Add fail2ban playbook for updating jails remotely
+ Can be used for a single host or a group of hosts + Update nginx-nobinary jail regex
This commit is contained in:
parent
909bf3278e
commit
b5a97de9ff
|
|
@ -0,0 +1,24 @@
|
|||
- hosts: nginx-server
|
||||
become: yes
|
||||
tasks:
|
||||
- name: Copy custom fail2ban filters
|
||||
synchronize:
|
||||
mode: push
|
||||
src: fail2ban/filter.d/
|
||||
dest: /etc/fail2ban/filter.d/
|
||||
- name: Copy custom fail2ban jail.local
|
||||
synchronize:
|
||||
mode: push
|
||||
src: fail2ban/jail.local
|
||||
dest: /etc/fail2ban/
|
||||
- name: Reload fail2ban service
|
||||
ansible.builtin.service:
|
||||
name: fail2ban
|
||||
state: reloaded
|
||||
- name: Checking status of fail2ban service after restart
|
||||
command: systemctl status fail2ban
|
||||
register: result
|
||||
- name: Showing fail2ban status report
|
||||
debug:
|
||||
var: result
|
||||
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# Fail2Ban filter for 3proxy
|
||||
#
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
|
||||
failregex = ^\s[+-]\d{4} \S+ \d{3}0[1-9] \S+ <HOST>:\d+ [\d.]+:\d+ \d+ \d+ \d+\s
|
||||
|
||||
ignoreregex =
|
||||
|
||||
datepattern = {^LN-BEG}
|
||||
|
||||
# DEV Notes:
|
||||
# http://www.3proxy.ru/howtoe.asp#ERRORS indicates that 01-09 are
|
||||
# all authentication problems (%E field)
|
||||
# Log format is: "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T"
|
||||
#
|
||||
# Requested by ykimon in https://github.com/fail2ban/fail2ban/issues/246
|
||||
# Author: Daniel Black
|
||||
|
|
@ -0,0 +1,71 @@
|
|||
# Fail2Ban apache-auth filter
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# apache-common.local
|
||||
before = apache-common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
# Mode for filter: normal (default) and aggressive (allows DDoS & brute force detection of mod_evasive)
|
||||
mode = normal
|
||||
|
||||
# ignore messages of mod_evasive module:
|
||||
apache-pref-ign-normal = (?!evasive)
|
||||
# allow "denied by server configuration" from all modules:
|
||||
apache-pref-ign-aggressive =
|
||||
# mode related ignore prefix for common _apache_error_client substitution:
|
||||
apache-pref-ignore = <apache-pref-ign-<mode>>
|
||||
|
||||
prefregex = ^%(_apache_error_client)s (?:AH\d+: )?<F-CONTENT>.+</F-CONTENT>$
|
||||
|
||||
# auth_type = ((?:Digest|Basic): )?
|
||||
auth_type = ([A-Z]\w+: )?
|
||||
|
||||
failregex = ^client (?:denied by server configuration|used wrong authentication scheme)\b
|
||||
^user (?!`)<F-USER>(?:\S*|.*?)</F-USER> (?:auth(?:oriz|entic)ation failure|not found|denied by provider)\b
|
||||
^Authorization of user <F-USER>(?:\S*|.*?)</F-USER> to access .*? failed\b
|
||||
^%(auth_type)suser <F-USER>(?:\S*|.*?)</F-USER>: password mismatch\b
|
||||
^%(auth_type)suser `<F-USER>(?:[^']*|.*?)</F-USER>' in realm `.+' (auth(?:oriz|entic)ation failure|not found|denied by provider)\b
|
||||
^%(auth_type)sinvalid nonce .* received - length is not\b
|
||||
^%(auth_type)srealm mismatch - got `(?:[^']*|.*?)' but expected\b
|
||||
^%(auth_type)sunknown algorithm `(?:[^']*|.*?)' received\b
|
||||
^invalid qop `(?:[^']*|.*?)' received\b
|
||||
^%(auth_type)sinvalid nonce .*? received - user attempted time travel\b
|
||||
^(?:No h|H)ostname \S+ provided via SNI(?:, but no hostname provided| and hostname \S+ provided| for a name based virtual host)\b
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# This filter matches the authorization failures of Apache. It takes the log messages
