From e09fad559a8aea08f493d27c2e3345474d50455e Mon Sep 17 00:00:00 2001 From: Arturo 'Buanzo' Busleiman Date: Sun, 30 Aug 2009 00:36:40 +0000 Subject: [PATCH 01/20] Fix for python 2.6 / 3.0 incompatibility git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@735 a942ae1a-1317-0410-a47c-b1dcaea8d605 --- server/asyncserver.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/server/asyncserver.py b/server/asyncserver.py index 13a74dac..b3f8ea52 100644 --- a/server/asyncserver.py +++ b/server/asyncserver.py @@ -132,7 +132,8 @@ class AsyncServer(asyncore.dispatcher): # Sets the init flag. self.__init = True # TODO Add try..catch - asyncore.loop(use_poll = True) + # There's a bug report for Python 2.6/3.0 that use_poll=True yields some 2.5 incompatibilities: + asyncore.loop(use_poll = False) # fixes the "Unexpected communication problem" issue on Python 2.6. ## # Stops the communication server. From fd898c9eacf35fd3d6b2fe647da11100be24a8de Mon Sep 17 00:00:00 2001 From: Arturo 'Buanzo' Busleiman Date: Sun, 30 Aug 2009 13:27:52 +0000 Subject: [PATCH 02/20] added python version detection to asyncore.loop(use_poll=True|False) git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@736 a942ae1a-1317-0410-a47c-b1dcaea8d605 --- server/asyncserver.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/server/asyncserver.py b/server/asyncserver.py index b3f8ea52..fedfdd30 100644 --- a/server/asyncserver.py +++ b/server/asyncserver.py @@ -133,7 +133,12 @@ class AsyncServer(asyncore.dispatcher): self.__init = True # TODO Add try..catch # There's a bug report for Python 2.6/3.0 that use_poll=True yields some 2.5 incompatibilities: - asyncore.loop(use_poll = False) # fixes the "Unexpected communication problem" issue on Python 2.6. + if (sys.version_info[0] == 2 and sys.version_info[1] == 6) or (sys.version_info[0] == 3): # if python 2.6 or 3.*... + logSys.debug("Detected Python 2.6 or 3.*. asyncore.loop() not using poll") + asyncore.loop(use_poll = False) # fixes the "Unexpected communication problem" issue on Python 2.6 and 3.0 + else: + logSys.debug("NOT Python 2.6/3.* - asyncore.loop() using poll") + asyncore.loop(use_poll = True) ## # Stops the communication server. From 08a36ca6576c47c5c4e6f3a84998d2eb4653548a Mon Sep 17 00:00:00 2001 From: Arturo 'Buanzo' Busleiman Date: Sun, 30 Aug 2009 13:32:19 +0000 Subject: [PATCH 03/20] more readable code for python version comparison git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@737 a942ae1a-1317-0410-a47c-b1dcaea8d605 --- server/asyncserver.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/asyncserver.py b/server/asyncserver.py index fedfdd30..2d396690 100644 --- a/server/asyncserver.py +++ b/server/asyncserver.py @@ -133,8 +133,8 @@ class AsyncServer(asyncore.dispatcher): self.__init = True # TODO Add try..catch # There's a bug report for Python 2.6/3.0 that use_poll=True yields some 2.5 incompatibilities: - if (sys.version_info[0] == 2 and sys.version_info[1] == 6) or (sys.version_info[0] == 3): # if python 2.6 or 3.*... - logSys.debug("Detected Python 2.6 or 3.*. asyncore.loop() not using poll") + if sys.version_info >= (2, 6): # if python 2.6 or greater... + logSys.debug("Detected Python 2.6 or greater. asyncore.loop() not using poll") asyncore.loop(use_poll = False) # fixes the "Unexpected communication problem" issue on Python 2.6 and 3.0 else: logSys.debug("NOT Python 2.6/3.* - asyncore.loop() using poll") From b2f0bfe7519a548ff887da0241d631b2eaa5dfcc Mon Sep 17 00:00:00 2001 From: Arturo 'Buanzo' Busleiman Date: Sun, 30 Aug 2009 13:36:04 +0000 Subject: [PATCH 04/20] added missing import sys to asyncserver.py git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@738 a942ae1a-1317-0410-a47c-b1dcaea8d605 --- server/asyncserver.