diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index 96a3ae6a..63e5ce2d 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -20,6 +20,7 @@ failregex = (?:error: PAM: )?Authentication failure for .* from \s*$ [iI](?:llegal|nvalid) user .* from \s*$ User .+ from not allowed because not listed in AllowUsers\s*$ User .+ from not allowed because none of user's groups are listed in AllowGroups\s*$ + sshd(?:\[\d+\])?: refused connect from \S+ \(\)\s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/debian/changelog b/debian/changelog index 5d9e61a1..1b150490 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,12 +1,15 @@ -fail2ban (0.8.1-3~pre2~1.gbp5ac568) UNRELEASED; urgency=low +fail2ban (0.8.1-3~pre2~2.gbpb2ab5f) UNRELEASED; urgency=low + + ** SNAPSHOT build @b2ab5fc085525a29b8a57ac1ad17c510b26f5290 ** * Propagated patch from 0.9 upstream branch: Replaced ssocket.py with asyncore/asynchat implementation. Correct fix for bug #1769616. That is supposed to resolve spontaneous 100% CPU utilization by fail2ban-server. * BF: removed sftp from ssh jails (closes: #436053) + * NF: new filter for 'refused connect' (closes: #451093). Thanks Guido + Bozzetto - - -- Yaroslav Halchenko Sun, 11 Nov 2007 01:12:18 -0500 + -- Yaroslav Halchenko Fri, 23 Nov 2007 09:01:11 -0500 fail2ban (0.8.1-2) unstable; urgency=low diff --git a/debian/patches/00_ssh_strong_re.dpatch b/debian/patches/00_ssh_strong_re.dpatch index 82e8d305..288c11ad 100755 --- a/debian/patches/00_ssh_strong_re.dpatch +++ b/debian/patches/00_ssh_strong_re.dpatch @@ -5,10 +5,10 @@ ## DP: No description. @DPATCH@ -diff -urNad trunk~/config/filter.d/sshd.examples trunk/config/filter.d/sshd.examples ---- trunk~/config/filter.d/sshd.examples 1969-12-31 19:00:00.000000000 -0500 -+++ trunk/config/filter.d/sshd.examples 2007-08-14 19:40:23.000000000 -0400 -@@ -0,0 +1,19 @@ +diff -urNad fail2ban~/config/filter.d/sshd.examples fail2ban/config/filter.d/sshd.examples +--- fail2ban~/config/filter.d/sshd.examples 1969-12-31 19:00:00.000000000 -0500 ++++ fail2ban/config/filter.d/sshd.examples 2007-11-23 08:59:47.000000000 -0500 +@@ -0,0 +1,22 @@ +#1 +Jun 21 16:47:48 digital-mlhhyiqscv sshd[13709]: error: PAM: Authentication failure for myhlj1374 from 192.030.0.6 +May 29 20:56:52 imago sshd[28732]: error: PAM: Authentication failure for stefanor from www.onerussian.com @@ -28,3 +28,6 @@ diff -urNad trunk~/config/filter.d/sshd.examples trunk/config/filter.d/sshd.exam +#5 new filter introduced after looking at 44087D8C.9090407@bluewin.ch +Mar 3 00:17:22 [sshd] User root from 210.188.220.49 not allowed because not listed in AllowUsers +Feb 25 14:34:11 belka sshd[31607]: User root from ferrari.inescn.pt not allowed because not listed in AllowUsers ++ ++#6 ew filter introduced thanks to report Guido Bozzetto ++Nov 11 23:33:27 Server sshd[5174]: refused connect from _U2FsdGVkX19P3BCJmFBHhjLza8BcMH06WCUVwttMHpE=_@::ffff:218.249.210.161 (::ffff:218.249.210.161)