|
||||
# from the modules in aaa that return HTTP_UNAUTHORIZED, HTTP_METHOD_NOT_ALLOWED or
|
||||
# HTTP_FORBIDDEN and not AUTH_GENERAL_ERROR or HTTP_INTERNAL_SERVER_ERROR.
|
||||
#
|
||||
# An unauthorized response 401 is the first step for a browser to instigate authentication
|
||||
# however apache doesn't log this as an error. Only subsequent errors are logged in the
|
||||
# error log.
|
||||
#
|
||||
# Source:
|
||||
#
|
||||
# By searching the code in http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/*
|
||||
# for ap_log_rerror(APLOG_MARK, APLOG_ERR and examining resulting return code should get
|
||||
# all of these expressions. Lots of submodules like mod_authz_* return back to mod_authz_core
|
||||
# to return the actual failure.
|
||||
#
|
||||
# Note that URI can contain spaces.
|
||||
#
|
||||
# See also: http://wiki.apache.org/httpd/ListOfErrors
|
||||
# Expressions that don't have tests and aren't common.
|
||||
# more be added with https://issues.apache.org/bugzilla/show_bug.cgi?id=55284
|
||||
# ^user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
|
||||
# ^user .*: one-time-nonce mismatch - sending new nonce\s*$
|
||||
# ^realm mismatch - got `(?:[^']*|.*?)' but no realm specified\s*$
|
||||
#
|
||||
# Because url/referer are foreign input, short form of regex used if long enough to idetify failure.
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
# Major edits by Daniel Black and Ben Rubson.
|
||||
# Rewritten for v.0.10 by Sergey Brester (sebres).
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
# Fail2Ban configuration file
|
||||
#
|
||||
# Regexp to catch known spambots and software alike. Please verify
|
||||
# that it is your intent to block IPs which were driven by
|
||||
# above mentioned bots.
|
||||
|
||||
|
||||
[Definition]
|
||||
|
||||
badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou music spider|(?:Mozilla/\d+\.\d+ )?Jorgee
|
||||
badbots = Atomic_Email_Hunter/4\.0|atSpider/1\.0|autoemailspider|bwh3_user_agent|China Local Browse 2\.6|ContactBot/0\.2|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailSpider|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Guestbook Auto Submitter|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 \+http\://letscrawl\.com/|Lincoln State Web Browser|LMQueueBot/0\.2|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|MVAClient|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/3\.0 \(compatible; scan4mail \(advanced version\) http\://www\.peterspages\.net/?scan4mail\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|NameOfAgent \(CMS Spider\)|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|ShablastBot 1\.0|snap\.com beta crawler v0|Snapbot/1\.0|Snapbot/1\.0 \(Snap Shots, \+http\://www\.snap\.com\)|sogou develop spider|Sogou Orion spider/3\.0\(\+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sogou spider|Sogou web spider/3\.0\(\+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|VadixBot|WebVulnCrawl\.unknown/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
|
||||
|
||||
failregex = ^<HOST> -.*"(GET|POST|HEAD).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
datepattern = ^[^\[]*\[({DATE})
|
||||
{^LN-BEG}
|
||||
|
||||
# DEV Notes:
|
||||
# List of bad bots fetched from http://www.user-agents.org
|
||||
# Generated on Thu Nov 7 14:23:35 PST 2013 by files/gen_badbots.
|
||||
#
|
||||
# Author: Yaroslav Halchenko
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
# Fail2Ban filter to match web requests for selected URLs that don't exist
|
||||
#
|
||||
# This filter is aimed at blocking specific URLs that don't exist. This
|
||||
# could be a set of URLs places in a Disallow: directive in robots.txt or
|
||||
# just some web services that don't exist caused bots are searching for
|
||||
# exploitable content. This filter is designed to have a low false positive
|
||||
# rate due.
|
||||
#
|
||||
# An alternative to this is the apache-noscript filter which blocks all
|
||||
# types of scripts that don't exist.
|
||||
#
|
||||
#
|
||||
# This is normally a predefined list of exploitable or valuable web services
|
||||
# that are hidden or aren't actually installed.
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# overwrite with apache-common.local if _apache_error_client is incorrect.
