* '3proxy' of https://github.com/grooverdan/fail2ban:
BF: fix to proxy port in 3proxy example
ENH: sample log + more specific regex
BF: authentication errors end in 01-09 but the beginning part indicates the service as per https://github.com/fail2ban/fail2ban/issues/246#issuecomment-19327955 thanks to ykimon
BF: need to anchor the start to avoid another repeat of DoS injection like Apache
ENH: stricter regex thanks to Steven Hiscocks (kwirk)
DOC: credits
Conflicts:
ChangeLog
* 'exim' of https://github.com/grooverdan/fail2ban:
BF/ENH: Incorrect authentication data doesn't need tailier so that's optional. Also gained log entry for Unrouteable address
ENH: readibility thanks to Yaroslav
ENH/BF: exim improvements with sample
Conflicts:
ChangeLog
* 'proftpd' of https://github.com/grooverdan/fail2ban:
ENH: proftpd chan accept usernames with spaces
ENH: injection of fail data into USER field
ENH: proftp regex hardening and log messages
Conflicts:
ChangeLog
* 'dovecot' of https://github.com/grooverdan/fail2ban:
TST: attempts at injection with username=rhost=1.2.3.4 have no user= logged in dovecot-1.2.15
ENH: dovecot regexs rewritten and extra failures
Conflicts:
ChangeLog -- merged entries
* 'assp' of https://github.com/grooverdan/fail2ban:
BF: missed a space
BF: [SSL-out] is optional in assp
ENH: regex hardening on assp
Conflicts:
ChangeLog -- merged the two entries into 1
# Only works only if log driver: is set to 'syslog'. this is becoz fail2ban fails to 'read' the line due to the
brackets around the date timestamp on logline when log driver is set to file
* 'bsd_logs' of https://github.com/grooverdan/fail2ban:
ENH: separate out regex and escape a .
BF: missed MANIFEST include
DOC: credits for bsd log
DOC: bsd syslog files thanks to Nick Hilliard
BF: change common.conf to handle formats of syslog -v and syslog -vv in BSD
Conflicts:
config/filter.d/common.conf
Origin: from https://github.com/jamesstout/fail2ban
* 'OpenSolaris' of https://github.com/jamesstout/fail2ban:
ENH: Removed unused log line
BF: fail2ban.local needs section headers
ENH: Use .local config files for logtarget and jail
ENH+TST: ssh failure messages for OpenSolaris and OS X
ENH: fail message matching for OpenSolaris and OS X
ENH: extra daemon info regex
ENH: actionunban back to a sed command
Readme for config on Solaris
create socket/pid dir if needed
Extra patterns for Solaris
change sed to perl for Solaris
Conflicts:
config/filter.d/sshd.conf
Origin: https://github.com/lenrico/fail2ban
Squashing was done via rebase -i 1524b076d6
to eliminate massive assp sample log file originally added
fixed test date thx to steven
tight control of the filter for ASSP
as yaroslav wishes
as daniel desires
changed from DateASSPlike class to DateStrptime
fixed little things
added new date format support for ASSP SMTP Proxy
- OpenSolaris keyboard message matched by new regex 3
- Removed Bye Bye regex per
https://github.com/fail2ban/fail2ban/issues/175#issuecomment-16538036
- PAM auth failure or error and first char case-insensitive, can also
have chars after the hostname. e.g.
Apr 29 16:53:38 Jamess-iMac.local sshd[47831]: error: PAM:
authentication error for james from 205.186.180.101 via 192.168.1.201
for matching log lines like:
Mar 29 05:20:09 dusky sshd[19558]: [ID 800047 auth.info] Failed
keyboard-interactive for james from 205.186.180.30 port 54520 ssh2
this matches [ID 800047 auth.info]
* 'Support_for_mysql_log_example' of https://github.com/arto-p/fail2ban:
Added testcase for MySQL date format to testcases/datedetectortestcase.py and example of MySQL log file.
