Yaroslav Halchenko
aa303acfd6
Merge pull request #1381 from theDogOfPavlov/patch-3
...
Tightened up exim regexes to catch rDNS entries
9 years ago
Alexandre Perrin
7712310d2d
Be more backward compatible on matching postfix/smtps/smtpd
...
Support trailing smtps also and not only smtpd.
suggested by @sebres
9 years ago
Alexandre Perrin
1a299409e5
Fix postfix/smtps/smtpd matching.
9 years ago
theDogOfPavlov
1eb51b1bc2
Tightened up regexes to catch rDNS entries
9 years ago
Yaroslav Halchenko
db2dd070ad
Merge pull request #1356 from opoplawski/bug-1354
...
Fedora use mariadb by default, fix log path
9 years ago
Serg G. Brester
b9b7ecbf6b
Merge pull request #1357 from sebres/monit-new-fltr
...
monit filter fixup for the new version (gh-1355)
9 years ago
TorontoMedia
3d239215cd
Two new firewalld actions with rich rules for firewalld-0.3.1+ (gh-1367)
...
closes #1367
9 years ago
sebres
ac27c9cb96
Merge branch 'patch-2' (gh-1371)
9 years ago
Serg G. Brester
0effe76971
Merge pull request #1370 from theDogOfPavlov/patch-1
...
Added regex for LDAP authentication failures
9 years ago
jblachly
e9202fa0b2
Placed failure (illumos) at end of regex
9 years ago
theDogOfPavlov
fe1475be95
Additional exim regexes to cover common attacks...
9 years ago
theDogOfPavlov
cf2aa9c1c0
Added regex for LDAP authentication failures
9 years ago
jblachly
25c2334bc8
SmartOS PAM Authentication failed (not failURE)
...
SmartOS (and likely other Illumos platforms) enter log entries for failed sshd logins of the form:
`Authentication failed for USER from HOST`
The current sshd.conf regex matches `failure` -- add to this a match for `failed` to support Illumos
9 years ago
Johannes Weberhofer
bd25a43417
define journalmatch setting for pure-ftps
9 years ago
Orion Poplawski
f3f813a925
- mysqld does not log login attempts to the journal.
...
- Add /var/log/mysqld.log to mysql_log
9 years ago
sebres
37c9075fad
fixed monit filter: failregex find now both previous and new versions:
...
- failregex of previous monit version merged as single expression;
- extended failregex with new monit "access denied" version;
9 years ago
Orion Poplawski
dfc65018da
Fedora use mariadb by default, fix log path
9 years ago
Yaroslav Halchenko
385b50e4a9
Merge pull request #1343 from denics/master
...
adding wp-admin to bot search
9 years ago
Denix
ed0e572bfc
added wp-admin
...
bot are very annoying and I am getting a lot of checks on wp-admin. This should calm them.
9 years ago
Yaroslav Halchenko
6ffbc1ffad
ENH: revert back to having detailed suffix anchored at the end for mysqld-auto.conf
...
As discussed in https://github.com/fail2ban/fail2ban/pull/1333#discussion_r54100127
9 years ago
Yaroslav Halchenko
3e31145c33
Merge pull request #1331 from whyscream/postfix-multi-instance-support
...
Add support for matching postfix multi-instance daemon names by default
9 years ago
sebres
667785b608
mysqld: failregex fixed (accepts different log level, more secure expression now);
...
closes #1332
9 years ago
Tom Hendrikx
6c606cf98f
Add support for matching postfix multi-instance daemon names by default
9 years ago
Yaroslav Halchenko
905c87ca4a
Merge pull request #1310 from yarikoptic/pr-1288
...
NF: HAProxy HTTP Auth filter
9 years ago
sebres
d8e81eb417
regexp rewritten (few vulnerable as previous) + test case added
9 years ago
3eBoP
257b7049d8
Update asterisk filter: changed regex for "Call from ...". Sometimes extension can have a plus symbol (+) because they can be phone number.
...
