From 9eaa2322b0913c805cfa7d45be96d0067ffe61b1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=BCdiger=20Olschewsky?= Date: Mon, 24 Feb 2020 16:35:42 +0100 Subject: [PATCH] Filter and Defaults for Microsoft SQL Server --- config/filter.d/mssql-auth.conf | 15 +++++++++++++++ config/jail.conf | 8 ++++++++ fail2ban/tests/files/logs/mssql-auth | 3 +++ 3 files changed, 26 insertions(+) create mode 100644 config/filter.d/mssql-auth.conf create mode 100644 fail2ban/tests/files/logs/mssql-auth diff --git a/config/filter.d/mssql-auth.conf b/config/filter.d/mssql-auth.conf new file mode 100644 index 000000000..a1813c83d --- /dev/null +++ b/config/filter.d/mssql-auth.conf @@ -0,0 +1,15 @@ +# Fail2Ban filter for failed MSSQL Server authentication attempts + +[Definition] + +failregex = Logon\s+Login failed for user ('.*')(.*)\[CLIENT: \]$ + + +# DEV Notes: +# Tested with SQL Server 2019 on Ubuntu 18.04 +# +# Example: +# 2020-02-24 14:48:55.12 Logon Login failed for user 'root'. Reason: Could not find a login matching the name provided. [CLIENT: 127.0.0.1] +# +# Author: Rüdiger Olschewsky +# \ No newline at end of file diff --git a/config/jail.conf b/config/jail.conf index 20958d11f..aeff3616c 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -786,6 +786,14 @@ logpath = %(mysql_log)s backend = %(mysql_backend)s +[mssql-auth] +# Default configuration for Microsoft SQL Server for Linux +# See the 'mssql-conf' manpage how to change logpath or port +logpath = /var/opt/mssql/log/errorlog +port = 1433 +filter = mssql-auth + + # Log wrong MongoDB auth (for details see filter 'filter.d/mongodb-auth.conf') [mongodb-auth] # change port when running with "--shardsvr" or "--configsvr" runtime operation diff --git a/fail2ban/tests/files/logs/mssql-auth b/fail2ban/tests/files/logs/mssql-auth new file mode 100644 index 000000000..5a97f53ef --- /dev/null +++ b/fail2ban/tests/files/logs/mssql-auth @@ -0,0 +1,3 @@ +2020-02-24 16:05:21.00 Logon Login failed for user 'Backend'. Reason: Could not find a login matching the name provided. [CLIENT: 212.96.131.253] +2020-02-24 16:30:25.88 Logon Login failed for user '===)jf02hüas9ä##22f'. Reason: Could not find a login matching the name provided. [CLIENT: 148.86.203.199] +2020-02-24 16:31:12.20 Logon Login failed for user ''. Reason: An attempt to login using SQL authentication failed. Server is configured for Integrated authentication only. [CLIENT: 105.254.136.171] \ No newline at end of file