Daniel Black
f998e01590
Merge pull request #359 from grooverdan/pureftpd
...
ENH: Pureftpd syslog prefixing and filter achoring
11 years ago
Daniel Black
ba8183b116
Merge pull request #372 from grooverdan/uw-imap
...
ENH: filter.d/uwimap-auth added. Closes #18
11 years ago
Daniel Black
262616f7a7
ENH: filter.d/uwimap-auth - failure of an admin override to regex
11 years ago
Daniel Black
9211179d30
ENH: filter.d/uwimap-auth - add "disabled" to regex
11 years ago
Daniel Black
4649cf9608
ENH: separate selinux and selinux-ssh
11 years ago
Daniel Black
791183b639
ENH: filter.d/uwimap-auth - add SYSTEM BREAK-IN ATTEMPT
11 years ago
Daniel Black
a1eaa5f755
ENH: filter.d/selinxu added. Closes #296
11 years ago
Daniel Black
778f09debe
DOC/ENH: __md5hex regex defination to common.conf. Document debian bug #
11 years ago
Daniel Black
b3b62d65bf
ENH: filter.d/uwimap-auth added. Closes #18
11 years ago
Daniel Black
f2ae20a3b8
BF: filter.d/sshd group on md5hex and () for serial needed to be escaped
11 years ago
Daniel Black
1eeb6e94bd
BF: fix regex for openssh-6.3
11 years ago
Daniel Black
e12d389c65
MRG/DOC: jail.conf resolution, ChangeLog fixes
11 years ago
Mark McKinstry
b6bf26c9f2
dont' need to set a default name
11 years ago
Mark McKinstry
4187e87b69
don't enabel ssh-apf jail by default
11 years ago
Mark McKinstry
f9f4d2728f
add an example jail for apf action and ssh filter
11 years ago
Mark McKinstry
2668adc896
Merge branch 'master' of github.com:fail2ban/fail2ban
11 years ago
Mark McKinstry
1af4543aca
ability to name the jail that banned the IP with apf
11 years ago
Mark McKinstry
dd9ee4c39a
quotes around the comment put in apf's deny_hosts.rules file
11 years ago
Mark McKinstry
e64493c328
use human readable/longer options when banning and un-banning IPs with apf
11 years ago
Mark McKinstry
c692912a82
don't hardcode absolute path for apf firewall
11 years ago
Mark McKinstry
66aff43d68
remove un-needed '$' line
11 years ago
Daniel Black
8c2a5612ed
DOC: resolve ChangeLog conflicts
11 years ago
Daniel Black
2a805452c6
DOC: resolve ChangeLog conflicts
11 years ago
Daniel Black
8e9fab9b3c
Merge branch 'master' of https://github.com/fail2ban/fail2ban
11 years ago
Daniel Black
3be7dcd701
DOC: resolve ChangeLog conflicts
11 years ago
Daniel Black
89e0520675
ENH: dovecot regex to match failure reported by Bob Cohen on mailing list
11 years ago
Daniel Black
c3ee03b9ba
BF: fix daemon name typo for filter proftpd
11 years ago
Daniel Black
39ca8837eb
TST: pureftpd - syslog therefore use syslog prefixes in filter
11 years ago
Daniel Black
30bb1a77a3
ENH: added syslog prefix to pam-generic filter. Disable regex match for pre 2006 (< 0.99.2.0) versions on linux-pam
11 years ago
Daniel Black
ee497ff1cb
ENH: filter mysqld-auth can be a is a syslog based service so anchor it using syslog prefix
11 years ago
Daniel Black
13ec9d58c0
ENH: filter gssftpd is a syslog based service so anchor it using syslog prefix
11 years ago
Daniel Black
673cc4d77f
ENH: anchor at end of recidive filter
11 years ago
Daniel Black
504111b0b1
ENH: filter.d/recidive - anchor regex at start and support f2b SYSLOG target
11 years ago
Beau Raines
060bd45295
ENH - Added server name to subject line in email notifications
...
This is useful when fail2ban is running on multiple servers and
keeping the notifictions separate and knowing which machine is "under
attack".
11 years ago
Daniel Black
ad291d7e38
Merge pull request #346 from grooverdan/bsd-ipfw-default-unreach-port
...
BF: action.d/bsd-ipfw - use blocktype instead of unused action for icmp ...
11 years ago
Daniel Black
e5f1a7f050
Merge pull request #344 from grooverdan/osx
...