|
||||
# Load regexes for filtering from botsearch-common.conf
|
||||
before = apache-common.conf
|
||||
botsearch-common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
prefregex = ^%(_apache_error_client)s (?:AH\d+: )?<F-CONTENT>.+</F-CONTENT>$
|
||||
|
||||
failregex = ^(?:File does not exist|script not found or unable to stat): <webroot><block>(, referer: \S+)?\s*$
|
||||
^script '<webroot><block>' not found or unable to stat(, referer: \S+)?\s*$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# Webroot represents the webroot on which all other files are based
|
||||
webroot = /var/www/
|
||||
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# Author: Daniel Black
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
# Generic configuration items (to be used as interpolations) in other
|
||||
# apache filters.
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
before = common.conf
|
||||
# Load customizations if any available
|
||||
after = apache-common.local
|
||||
|
||||
[DEFAULT]
|
||||
|
||||
# Apache logging mode:
|
||||
# all - universal prefix (logfile, syslog)
|
||||
# logfile - logfile only
|
||||
# syslog - syslog only
|
||||
# Use `filter = apache-auth[logging=syslog]` to get more precise regex if apache logs into syslog (ErrorLog syslog).
|
||||
# Use `filter = apache-auth[logging=all]` to get universal regex matches both logging variants.
|
||||
logging = logfile
|
||||
|
||||
# Apache logging prefixes (date-pattern prefix, server, process etc.):
|
||||
apache-prefix-syslog = %(__prefix_line)s
|
||||
apache-prefix-logfile = \[\]\s
|
||||
apache-prefix-all = (?:%(apache-prefix-logfile)s|%(apache-prefix-syslog)s)?
|
||||
|
||||
# Setting for __prefix_line (only `logging=syslog`):
|
||||
_daemon = (?:apache\d*|httpd(?:/\w+)?)
|
||||
|
||||
apache-prefix = <apache-prefix-<logging>>
|
||||
|
||||
apache-pref-ignore =
|
||||
|
||||
_apache_error_client = <apache-prefix>\[(:?error|<apache-pref-ignore>\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client <HOST>(:\d{1,5})?\]
|
||||
|
||||
datepattern = {^LN-BEG}
|
||||
|
||||
# Common prefix for [error] apache messages which also would include <HOST>
|
||||
# Depending on the version it could be
|
||||
# 2.2: [Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4]
|
||||
# 2.4: [Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 1.2.3.4:46652]
|
||||
# 2.4 (perfork): [Mon Dec 23 07:49:01.981912 2013] [:error] [pid 3790] [client 204.232.202.107:46301] script '/var/www/timthumb.php' not found or unable to
|
||||
#
|
||||
# Reference: https://github.com/fail2ban/fail2ban/issues/268
|
||||
#
|
||||
# Author: Yaroslav Halchenko
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
# Fail2Ban filter for fake Googlebot User Agents
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = ^<HOST> .*Googlebot.*$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
datepattern = ^[^\[]*\[({DATE})
|
||||
{^LN-BEG}
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# Author: Lee Clemens
|
||||
# Thanks: Johannes B. Ullrich, Ph.D.
|
||||
# Reference: https://isc.sans.edu/forums/diary/When+Google+isnt+Google/15968/
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
# Fail2Ban apache-modsec filter
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# apache-common.local
|
||||
before = apache-common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
|
||||
failregex = ^%(_apache_error_client)s(?: \[client [^\]]+\])? ModSecurity:\s+(?:\[(?:\w+ \"[^\"]*\"|[^\]]*)\]\s*)*Access denied with code [45]\d\d
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# https://github.com/SpiderLabs/ModSecurity/wiki/ModSecurity-2-Data-Formats
|
||||
# Author: Daniel Black
|
||||
# Sergey G. Brester aka sebres (review, optimization)
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# Fail2Ban filter to web requests for home directories on Apache servers
|
||||
#
|
||||
# Regex to match failures to find a home directory on a server, which
|
||||
# became popular last days. Most often attacker just uses IP instead of
|
||||
# domain name -- so expect to see them in generic error.log if you have
|
||||
# per-domain log files.
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# overwrite with apache-common.local if _apache_error_client is incorrect.
