diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf index 756c3767..501e3d68 100644 --- a/config/filter.d/apache-auth.conf +++ b/config/filter.d/apache-auth.conf @@ -8,10 +8,12 @@ [Definition] # Option: failregex -# Notes.: regex to match the password failure messages in the logfile. +# Notes.: regex to match the password failure messages in the logfile. The +# host must be matched by a group named "host". The tag "" can +# be used for standard IP/hostname matching. # Values: TEXT # -failregex = [[]client (?P\S*)[]] user .*(?:: authentication failure|not found) +failregex = [[]client []] user .*(?:: authentication failure|not found) # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf index dc11a304..45366867 100644 --- a/config/filter.d/apache-noscript.conf +++ b/config/filter.d/apache-noscript.conf @@ -8,10 +8,12 @@ [Definition] # Option: failregex -# Notes.: regex to match the password failure messages in the logfile. +# Notes.: regex to match the password failure messages in the logfile. The +# host must be matched by a group named "host". The tag "" can +# be used for standard IP/hostname matching. # Values: TEXT # -failregex = [[]client (?P\S*)[]] File does not exist: .*(\.php|\.asp) +failregex = [[]client []] File does not exist: .*(\.php|\.asp) # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/config/filter.d/courierlogin.conf b/config/filter.d/courierlogin.conf index 7088a625..0e6b7a11 100644 --- a/config/filter.d/courierlogin.conf +++ b/config/filter.d/courierlogin.conf @@ -9,10 +9,12 @@ [Definition] # Option: failregex -# Notes.: regex to match the password failures messages in the logfile. +# Notes.: regex to match the password failures messages in the logfile. The +# host must be matched by a group named "host". The tag "" can +# be used for standard IP/hostname matching. # Values: TEXT # -failregex = LOGIN FAILED, ip=\[::ffff:(?P\S*)\]$ +failregex = LOGIN FAILED, ip=\[\]$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/config/filter.d/couriersmtp.conf b/config/filter.d/couriersmtp.conf index 7860fedb..d67a61ea 100644 --- a/config/filter.d/couriersmtp.conf +++ b/config/filter.d/couriersmtp.conf @@ -8,10 +8,12 @@ [Definition] # Option: failregex -# Notes.: regex to match the password failures messages in the logfile. +# Notes.: regex to match the password failures messages in the logfile. The +# host must be matched by a group named "host". The tag "" can +# be used for standard IP/hostname matching. # Values: TEXT # -failregex = error,relay=(?:::f{4,6}:)?(?P\S*),.*550 User unknown +failregex = error,relay=,.*550 User unknown # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf index 8ca98149..a0e0a974 100644 --- a/config/filter.d/postfix.conf +++ b/config/filter.d/postfix.conf @@ -8,10 +8,12 @@ [Definition] # Option: failregex -# Notes.: regex to match the password failures messages in the logfile. +# Notes.: regex to match the password failures messages in the logfile. The +# host must be matched by a group named "host". The tag "" can +# be used for standard IP/hostname matching. # Values: TEXT # -failregex = reject: RCPT from (.*)\[(?P\S*)\]: 554 +failregex = reject: RCPT from (.*)\[\]: 554 # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf index 1b31cda1..28921a01 100644 --- a/config/filter.d/proftpd.conf +++ b/config/filter.d/proftpd.conf @@ -8,10 +8,12 @@ [Definition] # Option: failregex -# Notes.: regex to match the password failures messages in the logfile. +# Notes.: regex to match the password failures messages in the logfile. The +# host must be matched by a group named "host". The tag "" can +# be used for standard IP/hostname matching. # Values: TEXT # -failregex = USER \S+: no such user found from \S* ?\[(?P\S+)\] to \S+\s*$ +failregex = USER \S+: no such user found from \S* ?\[\] to \S+\s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/config/filter.d/qmail.conf b/config/filter.d/qmail.conf index 9aaac649..3e4ae215 100644 --- a/config/filter.d/qmail.conf +++ b/config/filter.d/qmail.conf @@ -8,10 +8,12 @@ [Definition] # Option: failregex -# Notes.: regex to match the password failures messages in the logfile. +# Notes.: regex to match the password failures messages in the logfile. The +# host must be matched by a group named "host". The tag "" can +# be used for standard IP/hostname matching. # Values: TEXT # -failregex = (?:[\d,.]+[\d,.] rblsmtpd: |421 badiprbl: ip )(?P\S*) +failregex = (?:[\d,.]+[\d,.] rblsmtpd: |421 badiprbl: ip ) # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/config/filter.d/sasl.conf b/config/filter.d/sasl.conf index 8fd2027b..3602b594 100644 --- a/config/filter.d/sasl.conf +++ b/config/filter.d/sasl.conf @@ -8,10 +8,12 @@ [Definition] # Option: failregex -# Notes.: regex to match the password failures messages in the logfile. +# Notes.: regex to match the password failures messages in the logfile. The +# host must be matched by a group named "host". The tag "" can +# be used for standard IP/hostname matching. # Values: TEXT # -failregex = : warning: [-._\w]+\[(?P[.\d]+)\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$ +failregex = : warning: [-._\w]+\[\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index cd9a3628..3c2c5db6 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -8,10 +8,12 @@ [Definition] # Option: failregex -# Notes.: regex to match the password failures messages in the logfile. +# Notes.: regex to match the password failures messages in the logfile. The +# host must be matched by a group named "host". The tag "" can +# be used for standard IP/hostname matching. # Values: TEXT # -failregex = (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P\S*) +failregex = (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf index aaa3fbbb..384fa36b 100644 --- a/config/filter.d/vsftpd.conf +++ b/config/filter.d/vsftpd.conf @@ -8,10 +8,12 @@ [Definition] # Option: failregex -# Notes.: regex to match the password failures messages in the logfile. +# Notes.: regex to match the password failures messages in the logfile. The +# host must be matched by a group named "host". The tag "" can +# be used for standard IP/hostname matching. # Values: TEXT # -failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P\S*) +failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost= # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/server/filter.py b/server/filter.py index cade9eab..f19cf732 100644 --- a/server/filter.py +++ b/server/filter.py @@ -167,13 +167,17 @@ class Filter(JailThread): def setFailRegex(self, value): try: if value.lstrip() == '': + self.__failRegex = value self.__failRegexObj = None else: - self.__failRegexObj = re.compile(value) - self.__failRegex = value - logSys.info("Set failregex = %s" % value) + # Replace "" with default regular expression for host. + regex = value.replace("", "(?:::f{4,6}:)?(?P\S+)") + self.__failRegex = regex + self.__failRegexObj = re.compile(regex) + logSys.info("Set failregex = %s" % self.__failRegex) except sre_constants.error: - logSys.error("Unable to compile regular expression " + value) + logSys.error("Unable to compile regular expression " + + self.__failRegex) ## # Get the regular expression which matches the failure. @@ -475,6 +479,8 @@ class DNSUtils: try: return socket.gethostbyname_ex(dns)[2] except socket.gaierror: + logSys.warn("Unable to find a corresponding IP address for %s" + % dns) return list() @staticmethod