ENH: OSX ipfw based on Andy Fragen's work
11 years ago
Daniel Black
4face1f3e7
MRG: resolve conficts in action.d/osx-ipfw design
11 years ago
Andy Fragen
d258a51a23
after some research it looks like setting to unreachable better than deny
11 years ago
Andy Fragen
fe557e5900
more specific actionunban
11 years ago
Andy Fragen
a4884f82cd
add mods from grooverdan and fix actionunban
...
actionunban still not working in grooverdan's mod. I made this one grep both <ip> and <port>. It should be more specific if the same <ip> is banned on multiple ports.
11 years ago
Daniel Black
6b0e2289d4
Merge pull request #335 from grooverdan/gh-333-bind
...
ENH: filter.d/named-refused.conf - BIND 9.9.3 regex changes. Closes gh-333
11 years ago
Daniel Black
f2bcf84893
BF: action.d/bsd-ipfw - use blocktype instead of unused action for icmp rejecting blocked packets
11 years ago
Daniel Black
749f215089
ENH: port optional
11 years ago
Daniel Black
8b22fa15b5
BF: reverted to simplier random rulenum. If your machine is handling 1000s of block the addition complexity isnt what you want
11 years ago
Daniel Black
b31799a322
ENH: add action.d/osx-afctl anonymously contributed on f2b wiki
11 years ago
Daniel Black
808aa1a792
ENH: added jail.conf example. closes gh-340
11 years ago
Daniel Black
5741348f45
ENH: more options and ruggedness to prevent unintensional consequences
11 years ago
Daniel Black
52bd0f86a8
Merge branch 'osx-ipfw' of https://github.com/afragen/fail2ban into osx
11 years ago
Daniel Black
7cc3e8a8c0
BF: Invert expression on actionstop in bsd-ipfw.conf to ensure exit status 0 on success. Closes gh-343
11 years ago
Daniel Black
15f2f38972
ENH: anchor regex at start
11 years ago
Daniel Black
d5684a0834
BF: filter.d/routecube-auth - time offset can be positive or negative
11 years ago
Daniel Black
a401d11644
ENH: add regex for bad zone transfer request/ TST: add test for bind-9.9 zone transfer denied
11 years ago
Andy Fragen
ef504c869f
added osx specific ipfw action with random rulenum
11 years ago
Yaroslav Halchenko
265a85ec1f
RF: do not catch for now "invalid nonce \S* received - hash is not \S*" -- imho needs more analysis
11 years ago
Daniel Black
b8e7d0b867
ENH: further tighten lighttpd basic auth regex
11 years ago
Daniel Black
a7ebb84a7d
ENH: tighted up lighttpd regex
11 years ago
François Boulogne
e133b9f1d1
MAINT: add support for lightty1.4.31
11 years ago
Daniel Black
ca4729e943
ENH: filter.d/exim.conf - add authentication failures for "plain" authentication
11 years ago
Daniel Black
ef903db3c9
ENH: filter.d/named-refused.conf - BIND 9.9.3 regex changes. Closes gh-333
11 years ago
Daniel Black
cfb7dba268
DOC: merge ChangeLog
11 years ago
Daniel Black
b589533d69
Merge branch 'master' into kwirk-merge
...
Conflicts:
ChangeLog
testcases/files/logs/dropbear
11 years ago
Daniel Black
fd7cc5bda7
BF: duplicate regex match fixed
11 years ago
Daniel Black
6a56727669
BF: apache-common regex - datetime could be entirely consumed
11 years ago
Daniel Black
a9eb8a76c6
merge of change log and apache-auth differences
11 years ago
Steven Hiscocks
4e5feed7fc
Merge pull request #8 from grooverdan/gh-303-merge-2
...
training space on wuftp
11 years ago
Daniel Black
aad7d08451
BF: disable filter expressions without tests
11 years ago
Yaroslav Halchenko
42f3aa9f62
Merge pull request #329 from grooverdan/bind-unauth-zonetransfer
...
Bind unauth zonetransfer. Closes #323
11 years ago
Daniel Black
6a36ff1a4a
BF: order mailx arguments with dest email address last - redhat bugzilla 998020. Closes gh-328
11 years ago
Daniel Black
c44328b1a3
ENH: new "realm mismatch" message from https://issues.apache.org/bugzilla/show_bug.cgi?id=55284#c8
11 years ago
Daniel Black
ea7cba4205
ENH: trailing space as per discussion on gh-303
11 years ago
Daniel Black
61d43608ae
ENH: filter.d/postfix - add filter for VRFY. Closes gh-322
11 years ago
Daniel Black
5d451bc4d6
ENH: add refused zone tranfer to named-refused filter. closes #323
11 years ago
Steven Hiscocks
53e16e07ad
ENH: Minor tweak on previous commit proftpd regex changes
11 years ago
Steven Hiscocks
9002de069e
ENH: Improve proftpd regex.