|
||||
before = apache-common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
|
||||
failregex = ^%(_apache_error_client)s (AH00128: )?File does not exist: .*/~.*
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# Author: Yaroslav O. Halchenko <debian@onerussian.com>
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
# Fail2Ban filter to block web requests for scripts (on non scripted websites)
|
||||
#
|
||||
# This matches many types of scripts that don't exist. This could generate a
|
||||
# lot of false positive matches in cases like wikis and forums where users
|
||||
# no affiliated with the website can insert links to missing files/scripts into
|
||||
# pages and cause non-malicious browsers of the site to trigger against this
|
||||
# filter.
|
||||
#
|
||||
# If you'd like to match specific URLs that don't exist see the
|
||||
# apache-botsearch filter.
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# overwrite with apache-common.local if _apache_error_client is incorrect.
|
||||
before = apache-common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl)
|
||||
|
||||
prefregex = ^%(_apache_error_client)s (?:AH0(?:01(?:28|30)|1(?:264|071)): )?(?:(?:[Ff]ile|script|[Gg]ot) )<F-CONTENT>.+</F-CONTENT>$
|
||||
|
||||
failregex = ^(?:does not exist|not found or unable to stat): <script>\b
|
||||
^'<script>\S*' not found or unable to stat
|
||||
^error '[Pp]rimary script unknown(?:\\n)?'
|
||||
|
||||
ignoreregex =
|
||||
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# https://wiki.apache.org/httpd/ListOfErrors for apache error IDs
|
||||
#
|
||||
# Second regex, script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat\s*$ is in httpd-2.2
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
# Fail2Ban filter to block web requests on a long or suspicious nature
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# overwrite with apache-common.local if _apache_error_client is incorrect.
|
||||
before = apache-common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = ^%(_apache_error_client)s (?:(?:AH0013[456]: )?Invalid (method|URI) in request\b|(?:AH00565: )?request failed: URI too long \(longer than \d+\)|request failed: erroneous characters after protocol string:|(?:AH00566: )?request failed: invalid characters in URI\b)
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# [sebres] Because this apache-log could contain very long URLs (and/or referrer),
|
||||
# the parsing of it anchored way may be very vulnerable (at least as regards
|
||||
# the system resources, see gh-1790). Thus rewritten without end-anchor ($).
|
||||
#
|
||||
# fgrep -r 'URI too long' httpd-2.*
|
||||
# httpd-2.2.25/server/protocol.c: "request failed: URI too long (longer than %d)", r->server->limit_req_line);
|
||||
# httpd-2.4.4/server/protocol.c: "request failed: URI too long (longer than %d)",
|
||||
#
|
||||
# fgrep -r 'in request' ../httpd-2.* | fgrep Invalid
|
||||
# httpd-2.2.25/server/core.c: "Invalid URI in request %s", r->the_request);
|
||||
# httpd-2.2.25/server/core.c: "Invalid method in request %s", r->the_request);
|
||||
# httpd-2.2.25/docs/manual/rewrite/flags.html.fr:avertissements 'Invalid URI in request'.
|
||||
# httpd-2.4.4/server/core.c: "Invalid URI in request %s", r->the_request);
|
||||
# httpd-2.4.4/server/core.c: "Invalid method in request %s - possible attempt to establish SSL connection on non-SSL port", r->the_request);