Closes #1309
9 years ago
Pierre GINDRAUD
b5a07741c8
Add new regex into postfix filter. The new regexp is able to detect bad formatted SMTP EHLO command
9 years ago
Yaroslav Halchenko
3f437b32db
Merge remote-tracking branch 'pr/1288/head'
...
* pr/1288/head:
Update haproxy-http-auth.conf
Added HAProxy HTTP Auth filter
Conflicts:
config/jail.conf - resolved + removed unnecessary filter/enabled (defaults should be as good)
9 years ago
Yaroslav Halchenko
377ea32441
Merge pull request #1295 from obounaim/master
...
The sender option is ignored by some actions
9 years ago
Serg G. Brester
fe14c8fa05
Merge pull request #1292 from albel727/master
...
Add nftables actions
9 years ago
Jordan Moeser
d7b46509d8
Update haproxy-http-auth.conf
...
Updated failregex to be more strict
9 years ago
local
40c0bed82c
action_mw, action_mwl, action_cf_mwl ignore the "sender" option when sending a notification email.
...
This commit adds "sender="%(sender)s"" to the three actions to correct this issue.
9 years ago
Yaroslav Halchenko
5d0d96a5cb
Merge pull request #1286 from yarikoptic/enh-jail
...
ENH: harmonize jail.conf + 1 more test that passed bantime is non-degenerate and int
9 years ago
Alexander Belykh
985e8938a4
Refactor nftables actionstop into smaller parts
9 years ago
Alexander Belykh
9779eeb986
Add nftables_type/family/table parameters
9 years ago
Alexander Belykh
260c30535d
Escape curly braces in nftables actions
9 years ago
Alexander Belykh
1983e15580
Add empty line between parameters in nftables-common.conf
9 years ago
Alexander Belykh
f7f91a8bd4
Refactor common code out of nftables-multiport/allports.conf
9 years ago
sebres
69f5623f83
code simplifying (remove duplication): agent will be always supplied as parameter from jail.conf
9 years ago
Alexander Belykh
618e97bce8
Add nftables actions
9 years ago
sebres
ac31121432
amend to fix fail2ban-version: correct user-agent for badips.py "Fail2Ban/ver", changeable within jail/config now;
9 years ago
Jordan Moeser
e133762a28
Added HAProxy HTTP Auth filter
9 years ago
sebres
cf334421bd
Provides fail2ban version to jail (as interpolation variable during parse of jail.conf);
...
BF: use `fail2ban_agent` as user-agent in actions badips, blocklist_de, etc. (closes #1271 , closes #1272 )
9 years ago
Yaroslav Halchenko
28c9832293
RF: harmonize jail.conf (no explicit enabled=false in jails, match filter name for screesharingd, etc)
9 years ago
Yaroslav Halchenko
69aa1feac0
Merge "Mac OS Screen Sharing filter" PR 1232
...
* pr/1232/head:
removed system.log
Removed old svn revision comment
removed false matches
Removed includes comment for screensharing jail
Now using a literal logpath for screensharing jail
Fixed blatant typo in regex
clarified comments on sample log format
Fixed name (again?)
Made screensharing jail off by default
Changed regex prequel
added entry for new screensharingd filter
name change & new sample data
Added json metadata
Sample log for test case
Replaced .* with literal
Update jail.conf
Added new path variable for system.log
Added in settings for screensharingd filter
Created file
Conflicts:
ChangeLog - moved to New Features
config/jail.conf - kept at the end
9 years ago
Yaroslav Halchenko
26dd6d7425
Merge pull request #1258 from aleksandrs-ledovskis/feature/postfix-domain-not-found-failregex
...
Add 'Sender address rejected: Domain not found' Postfix failregex
9 years ago
Ross Brown
8d12dba245
Merge remote-tracking branch 'upstream/master'
9 years ago
Ross Brown
ead2d509dc
Updated 'murmur' filter to use new double-anchored regex based on @yarikoptic's suggestions.
9 years ago
Yaroslav Halchenko
5d6cead996
ENH: sshd filter -- match new "maximum auth attempts exceeded" ( Closes #1269 )
9 years ago
Ross Brown
106c3eab9a
Added filter and jail for murmur/mumble-server.
9 years ago