mirror of https://github.com/fail2ban/fail2ban
sebres
8 years ago
17 changed files with 165 additions and 27 deletions
@ -0,0 +1,49 @@
|
||||
# Fail2Ban filter for unsuccesfull MongoDB authentication attempts |
||||
# |
||||
# Logfile /var/log/mongodb/mongodb.log |
||||
# |
||||
# add setting in /etc/mongodb.conf |
||||
# logpath=/var/log/mongodb/mongodb.log |
||||
# |
||||
# and use of the authentication |
||||
# auth = true |
||||
# |
||||
|
||||
[Definition] |
||||
#failregex = ^\s+\[initandlisten\] connection accepted from <HOST>:\d+ \#(?P<__connid>\d+) \(1 connection now open\)<SKIPLINES>\s+\[conn(?P=__connid)\] Failed to authenticate\s+ |
||||
failregex = ^\s+\[conn(?P<__connid>\d+)\] Failed to authenticate [^\n]+<SKIPLINES>\s+\[conn(?P=__connid)\] end connection <HOST> |
||||
|
||||
ignoreregex = |
||||
|
||||
|
||||
[Init] |
||||
maxlines = 10 |
||||
|
||||
# DEV Notes: |
||||
# |
||||
# Regarding the multiline regex: |
||||
# |
||||
# There can be a nunber of non-related lines between the first and second part |
||||
# of this regex maxlines of 10 is quite generious. |
||||
# |
||||
# Note the capture __connid, includes the connection ID, used in second part of regex. |
||||
# |
||||
# The first regex is commented out (but will match also), because it is better to use |
||||
# the host from "end connection" line (uncommented above): |
||||
# - it has the same prefix, searching begins directly with failure message |
||||
# (so faster, because ignores success connections at all) |
||||
# - it is not so vulnerable in case of possible race condition |
||||
# |
||||
# Log example: |
||||
# 2016-10-20T09:54:27.108+0200 [initandlisten] connection accepted from 127.0.0.1:53276 #1 (1 connection now open) |
||||
# 2016-10-20T09:54:27.109+0200 [conn1] authenticate db: test { authenticate: 1, nonce: "xxx", user: "root", key: "xxx" } |
||||
# 2016-10-20T09:54:27.110+0200 [conn1] Failed to authenticate root@test with mechanism MONGODB-CR: AuthenticationFailed UserNotFound Could not find user root@test |
||||
# 2016-11-09T09:54:27.894+0100 [conn1] end connection 127.0.0.1:53276 (0 connections now open) |
||||
# 2016-11-09T11:55:58.890+0100 [initandlisten] connection accepted from 127.0.0.1:54266 #1510 (1 connection now open) |
||||
# 2016-11-09T11:55:58.892+0100 [conn1510] authenticate db: admin { authenticate: 1, nonce: "xxx", user: "root", key: "xxx" } |
||||
# 2016-11-09T11:55:58.892+0100 [conn1510] Failed to authenticate root@admin with mechanism MONGODB-CR: AuthenticationFailed key mismatch |
||||
# 2016-11-09T11:55:58.894+0100 [conn1510] end connection 127.0.0.1:54266 (0 connections now open) |
||||
# |
||||
# Authors: Alexander Finkhäuser |
||||
# Sergey G. Brester (sebres) |
||||
|
||||
@ -1,5 +1,5 @@
|
||||
# failJSON: { "time": "2013-12-23T13:12:31", "match": true , "host": "173.255.225.101" } |
||||
[Mon Dec 23 13:12:31 2013] [error] [client 173.255.225.101] ModSecurity: [file "/etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "47"] [id "960015"] [rev "1"] [msg "Request Missing an Accept Header"] [severity "NOTICE"] [ver "OWASP_CRS/2.2.8"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_ACCEPT"] [tag "WASCTC/WASC-21"][tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [hostname "www.mysite.net"] [uri "/"] [unique_id "Urf@f12qgHIAACrFOlgAAABA"] |
||||
|
||||
# failJSON: { "time": "2013-12-28T09:18:05", "match": true , "host": "32.65.254.69" } |
||||