|
||||
# httpd-2.4.4/server/core.c: "Invalid method in request %s", r->the_request);
|
||||
#
|
||||
# fgrep -r 'invalid characters in URI' httpd-2.*
|
||||
# httpd-2.4.4/server/protocol.c: "request failed: invalid characters in URI");
|
||||
#
|
||||
# http://svn.apache.org/viewvc/httpd/httpd/trunk/server/core.c?r1=739382&r2=739620&pathrev=739620
|
||||
# ...possible attempt to establish SSL connection on non-SSL port
|
||||
#
|
||||
# https://wiki.apache.org/httpd/ListOfErrors
|
||||
# Author: Tim Connors
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
# Fail2Ban Apache pass filter
|
||||
# This filter is for access.log, NOT for error.log
|
||||
#
|
||||
# The knocking request must have a referer.
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = ^<HOST> - \w+ \[\] "GET <knocking_url> HTTP/1\.[01]" 200 \d+ ".*" "[^-].*"$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
datepattern = ^[^\[]*\[({DATE})
|
||||
{^LN-BEG}
|
||||
|
||||
[Init]
|
||||
|
||||
knocking_url = /knocking/
|
||||
|
||||
# Author: Viktor Szépe
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
# Fail2Ban filter to block web requests containing custom headers attempting to exploit the shellshock bug
|
||||
#
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# overwrite with apache-common.local if _apache_error_client is incorrect.
|
||||
before = apache-common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
prefregex = ^%(_apache_error_client)s (AH01215: )?/bin/([bd]a)?sh: <F-CONTENT>.+</F-CONTENT>$
|
||||
|
||||
failregex = ^warning: HTTP_[^:]+: ignoring function definition attempt(, referer: \S+)?\s*$
|
||||
^error importing function definition for `HTTP_[^']+'(, referer: \S+)?\s*$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# https://wiki.apache.org/httpd/ListOfErrors for apache error IDs
|
||||
#
|
||||
# example log lines:
|
||||
# [Thu Sep 25 09:27:18.813902 2014] [cgi:error] [pid 16860] [client 89.207.132.76:59635] AH01215: /bin/bash: warning: HTTP_TEST: ignoring function definition attempt
|
||||
# [Thu Sep 25 09:29:56.141832 2014] [cgi:error] [pid 16864] [client 162.247.73.206:41273] AH01215: /bin/bash: error importing function definition for `HTTP_TEST'
|
||||
#
|
||||
# Author: Eugene Hopkinson (e.hopkinson@gmail.com)
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
# Fail2Ban filter for Anti-Spam SMTP Proxy Server (ASSP)
|
||||
# Filter works in theory for both ASSP V1 and V2. Recommended ASSP is V2.5.1 or later.
|
||||
# Support for ASSP V1 ended in 2014 so if you are still running ASSP V1 an immediate upgrade is recommended.
|
||||
#
|
||||
# Homepage: http://sourceforge.net/projects/assp/
|
||||
# ProjectSite: http://sourceforge.net/projects/assp/?source=directory
|
||||
#
|
||||
#
|
||||
|
||||
[Definition]
|
||||
# Note: First three failregex matches below are for ASSP V1 with the remaining being designed for V2. Deleting the V1 regex is recommended but I left it in for compatibility reasons.
|
||||
|
||||
__assp_actions = (?:dropping|refusing)
|
||||
|
||||
failregex = ^(:? \[SSL-out\])? <HOST> max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$
|
||||
^(?: \[SSL-out\])? <HOST> SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$
|
||||
^ Blocking <HOST> - too much AUTH errors \(\d{,3}\);$
|
||||
^\s*(?:[\w\-]+\s+)*(?:\[\S+\]\s+)*<HOST> (?:\<\S+@\S+\.\S+\> )*(?:to: \S+@\S+\.\S+ )*relay attempt blocked for(?: \(parsing\))?: \S+$
|
||||
^\s*(?:[\w\-]+\s+)*(?:\[\S+\]\s+)*<HOST> \[SMTP Error\] 535 5\.7\.8 Error: authentication failed:\s+(?:\S+|Connection lost to authentication server|Invalid authentication mechanism|Invalid base64 data in continued response)?$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
datepattern = {^LN-BEG}%%b-%%d-%%Exy %%H:%%M:%%S
|
||||
{^LN-BEG}
|
||||
|
||||
# DEV Notes:
|
||||
# V1 Examples matches:
|
||||
# Apr-27-13 02:33:09 Blocking 217.194.197.97 - too much AUTH errors (41);
|
||||