Added support for MySQL logfiles
Conflicts:
testcases/datedetectortestcase.py -- conflictde with other added test cases
* pr/117/head:
An example of failed logins against sogo
Update sogo-auth.conf
Update config/filter.d/sogo-auth.conf
Create sogo-auth.conf
Update config/jail.conf
* 'master' of git://github.com/fail2ban/fail2ban:
add blocking type
add example jail.conf for blocking through blackhole routes for ssh
add support for blocking through blackhole routes
Do not trigger sshd bans on pam_unix authentication failures, this will trigger on successful logins on systems that use non-pam_unix authentication (sssd, ldap, etc.).
Noticed while looking at the source (to see the point of ssh-ddos).
POSSIBLE BREAK-IN ATTEMPT - sounds scary? But keep reading
the message. It's not a login failure. It's a warning about
reverse-DNS. The login can still succeed, and if it _does_ fail,
that will be logged as normal.
<exhibit n="1">
Jul 9 05:43:00 brick sshd[18971]: Address 200.41.233.234 maps to host234.advance.com.
ar, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 9 05:43:00 brick sshd[18971]: Invalid user html from 200.41.233.234
</exhibit>
The problem (in my mind) is that some users are stuck with bad dns.
The warning won't stop them from logging in. I'm pretty sure they can't
even see it. But when they exceed a threshold number of logins -
which could be all successful logins - fail2ban will trigger.
fail2ban shouldn't adding additional checks to successful logins
- it goes against the name fail2ban :)
- the first X "POSSIBLE BREAK-IN ATTEMPT"s would be permitted anyway
- if you want to ban bad DNS, the right way is PARANOID in /etc/hosts.deny
I've checked the source of OpenSSH, and this will only affect the
reverse-DNS error. (I won't be offended if you want to check
for yourself though ;)
<exhibit n="2">
$ grep -r -h -C1 'ATTEMPT' openssh-5.5p1/
logit("reverse mapping checking getaddrinfo for %.700s "
"[%s] failed - POSSIBLE BREAK-IN ATTEMPT!", name, ntop);
return xstrdup(ntop);
--
logit("Address %.100s maps to %.600s, but this does not "
"map back to the address - POSSIBLE BREAK-IN ATTEMPT!",
ntop, name);
$
</exhibit>
* gh-magicrhesus/master:
Add the INCLUDE section to use __pid_re feature
Disable asterisk jail by default
Change jail for asterisk, add support for SIP and SIP-TLS on TCP and UDP ports
Change NOTICE by NOTICE%(__pid_re)s
Remove custom bantime
Add sample log file for asterisk
Add $ at the end of the failregex
Add asterisk support
Conflicts:
config/jail.conf -- placed asterisk jails before recidive and added blank lines after the jail headers
Based on previous work as documented in the bug by Amir and myself,
plus some enhancements and documentation added to the file itself rather
than a URL (they rot).
following commits were squashed from feature branch use_dns
commit 068c105eb5
Author: Lee Clemens <java@leeclemens.net>
Date: Tue Jan 10 22:19:04 2012 -0500
Prevent warning when IP is read from log
commit 635ed36a8c
Author: Lee Clemens <java@leeclemens.net>
Date: Tue Jan 10 22:17:08 2012 -0500
Removed logDebug
commit 24656d2812
Merge: 7957fbec429f5c
Author: Lee Clemens <java@leeclemens.net>
Date: Tue Jan 10 21:13:11 2012 -0500
Merge branch 'enh/use_dns' of github:leeclemens/fail2ban into enh/use_dns
Conflicts:
testcases/filtertestcase.py
commit 7957fbe821
Author: Lee Clemens <java@leeclemens.net>
Date: Tue Jan 10 21:09:58 2012 -0500
filtertestcase fixes from yarikoptic
commit 6ce9d04640
Author: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue Jan 10 19:26:05 2012 -0500
RF: for consistency use_dns -> usedns
I guess it was might fault of inconsistency suggesting that name.
