From eebef0089c2327372e9ff38f618e334659a4d9b4 Mon Sep 17 00:00:00 2001 From: sebres Date: Tue, 13 Jun 2023 18:49:26 +0200 Subject: [PATCH 1/2] avoid double counting for "maximum authentication attempts exceeded" ("Disconnecting ..." is no failure anymore, now it's helper only); closes gh-3485 --- config/filter.d/sshd.conf | 32 ++++++++++++++++---------------- fail2ban/tests/files/logs/sshd | 5 +++++ 2 files changed, 21 insertions(+), 16 deletions(-) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index d5d189b0..e5cdee88 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -24,8 +24,8 @@ __pref = (?:(?:error|fatal): (?:PAM: )?)? #__suff = (?: port \d+)?(?: \[preauth\])?\s* __suff = (?: (?:port \d+|on \S+|\[preauth\])){0,3}\s* __on_port_opt = (?: (?:port \d+|on \S+)){0,2} -# close by authenticating user: -__authng_user = (?: (?:invalid|authenticating) user \S+|.*?)? +# close by authenticating user (don't use after %(__authng_user)s because of catch-all `.*?`): +__authng_user = (?: (?:by|from))?(?: (?:invalid|authenticating) user \S+|.*?)?(?: from)? # for all possible (also future) forms of "no matching (cipher|mac|MAC|compression method|key exchange method|host key type) found", # see ssherr.c for all possible SSH_ERR_..._ALG_MATCH errors. @@ -38,21 +38,21 @@ __pam_auth = pam_[a-z]+ prefregex = ^%(__prefix_line)s%(__pref)s.+$ -cmnfailre = ^[aA]uthentication (?:failure|error|failed) for .* from ( via \S+)?%(__suff)s$ - ^User not known to the underlying authentication module for .* from %(__suff)s$ +cmnfailre = ^[aA]uthentication (?:failure|error|failed) for .*? (?:from )?( via \S+)?%(__suff)s$ + ^User not known to the underlying authentication module for .*? (?:from )?%(__suff)s$ > ^Failed for (?Pinvalid user )?(?P\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+) from %(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$) ^ROOT LOGIN REFUSED FROM - ^[iI](?:llegal|nvalid) user .*? from %(__suff)s$ - ^User \S+|.*? from not allowed because not listed in AllowUsers%(__suff)s$ - ^User \S+|.*? from not allowed because listed in DenyUsers%(__suff)s$ - ^User \S+|.*? from not allowed because not in any group%(__suff)s$ + ^[iI](?:llegal|nvalid) user .*? (?:from )?%(__suff)s$ + ^User \S+|.*? (?:from )? not allowed because not listed in AllowUsers%(__suff)s$ + ^User \S+|.*? (?:from )? not allowed because listed in DenyUsers%(__suff)s$ + ^User \S+|.*? (?:from )? not allowed because not in any group%(__suff)s$ ^refused connect from \S+ \(\) ^Received disconnect from %(__on_port_opt)s:\s*3: .*: Auth fail%(__suff)s$ - ^User \S+|.*? from not allowed because a group is listed in DenyGroups%(__suff)s$ - ^User \S+|.*? from not allowed because none of user's groups are listed in AllowGroups%(__suff)s$ + ^User \S+|.*? (?:from )? not allowed because a group is listed in DenyGroups%(__suff)s$ + ^User \S+|.*? (?:from )? not allowed because none of user's groups are listed in AllowGroups%(__suff)s$ ^%(__pam_auth)s\(sshd:auth\):\s+authentication failure;(?:\s+(?:(?:logname|e?uid|tty)=\S*)){0,4}\s+ruser=\S*\s+rhost=(?:\s+user=\S*)?%(__suff)s$ - ^maximum authentication attempts exceeded for .* from %(__on_port_opt)s(?: ssh\d*)?%(__suff)s$ + ^maximum authentication attempts exceeded for (?:invalid user )?.*? (?:from )?%(__on_port_opt)s(?: ssh\d*)?%(__suff)s$ ^User \S+|.*? not allowed because account is locked%(__suff)s ^Disconnecting(?: from)?(?: (?:invalid|authenticating)) user \S+ %(__on_port_opt)s:\s*Change of username or service not allowed:\s*.*\[preauth\]\s*$ ^Disconnecting: Too many authentication failures(?: for \S+|.*?)?%(__suff)s$ @@ -68,24 +68,24 @@ cmnfailed = > mdre-normal = # used to differentiate "connection closed" with and without `[preauth]` (fail/nofail cases in ddos mode) -mdre-normal-other = ^(Connection (?:closed|reset)|Disconnected) (?:by|from)%(__authng_user)s (?:%(__suff)s|\s*)$ +mdre-normal-other = ^(?:Connection (?:closed|reset)|Disconnect(?:ed|ing))%(__authng_user)s %(__on_port_opt)s(?:: (?!Too many authentication failures)[^\[]+)?(?: \[preauth\])?