05ec675305
`filter.d/sshd.conf`: `extra` or `aggressive` modes consider `Received disconnect ... 11: Bye Bye` with `[preauth]` as a failure and without `[preauth]` it'd be still used as nofail-helper e. g. to obtain IP by multi-line processing;
...
closes gh-2115
2024-12-29 20:34:26 +01:00
a796cc9b91
`filter.d/dropbear.conf`: failregex extended to match different format of "Exit before auth" message;
...
closes gh-3791
2024-12-27 16:43:33 +01:00
eb8b44370a
Make Dropbear regex more compatible and simpler
...
Dropbear uses `strftime` `"%b %d %H:%M:%S` to print its timestamps, hence we know the day and time format, but the month could be localized. We hence allow any 3 word characters for it, and additionally simplify the day and time pattern into a single group.
Signed-off-by: MichaIng <micha@dietpi.com>
2024-12-27 14:00:36 +07:00
dd9f359f5c
Fix Dropbear filter when logging to STDOUT
...
Since Debian Bookworm, the distribution ships Dropbear with a native systemd service instead of the default upstream init.d service, and accordingly uses the `-F` and `-E` flags, to run it in foreground and have it logging to STDOUT instead of syslog.
As usual, timestamps and also the PID are now included by the log message emitted by Dropbear, in addition to the systemd journal log prefix.
The Dropbear filter hence does not match anymore. This commit adds the PID and timestamp as optional pattern between prefix and fail log text, to support Dropbear on Debian Bookworm and newer (and likely new versions of other distros) without breaking the old pattern when running Dropbear without `-E` flag.
Additionally, for performance reasons, this commit adds a `journalmatch` entry, matching Debian's and Fedora's `dropbear.service` with `dropbear` executable/identifier, the most likely match for a Dropbear systemd service.
Signed-off-by: MichaIng <micha@dietpi.com>
2024-12-27 13:59:35 +07:00
89b5f3bb1e
`filter.d/sshd.conf`: `ddos` and `aggressive` modes, regex extended for timeout before authentication (optional connection from part);
...
closes gh-3907
2024-12-26 14:24:15 +01:00
91c27d0600
`filter.d/freeswitch.conf`: bypass some new info in prefix before [WARNING] (changed default `_pref_line`);
...
closes gh-3143
2024-12-04 16:56:23 +01:00
54c0effceb
filter.d/sshd.conf: amend to #3747/#3812 (new ssh version would log with `_COMM=sshd-session`)
2024-08-11 12:10:12 +02:00
c769046a1f
Revert "`filterd./sshd.conf`: fixed journalmatch (sshd.service seems to be renamed to ssh.service)" - it'd patched in debian branch.
...
This reverts commit 6fce23e7ba
2024-08-11 11:55:39 +02:00
8e0a2366f0
Fixes unmatched tag (caused unmatched brace); review: combined to single regex, simple case without injection attempts faster, `<HOST>` replaced with `<ADDR>` (faster and fewer vulnerable on complex cases, since doesn't match text as hostname) etc.
2024-08-10 13:20:18 +02:00
35afe20ea0
Roundcube 1.4 change log format
...
From roundcube 1.4 log change format -> e92d8e31a3/program/lib/Roundcube/rcube_imap.php (L194)
2024-08-09 22:53:45 +02:00
9a558589d7
review (anchoring RE, etc)
2024-07-30 19:16:40 +02:00
83f2d59eee
match numbers
2024-07-30 19:05:56 +02:00
07a7da8d8e
Remove greedy catch-all before HOST
2024-07-30 19:05:55 +02:00
ca45671db2
Add support to Proxmox Web GUI
2024-07-30 19:04:00 +02:00
93810fff75
consider CONNECT and other rejected commands as a valid `_pref`;
...
closes gh-3800
2024-07-26 19:25:36 +02:00
50ff131a0f
filter.d/sshd.conf: ungroup (unneeded for _daemon)
2024-07-03 19:35:28 +02:00
2fed408c05
Adjust sshd filter for OpenSSH 9.8 new daemon name
2024-07-02 08:51:51 +02:00
59c5e78ce9
`filter.d/apache-overflows.conf` - consider AH10244: invalid URI path;
...
closes gh-3778
2024-06-28 12:50:14 +02:00
a7f3a04b0e
`filter.d/recidive.conf` - restore possibility to set jail name in the filter, _jailname is positive now (but by default it uses now negative lookahead to exclude recidive jail);
...
closes gh-3769
2024-06-21 13:24:46 +02:00
6fce23e7ba
`filterd./sshd.conf`: fixed journalmatch (sshd.service seems to be renamed to ssh.service)
...
closes gh-3747
2024-06-10 01:40:59 +02:00
2c13cba73d
loosening for denied suffix (would match no matter which reason in parenthesis);
...
add coverage for denied with "(allow-query-cache did not match)"
2024-03-25 16:35:20 +01:00
fd7657f9a9
Update named-refused.conf
2024-03-25 16:35:16 +01:00
1ec9237e53
bypass additional pid in prefix (may be logged by syslog-ng, gh-3060); matches protocol error with authentication mechanism not supported
2024-03-25 15:52:06 +01:00
c80908837f
`filter.d/exim.conf`:
...