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/asyncserver.py b/server/asyncserver.py index 2d396690..33e80aff 100644 --- a/server/asyncserver.py +++ b/server/asyncserver.py @@ -25,7 +25,7 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" from pickle import dumps, loads, HIGHEST_PROTOCOL -import asyncore, asynchat, socket, os, logging +import asyncore, asynchat, socket, os, logging, sys # Gets the instance of the logger. logSys = logging.getLogger("fail2ban.server") From 81e2fe8306ab79028f5836352228c3eef3aa71e5 Mon Sep 17 00:00:00 2001 From: Arturo 'Buanzo' Busleiman Date: Sun, 30 Aug 2009 13:51:17 +0000 Subject: [PATCH 05/20] added 'unexpected communication error' fix to ChangeLog. Added formatExceptionInfo to server/asyncserver.py We should move that function to a helpers module. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@739 a942ae1a-1317-0410-a47c-b1dcaea8d605 --- ChangeLog | 2 ++ server/asyncserver.py | 17 ++++++++++++++++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 6b5c9864..cb4c9b63 100644 --- a/ChangeLog +++ b/ChangeLog @@ -9,6 +9,8 @@ Fail2Ban (version 0.8.4) 2009/02/?? ver. 0.8.4 (2009/??/??) - stable ---------- +- Fixed the 'unexpected communication error' problem by means of + use_poll=False in Python >= 2.6. - Merged patches from Debian package. Thanks to Yaroslav Halchenko. - Use current day and month instead of Jan 1st if both are not available in the log. Thanks to Andreas Itzchak Rehberg. diff --git a/server/asyncserver.py b/server/asyncserver.py index 33e80aff..0714513d 100644 --- a/server/asyncserver.py +++ b/server/asyncserver.py @@ -30,6 +30,19 @@ import asyncore, asynchat, socket, os, logging, sys # Gets the instance of the logger. logSys = logging.getLogger("fail2ban.server") +# we should move this to some sort of helper functions module + +def formatExceptionInfo(): + """ Author: Arturo 'Buanzo' Busleiman """ + import sys + cla, exc = sys.exc_info()[:2] + excName = cla.__name__ + try: + excArgs = exc.__dict__["args"] + except KeyError: + excArgs = str(exc) + return (excName, excArgs) + ## # Request handler class. # @@ -69,7 +82,9 @@ class RequestHandler(asynchat.async_chat): self.close_when_done() def handle_error(self): - logSys.error("Unexpected communication error") + e1,e2 = formatExceptionInfo() + logSys.error("Unexpected communication error: "+e2) + logSys.error(traceback.format_exc().splitlines()) self.close() ## From b88956e8984a5afa82893295a344de680f6f6dee Mon Sep 17 00:00:00 2001 From: Cyril Jaquier Date: Sun, 30 Aug 2009 14:03:18 +0000 Subject: [PATCH 06/20] - Added helper module in common. - Moved formatExceptionInfo by Buanzo to common/helpers.py. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@740 a942ae1a-1317-0410-a47c-b1dcaea8d605 --- MANIFEST | 1 + common/helpers.py | 38 ++++++++++++++++++++++++++++++++++++++ server/asyncserver.py | 16 ++-------------- 3 files changed, 41 insertions(+), 14 deletions(-) create mode 100644 common/helpers.py diff --git a/MANIFEST b/MANIFEST index 7d8a722d..eb03723f 100644 --- a/MANIFEST +++ b/MANIFEST @@ -53,6 +53,7 @@ testcases/files/testcase04.log setup.py setup.cfg common/__init__.py +common/helpers.py common/version.py common/protocol.py config/jail.conf diff --git a/common/helpers.py b/common/helpers.py new file mode 100644 index 00000000..95a7c103 --- /dev/null +++ b/common/helpers.py @@ -0,0 +1,38 @@ +# This file is part of Fail2Ban. +# +# Fail2Ban is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Fail2Ban is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Fail2Ban; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +# Author: Cyril Jaquier +# Author: Arturo 'Buanzo' Busleiman +# +# $Revision: 711 $ + +__author__ = "Cyril Jaquier" +__version__ = "$Revision: 567 $" +__date__ = "$Date: 2007-03-26 23:17:31 +0200 (Mon, 26 Mar 2007) $" +__copyright__ = "Copyright (c) 2009 Cyril Jaquier" +__license__ = "GPL" + + +def formatExceptionInfo(): + """ Author: Arturo 'Buanzo' Busleiman """ + import sys + cla, exc = sys.exc_info()[:2] + excName = cla.__name__ + try: + excArgs = exc.