1\x9c\xad\x17\xdci\x9b\xca\x93\xafSM\xb8\x99\xd9|\xc2\xd8\xc9\xe7\xe9O\x99\xad\x19\xc3V]\xcc\xddR\xf7$\xaa\xb8\x18\xe0f\xb8\xff
|
||||
|
||||
|
||||
# Could be apache-2.2 or earlier
|
||||
# http://www.aota.net/forums/showthread.php?t=15796
|
||||
# failJSON: { "time": "2003-11-14T16:11:55", "match": true , "host": "1.2.3.4" }
|
||||
[Fri Nov 14 16:11:55 2003] [error] [client 1.2.3.4] request failed: erroneous characters after protocol string: User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; m18) Gecko/20001108 Netscape6/6.0
|
||||
|
||||
# http://forum.directadmin.com/showthread.php?t=22412
|
||||
# failJSON: { "time": "2007-11-15T03:09:59", "match": true , "host": "89.189.71.87" }
|
||||
[Thu Nov 15 03:09:59 2007] [error] [client 89.189.71.87] Invalid method in request NOOP
|
||||
|
||||
# https://issues.apache.org/bugzilla/show_bug.cgi?id=46123
|
||||
# failJSON: { "time": "2008-10-29T11:55:14", "match": true , "host": "127.0.0.1" }
|
||||
[Wed Oct 29 11:55:14 2008] [error] [client 127.0.0.1] Invalid method in request \x16\x03\x01 - possible attempt to establish SSL connection when the server isn't expecting it
|
||||
|
|
|
|||
|
|
@ -40,3 +40,6 @@
|
|||
[2009-12-22 16:35:24] NOTICE[14916]: chan_sip.c:15644 handle_request_subscribe: Sending fake auth rejection for user <sip:CS@192.168.2.102>;tag=6pwd6erg54
|
||||
# failJSON: { "time": "2013-07-06T09:09:25", "match": true , "host": "141.255.164.106" }
|
||||
[2013-07-06 09:09:25] SECURITY[3308] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="1373098165-824497",Severity="Error",Service="SIP",EventVersion="2",AccountID="972592891005",SessionID="0x88aab6c",LocalAddress="IPV4/UDP/92.28.73.180/5060",RemoteAddress="IPV4/UDP/141.255.164.106/5084",Challenge="41d26de5",ReceivedChallenge="41d26de5",ReceivedHash="7a6a3a2e95a05260aee612896e1b4a39"
|
||||
|
||||
# failJSON: { "time": "2013-11-11T14:33:38", "match": true , "host": "192.168.55.152" }
|
||||
[2013-11-11 14:33:38] WARNING[6756][C-0000001d] Ext. s: "Rejecting unknown SIP connection from 192.168.55.152"
|
||||
|
|
|
|||
|
|
@ -12,6 +12,9 @@
|
|||
# failJSON: { "time": "2004-12-12T11:19:11", "match": true , "host": "190.210.136.21" }
|
||||
Dec 12 11:19:11 dunnart dovecot: pop3-login: Aborted login (tried to use disabled plaintext auth): rip=190.210.136.21, lip=113.212.99.193
|
||||
|
||||
# failJSON: { "time": "2004-12-12T11:19:11", "match": true , "host": "190.210.136.21" }
|
||||
Dec 12 11:19:11 dunnart dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): rip=190.210.136.21, lip=113.212.99.193, session=<LgDINsQCkttVIMPg>
|
||||
|
||||
# failJSON: { "time": "2005-06-13T16:30:54", "match": true , "host": "49.176.98.87" }
|
||||
Jun 13 16:30:54 platypus dovecot: imap-login: Disconnected (auth failed, 2 attempts): user=<username.bob>, method=PLAIN, rip=49.176.98.87, lip=113.212.99.194, TLS
|
||||
# failJSON: { "time": "2005-06-14T00:48:21", "match": true , "host": "59.167.242.100" }
|
||||
|
|
|
|||
|
|
@ -4,3 +4,21 @@
|
|||
May 26 07:12:40 hamster roundcube: IMAP Error: Login failed for sales@example.com from 10.1.1.47
|
||||
# failJSON: { "time": "2005-07-11T03:06:37", "match": true , "host": "1.2.3.4" }
|
||||
Jul 11 03:06:37 myhostname roundcube: IMAP Error: Login failed for admin from 1.2.3.4. AUTHENTICATE PLAIN: A0002 NO Login failed. in /usr/share/roundcube/program/include/rcube_imap.php on line 205 (POST /wmail/?_task=login&_action=login)
