Guillaume FRANCOIS
a6a2dc868b
Add ignoreregex to avoid warning on start
10 years ago
Guillaume FRANCOIS
9269664350
Add ignoreregex to avoid warning on start
10 years ago
Yaroslav Halchenko
967485c2d0
improving grepping
10 years ago
Yaroslav Halchenko
efbf5064a1
Merge pull request #807 from xslidian/patch-1
...
grep IP at the start of lines
10 years ago
Orion Poplawski
01b2673e34
Use multiport for firewallcmd-new
10 years ago
Yaroslav Halchenko
36abb5ed96
BF: fix $ for % in jail.conf. Debian bug #767255
10 years ago
pacop
e3a037ee3f
merge master
10 years ago
pacop
ce4f2d1c88
added filter for PortSentry with jail and samples
10 years ago
SlowRiot
fc5f729f01
adding jail conf for shellshock filter
10 years ago
SlowRiot
4f636eb0e3
adding filter to detect Shellshock attack attempts against bash scripts through apache. See http://seclists.org/oss-sec/2014/q3/650
10 years ago
Nick Weeds
2c158fe168
Add apache filter for AH01630 client denied by server configuration
10 years ago
Yaroslav Halchenko
0e1f8f7f39
RF: remove those two additional failregexes for the postfix
...
see comment
https://github.com/fail2ban/fail2ban/pull/804\#discussion_r17512426
10 years ago
Yaroslav Halchenko
96c20c8379
Merge pull request #804 from pleasantone/master
...
Add support for postfix/submission/smtpd matching.
10 years ago
Yaroslav Halchenko
c58c4de9bc
ENH: add empty ignoreregex to avoid a warning ( Close #805 )
10 years ago
Dean Lee
ba44ff312b
grep IP at the start of lines
...
I'm not sure if this regex works best, so I'm patching this single file as a sample.
Don't forget to update `mail-whois-lines.conf` after this patch got merged.
For the following logs, `grep '[^0-9]199.48.161.87[^0-9]'` will output nothing, while `grep '\([^0-9]\|^\)199.48.161.87[^0-9]'` works:
<pre>199.48.161.87 - - [09/Sep/2014:13:38:54 +0800] "POST /wp-login.php HTTP/1.1" 403 4674 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com
199.48.161.87 - - [09/Sep/2014:13:38:56 +0800] "POST /wp-login.php HTTP/1.1" 403 4674 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com
199.48.161.87 - - [09/Sep/2014:13:38:58 +0800] "POST /wp-login.php HTTP/1.1" 403 4674 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com
199.48.161.87 - - [09/Sep/2014:13:39:00 +0800] "POST /wp-login.php HTTP/1.1" 403 4674 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com
199.48.161.87 - - [09/Sep/2014:13:39:05 +0800] "POST /wp-login.php HTTP/1.1" 403 4674 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com
199.48.161.87 - - [09/Sep/2014:13:39:05 +0800] "POST /wp-login.php HTTP/1.1" 403 4674 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com
199.48.161.87 - - [09/Sep/2014:13:39:13 +0800] "POST /wp-login.php HTTP/1.1" 403 4674 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com
199.48.161.87 - - [09/Sep/2014:13:39:21 +0800] "POST /wp-login.php HTTP/1.1" 403 4674 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com
199.48.161.87 - - [09/Sep/2014:13:39:32 +0800] "POST /wp-login.php HTTP/1.1" 403 4674 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com
199.48.161.87 - - [09/Sep/2014:13:39:34 +0800] "POST /wp-login.php HTTP/1.1" 403 4674 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com
199.48.161.87 - - [09/Sep/2014:13:39:34 +0800] "POST /wp-login.php HTTP/1.1" 403 168 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com
199.48.161.87 - - [09/Sep/2014:13:39:34 +0800] "POST /wp-login.php HTTP/1.1" 403 168 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com
199.48.161.87 - - [09/Sep/2014:13:39:35 +0800] "POST /wp-login.php HTTP/1.1" 403 168 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com
199.48.161.87 - - [09/Sep/2014:13:39:35 +0800] "POST /wp-login.php HTTP/1.1" 403 168 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com
199.48.161.87 - - [09/Sep/2014:13:39:35 +0800] "POST /wp-login.php HTTP/1.1" 403 168 "-" "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" - hitsjapan.com</pre>
10 years ago
Paul Traina
249e169d8e
Update test cases and also suport smtps per request.