...
Taken from @yarikoptic comment:
https://github.com/fail2ban/fail2ban/pull/303#discussion_r5687500
11 years ago
Orion Poplawski
31a78b2711
Use /var/run/fail2ban in config/action.d/dummy.conf
11 years ago
Yaroslav Halchenko
e7d5e466b9
Merge branch 'enh/asterisk_and_dropbear_filters'
...
* enh/asterisk_and_dropbear_filters:
ENH: hardened added dropbear failregex to avoid trailing .* and enclose username in ''
minor: consistent indentation in dropbear.conf
https://github.com/fail2ban/fail2ban/issues/306
fail2ban-users: Sebastian Arcus - Detect device auth failures on Asterisk 11
11 years ago
Yaroslav Halchenko
4e0ddc5f67
ENH: hardened added dropbear failregex to avoid trailing .* and enclose username in ''
11 years ago
Yaroslav Halchenko
9487ee5562
minor: consistent indentation in dropbear.conf
11 years ago
Daniel Black
d8883f4346
DOC: Notes about 401 responses and how apache logs this
12 years ago
Daniel Black
7b2773889d
TST: apache-auth filter - nonce timetravel tests + other expression fixes
12 years ago
Daniel Black
0fb04cb2f0
ENH: filter enhancements on mod-digest (with test cases) for apache-auth (httpd-2.4.4)
12 years ago
Daniel Black
56faf7f5ad
DOC: fix ChangeLog merge
12 years ago
Jamyn Shanley
a355fab91b
https://github.com/fail2ban/fail2ban/issues/306
...
Fix regex for latest dropbear (keep backwards compatibility). Add test case logfiles.
Signed-off-by: Jamyn Shanley <jshanley@gmail.com>
12 years ago
Jamyn Shanley
8936f2cd02
fail2ban-users: Sebastian Arcus - Detect device auth failures on Asterisk 11
12 years ago
Steven Hiscocks
2f4aaa9fb9
ENH: Simplify sieve filter failregex
12 years ago
Steven Hiscocks
b5639a8672
ENH: Simplify cyrus-imap filter fail regex
12 years ago
Daniel Black
8f532f9148
NIT: space remove
12 years ago
Daniel Black
7d7ef08145
ENH: authentication_id can be an imap4 quoted string, whatever that is, so using .+ as its id
12 years ago
Daniel Black
abc4146079
ENH: perdition proxies other types hence daemon can include (perdidtion.(imap|pop)s?|managesieve). Also support local authentication resulting in the log message: local authentication failure
12 years ago
Steven Hiscocks
cf1e5bdbc2
ENH: Tweak proftpd regex and add sample logs
...
Needed to add optional ":" post __pid_re, and for consistency, decided
to make use of __prefix_line instead which includes this.
12 years ago
Steven Hiscocks
8b9bafda79
ENH: Change lighttpd-fastcgi to suhosin, and improve regex and samples
...
suhosin is hardened php implmentation, which will log the alerts (as
seen in samples) to stderr, which is picked up by fastcgi webserver
(e.g. lighttpd, apache, nginx)
12 years ago
Steven Hiscocks
4033857f63
ENH: Improve xinetd-fail regex and add sample logs
12 years ago
Steven Hiscocks
a11f91b835
ENH: Improve cyrus-imap regex and add extra sample line
12 years ago
Steven Hiscocks
534be189dc
ENH: Improve sieve regex and add sample line
12 years ago
Steven Hiscocks
ab671b0b1a
ENH: Improve wuftpd failregex, drop duplicate pam regex and add sample
...
For wu-ftpd configured to use pam, the pam filter used be used, as regex
is more robust.
12 years ago
Steven Hiscocks
57a6c11260
ENH: Improve courierlogin regex and add sample logs
12 years ago
Steven Hiscocks
bd175f0267
ENH: Improve cyrus-imap regex and add sample log file
12 years ago
Steven Hiscocks
83a80a29ea
ENH: Improve couriersmtp and add sample logs
12 years ago
Steven Hiscocks
eb2f0c9272
ENH: Improve postfix regex and add more samples
12 years ago
Daniel Black
5cfe108186
ENH: filter enhancements (with test cases) for apache-auth (httpd-2.4.4)
12 years ago