From 8825a5f31b984fe52f705df6cec4720c9c1f0beb Mon Sep 17 00:00:00 2001 From: Markus Oesterle Date: Thu, 16 Apr 2015 19:48:28 +0200 Subject: [PATCH 1/6] updated filter.d/sshd.conf Added line to match sshd auth errors on OpenSuSE systems --- config/filter.d/sshd.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index 6589e21b..f6274a30 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -33,6 +33,7 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|erro ^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked(?P=__prefix)(?:error: )?Received disconnect from : 11: .+ \[preauth\]$ ^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\](?P=__prefix)(?:error: )?Connection closed by \[preauth\]$ ^(?P<__prefix>%(__prefix_line)s)Connection from port \d+(?: on \S+ port \d+)?(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$ + ^%(__prefix_line)spam_unix\(sshd:auth\):\s+authentication failure.*rhost=\s.*$ ignoreregex = From b9a09af914a0cd2a701bc819878aa6cb9bae1a51 Mon Sep 17 00:00:00 2001 From: Markus Oesterle Date: Thu, 16 Apr 2015 21:33:57 +0200 Subject: [PATCH 2/6] Added changes to ChangeLog & updated sample test cases --- ChangeLog | 1 + fail2ban/tests/files/logs/sshd | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/ChangeLog b/ChangeLog index 19eacf83..239d3da9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -40,6 +40,7 @@ ver. 0.9.2 (2014/XX/XXX) - wanna-be-released * firewallcmd-* actions: split output into separate lines for grepping (gh-908) * Guard unicode encode/decode issues while storing records in the database. Fixes "binding parameter error (unsupported type)" (gh-973), thanks to kot for reporting + * filter.d/sshd added regex for matching openSUSE ssh authentication failure - New Features: - New filters: diff --git a/fail2ban/tests/files/logs/sshd b/fail2ban/tests/files/logs/sshd index a6e54196..f1f0d982 100644 --- a/fail2ban/tests/files/logs/sshd +++ b/fail2ban/tests/files/logs/sshd @@ -148,3 +148,8 @@ Apr 27 13:02:04 host sshd[29116]: User root not allowed because account is locke Apr 27 13:02:04 host sshd[29116]: input_userauth_request: invalid user root [preauth] # failJSON: { "time": "2005-04-27T13:02:04", "match": true , "host": "1.2.3.4", "desc": "No Bye-Bye" } Apr 27 13:02:04 host sshd[29116]: Received disconnect from 1.2.3.4: 11: Normal Shutdown, Thank you for playing [preauth] + +# Match sshd auth errors on OpenSUSE systems +# failJSON: { "time": "Thu Apr 16 19:02:50 2015", "match": true , "host": "222.186.21.217", "desc": "Authentification for user failed" } +2015-04-16T18:02:50.321974+00:00 host sshd[2716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.21.217 user=root + From 7a1f1c6b0c8e6f64532be4750a610082144ed635 Mon Sep 17 00:00:00 2001 From: Markus Oesterle Date: Thu, 16 Apr 2015 21:54:57 +0200 Subject: [PATCH 3/6] Fixed the UTC -> CEST difference... --- fail2ban/tests/files/logs/sshd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/tests/files/logs/sshd b/fail2ban/tests/files/logs/sshd index f1f0d982..30073eda 100644 --- a/fail2ban/tests/files/logs/sshd +++ b/fail2ban/tests/files/logs/sshd @@ -150,6 +150,6 @@ Apr 27 13:02:04 host sshd[29116]: input_userauth_request: invalid user root [pre Apr 27 13:02:04 host sshd[29116]: Received disconnect from 1.2.3.4: 11: Normal Shutdown, Thank you for playing [preauth] # Match sshd auth errors on OpenSUSE systems -# failJSON: { "time": "Thu Apr 16 19:02:50 2015", "match": true , "host": "222.186.21.217", "desc": "Authentification for user failed" } +# failJSON: { "time": "2015-04-16T20:02:50", "match": true , "host": "222.186.21.217", "desc": "Authentification for user failed" } 2015-04-16T18:02:50.321974+00:00 host sshd[2716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.21.217 user=root From 6ba389c70c8f7f1ff712ad5abb33c9d20c83eccb Mon Sep 17 00:00:00 2001 From: Markus Oesterle Date: Thu, 16 Apr 2015 23:43:57 +0200 Subject: [PATCH 4/6] Fixed typo in filter description authentification instead of authentication --- fail2ban/tests/files/logs/sshd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/tests/files/logs/sshd b/fail2ban/tests/files/logs/sshd index 30073eda..2f4400bb 100644 --- a/fail2ban/tests/files/logs/sshd +++ b/fail2ban/tests/files/logs/sshd @@ -150,6 +150,6 @@ Apr 27 13:02:04 host sshd[29116]: input_userauth_request: invalid user root [pre Apr 27 13:02:04 host sshd[29116]: Received disconnect from 1.2.3.4: 11: Normal Shutdown, Thank you for playing [preauth] # Match sshd auth errors on OpenSUSE systems -# failJSON: { "time": "2015-04-16T20:02:50", "match": true , "host": "222.186.21.217", "desc": "Authentification for user failed" } +# failJSON: { "time": "2015-04-16T20:02:50", "match": true , "host": "222.186.21.217", "desc": "Authentication for user failed" } 2015-04-16T18:02:50.321974+00:00 host sshd[2716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.21.217 user=root From 5f2807b41f5af5fd9badc32c630117e19784227b Mon Sep 17 00:00:00 2001 From: Markus Oesterle Date: Fri, 17 Apr 2015 10:04:35 +0200 Subject: [PATCH 5/6] replaced .* before rhost with regex matching all the previous fields --- config/filter.d/sshd.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index f6274a30..e69c8622 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -33,7 +33,7 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|erro ^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked(?P=__prefix)(?:error: )?Received disconnect from : 11: .+ \[preauth\]$ ^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\](?P=__prefix)(?:error: )?Connection closed by \[preauth\]$ ^(?P<__prefix>%(__prefix_line)s)Connection from port \d+(?: on \S+ port \d+)?(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$ - ^%(__prefix_line)spam_unix\(sshd:auth\):\s+authentication failure.*rhost=\s.*$ + ^%(__prefix_line)spam_unix\(sshd:auth\):\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=\S*\s*rhost=.*$ ignoreregex = From f8c7247f42ebfac4e5ad761b14898cc9324ed438 Mon Sep 17 00:00:00 2001 From: Markus Oesterle Date: Fri, 17 Apr 2015 10:22:01 +0200 Subject: [PATCH 6/6] added \s after host --- config/filter.d/sshd.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index e69c8622..b000cd49 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -33,7 +33,7 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|erro ^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked(?P=__prefix)(?:error: )?Received disconnect from : 11: .+ \[preauth\]$ ^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\](?P=__prefix)(?:error: )?Connection closed by \[preauth\]$ ^(?P<__prefix>%(__prefix_line)s)Connection from port \d+(?: on \S+ port \d+)?(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$ - ^%(__prefix_line)spam_unix\(sshd:auth\):\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=\S*\s*rhost=.*$ + ^%(__prefix_line)spam_unix\(sshd:auth\):\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=\S*\s*rhost=\s.*$ ignoreregex =