__dict__["args"] + except KeyError: + excArgs = str(exc) + return (excName, excArgs) diff --git a/server/asyncserver.py b/server/asyncserver.py index 0714513d..edcd9bbc 100644 --- a/server/asyncserver.py +++ b/server/asyncserver.py @@ -25,24 +25,12 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" from pickle import dumps, loads, HIGHEST_PROTOCOL +from common import helpers import asyncore, asynchat, socket, os, logging, sys # Gets the instance of the logger. logSys = logging.getLogger("fail2ban.server") -# we should move this to some sort of helper functions module - -def formatExceptionInfo(): - """ Author: Arturo 'Buanzo' Busleiman """ - import sys - cla, exc = sys.exc_info()[:2] - excName = cla.__name__ - try: - excArgs = exc.__dict__["args"] - except KeyError: - excArgs = str(exc) - return (excName, excArgs) - ## # Request handler class. # @@ -82,7 +70,7 @@ class RequestHandler(asynchat.async_chat): self.close_when_done() def handle_error(self): - e1,e2 = formatExceptionInfo() + e1,e2 = helpers.formatExceptionInfo() logSys.error("Unexpected communication error: "+e2) logSys.error(traceback.format_exc().splitlines()) self.close() From 9c05632dd8b67e38a8f2dadaea77b1107dde7dde Mon Sep 17 00:00:00 2001 From: Cyril Jaquier Date: Sun, 30 Aug 2009 14:13:04 +0000 Subject: [PATCH 07/20] - Added svn:keywords property. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@741 a942ae1a-1317-0410-a47c-b1dcaea8d605 --- common/helpers.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/common/helpers.py b/common/helpers.py index 95a7c103..a8671592 100644 --- a/common/helpers.py +++ b/common/helpers.py @@ -17,11 +17,11 @@ # Author: Cyril Jaquier # Author: Arturo 'Buanzo' Busleiman # -# $Revision: 711 $ +# $Revision$ __author__ = "Cyril Jaquier" -__version__ = "$Revision: 567 $" -__date__ = "$Date: 2007-03-26 23:17:31 +0200 (Mon, 26 Mar 2007) $" +__version__ = "$Revision$" +__date__ = "$Date$" __copyright__ = "Copyright (c) 2009 Cyril Jaquier" __license__ = "GPL" From dde7afe1f31a55ae9191519899d9224ec57ec04d Mon Sep 17 00:00:00 2001 From: Arturo 'Buanzo' Busleiman Date: Sun, 30 Aug 2009 14:17:29 +0000 Subject: [PATCH 08/20] added two new filter files (PHP url_fopen, lighttpd fastcgi alerts), updated MANIFEST and jail.conf accordingly git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@742 a942ae1a-1317-0410-a47c-b1dcaea8d605 --- MANIFEST | 2 ++ config/filter.d/lighttpd-fastcgi.conf | 18 +++++++++++++++++ config/filter.d/php-url-fopen.conf | 23 ++++++++++++++++++++++ config/jail.conf | 28 +++++++++++++++++++++++++++ 4 files changed, 71 insertions(+) create mode 100644 config/filter.d/lighttpd-fastcgi.conf create mode 100644 config/filter.d/php-url-fopen.conf diff --git a/MANIFEST b/MANIFEST index eb03723f..713db994 100644 --- a/MANIFEST +++ b/MANIFEST @@ -122,3 +122,5 @@ files/cacti/cacti_host_template_fail2ban.xml files/cacti/README files/nagios/check_fail2ban files/nagios/f2ban.txt +config/filter.d/lighttpd-fastcgi.conf +config/filter.d/php-url-fopen.conf diff --git a/config/filter.d/lighttpd-fastcgi.conf b/config/filter.d/lighttpd-fastcgi.conf new file mode 100644 index 00000000..1c6e3fce --- /dev/null +++ b/config/filter.d/lighttpd-fastcgi.conf @@ -0,0 +1,18 @@ +# Fail2Ban configuration file +# +# Author: Arturo 'Buanzo' Busleiman +# + +[Definition] + +# Option: failregex +# Notes.: regex to match ALERTS as notified by lighttpd's FastCGI Module +# Values: TEXT +# +failregex = .*ALERT\ -\ .*attacker\ \'\' + +# Option: ignoreregex +# Notes.: regex to ignore. If this regex matches, the line is ignored. +# Values: TEXT +# +ignoreregex = diff --git a/config/filter.d/php-url-fopen.conf b/config/filter.d/php-url-fopen.conf new file mode 100644 index 00000000..68927e06 --- /dev/null +++ b/config/filter.d/php-url-fopen.conf @@ -0,0 +1,23 @@ +# Fail2Ban configuration file +# +# Author: Arturo 'Buanzo' Busleiman +# Version 2 +# fixes the failregex so REFERERS that contain =http:// don't get blocked +# (mentioned by "fasuto" (no real email provided... blog comment) in this entry: +# http://blogs.buanzo.com.ar/2009/04/fail2ban-filter-for-php-injection-attacks.html#comment-1489 +# + +[Definition] + +# Option: failregex +# Notes.: regex to match this kind of request: +# +# 66.185.212.172 - - [26/Mar/2009:08:44:20 -0500] "GET /index.php?n=http://eatmyfood.hostinginfive.com/pizza.htm? HTTP/1.1" 200 114 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" +# +failregex = ^ -.