\s*$ mdre-ddos = ^Did not receive identification string from ^kex_exchange_identification: (?:read: )?(?:[Cc]lient sent invalid protocol identifier|[Cc]onnection (?:closed by remote host|reset by peer)) - ^Bad protocol version identification '.*' from + ^Bad protocol version identification '(?:[^']|.*?)' (?:from )?%(__suff)s$ ^SSH: Server;Ltype: (?:Authname|Version|Kex);Remote: -\d+;[A-Z]\w+: ^Read from socket failed: Connection reset by peer ^banner exchange: Connection from <__on_port_opt>: invalid format # same as mdre-normal-other, but as failure (without with [preauth] and with on no preauth phase as helper to identify address): -mdre-ddos-other = ^(Connection (?:closed|reset)|Disconnected) (?:by|from)%(__authng_user)s %(__on_port_opt)s\s+\[preauth\]\s*$ - ^(Connection (?:closed|reset)|Disconnected) (?:by|from)%(__authng_user)s (?:%(__on_port_opt)s|\s*)$ +mdre-ddos-other = ^(?:Connection (?:closed|reset)|Disconnect(?:ed|ing))%(__authng_user)s %(__on_port_opt)s(?:: (?!Too many authentication failures)[^\[]+)?\s+\[preauth\]\s*$ + ^(?:Connection (?:closed|reset)|Disconnect(?:ed|ing))%(__authng_user)s (?:%(__on_port_opt)s(?:: (?!Too many authentication failures)[^\[]+)?|\s*)$ mdre-extra = ^Received disconnect from %(__on_port_opt)s:\s*14: No(?: supported)? authentication methods available ^Unable to negotiate with %(__on_port_opt)s: no matching <__alg_match> found. ^Unable to negotiate a <__alg_match> ^no matching <__alg_match> found: # part of mdre-ddos-other, but user name is supplied (invalid/authenticating) on [preauth] phase only: -mdre-extra-other = ^Disconnected(?: from)?(?: (?:invalid|authenticating)) user \S+|.*? %(__on_port_opt)s \[preauth\]\s*$ +mdre-extra-other = ^Disconnected(?: from)?(?: (?:invalid|authenticating)) user \S+|.*? (?:from )?%(__on_port_opt)s \[preauth\]\s*$ mdre-aggressive = %(mdre-ddos)s %(mdre-extra)s diff --git a/fail2ban/tests/files/logs/sshd b/fail2ban/tests/files/logs/sshd index 99c3756b..c20485d7 100644 --- a/fail2ban/tests/files/logs/sshd +++ b/fail2ban/tests/files/logs/sshd @@ -223,6 +223,11 @@ Apr 27 13:02:04 host sshd[29116]: Received disconnect from 1.2.3.4: 11: Normal S # disable this test-cases block for obsolete multi-line filter (zzz-sshd-obsolete...): # filterOptions: [{"test.condition":"name=='sshd'"}] +# failJSON: { "time": "2004-11-23T21:50:38", "match": true , "host": "192.0.2.7", "user": "xxx", "desc": "maximum authentication attempts exceeded for invalid user" } +Nov 23 21:50:38 myhost sshd[109798]: error: maximum authentication attempts exceeded for invalid user xxx from 192.0.2.7 port 49941 ssh2 [preauth] +# failJSON: { "time": "2004-11-23T21:50:38", "match": false, "desc": "No failure, helper only (already counted above)" } +Nov 23 21:50:38 myhost sshd[109798]: Disconnecting invalid user xxx 192.0.2.7 port 49941: Too many authentication failures [preauth] + # 2 methods auth: pam_unix and pam_ldap are used in combination (gh-2070), succeeded after "failure" in first method: # failJSON: { "match": false , "desc": "No failure" } Mar 7 18:53:20 bar sshd[1556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.0.2.113 user=rda From 101d6923e3ebc9e94a41aa72ea0c7ddeb8c5f74d Mon Sep 17 00:00:00 2001 From: sebres Date: Tue, 13 Jun 2023 18:57:05 +0200 Subject: [PATCH 2/2] ChangeLog (gh-3485) --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 9085fcae..f41eb156 100644 --- a/ChangeLog +++ b/ChangeLog @@ -22,6 +22,9 @@ ver. 1.0.3-dev-1 (20??/??/??) - development nightly edition * `action.d/mikrotik.conf` - new action for mikrotik routerOS, adds and removes entries from address lists on the router (gh-2860) * `filter.d/exim.conf` - fixed "dropped: too many ..." regex, also matching unrecognized commands now (gh-3502) * `filter.d/nginx-forbidden.conf` - new filter to ban forbidden locations, e. g. using `deny` directive (gh-2226) +* `filter.d/sshd.conf`: + - avoid double counting for "maximum authentication attempts exceeded" (gh-3502) + - message "Disconnecting ... Too many authentication failures" is not a failure anymore ver. 1.0.2 (2022/11/09) - finally-war-game-test-tape-not-a-nuclear-alarm