# Dec-29-12 17:10:31 [SSL-out] 200.247.87.82 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
|
||||
# Dec-30-12 04:01:47 [SSL-out] 81.82.232.66 max sender authentication errors (5) exceeded
|
||||
#
|
||||
# V2 Examples matches:
|
||||
# Jul-29-16 16:49:52 m1-25391-06124 [Worker_1] [TLS-out] [RelayAttempt] 0.0.0.0 <user@example.com> to: user@example.org relay attempt blocked for: someone@example.org
|
||||
# Jul-30-16 16:59:42 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
|
||||
# Jul-30-16 00:15:36 m1-52131-09651 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
|
||||
# Jul-31-16 06:45:59 [Worker_1] [TLS-in] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed:
|
||||
# Jan-05-16 08:38:49 m1-01129-09140 [Worker_1] [TLS-in] [TLS-out] [RelayAttempt] 0.0.0.0 <user@example.com> relay attempt blocked for (parsing): <user2@example>
|
||||
# Jun-12-16 16:43:37 m1-64217-12013 [Worker_1] [TLS-in] [TLS-out] [RelayAttempt] 0.0.0.0 <user@example.com> to: user2@example.com relay attempt blocked for (parsing): <a.notheruser69@example.c>
|
||||
# Jan-22-16 22:25:51 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: Invalid authentication mechanism
|
||||
# Mar-19-16 13:42:20 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: Invalid base64 data in continued response
|
||||
# Jul-18-16 16:54:21 [Worker_2] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: Connection lost to authentication server
|
||||
# Jul-18-16 17:14:23 m1-76453-02949 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: Connection lost to authentication server
|
||||
|
||||
#
|
||||
# Author: Enrico Labedzki (enrico.labedzki@deiwos.de)
|
||||
# V2 Filters: Robert Hardy (rhardy@webcon.ca)
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
# Fail2Ban filter for asterisk authentication failures
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# common.local
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
_daemon = asterisk
|
||||
|
||||
__pid_re = (?:\s*\[\d+\])
|
||||
|
||||
iso8601 = \d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+[+-]\d{4}
|
||||
|
||||
# All Asterisk log messages begin like this:
|
||||
log_prefix= (?:NOTICE|SECURITY|WARNING)%(__pid_re)s:?(?:\[C-[\da-f]*\])?:? [^:]+:\d*(?:(?: in)? [^:]+:)?
|
||||
|
||||
prefregex = ^%(__prefix_line)s%(log_prefix)s <F-CONTENT>.+</F-CONTENT>$
|
||||
|
||||
failregex = ^Registration from '[^']*' failed for '<HOST>(:\d+)?' - (?:Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$
|
||||
^Call from '[^']*' \(<HOST>:\d+\) to extension '[^']*' rejected because extension not found in context
|
||||
^(?:Host )?<HOST> (?:failed (?:to authenticate\b|MD5 authentication\b)|tried to authenticate with nonexistent user\b)
|
||||
^No registration for peer '[^']*' \(from <HOST>\)$
|
||||
^hacking attempt detected '<HOST>'$
|
||||
^SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)"(?:(?:,(?!RemoteAddress=)\w+="[^"]*")*|.*?),RemoteAddress="IPV[46]/[^/"]+/<HOST>/\d+"(?:,(?!RemoteAddress=)\w+="[^"]*")*$
|
||||
^"Rejecting unknown SIP connection from <HOST>(?::\d+)?"$
|
||||
^Request (?:'[^']*' )?from '(?:[^']*|.*?)' failed for '<HOST>(?::\d+)?'\s\(callid: [^\)]*\) - (?:No matching endpoint found|Not match Endpoint(?: Contact)? ACL|(?:Failed|Error) to authenticate)\s*$
|
||||
|
||||
# FreePBX (todo: make optional in v.0.10):
|
||||
# ^(%(__prefix_line)s|\[\]\s*WARNING%(__pid_re)s:?(?:\[C-[\da-f]*\])? )[^:]+: Friendly Scanner from <HOST>$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
datepattern = {^LN-BEG}
|
||||
|
||||
# Author: Xavier Devlamynck / Daniel Black
|
||||
#
|
||||
# General log format - main/logger.c:ast_log
|
||||
# Address format - ast_sockaddr_stringify
|
||||
#
|
||||
# First regex: channels/chan_sip.c
|
||||
#
|
||||
# main/logger.c:ast_log_vsyslog - "in {functionname}:" only occurs in syslog
|
||||
|
||||
journalmatch = _SYSTEMD_UNIT=asterisk.service
|
||||
|
||||
|
||||
[lt_journal]