*"(GET|POST).*\?.*\=http\:\/\/.* HTTP\/.*$ + +# Option: ignoreregex +# Notes.: regex to ignore. If this regex matches, the line is ignored. +# Values: TEXT +# +ignoreregex = diff --git a/config/jail.conf b/config/jail.conf index 3ce79715..5273e5f0 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -152,6 +152,34 @@ action = shorewall sendmail[name=Postfix, dest=you@mail.com] logpath = /var/log/apache2/error_log +# Ban attackers that try to use PHP's URL-fopen() functionality +# through GET/POST variables. - Experimental, with more than a year +# of usage in production environments. + +[php-url-fopen] + +enabled = false +port = http,https +filter = php-url-fopen +logpath = /var/www/*/logs/access_log +maxretry = 1 + +# A simple PHP-fastcgi jail which works with lighttpd. +# If you run a lighttpd server, then you probably will +# find these kinds of messages in your error_log: +# ALERT – tried to register forbidden variable ‘GLOBALS’ +# through GET variables (attacker '1.2.3.4', file '/var/www/default/htdocs/index.php') +# This jail would block the IP 1.2.3.4. + +[lighttpd-fastcgi] + +enabled = true +port = http,https +filter = lighttpd-fastcgi +# adapt the following two items as needed +logpath = /var/log/lighttpd/error.log +maxretry = 2 + # This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip" # option is overridden in this jail. Moreover, the action "mail-whois" defines # the variable "name" which contains a comma using "". The characters '' are From f0f96a6cfdb4371c13e3ef73f8bf6b99a0973708 Mon Sep 17 00:00:00 2001 From: Cyril Jaquier Date: Sun, 30 Aug 2009 14:21:41 +0000 Subject: [PATCH 09/20] - Moved last entries in the config/ part. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@743 a942ae1a-1317-0410-a47c-b1dcaea8d605 --- MANIFEST | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/MANIFEST b/MANIFEST index 713db994..d3791b34 100644 --- a/MANIFEST +++ b/MANIFEST @@ -68,12 +68,14 @@ config/filter.d/couriersmtp.conf config/filter.d/cyrus-imap.conf config/filter.d/exim.conf config/filter.d/gssftpd.conf +config/filter.d/lighttpd-fastcgi.conf config/filter.d/named-refused.conf config/filter.d/postfix.conf config/filter.d/proftpd.conf config/filter.d/pure-ftpd.conf config/filter.d/qmail.conf config/filter.d/pam-generic.conf +config/filter.d/php-url-fopen.conf config/filter.d/sasl.conf config/filter.d/sieve.conf config/filter.d/sshd.conf @@ -122,5 +124,3 @@ files/cacti/cacti_host_template_fail2ban.xml files/cacti/README files/nagios/check_fail2ban files/nagios/f2ban.txt -config/filter.d/lighttpd-fastcgi.conf -config/filter.d/php-url-fopen.conf From a354050913b557654a7902c6e061712c0b275083 Mon Sep 17 00:00:00 2001 From: Cyril Jaquier Date: Sun, 30 Aug 2009 14:49:16 +0000 Subject: [PATCH 10/20] - Added two new filters: lighttpd-fastcgi and php-url-fopen. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@744 a942ae1a-1317-0410-a47c-b1dcaea8d605 --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index cb4c9b63..af26b9d6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -9,6 +9,7 @@ Fail2Ban (version 0.8.4) 2009/02/?? ver. 0.8.4 (2009/??/??) - stable ---------- +- Added two new filters: lighttpd-fastcgi and php-url-fopen. - Fixed the 'unexpected communication error' problem by means of use_poll=False in Python >= 2.6. - Merged patches from Debian package. Thanks to Yaroslav Halchenko. From a1a106a27ee789377471ac1621cfb18dfe66f17f Mon Sep 17 00:00:00 2001 From: Arturo 'Buanzo' Busleiman Date: Sun, 30 Aug 2009 18:26:15 +0000 Subject: [PATCH 11/20] added "Ban IP" command to fail2ban branch 0.8 git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@745 a942ae1a-1317-0410-a47c-b1dcaea8d605 --- common/protocol.py | 1 + server/filter.py | 11 +++++++++++ server/server.py | 3 +++ server/transmitter.py | 3 +++ 4 files changed, 18 insertions(+) diff --git a/common/protocol.py b/common/protocol.py index d0fbae73..71c916ce 100644 --- a/common/protocol.py +++ b/common/protocol.py @@ -59,6 +59,7 @@ protocol = [ ["set delignoreregex ", "removes the regular expression at for ignoreregex"], ["set findtime