From fd1d0d25a828321dc705d05006216e26d399fdea Mon Sep 17 00:00:00 2001 From: Lucian Maly Date: Tue, 4 Mar 2025 12:20:24 +1100 Subject: [PATCH 1/6] Added regex for systemd-journal matches of lighttpd-auth --- config/filter.d/lighttpd-auth.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/config/filter.d/lighttpd-auth.conf b/config/filter.d/lighttpd-auth.conf index dcf19d3e..f6b5893e 100644 --- a/config/filter.d/lighttpd-auth.conf +++ b/config/filter.d/lighttpd-auth.conf @@ -4,7 +4,8 @@ [Definition] failregex = ^\s*(?:: )?\(?(?:http|mod)_auth\.c\.\d+\) (?:password doesn\'t match for (?:\S+|.*?) username:\s+(?:\S+|.*?)\s*|digest: auth failed(?: for\s+(?:\S+|.*?)\s*)?: (?:wrong password|uri mismatch \([^\)]*\))|get_password failed),? IP: \s*$ + ^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]) lighttpd\[\d+\]: \s*(?:: )?\(?(?:http|mod)_auth\.c\.\d+\) (?:password doesn\'t match for (?:\S+|.*?) username:\s+(?:\S+|.*?)\s*|digest: auth failed(?: for\s+(?:\S+|.*?)\s*)?: (?:wrong password|uri mismatch \([^\)]*\))|get_password failed),? IP: \s*$ -ignoreregex = +ignoreregex = # Author: Francois Boulogne From f5ba525cd2c665037ac88b2d7380f1e028b1c163 Mon Sep 17 00:00:00 2001 From: Lucian Maly Date: Tue, 4 Mar 2025 12:22:35 +1100 Subject: [PATCH 2/6] Added sample log line --- fail2ban/tests/files/logs/lighttpd-auth | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fail2ban/tests/files/logs/lighttpd-auth b/fail2ban/tests/files/logs/lighttpd-auth index c8a922b5..4619b2a8 100644 --- a/fail2ban/tests/files/logs/lighttpd-auth +++ b/fail2ban/tests/files/logs/lighttpd-auth @@ -12,3 +12,6 @@ 2021-09-30 17:44:37: (mod_auth.c.791) digest: auth failed for tester : wrong password, IP: 192.0.2.3 # failJSON: { "time": "2021-09-30T17:44:37", "match": true , "host": "192.0.2.4", "desc": "gh-3116" } 2021-09-30 17:44:37: (mod_auth.c.791) digest: auth failed: uri mismatch (/uri1 != /uri2), IP: 192.0.2.4 + +# systemd-journal +2025-03-04T02:11:57.602061 ip-172-31-3-150.ap-southeast-2.compute.internal lighttpd[764]: (mod_auth.c.853) password doesn't match for / username: user1 IP: 122.251.111.211 From 9d7646e6c0b0f03db7f9a1dd3a9aef5178e4da8d Mon Sep 17 00:00:00 2001 From: Lucian Maly Date: Tue, 4 Mar 2025 12:25:27 +1100 Subject: [PATCH 3/6] Added author --- config/filter.d/lighttpd-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/lighttpd-auth.conf b/config/filter.d/lighttpd-auth.conf index f6b5893e..56fc4cae 100644 --- a/config/filter.d/lighttpd-auth.conf +++ b/config/filter.d/lighttpd-auth.conf @@ -8,4 +8,4 @@ failregex = ^\s*(?:: )?\(?(?:http|mod)_auth\.c\.\d+\) (?:password doesn\'t match ignoreregex = -# Author: Francois Boulogne +# Authors: Francois Boulogne , Lucian Maly From 13a74feaad10f52b6b54fc60f54334f089e2e8cf Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Tue, 4 Mar 2025 13:02:50 +0100 Subject: [PATCH 4/6] 2nd RE unneeded, fix single RE - bypass everything before open parenthesis --- config/filter.d/lighttpd-auth.conf | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/config/filter.d/lighttpd-auth.conf b/config/filter.d/lighttpd-auth.conf index 56fc4cae..7e8be0f9 100644 --- a/config/filter.d/lighttpd-auth.conf +++ b/config/filter.d/lighttpd-auth.conf @@ -3,8 +3,7 @@ [Definition] -failregex = ^\s*(?:: )?