|
||||
|
||||
# asterisk can log timestamp if logs into systemd-journal (optional part matching this timestamp, gh-2383):
|
||||
__extra_timestamp = (?:\[[^\]]+\]\s+)?
|
||||
__prefix_line = %(known/__prefix_line)s%(__extra_timestamp)s
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
# Fail2Ban filter for Bitwarden
|
||||
# Detecting failed login attempts
|
||||
# Logged in bwdata/logs/identity/Identity/log.txt
|
||||
|
||||
[Definition]
|
||||
failregex = ^\s*\[WRN\]\s+Failed login attempt(?:, 2FA invalid)?\. <HOST>$
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
# Generic configuration file for -botsearch filters
|
||||
|
||||
[Init]
|
||||
|
||||
# Block is the actual non-found directories to block
|
||||
block = \/?(<webmail>|<phpmyadmin>|<wordpress>|cgi-bin|mysqladmin)[^,]*
|
||||
|
||||
# These are just convenient definitions that assist the blocking of stuff that
|
||||
# isn't installed
|
||||
webmail = roundcube|(ext)?mail|horde|(v-?)?webmail
|
||||
|
||||
phpmyadmin = (typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin)
|
||||
|
||||
wordpress = wp-(login|signup|admin)\.php
|
||||
|
||||
# DEV Notes:
|
||||
# Taken from apache-botsearch filter
|
||||
#
|
||||
# Author: Frantisek Sumsal
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
# Fail2Ban filter for Centreon Web
|
||||
# Detecting unauthorized access to the Centreon Web portal
|
||||
# typically logged in /var/log/centreon/login.log
|
||||
|
||||
[Init]
|
||||
datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S
|
||||
|
||||
[Definition]
|
||||
failregex = ^(?:\|-?\d+){3}\|\[[^\]]*\] \[<HOST>\] Authentication failed for '<F-USER>[^']+</F-USER>'
|
||||
|
|
@ -0,0 +1,89 @@
|
|||
# Generic configuration items (to be used as interpolations) in other
|
||||
# filters or actions configurations
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Load customizations if any available
|
||||
after = common.local
|
||||
|
||||
|
||||
[DEFAULT]
