github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity
3,025 Commits
34 Branches
229 Tags
21 MiB
Commit Graph

3025 Commits (c9b24839e4338059224dcc743eb7f458f850f18e)

Author SHA1 Message Date
Steven Hiscocks 8b9bafda79 ENH: Change lighttpd-fastcgi to suhosin, and improve regex and samples 
suhosin is hardened php implmentation, which will log the alerts (as
seen in samples) to stderr, which is picked up by fastcgi webserver
(e.g. lighttpd, apache, nginx)
 2013-07-21 16:35:37 +01:00
Steven Hiscocks 4033857f63 ENH: Improve xinetd-fail regex and add sample logs 2013-07-21 15:44:09 +01:00
Steven Hiscocks b5ffbced37 TST: Sample test cases now handle ignoreregex and add recidive samples 2013-07-21 15:31:32 +01:00
Steven Hiscocks e7b7815de3 TST: Add additional sshd sample logs 2013-07-21 15:22:44 +01:00
Daniel Black 0de02f9ab0 Merge pull request #300 from kwirk/ejabberd-auth 
ENH: Add ejabberd-auth filter and sample log lines
 2013-07-20 15:39:01 -07:00
Steven Hiscocks a11f91b835 ENH: Improve cyrus-imap regex and add extra sample line 2013-07-20 17:28:28 +01:00
Steven Hiscocks 534be189dc ENH: Improve sieve regex and add sample line 2013-07-20 17:26:09 +01:00
Steven Hiscocks d791ba12ba TST: Add sample log for dropbear filter 2013-07-20 16:54:28 +01:00
Steven Hiscocks ab671b0b1a ENH: Improve wuftpd failregex, drop duplicate pam regex and add sample 
For wu-ftpd configured to use pam, the pam filter used be used, as regex
is more robust.
 2013-07-20 16:34:24 +01:00
Steven Hiscocks 57a6c11260 ENH: Improve courierlogin regex and add sample logs 2013-07-20 15:53:18 +01:00
Steven Hiscocks bd175f0267 ENH: Improve cyrus-imap regex and add sample log file 2013-07-20 15:38:29 +01:00
Steven Hiscocks 83a80a29ea ENH: Improve couriersmtp and add sample logs 2013-07-20 15:34:00 +01:00
Steven Hiscocks eb2f0c9272 ENH: Improve postfix regex and add more samples 2013-07-20 15:31:21 +01:00
Daniel Black 5cfe108186 ENH: filter enhancements (with test cases) for apache-auth (httpd-2.4.4) 2013-07-20 22:21:08 +10:00
Daniel Black bdcde678d1 TST: fix year 2013-07-20 15:15:02 +10:00
Daniel Black 6fdfd8d356 BF: fix port 2013-07-20 15:09:25 +10:00
Daniel Black eea5b071e6 ENH: jail for perdition 2013-07-19 20:27:15 +10:00
Daniel Black fcf79b475f ENH: new filter perdition.conf 2013-07-19 20:14:53 +10:00
Steven Hiscocks a012b54117 TST: Add additional postfix filter sample 2013-07-18 22:17:31 +01:00
Steven Hiscocks 2a3a627322 TST: Add sample for sieve regex 2013-07-18 22:17:14 +01:00
Steven Hiscocks 26b472f70f ENH: Add ejabberd-auth filter and sample log lines 2013-07-18 21:31:51 +01:00
Yaroslav Halchenko 60aa44f42d DOC: added a note on commit comments for merges with Conflicts 2013-07-18 14:43:41 -04:00
Daniel Black fa85be2eea DOC/TST: fix configuration path for apache-auth test cases 2013-07-18 08:37:05 +10:00
Steven Hiscocks 2b6ecfe56a TST: More verbose when multiple regexs matched in sample test case 2013-07-17 22:25:27 +01:00
Steven Hiscocks 7c3a2a0223 ENH: Allow setting of date pattern as part of filter config Init section 2013-07-17 21:27:19 +01:00
Steven Hiscocks 614fb8505e BF: globally make HEAVYDEBUG logging level when importing fail2ban 2013-07-17 21:12:48 +01:00
Steven Hiscocks 674e1d82f4 TST: vsftpd fail data update due to recent date pattern changes 2013-07-17 21:12:16 +01:00
Steven Hiscocks bf86edb3ae BF: ISO8601 format now returns time in local time zone 2013-07-17 21:11:29 +01:00
Steven Hiscocks d661b8c046 BF: Apache regex and sample fail data update due to date pattern changes 2013-07-17 21:09:30 +01:00
Steven Hiscocks 72430e805d Merge branch 'datepatterns' into datepatterns-dateregex 
Conflicts:
	bin/fail2ban-regex
	fail2ban/client/beautifier.py
	fail2ban/server/datedetector.py
 2013-07-17 21:07:09 +01:00
Daniel Black 03ec7c211b ENH: could not find a way to trigger filter ^%(_apache_error_client)s authorization failure \(no authenticated user\): \S*\s*$ 2013-07-18 00:37:33 +10:00
Daniel Black 8ce9c78474 TST: apache-auth digest logs 2013-07-18 00:36:17 +10:00
Daniel Black f8b5b3a1ef ENH: apache-auth - quite a lot of authorization failure messages depending on module. Make a wildcard 2013-07-17 23:31:44 +10:00
Daniel Black 4eca2c0bd5 TST: apache-auth client denied by server configuration 2013-07-17 23:24:19 +10:00
Daniel Black e0292913eb ENH/TST: filter, testcase and log entry for apache-auth authorization scheme mod_authz_owner 2013-07-17 23:05:04 +10:00
Daniel Black 40cc336cd5 TST: testcases and logs for apache-auth basic 2013-07-17 22:46:04 +10:00
Steven Hiscocks 05fac65a50 BF: fail2ban-regex multiline regex matches no longer in missed lines 
Closes #263
Closes #282
 2013-07-17 00:08:43 +01:00
Steven Hiscocks c61ba9f0de ENH+BF: Allow multi lines regex to be tested with samples test case 
Multi line regex currently only flags on last line, and other lines must
be labelled as not matched.
