github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #2950 from sunweaver/pr/scanlogd-filter 

Add support for filtering out detected port scans via scanlogd.
pull/2881/head^2
Sergey G. Brester 2021-04-03 23:36:14 +02:00 committed by GitHub
parent 080dd12288 2d51240b3e
commit 4eba9f2a4b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
config/filter.d/scanlogd.conf Normal file
View File

@ -0,0 +1,17 @@
# Fail2Ban filter for port scans detected by scanlogd
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf
[Definition]
_daemon = scanlogd
failregex = ^%(__prefix_line)s<ADDR>(?::<F-PORT/>)? to \S+ ports\b
ignoreregex =
# Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

4
config/jail.conf
View File

@ -959,3 +959,7 @@ logpath = %(apache_error_log)s
# see `filter.d/traefik-auth.conf` for details and service example. # see `filter.d/traefik-auth.conf` for details and service example.
port = http,https port = http,https
logpath = /var/log/traefik/access.log logpath = /var/log/traefik/access.log
[scanlogd]
logpath = %(syslog_local0)s
banaction = %(banaction_allports)s

8
fail2ban/tests/files/logs/scanlogd Normal file
View File

@ -0,0 +1,8 @@
# failJSON: { "time": "2005-03-05T21:44:43", "match": true , "host": "192.0.2.123" }
Mar 5 21:44:43 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 80, 81, 83, 88, 99, 443, 1080, 3128, ..., f????uxy, TOS 00, TTL 49 @20:44:43
# failJSON: { "time": "2005-03-05T21:44:44", "match": true , "host": "192.0.2.123" }
Mar 5 21:44:44 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 497, 515, 544, 543, 464, 513, ..., fSrpauxy, TOS 00 @09:04:25
# failJSON: { "time": "2005-03-05T21:44:45", "match": true , "host": "192.0.2.123" }
Mar 5 21:44:45 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 593, 548, 636, 646, 625, 631, ..., fSrpauxy, TOS 00, TTL 239 @17:34:00
# failJSON: { "time": "2005-03-05T21:44:46", "match": true , "host": "192.0.2.123" }
Mar 5 21:44:46 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 22, 26, 37, 80, 25, 79, ..., fSrpauxy, TOS 00 @22:38:37