[Sat Dec 28 09:18:05 2013] [error] [client 32.65.254.69] ModSecurity: [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "635"] [id "340069"] [rev "4"] [msg "Atomicorp.com UNSUPPORTED DELAYED Rules: Web vulnerability scanner"] [severity "CRITICAL"] Access denied with code 403 (phase 2). Pattern match "(?:nessus(?:_is_probing_you_|test)|^/w00tw00t\\\\.at\\\\.)" at REQUEST_URI. [hostname "192.81.249.191"] [uri "/w00tw00t.at.blackhats.romanian.anti-sec:)"] [unique_id "4Q6RdsBR@b4AAA65LRUAAAAA"] |
||||
# failJSON: { "time": "2013-12-28T09:18:05", "match": true , "host": "32.65.254.69", "desc": "additional entry (and exact one space)" } |
||||
[Sat Dec 28 09:18:05 2013] [error] [client 32.65.254.69] ModSecurity: [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "635"] [id "340069"] [rev "4"] [msg "Atomicorp.com UNSUPPORTED DELAYED Rules: Web vulnerability scanner"] [severity "CRITICAL"] Access denied with code 403 (phase 2). Pattern match "(?:nessus(?:_is_probing_you_|test)|^/w00tw00t\\\\.at\\\\.)" at REQUEST_URI. [hostname "192.81.249.191"] [uri "/w00tw00t.at.blackhats.romanian.anti-sec:)"] [unique_id "4Q6RdsBR@b4AAA65LRUAAAAA"] |
||||
|
||||
@ -0,0 +1,30 @@
|
||||
# failJSON: { "match": false } |
||||
2016-11-20T00:04:00.110+0100 [conn1] Failed to authenticate root@admin with mechanism MONGODB-CR: AuthenticationFailed UserNotFound Could not find user root@admin |
||||
# failJSON: { "time": "2016-11-20T00:04:00", "match": true , "host": "192.0.2.35" } |
||||
2016-11-20T00:04:00.111+0100 [conn1] end connection 192.0.2.35:53276 (0 connections now open) |
||||
|
||||
# failJSON: { "match": false } |
||||
2016-11-20T00:24:00.110+0100 [conn5] Failed to authenticate root@admin with mechanism MONGODB-CR: AuthenticationFailed UserNotFound Could not find user root@admin |
||||
# failJSON: { "time": "2016-11-20T00:24:00", "match": true , "host": "192.0.2.171" } |
||||
2016-11-20T00:24:00.111+0100 [conn5] end connection 192.0.2.171:53276 (0 connections now open) |
||||
|
||||
# failJSON: { "match": false } |
||||
2016-11-20T00:24:00.110+0100 [conn334] Failed to authenticate root@admin with mechanism MONGODB-CR: AuthenticationFailed key mismatch |
||||
# failJSON: { "time": "2016-11-20T00:24:00", "match": true , "host": "192.0.2.176" } |
||||
2016-11-20T00:24:00.111+0100 [conn334] end connection 192.0.2.176:53276 (0 connections now open) |
||||
|
||||
# failJSON: { "match": false } |
||||
2016-11-20T00:24:00.110+0100 [conn56] Failed to authenticate root@admin with mechanism MONGODB-CR: AuthenticationFailed key mismatch |
||||
# failJSON: { "time": "2016-11-20T00:24:00", "match": true , "host": "192.0.2.1" } |
||||
2016-11-20T00:24:00.111+0100 [conn56] end connection 192.0.2.1:53276 (0 connections now open) |
||||
|
||||
# failJSON: { "match": false } |
||||
2016-11-20T12:54:02.370+0100 [initandlisten] connection accepted from 127.0.0.1:58774 #2261 (1 connection now open) |
||||
# failJSON: { "match": false } |
||||
2016-11-20T12:54:02.370+0100 [conn2261] end connection 127.0.0.1:58774 (0 connections now open) |
||||
|
||||
# failJSON: { "match": false } |
||||
2016-11-20T13:07:49.781+0100 [conn2271] authenticate db: admin { authenticate: 1, nonce: "xxx", user: "root", key: "xxx" } |
||||
# failJSON: { "time": "2016-11-20T13:07:49", "match": false , "host": "192.0.2.178" } |
||||
2016-11-20T13:07:49.834+0100 [conn2271] end connection 192.0.2.178:60268 (3 connections now open) |
||||
|
||||
Loading…
Reference in new issue