10 years ago
Daniel Black
1864f75b3b
Credits and notes from #806
10 years ago
weberho
d2c086b187
fixed encoding
10 years ago
weberho
218ffe862e
fixed encoding
10 years ago
Paul Traina
544cfaff2c
Add support for postfix/submission/smtpd matching.
10 years ago
Yaroslav Halchenko
0d9cfb84e3
Merge pull request #778 from yarikoptic/enh/symbiosis
...
ENH: symbiosis-blacklist-allports action
10 years ago
Yaroslav Halchenko
426ed7ff2f
Merge pull request #780 from opoplawski/logpath
...
Fxi jail.conf to use more syslog macros
10 years ago
Yaroslav Halchenko
93243e7d57
ENH: Ignore errors while unbaning in symbiosis firewall
...
Fail2Ban at times "interfers" with the firewall reflashing thus leading
to the sporadic errors. IMHO should be safe to ignore
10 years ago
Luc Maisonobe
763115b1eb
added systemd configuration for postfix-sasl.conf
10 years ago
Yaroslav Halchenko
aee560b1c6
Merge branch 'master' of git://github.com/fail2ban/fail2ban
...
* 'master' of git://github.com/fail2ban/fail2ban:
1.5 version of Fail2ban logwatch file
Fix typos.
10 years ago
Yaroslav Halchenko
6fc04c2256
Merge branch 'bf+enh/cyrus-imap' of https://github.com/yarikoptic/fail2ban (with some tune up to Changelog entry)
...
* 'bf+enh/cyrus-imap' of https://github.com/yarikoptic/fail2ban :
ENH: cyrus-imap -- catch also 'user not found' attempts
BF: cyrus-imaps -- catch also for secured daemons
Conflicts:
ChangeLog
10 years ago
Yaroslav Halchenko
f403bad0ab
Merge pull request #775 from alimony/patch-1
...
Fix typos.
10 years ago
Yaroslav Halchenko
b79a82ebdd
minor typo
10 years ago
Orion Poplawski
6b554fbe98
Fxi jail.conf to use more syslog macros
10 years ago
Yaroslav Halchenko
818dd59d65
ENH: symbiosis-blacklist-allports action
10 years ago
Markus Amalthea Magnuson
7b76322898
Fix typos.
10 years ago
Yaroslav Halchenko
4a23a7dcf1
Merge pull request #766 from leftyfb/master
...
Added cloudflare action
10 years ago
leftyfb
6dbd449f77
Changed to Cloudflare JSON API
10 years ago
Jisoo Park
2e7b8adb3b
Fix sieve filter to use correct option
10 years ago
Yaroslav Halchenko
f19c5fc939
Merge pull request #770 from eltrai/master
...
Forwards bantime to action scripts
10 years ago
Yaroslav Halchenko
f9cfbd66e6
Merge pull request #771 from szepeviktor/patch-1
...
named users + smtp auth probes
10 years ago
Szépe Viktor
143a55bf26
Update courier-smtp.conf
10 years ago
Yaroslav Halchenko
2d7f2fa33f
Merge pull request #756 from marclaporte/patch-1
...
typo
10 years ago
Yaroslav Halchenko
45c1095606
Merge pull request #750 from niorg/master
...
Added Directadmin filter, jail and log test
10 years ago
Yaroslav Halchenko
3339dc8d84
ENH: cyrus-imap -- catch also 'user not found' attempts
11 years ago
Yaroslav Halchenko
3e5c598b79
BF: cyrus-imaps -- catch also for secured daemons
11 years ago
Szépe Viktor
d757ef584f
Update courier-smtp.conf
11 years ago
Szépe Viktor
a786e8a29b
named users + smtp atuh probes
11 years ago
Pierre-Alain Dupont
3d7504c19e
Forwards bantime to action scripts
...
That way, ipset and afctl will use a real timeout and not default to a fixed value for all jails
11 years ago
leftyfb
cba570cabd
Updated comments
11 years ago
leftyfb
5471e99ebe
Added cloudflare action
11 years ago
Yaroslav Halchenko
6cddc65cee
BF: path to exim's mainlog on Fedora (Thanks Frantisek Sumsal) + changelog entry
11 years ago
Yaroslav Halchenko
43950d8b7e
BF: fix path to the exim log on Debian systems (/var/log/exim4)
11 years ago
Marc Laporte
3777591ab0
typo
11 years ago
Cyril Roos
add8e61036
Added Directadmin filter, jail and log test
11 years ago