\(?(?:http|mod)_auth\.c\.\d+\) (?:password doesn\'t match for (?:\S+|.*?) username:\s+(?:\S+|.*?)\s*|digest: auth failed(?: for\s+(?:\S+|.*?)\s*)?: (?:wrong password|uri mismatch \([^\)]*\))|get_password failed),? IP: \s*$ - ^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]) lighttpd\[\d+\]: \s*(?:: )?\(?(?:http|mod)_auth\.c\.\d+\) (?:password doesn\'t match for (?:\S+|.*?) username:\s+(?:\S+|.*?)\s*|digest: auth failed(?: for\s+(?:\S+|.*?)\s*)?: (?:wrong password|uri mismatch \([^\)]*\))|get_password failed),? IP: \s*$ +failregex = ^[^\)]*\(?(?:http|mod)_auth\.c\.\d+\) (?:password doesn\'t match for (?:\S+|.*?) username:\s+(?:\S+|.*?)\s*|digest: auth failed(?: for\s+(?:\S+|.*?)\s*)?: (?:wrong password|uri mismatch \([^\)]*\))|get_password failed),? IP: \s*$ ignoreregex = From 95cdf553f551a23dec37fcfef996d6b156cc594e Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Tue, 4 Mar 2025 13:09:21 +0100 Subject: [PATCH 5/6] fixes test in lighttpd-auth: added failJSON to match the line --- fail2ban/tests/files/logs/lighttpd-auth | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fail2ban/tests/files/logs/lighttpd-auth b/fail2ban/tests/files/logs/lighttpd-auth index 4619b2a8..7c48eeb6 100644 --- a/fail2ban/tests/files/logs/lighttpd-auth +++ b/fail2ban/tests/files/logs/lighttpd-auth @@ -14,4 +14,5 @@ 2021-09-30 17:44:37: (mod_auth.c.791) digest: auth failed: uri mismatch (/uri1 != /uri2), IP: 192.0.2.4 # systemd-journal -2025-03-04T02:11:57.602061 ip-172-31-3-150.ap-southeast-2.compute.internal lighttpd[764]: (mod_auth.c.853) password doesn't match for / username: user1 IP: 122.251.111.211 +# failJSON: { "time": "2025-03-04T02:11:57", "match": true , "host": "192.0.2.211", "desc": "gh-3955" } +2025-03-04T02:11:57.602061 ip-172-31-3-150.ap-southeast-2.compute.internal lighttpd[764]: (mod_auth.c.853) password doesn't match for / username: user1 IP: 192.0.2.211 From 3e9a4b4a4865d56488a007722a4da96d0f5a9bea Mon Sep 17 00:00:00 2001 From: "Sergey G. Brester" Date: Tue, 4 Mar 2025 13:20:54 +0100 Subject: [PATCH 6/6] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index b43aac80..d579a40e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -26,6 +26,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition * `filter.d/exim.conf` - mode `aggressive` extended to catch dropped by ACL failures, e.g. "ACL: Country is banned" * `filter.d/freeswitch.conf` - bypass some new info in prefix before [WARNING] (changed default `_pref_line`), FreeSWITCH log line prefix has changed in newer versions (gh-3143) +* `filter.d/lighttpd-auth.conf` - fixed regex (if failures generated by systemd-journal), bypass several prefixes now (gh-3955) * `filter.d/postfix.conf` - consider CONNECT and other rejected commands as a valid `_pref` (gh-3800) * `filter.d/dropbear.conf`: - recognizes extra pid/timestamp if logged into stdout/journal, added `journalmatch` (gh-3597)