Other options/commands do not have _ in the names, so let it be
consistent with the rest for now
commit cfb2c75b49
Author: Lee Clemens <java@leeclemens.net>
Date: Tue Jan 10 19:18:41 2012 -0500
Updated DNSUtilsTests to test use_dns and added positive test to testTextToIp
commit f6186eff14
Author: Lee Clemens <java@leeclemens.net>
Date: Tue Jan 10 19:02:04 2012 -0500
Changed wording of 'DNS Reverse lookup used' message
commit 82c62d29dc
Author: Lee Clemens <java@leeclemens.net>
Date: Tue Jan 10 18:53:17 2012 -0500
Removed extraneous "n"
commit dc0ae21932
Author: Lee Clemens <java@leeclemens.net>
Date: Mon Jan 9 23:07:59 2012 -0500
ENH: use_dns - removed debugging statements
commit 594e25818c
Author: Lee Clemens <java@leeclemens.net>
Date: Mon Jan 9 22:53:39 2012 -0500
Added use_dns protocol to set and get per jail during runtime
commit 48ff80ffac
Author: Lee Clemens <java@leeclemens.net>
Date: Mon Jan 9 22:41:18 2012 -0500
Completed use_dns for initial startup - with debugging statements
commit 0bdab4c2d7
Author: Lee Clemens <java@leeclemens.net>
Date: Mon Jan 9 20:05:35 2012 -0500
ENH: Added use_dns option
commit 6d6b734ea5
Author: Lee Clemens <java@leeclemens.net>
Date: Mon Jan 9 20:01:34 2012 -0500
ENH: Added use_dns option
commit 11ad2b6125
Author: Lee Clemens <java@leeclemens.net>
Date: Mon Jan 9 19:17:30 2012 -0500
Added useDns flag to testcase
commit b48fa9b6af
Author: Lee Clemens <java@leeclemens.net>
Date: Sun Jan 8 15:13:27 2012 -0500
Added use_dns option in jail.conf
commit c429f5c91a
Merge: 4b18afb0021906
Author: leeclemens <java@leeclemens.net>
Date: Tue Jan 10 16:32:22 2012 -0800
Merge pull request #3 from yarikoptic/enh/use_dns
let's be consistent ;-)
commit 0021906358
Author: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue Jan 10 19:26:05 2012 -0500
RF: for consistency use_dns -> usedns
I guess it was might fault of inconsistency suggesting that name.
Other options/commands do not have _ in the names, so let it be
consistent with the rest for now
commit 4b18afb28a
Author: Lee Clemens <java@leeclemens.net>
Date: Tue Jan 10 19:18:41 2012 -0500
Updated DNSUtilsTests to test use_dns and added positive test to testTextToIp
commit 4fae37e46f
Author: Lee Clemens <java@leeclemens.net>
Date: Tue Jan 10 19:02:04 2012 -0500
Changed wording of 'DNS Reverse lookup used' message
commit e94806ce48
Author: Lee Clemens <java@leeclemens.net>
Date: Tue Jan 10 18:53:17 2012 -0500
Removed extraneous "n"
commit 4d30c52907
Author: Lee Clemens <java@leeclemens.net>
Date: Mon Jan 9 23:07:59 2012 -0500
ENH: use_dns - removed debugging statements
commit 76696d452a
Author: Lee Clemens <java@leeclemens.net>
Date: Mon Jan 9 22:53:39 2012 -0500
Added use_dns protocol to set and get per jail during runtime
commit 0631618087
Author: Lee Clemens <java@leeclemens.net>
Date: Mon Jan 9 22:41:18 2012 -0500
Completed use_dns for initial startup - with debugging statements
commit d23d495547
Author: Lee Clemens <java@leeclemens.net>
Date: Mon Jan 9 20:05:35 2012 -0500
ENH: Added use_dns option
commit 9538553bc5
Author: Lee Clemens <java@leeclemens.net>
Date: Mon Jan 9 20:01:34 2012 -0500
ENH: Added use_dns option
commit ae1e857e53
Author: Lee Clemens <java@leeclemens.net>
Date: Mon Jan 9 19:17:30 2012 -0500
Added useDns flag to testcase
commit ace43eb941
Author: Lee Clemens <java@leeclemens.net>
Date: Sun Jan 8 15:13:27 2012 -0500
Added use_dns option in jail.conf
According to rfc2822, Date: headers are not optional.
Added these to all sendmail action templates, format specification
should conform to rfc and be portable across multiple platforms.
Daniel Black