github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Use anchored failregex for filters to avoid possible DoS -- couriersmtp.conf

pull/757/head
Yaroslav Halchenko 2014-06-22 12:00:41 -04:00
parent ed0ac76b0d
commit 369fb55c6d
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
config/filter.d/couriersmtp.conf
View File

@ -5,6 +5,12 @@
# $Revision$ # $Revision$
# #
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf
[Definition] [Definition]
# Option: failregex # Option: failregex
@ -14,7 +20,10 @@
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT # Values: TEXT
# #
failregex = error,relay=<HOST>,.*550 User unknown _daemon = courieresmtpd
failregex = ^%(__prefix_line)serror,relay=<HOST>,.*: 550 User unknown\.$
# Option: ignoreregex # Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored. # Notes.: regex to ignore. If this regex matches, the line is ignored.

1
debian/changelog vendored
View File

@ -7,6 +7,7 @@ fail2ban (0.8.6-3wheezy3) wheezy-security; urgency=high
"postfix/smtpd" prefix in the log line "postfix/smtpd" prefix in the log line
- CVE-2013-7177: cyrus-imap.conf - anchored on the front, and - CVE-2013-7177: cyrus-imap.conf - anchored on the front, and
refactored to have a single failregex refactored to have a single failregex
- couriersmtp.conf - anchored on both sides
-- Yaroslav Halchenko <debian@onerussian.com> Sun, 22 Jun 2014 11:56:54 -0400 -- Yaroslav Halchenko <debian@onerussian.com> Sun, 22 Jun 2014 11:56:54 -0400