2397 Commits (a9f0545d8fbb88ed5be5518dca1b706009b1e794)

 

All Branches   

Search

Author	SHA1	Message	Date
Daniel Black	f566cab766	Merge branch 'master' into badips	11 years ago
Daniel Black	657da2041c	BF: dovecot filters, session characters and order of session/tls in log messages	11 years ago
Ivo Truxa	4765bc757c	BF Dovecot auth failures ... I am sorry, I installed the Win GIT, but still did not learn how to work with it, so am posting here again. This time, I'll avoid posting two pull requests, so please fix the dovecot.filter for me, if you don't mind. This current filter does not match authentication errors in my Dovecot logs (two different lines attached). First of all the session string is at the end (after the optional TLS string), and not before it as it is now in the filter. I don't see it anywhere in the other logs here in the opposite order, hence I assume it is the rule for all installations. And then, the session ID can include also other characters than those matched by \w+ (i.e. the slash and the plus signs in my case), hence it needs to be \S+ instead. Personally, I'd do the regex much less restrictive than it is, but if I follow the current logics, the following form works: <pre>^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((no auth attempts|auth failed, \d+ attempts)( in \d+ secs)?|tried to use disabled \S+ auth)\):( user=&lt;\S*&gt;,)?( method=\S+,)? rip=&lt;HO ST&gt;, lip=(\d{1,3}\.){3}\d{1,3}(, TLS( handshaking)?(: Disconnected)?)?(, session=&lt;\S+&gt;)?\s*$</pre>	11 years ago
Daniel Black	2333b2d5d9	MRG: from 0.9	11 years ago
Daniel Black	703d337a39	Merge pull request #580 from grooverdan/master_to_0.9 ... MRG: Master to 0.9	11 years ago
Daniel Black	c7f887642d	Merge branch '0.9' into master_to_0.9	11 years ago
Daniel Black	3de80545e0	MRG: from master 2014/01/13	11 years ago
Daniel Black	01e5ae1234	Merge pull request #584 from grooverdan/exim-auth ... ENH: Exim auth	11 years ago
Daniel Black	b60449e5c7	Merge pull request #579 from grooverdan/squirrelmail ... ENH: Squirrelmail filter	11 years ago
Daniel Black	812463003d	Merge pull request #582 from grooverdan/postfix ... ENH: add improper command pipelining postfix filter	11 years ago
Daniel Black	08b4f3e5f2	Merge branch 'patch-5' of https://github.com/truxoft/fail2ban into exim-auth	11 years ago
Daniel Black	353b84a648	Merge branch 'patch-4' of https://github.com/truxoft/fail2ban into exim-auth	11 years ago
Lars Kneschke	47dd8fb897	ENH: filter for Tine 2.0	11 years ago
Ivo Truxa	2d8c0b26e4	Matching any Exim authentication name ... As explained in https://github.com/grooverdan/fail2ban/pull/4, in Exim there can be used plenty of other standard authentication names, and in fact the names can be custom. The failregex in Exim filter should catch authentication errors regardless of the name of the authentication. Hence replacing the plain|login with the general \w+	11 years ago
Ivo Truxa	9f107403e8	Update exim ... When using Dovecot authentication for Exim, which is relatively common, the current regex for catching authentication failures needs a small tweak. The current plain|login options are too limiting and will only work in the cases when only the Exim's rudimentary built-in authentication is used. There can be not only the dovecot_login shown in this log example, but also dovecot_plain, ntlm, cram, cyrus, md5, and plenty of others. In fact many admins may opt for their own authentication labels, when setting up Exim. For this reason the regex should catch any label. I suggest modifying the regex in the following way: <pre>^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$</pre>	11 years ago