TODO: Create extension to fail JSON data to allow tying together of
multiple lines
 2013-07-16 23:47:28 +01:00
Steven Hiscocks 774c9ce4fd BF: setup.py build now includes sample log files for tests 2013-07-16 23:37:44 +01:00
Steven Hiscocks 1eea0dcec8 Merge branch 'master' into 0.9 
Conflicts:
	ChangeLog
	bin/fail2ban-regex
	bin/fail2ban-testcases
	config/jail.conf
	fail2ban/server/failregex.py
	fail2ban/server/filter.py
	fail2ban/tests/files/logs/lighttpd
	fail2ban/tests/files/logs/mysqld.log
	fail2ban/tests/files/logs/wu-ftpd
	fail2ban/tests/filtertestcase.py
	fail2ban/tests/utils.py
	testcases/files/logs/lighttpd
	testcases/files/logs/lighttpd-auth
	testcases/files/logs/mysqld-auth
	testcases/files/logs/mysqld.log
	testcases/files/logs/wu-ftpd
	testcases/files/logs/wuftpd
 2013-07-16 23:16:22 +01:00
Steven Hiscocks bf05f2ac95 Merge branch 'filter-failregex-return' 
Conflicts:
	server/filter.py
 2013-07-16 21:17:18 +01:00
Steven Hiscocks ba29f6bef3 DOC: Update doc in reference to changes for sample testcases 2013-07-16 21:11:10 +01:00
Steven Hiscocks c2bdfefb62 DOC: Comment to fail2ban-regex - flagging lines matched multiple regexs 2013-07-16 20:58:44 +01:00
Yaroslav Halchenko e4d759ac94 Merge pull request #283 from yarikoptic/master 
Roundcube failregex -- anchor at the beginning as well + mandate <HOST> to end with alphanumeric
 2013-07-16 12:49:25 -07:00
Yaroslav Halchenko 90ec82669c DOC: changelog entries for preceeding changes 2013-07-16 15:10:41 -04:00
Yaroslav Halchenko f6a8a04cf3 ENH: roundcube-auth - adopt for current format with trailing error message. thanks @kwirk for the review/feedback 
I also used non-greedy .*? for the login portion since not sure if space could
be there and trying to minimize possibility of reacting on injected "from
<HOST>" somewhere within the trailing .*
 2013-07-16 15:07:32 -04:00
Yaroslav Halchenko 0a02cfe9e8 ENH: <HOST> must end with alphanumeric \w (not a dot or a dash etc) 
Otherwise <HOST> regexp might swallow period in the sentence right after the address.
I have decided to enforce alphanumeric instead of switching to non-greedy +? ... because
I think it is closer to what we actually want here
 2013-07-16 15:03:06 -04:00
Yaroslav Halchenko 8add63c733 ENH: anchor roundcube-auth at the beginning as well 2013-07-16 14:16:23 -04:00
Yaroslav Halchenko 148cbd8d2a ENH: heavier debugging -- log split date/log line even for no match. Log matching regex upon match 2013-07-16 14:16:23 -04:00
Steven Hiscocks 1a2b6442a0 ENH+BF+TST: Filter now returns reference to failregex and ignoreregex 
This avoids duplication of code across fail2ban-regex and samples test
cases. This also now more neatly resolves the issue of double counting
date templates matches in fail2ban-regex.
In addition, the samples test cases now also print a warning message
that not all regexs have samples for them, with future plan to change
this to an assertion.
 2013-07-15 22:22:13 +01:00