|
||||
|
||||
# Made up to attempts to inject a DoS on the server. Assume the user can manipulate the IMAP error response
|
||||
#
|
||||
# user = admin from 127.0.0.1
|
||||
# failJSON: { "time": "2005-07-11T03:06:37", "match": true , "host": "1.2.3.4" }
|
||||
Jul 11 03:06:37 myhostname roundcube: IMAP Error: Login failed for admin from 127.0.0.1 from 1.2.3.4. AUTHENTICATE PLAIN: A0002 NO Login failed. in /usr/share/roundcube/program/include/rcube_imap.php on line 205 (POST /wmail/?_task=login&_action=login)
|
||||
#
|
||||
# IMAP server logs user=${username}
|
||||
# failJSON: { "time": "2005-07-11T03:06:37", "match": true , "host": "1.2.3.4" }
|
||||
Jul 11 03:06:37 myhostname roundcube: IMAP Error: Login failed for admin from 127.0.0.1 from 1.2.3.4. AUTHENTICATE PLAIN: A0002 NO Login failed. user=admin from 127.0.0.1 in /usr/share/roundcube/program/include/rcube_imap.php on line 205 (POST /wmail/?_task=login&_action=login)
|
||||
#
|
||||
# Old roundcube version - no IMAP response
|
||||
# failJSON: { "time": "2005-07-11T03:06:37", "match": true , "host": "1.2.3.4" }
|
||||
Jul 11 03:06:37 myhostname roundcube: IMAP Error: Login failed for admin from 127.0.0.1 from 1.2.3.4
|
||||
#
|
||||
# user = admin from 127.0.0.1 in
|
||||
# failJSON: { "time": "2005-07-11T03:06:37", "match": true , "host": "1.2.3.4" }
|
||||
Jul 11 03:06:37 myhostname roundcube: IMAP Error: Login failed for admin from 127.0.0.1 in from 1.2.3.4. AUTHENTICATE PLAIN: A0002 NO Login failed. user=admin from 127.0.0.1 in in /usr/share/roundcube/program/include/rcube_imap.php on line 205 (POST /wmail/?_task=login&_action=login)
|
||||
|
|
|
|||
|
|
@ -108,3 +108,12 @@ Sep 29 17:15:02 spaceman sshd[12946]: Failed hostbased for dan from 127.0.0.1 po
|
|||
|
||||
# failJSON: { "time": "2004-09-29T17:15:02", "match": true , "host": "127.0.0.1" }
|
||||
Sep 29 17:15:02 spaceman sshd[12946]: Failed hostbased for dan from 127.0.0.1 port 45785 ssh2: DSA 01:c0:79:41:91:31:9a:7d:95:23:91:ac:b1:6d:59:81, client user "dan", client host "localhost.localdomain"
|
||||
|
||||
# failJSON: { "time": "2004-09-29T17:15:02", "match": true , "host": "127.0.0.1", "desc": "Injecting into rhost for the format of OpenSSH >=6.3" }
|
||||
Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4
|
||||
|
||||
# failJSON: { "time": "2004-09-29T17:15:02", "match": true , "host": "127.0.0.1", "desc": "Injecting while exhausting initially present {0,100} match length limits set for ruser etc" }
|
||||
Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX from 1.2.3.4
|
||||
|
||||
# failJSON: { "time": "2004-11-11T08:04:51", "match": true , "host": "127.0.0.1", "desc": "Injecting on username ssh 'from 10.10.1.1'@localhost" }
|
||||
Nov 11 08:04:51 redbamboo sshd[2737]: Failed password for invalid user from 10.10.1.1 from 127.0.0.1 port 58946 ssh2
|
||||
|
|
|
|||
|
|
@ -3,3 +3,5 @@
|
|||
Oct 6 09:59:26 myserver wu-ftpd[18760]: failed login from hj-145-173-a8.bta.net.cn [202.108.145.173]
|
||||
# failJSON: { "time": "2004-10-11T16:45:07", "match": true , "host": "198.51.100.71" }
|
||||
Oct 11 16:45:07 ubuntu wu-ftpd[2360]: failed login from example.com [198.51.100.71]
|
||||
# failJSON: { "time": "2005-03-22T09:35:02", "match": true , "host": "198.51.100.71" }
|
||||
Mar 22 09:35:02 SiD wu-ftpd[31278]: pam_unix(wu-ftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=198.51.100.71 user=root