Daniel Black	6b0e6b9bca	ENH: add improper command pipelining postfix filter	11 years ago
Steven Hiscocks	d41f372c6c	BF: Typo in "z" regex addition for TimeRE	11 years ago
Steven Hiscocks	5c16ac3a89	ENH: Full regex for datepattern, utilising modified Python `_strptime`	11 years ago
Daniel Black	a443b8b4d3	BF: remove second jail definition	11 years ago
Daniel Black	7b6ee64b9e	DOC: add over pruned bits of jail.conf.5	11 years ago
Daniel Black	cd3e94140c	MRG: complete merge	11 years ago
Daniel Black	f2e55e8499	ENH: add filter for squirrelmail. Closes gh-261	11 years ago
Daniel Black	1e8ed55a36	MRG: from 0.9	11 years ago
Daniel Black	5deb1f8ddc	Merge pull request #578 from dozepih/asterisk-acl ... ENH: Support ACL-events without AccountID. Typically happens when a registration from unknown domain	11 years ago
Tomas Pihl	b52a4441fd	Support ACL-events without AccountID. Typically happens when a registration ... from an unknown domain is performed. Add credits	11 years ago
Steven Hiscocks	0dd6533680	BF: Add ejabberd-auth to jail.conf	11 years ago
Steven Hiscocks	e73090d040	Merge pull request #577 from grooverdan/rel-imports ... ENH: fix test case imports to relative	11 years ago
Daniel Black	e9752d8d29	ENH: fix test case imports to relative	11 years ago
Daniel Black	928f566d19	Merge pull request #576 from kwirk/ejabberd-filter ... ENH: ejabberd filter	11 years ago
Steven Hiscocks	62cfad3c2d	Merge pull request #575 from grooverdan/no-dot-filters ... ENH: dont run samples on filter filenames beginning with .	11 years ago
Steven Hiscocks	6a6139f1e1	Merge pull request #574 from grooverdan/master-tag-subst ... TST: for tag substition, multiple on same line	11 years ago
Steven Hiscocks	128112d51c	ENH: ejabberd filter	11 years ago
Daniel Black	8e8c80d980	ENH: dont run samples on filter filenames beginning with .	11 years ago
Daniel Black	cd5aab5ff1	TST: for tag substition, multiple on same line	11 years ago
Daniel Black	8333abe420	Merge pull request #557 from grooverdan/apache-botsearch ... ENH: Apache botsearch + BF: tag substition	11 years ago
Daniel Black	b0baab3a0e	ENH: more test cases and wider regex	11 years ago
Daniel Black	9e358541b7	BF: fix multiple tag substitutions on the same line	11 years ago
Daniel Black	4b33f96db4	DOC: fix comment regarding apache version in apache-noscript	11 years ago
Daniel Black	8e5366a7e9	DOC: for apache-botsearch and apache-botsearch	11 years ago
Steven Hiscocks	7e8da15fc6	Merge pull request #572 from grooverdan/counterstrike ... ENH: Counter Strike filter	11 years ago
Daniel Black	4d4060930b	DOC: spelling + GPL2+ for license	11 years ago
Daniel Black	932a952096	Merge branch 'enh/jail-manpage' of https://github.com/yarikoptic/fail2ban into y-man-fix	11 years ago
Daniel Black	b6676dbadc	DOC: spelling of Counter Strike	11 years ago
Yaroslav Halchenko	e6627185b0	DOC: fixing formatting in the section names of the manpage - \fB to return into bold	11 years ago
Yaroslav Halchenko	6532a2e2f7	Merge pull request #548 from grooverdan/exim-honeypot ... Exim honeypot	11 years ago
Daniel Black	d94efe719d	ENH: jail.conf for counter-strike	11 years ago
Daniel Black	7e44257e7e	Merge pull request #569 from grooverdan/master_to_0.9 ... MRG: Master to 0.9	11 years ago
Daniel Black	0fb6bc7188	ENH: add filter for Counter Strike 1.6. Closes gh-347	11 years ago
Daniel Black	a115297ebd	TST: add datepattern for samplestestcases	11 years ago
Daniel Black	aabdc51e87	BF: revert separate jail for exim-honeypot as only exim-spam exists.	11 years ago