- messages are prefiltered by `prefregex` now
- filter can bypass additional timestamp that may be logged via systemd-journal (gh-3060)
2024-03-25 15:31:23 +01:00
8da0a99cde
pid part may contain full hostname
2024-03-22 22:38:33 +03:00
806a27cb4f
final `<HOST>` to `<ADDR>` conversion
2024-03-22 22:38:33 +03:00
e605415f61
simplify fields-group a bit (everything up to 4 chars long but H), so it'll be faster (no multiple branches) as well as would theoretically accept future enhancements of logged fields.
2024-03-22 16:47:54 +01:00
c22a83933b
let's use `<ADDR>` instead `<HOST>` - only IPs expected, since host-name bypassed before it (directly after H=)
2024-03-22 16:35:46 +01:00
df94ec4c52
filter.d/exim.conf: rewrite host line regex for all varied exim's log_selector states
...
Depending on Exim's log_selector settings, log lines may contain additional information about the connection. And also the line itself with the address of the remote host can vary greatly. But fortunately, all states can be found in the Exim code itself and taken into account. Makes it easier to add new regexps.
Closes #3263
2024-03-22 00:16:41 +03:00
0c125ec9c9
filter.d/postfix.conf: add Sender address rejected: Malformed DNS server reply ( #3590 )
...
* add Sender address rejected: Malformed DNS server reply
2024-03-19 20:30:45 +01:00
f63868b3e8
filter.d/apache-common.conf: remote besides client, gh-3622
2024-03-15 22:36:40 +01:00
529eb79ddb
Merge pull request #3692 from pingou2712/postfixSystemd
...
Change journalmatch postfix
2024-03-13 02:34:03 +01:00
d260ed31d2
Maintain backward compatibility Postfix SYSTEMD_UNIT
2024-03-12 04:42:36 +01:00
dd3c78ecab
filter.d/recidive.conf: conditional RE depending on logtype (for file or journal)
2024-03-11 17:49:06 +01:00
0b63fc312d
Change Regex Recidive and journalmatch For Systemd Match
2024-03-10 10:56:35 +01:00
93082ead79
Change journalmatch postfix
2024-03-10 10:10:03 +01:00
45d7f3cb97
no space in any case
2024-03-08 11:43:46 +01:00
ff701e94c3
Add to postfix syslog daemon format
2024-03-07 20:23:50 +01:00
4f679a56e0
filter.d/sshd.conf: ddos/aggressive mode extended to match new messages caused by port scanner, wrong payload on ssh port:
...
- message authentication code incorrect [preauth]
- connection corrupted [preauth]
- timeout before authentication
closes gh-3486
2024-02-13 16:53:21 +01:00
3190febb27
IPv6 fix (second IP logged in form for IPv6); pam authentication failure (part of gh-3410)
2023-12-30 15:10:37 +01:00
093cd763ce
filter.d/postfix.conf: "rejected" extended to match "Access denied" too;
...
closes gh-3474
2023-12-15 01:03:30 +01:00
ff4a2a12fc
filter.d/postfix.conf: avoid double counting ('lost connection after AUTH' together with message 'disconnect ...');
...
closes gh-3505
2023-12-15 00:32:48 +01:00
0abba5dc6e
more filters for nginx error-log supporting journal format now, added generalized include and __prefix_line
2023-12-10 15:21:20 +01:00
b245225b13
filter.d/nginx-http-auth.conf: added optional prefix to support systemd-journal format and additional timestamp (optionally) in prefix
2023-12-10 14:39:21 +01:00
8ef0d3c7a9
[DATALAD RUNCMD] run codespell throughout fixing typo automagically
...
=== Do not change lines below ===
{
"chain": [],
"cmd": "codespell -w",
"exit": 0,
"extra_inputs": [],
"inputs": [],
"outputs": [],
"pwd": "."
}
^^^ Do not change lines above ^^^
2023-11-18 10:04:04 -05:00
81b2eb32d6
Add pragma to ignore a codespell-detected typoin postfix.conf
2023-11-18 10:03:50 -05:00
eed319e896
gh-3604: filter.d/slapd.conf - switched to single-line processing
...
closes gh-3604
2023-10-18 16:06:56 +02:00
183f805ae3
amend
2023-10-16 11:41:05 +02:00
7931b67325
mysqld-auth.conf: better RE, optional suffix, non-capturing groups
2023-10-16 11:35:53 +02:00
c55e9949dc
Fix issue with Mariadb 10.3 failed message
2023-10-16 01:35:15 +03:00
sebres