github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

ENH: add refused zone tranfer to named-refused filter. closes #323

pull/329/head
Daniel Black 2013-08-18 22:19:31 +10:00
parent 2aa8ddea4d
commit 5d451bc4d6
4 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog
View File

@ -61,6 +61,8 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
Steven Hiscocks Steven Hiscocks
* filter.d/dovecot - Addition of session, time values and possible blank * filter.d/dovecot - Addition of session, time values and possible blank
user user
Zurd and Daniel Black
* filter/named-refused - added refused on zone transfer
ver. 0.8.10 (2013/06/12) - wanna-be-secure ver. 0.8.10 (2013/06/12) - wanna-be-secure
----------- -----------

1
THANKS
View File

@ -56,3 +56,4 @@ Yaroslav Halchenko
ykimon ykimon
Yehuda Katz Yehuda Katz
zugeschmiert zugeschmiert
Zurd

1
config/filter.d/named-refused.conf
View File

@ -26,6 +26,7 @@ __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
# Values: TEXT # Values: TEXT
# #
failregex = %(__line_prefix)sclient <HOST>#\S+: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$ failregex = %(__line_prefix)sclient <HOST>#\S+: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
%(__line_prefix)sclient <HOST>#\S+: zone transfer '\S+/AXFR/\w+' denied\s*$
# Option: ignoreregex # Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored. # Notes.: regex to ignore. If this regex matches, the line is ignored.

2
testcases/files/logs/named-refused
View File

@ -10,3 +10,5 @@ Jul 24 14:20:25 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'shi
Jul 24 14:23:36 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'mietberatung.de/NS/IN' denied Jul 24 14:23:36 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'mietberatung.de/NS/IN' denied
# failJSON: { "time": "2005-07-24T14:23:36", "match": true , "host": "62.109.4.89" } # failJSON: { "time": "2005-07-24T14:23:36", "match": true , "host": "62.109.4.89" }
Jul 24 14:23:36 raid5 named[3935]: client 62.109.4.89#9334: view external: query (cache) './NS/IN' denied Jul 24 14:23:36 raid5 named[3935]: client 62.109.4.89#9334: view external: query (cache) './NS/IN' denied
# failJSON: { "time": "2013-08-11T03:36:11", "match": true , "host": "1.2.3.4" }
11-Aug-2013 03:36:11.372 error: client 1.2.3.4#52115: zone transfer 'domain.com/AXFR/IN' denied