|
||||
|
|
|
|||
|
|
@ -0,0 +1,75 @@
|
|||
#!/bin/bash
|
||||
#-------------------------- =+- Shell script -+= --------------------------
|
||||
#
|
||||
# Yaroslav Halchenko CS@UNM, CS@NJIT
|
||||
# web: http://www.onerussian.com & PSYCH@RUTGERS
|
||||
# e-mail: yoh@onerussian.com ICQ#: 60653192
|
||||
#
|
||||
# DESCRIPTION (NOTES):
|
||||
#
|
||||
# Script to fetch list of agent strings from http://www.user-agents.org
|
||||
# which are known to be from mailicious bots, and create apache-badbots.conf
|
||||
# filter for fail2ban
|
||||
#
|
||||
# COPYRIGHT: Yaroslav Halchenko 2007-2013
|
||||
#
|
||||
# LICENSE:
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the
|
||||
# Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
|
||||
# MA 02110-1301, USA.
|
||||
#
|
||||
# On Debian system see /usr/share/common-licenses/GPL for the full license.
|
||||
#
|
||||
#-----------------\____________________________________/------------------
|
||||
|
||||
url=http://www.user-agents.org/index.shtml
|
||||
badbots=$(
|
||||
for f in "" "?g_m" "?moz" "?n_s" "?t_z"; do
|
||||
wget -q -O- $url$f;
|
||||
done \
|
||||
| grep -h -B4 '<td class="smallcell" nowrap>S </td>'\
|
||||
| sed -e 's/ //g' \
|
||||
| awk '/^--/{getline; gsub(" ",""); print $0}' \
|
||||
| sed -e 's/\([.\:|()]\)/\\\1/g' \
|
||||
| uniq \
|
||||
| tr '\n' '|' \
|
||||
| sed -e 's/|$//g'
|
||||
)
|
||||
|
||||
echo $badbots >| /tmp/badbots.tmp
|
||||
|
||||
cat >| config/filter.d/apache-badbots.conf <<EOF
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# Regexp to catch known spambots and software alike. Please verify
|
||||
# that it is your intent to block IPs which were driven by
|
||||
# above mentioned bots.
|
||||
|
||||
|
||||
[Definition]
|
||||
|
||||
badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou music spider
|
||||
badbots = $badbots
|
||||
|
||||
failregex = ^<HOST> -.*"(GET|POST).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# DEV Notes:
|
||||
# List of bad bots fetched from http://www.user-agents.org
|
||||
# Generated on `date` by $0.
|
||||
#
|
||||
# Author: Yaroslav Halchenko
|
||||
EOF
|
||||
|
|
@ -1,12 +1,12 @@
|
|||
.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.40.12.
|
||||
.TH FAIL2BAN-CLIENT "1" "October 2013" "fail2ban-client v0.8.11.pre1" "User Commands"
|
||||
.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.40.4.
|
||||
.TH FAIL2BAN-CLIENT "1" "November 2013" "fail2ban-client v0.8.11" "User Commands"
|
||||
.SH NAME
|
||||
fail2ban-client \- configure and control the server
|
||||
.SH SYNOPSIS
|
||||
.B fail2ban-client
|
||||
[\fIOPTIONS\fR] \fI<COMMAND>\fR
|
||||
.SH DESCRIPTION
|
||||
Fail2Ban v0.8.11.pre1 reads log file that contains password failure report
|
||||
Fail2Ban v0.8.11 reads log file that contains password failure report
|
||||
and bans the corresponding IP addresses using firewall rules.
|
||||
.SH OPTIONS
|
||||
.TP
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.40.12.
|
||||
.TH FAIL2BAN-REGEX "1" "October 2013" "fail2ban-regex 0.8.11.pre1" "User Commands"
|
||||
.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.40.4.
|
||||
.TH FAIL2BAN-REGEX "1" "November 2013" "fail2ban-regex 0.8.11" "User Commands"
|
||||
.SH NAME
|
||||
fail2ban-regex \- test Fail2ban "failregex" option
|
||||
.SH SYNOPSIS
|
||||
|
|
|
|||
|
|
@ -1,12 +1,12 @@
|
|||
.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.40.12.
|
||||
.TH FAIL2BAN-SERVER "1" "October 2013" "fail2ban-server v0.8.11.pre1" "User Commands"
|
||||
.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.40.4.
|
||||
.TH FAIL2BAN-SERVER "1" "November 2013" "fail2ban-server v0.8.11" "User Commands"
|
||||
.SH NAME
|
||||
fail2ban-server \- start the server
|
||||
.SH SYNOPSIS
|
||||
.B fail2ban-server
|
||||
[\fIOPTIONS\fR]
|
||||
.SH DESCRIPTION
|
||||
Fail2Ban v0.8.11.pre1 reads log file that contains password failure report
|
||||
Fail2Ban v0.8.11 reads log file that contains password failure report
|
||||
and bans the corresponding IP addresses using firewall rules.
|
||||
.PP
|
||||
Only use this command for debugging purpose. Start the server with
|
||||
|
|
|
|||
|
|
@ -0,0 +1,6 @@
|
|||
|
||||
# failJSON: { "time": "2012-04-09T11:53:29", "match": true , "host": "192.0.43.10" }
|
||||
2012/04/09 11:53:29 [error] 2865#0: *66647 user "xyz" was not found in "/var/www/.htpasswd", client: 192.0.43.10, server: www.myhost.com, request: "GET / HTTP/1.1", host: "www.myhost.com"
|
||||
# failJSON: { "time": "2012-04-09T11:53:36", "match": true , "host": "192.0.43.10" }
|
||||
2012/04/09 11:53:36 [error] 2865#0: *66647 user "xyz": password mismatch, client: 192.0.43.10, server: www.myhost.com, request: "GET / HTTP/1.1", host: "www.myhost.com"
|
||||
|
||||
Loading…
Reference in New Issue