Yaroslav Halchenko
345820d2aa
Merge pull request #1056 from ipoddubny/asterisk_security_log
...
Fix support for Asterisk security log
10 years ago
Yaroslav Halchenko
f41872f034
Merge pull request #1013 from szepeviktor/patch-4
...
Non-US locale warning for proftpd
10 years ago
Yaroslav Halchenko
eb091d9b8c
Merge remote-tracking branch 'origin/master' into pr-1039
...
* origin/master:
minor: no tripple empty lines
add froxlor-auth filter and jail
add froxlor-auth filter and jail 0
add froxlor-auth filter and jail
BF: Fix fail2ban-regex not parsing journalmatch correctly
10 years ago
Joern Muehlencord
964cdb5d9b
add froxlor-auth filter and jail
10 years ago
Ivan Poddubny
7a4e6fa6e5
Asterisk security log: add support for websocket protocol events
...
Thanks to @kcormier.
10 years ago
Ivan Poddubny
988d9a08da
Asterisk security log: accept events containing Response/ExpectedResponse
...
Event containing Challenge may come without ReceivedChallenge, but with
Response and ExpectedResponse.
Also Challenge now accepts '/' character, since it is used at least by PJSIP.
10 years ago
Ivan Poddubny
189265a323
Asterisk security log: accept SessionID of PJSIP events
...
Unlike chan_sip and manager, PJSIP populates SessionID using
Call-Id header of a related SIP message.
As Call-Id of a SIP message can contain almost anything,
the regular expression for SessionID has been loosened.
10 years ago
Ivan Poddubny
ab2ac1a367
Asterisk security log: accept <unknown> in AccountID
10 years ago
Ivan Poddubny
977f9955e7
Asterisk security log: accept EventTV in ISO8601
...
Asterisk uses ISO8601 dates in security log since version 12.
Closes #988
10 years ago
Anton Shestakov
56e5821c06
Match unknown user in dovecot's passwd-file auth database
10 years ago
Lee Clemens
8f792f52fb
Add drupal-auth filter and jail
10 years ago
Lee Clemens
b530d88eca
Merge remote-tracking branch 'upstream/master' into bf/1000-asteriskBlocksSelf
...
Conflicts:
ChangeLog
10 years ago
Markus Oesterle
f8c7247f42
added \s after host
10 years ago
Markus Oesterle
5f2807b41f
replaced .* before rhost with regex matching all the previous fields
10 years ago
Markus Oesterle
8825a5f31b
updated filter.d/sshd.conf
...
Added line to match sshd auth errors on OpenSuSE systems
10 years ago
Viktor Szépe
e776a4e1ab
Update proftpd.conf
10 years ago
Viktor Szépe
f9e8a99a79
Non-US locale warning for proftpd
10 years ago
Lee Clemens
72f4bcfbff
Match hacking attempt IP instead of asterisk server IP ( closes #1000 )
10 years ago
František Šumšal
eb0d086ed0
Merge branch 'master' into nginx-botsearch
10 years ago
Orion Poplawski
e7ff7e90b7
[postfix-sasl] update regexes
...
- Add : to match "SASL LOGIN authentication failed: Password:"
- Add ignoreregex to ignore system authentication issues:
"warning: unknown[1.1.1.1]: SASL LOGIN authentication failed: Connection lost to authentication server"
- Add test log messages for both
10 years ago
František Šumšal
fb0f463eac
Include consistency
10 years ago
František Šumšal
705718be52
Filter apache-botsearch.conf now loads variables from botsearch-common.conf
10 years ago
František Šumšal
18778d9174
Created botsearch-common.conf
...
File contains variables used in -botsearch filters
10 years ago
Yaroslav Halchenko
73af02ffc6
Merge pull request #940 from leeclemens/ENH/ApacheFakeGoogleBot
...
New jail: apache-fakegooglebot
10 years ago
Yaroslav Halchenko
df581fe6e2
Merge pull request #929 from opoplawski/pam_auth
...
Add filter variable __pam_auth to allow customize for setups with multiple authorization schemes (Close #928 )
10 years ago
Yaroslav Halchenko
7ada96b4e9
Merge pull request #932 from opoplawski/dovecot
...
Dovecot - dovecot auth failure from EL7
10 years ago
František Šumšal
f8fe165cd2
Switched from tabs to spaces for indents
10 years ago
Lee Clemens
841c476045
Merge branch 'enh/fakegooglebot' of https://github.com/yarikoptic/fail2ban into yarikoptic-enh/fakegooglebot
...
Conflicts:
config/filter.d/ignorecommands/apache-fakegooglebot
10 years ago
Yaroslav Halchenko
15b65c7ad2
NF: apache-fakegooglebot ignorecommand + DNSUtils.ipToName
10 years ago
Lee Clemens
7e94ba6f0c
Remove implementation specific suffix
10 years ago
Lee Clemens
af078532ac
New jail: apache-fakegooglebot
...
Detects fake googlebot user agents in apache access log
10 years ago
Yaroslav Halchenko
ec6a30efcf
ENH: define ignoreregex for all filters explicitly, to avoid warnings ( Closes #934 )
10 years ago
František Šumšal
c8e82f18b6
Add jail nginx-botsearch
...
Jail blocks requests for predefined non-existent folders. Based on
apache-botsearch jail.
10 years ago
Orion Poplawski
b4776a1ba0
Match dovecot unknown user line
10 years ago
Orion Poplawski
3bc92610f7
Add dovecot auth failure from EL7
10 years ago
Orion Poplawski
79b5a2617f
Add filter variable __pam_auth to allow easier changing of pam auth backend
10 years ago
Lee Clemens
bda8dc1926
Merge branch 'master' of github.com:fail2ban/fail2ban into ENH/PostfixRBL
10 years ago
Lee Clemens
0f48cf4284
loosen up regex for spamhaus (spamcop says "Blocked" as part of url)
10 years ago
Lee Clemens
fe72a5585c
Create Jail for Postfix based on RBL
...
Use RBL blocks to ban addresses, unique Jail so maxretry can be set to 1 (vs postfix.conf)
10 years ago
Lee Clemens
2d7429c47c
Add 'Client host rejected error message' regex
...
Not sure if it was reworded (using Postfix 2.6) or a slightly different error, but I only have "Client host rejected: cannot find your hostname"
10 years ago
Viktor Szépe
81b3dbde1d
postfix-sasl failregex case insensitive
10 years ago
bes-internal
ccc986b7d8
exim filter: correct failregex for exim with extended log options
...
incoming_interface, incoming_port, outgoing_port
10 years ago
Guillaume FRANCOIS
a6a2dc868b
Add ignoreregex to avoid warning on start
10 years ago
Guillaume FRANCOIS
9269664350
Add ignoreregex to avoid warning on start
10 years ago
pacop
e3a037ee3f
merge master
10 years ago
pacop
ce4f2d1c88
added filter for PortSentry with jail and samples
10 years ago
SlowRiot
4f636eb0e3
adding filter to detect Shellshock attack attempts against bash scripts through apache. See http://seclists.org/oss-sec/2014/q3/650
10 years ago
Nick Weeds
2c158fe168
Add apache filter for AH01630 client denied by server configuration
10 years ago
Yaroslav Halchenko
0e1f8f7f39
RF: remove those two additional failregexes for the postfix
...
see comment
https://github.com/fail2ban/fail2ban/pull/804\#discussion_r17512426
10 years ago
Yaroslav Halchenko
96c20c8379
Merge pull request #804 from pleasantone/master
...
Add support for postfix/submission/smtpd matching.
10 years ago