github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Add check in apache-fakegooglebot to protect against PTR fake record 

An attacker may return a PTR record which fakes a Googlebot's domain
name. This modification resolves the PTR records to verify it.

See "Verifying Googlebot":
<https://support.google.com/webmasters/answer/80553?vid=1-635800030504666679-1963774919>
pull/1221/head
Pablo Rodriguez Fernandez 2015-10-13 09:55:28 +02:00 committed by Pablo Rodriguez Fernandez
parent 16443f7b05
commit a28e6b442e
3 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog
View File

@ -32,6 +32,8 @@ ver. 0.9.4 (2015/XX/XXX) - wanna-be-released
* Allow to split ignoreip entries by ',' as well as by ' ' (gh-1197) * Allow to split ignoreip entries by ',' as well as by ' ' (gh-1197)
* Added a timeout (3 sec) to urlopen within badips.py action * Added a timeout (3 sec) to urlopen within badips.py action
(Thanks M. Maraun) (Thanks M. Maraun)
* Added check against atacker's Googlebot PTR fake records
(Thanks Pablo Rodriguez Fernandez)
ver. 0.9.3 (2015/08/01) - lets-all-stay-friends ver. 0.9.3 (2015/08/01) - lets-all-stay-friends
---------- ----------

1
THANKS
View File

@ -89,6 +89,7 @@ Mika (mkl)
Nick Munger Nick Munger
onorua onorua
Orion Poplawski Orion Poplawski
Pablo Rodriguez Fernandez
Paul Marrapese Paul Marrapese
Paul Traina Paul Traina
Noel Butler Noel Butler

5
config/filter.d/ignorecommands/apache-fakegooglebot
View File

@ -26,7 +26,10 @@ def is_googlebot(ip):
from fail2ban.server.filter import DNSUtils from fail2ban.server.filter import DNSUtils
host = DNSUtils.ipToName(ip) host = DNSUtils.ipToName(ip)
sys.exit(0 if (host and re.match('crawl-.*\.googlebot\.com', host)) else 1) if not host or not re.match('crawl-.*\.googlebot\.com', host):
sys.exit(1)
host_ips = DNSUtils.dnsToIp(host)
sys.exit(0 if ip in host_ips else 1)
if __name__ == '__main__': if __name__ == '__main__':
is_googlebot(process_args(sys.argv)) is_googlebot(process_args(sys.argv))