|
||||
|
||||
# Type of log-file resp. log-format (file, short, journal, rfc542):
|
||||
logtype = file
|
||||
|
||||
# Daemon definition is to be specialized (if needed) in .conf file
|
||||
_daemon = \S*
|
||||
|
||||
#
|
||||
# Shortcuts for easier comprehension of the failregex
|
||||
#
|
||||
# PID.
|
||||
# EXAMPLES: [123]
|
||||
__pid_re = (?:\[\d+\])
|
||||
|
||||
# Daemon name (with optional source_file:line or whatever)
|
||||
# EXAMPLES: pam_rhosts_auth, [sshd], pop(pam_unix)
|
||||
__daemon_re = [\[\(]?%(_daemon)s(?:\(\S+\))?[\]\)]?:?
|
||||
|
||||
# extra daemon info
|
||||
# EXAMPLE: [ID 800047 auth.info]
|
||||
__daemon_extra_re = \[ID \d+ \S+\]
|
||||
|
||||
# Combinations of daemon name and PID
|
||||
# EXAMPLES: sshd[31607], pop(pam_unix)[4920]
|
||||
__daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:?)
|
||||
|
||||
# Some messages have a kernel prefix with a timestamp
|
||||
# EXAMPLES: kernel: [769570.846956]
|
||||
__kernel_prefix = kernel:\s?\[ *\d+\.\d+\]:?
|
||||
|
||||
__hostname = \S+
|
||||
|
||||
# A MD5 hex
|
||||
# EXAMPLES: 07:06:27:55:b0:e3:0c:3c:5a:28:2d:7c:7e:4c:77:5f
|
||||
__md5hex = (?:[\da-f]{2}:){15}[\da-f]{2}
|
||||
|
||||
# bsdverbose is where syslogd is started with -v or -vv and results in <4.3> or
|
||||
# <auth.info> appearing before the host as per testcases/files/logs/bsd/*.
|
||||
__bsd_syslog_verbose = <[^.]+\.[^.]+>
|
||||
|
||||
__vserver = @vserver_\S+
|
||||
|
||||
__date_ambit = (?:\[\])
|
||||
|
||||
# Common line prefixes (beginnings) which could be used in filters
|
||||
#
|
||||
# [bsdverbose]? [hostname] [vserver tag] daemon_id spaces
|
||||
#
|
||||
# This can be optional (for instance if we match named native log files)
|
||||
__prefix_line = <lt_<logtype>/__prefix_line>
|
||||
|
||||
# PAM authentication mechanism check for failures, e.g.: pam_unix, pam_sss,
|
||||
# pam_ldap
|
||||
__pam_auth = pam_unix
|
||||
|
||||
# standardly all formats using prefix have line-begin anchored date:
|
||||
datepattern = <lt_<logtype>/datepattern>
|
||||
|
||||
[lt_file]
|
||||
# Common line prefixes for logtype "file":
|
||||
__prefix_line = %(__date_ambit)s?\s*(?:%(__bsd_syslog_verbose)s\s+)?(?:%(__hostname)s\s+)?(?:%(__kernel_prefix)s\s+)?(?:%(__vserver)s\s+)?(?:%(__daemon_combs_re)s\s+)?(?:%(__daemon_extra_re)s\s+)?
|
||||
datepattern = {^LN-BEG}
|
||||
|
||||
[lt_short]
|
||||
# Common (short) line prefix for logtype "journal" (corresponds output of formatJournalEntry):
|
||||
__prefix_line = \s*(?:%(__hostname)s\s+)?(?:%(_daemon)s%(__pid_re)s?:?\s+)?(?:%(__kernel_prefix)s\s+)?
|
||||
datepattern = %(lt_file/datepattern)s
|
||||
[lt_journal]
|
||||
__prefix_line = %(lt_short/__prefix_line)s
|
||||
datepattern = %(lt_short/datepattern)s
|
||||
|
||||
[lt_rfc5424]
|
||||
# RFC 5424 log-format, see gh-2309:
|
||||
#__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ \S+\s+
|
||||
__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ (?:[^\[\]\s]+|(?:\[(?:[^\]"]*|"[^"]*")*\])+)\s+
|
||||
datepattern = ^<\d+>\d+\s+{DATE}
|
||||
|
||||
# Author: Yaroslav Halchenko, Sergey G. Brester (aka sebres)
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
# Fail2Ban filter for failure attempts in Counter Strike-1.6
|
||||
#
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = ^: Bad Rcon: "rcon \d+ "\S+" sv_contact ".*?"" from "<HOST>:\d+"$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
datepattern = ^L %%d/%%m/%%Y - %%H:%%M:%%S
|
||||
|
||||
|
||||
# Author: Daniel Black
|
||||
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
# Fail2Ban filter for courier authentication failures
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# common.local
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
_daemon = (?:courier)?(?:imapd?|pop3d?)(?:login)?(?:-ssl)?
|
||||
|
||||
failregex = ^%(__prefix_line)sLOGIN FAILED, (?:user|method)=.*, ip=\[<HOST>\]$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
datepattern = {^LN-BEG}
|
||||
|
||||
# Author: Christoph Haas
|
||||
# Modified by: Cyril Jaquier
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
# Fail2Ban filter to block relay attempts though a Courier smtp server
|
||||
#
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# common.local
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
_daemon = courieresmtpd
|
||||
|
||||
prefregex = ^%(__prefix_line)serror,relay=<HOST>,<F-CONTENT>.+</F-CONTENT>$
|
||||
|
||||
failregex = ^[^:]*: 550 User (<.*> )?unknown\.?$
|
||||
^msg="535 Authentication failed\.",cmd:( AUTH \S+)?( [0-9a-zA-Z\+/=]+)?(?: \S+)$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# Author: Cyril Jaquier
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# Fail2Ban filter for authentication failures on Cyrus imap server
|
||||
#
|
||||
#
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# common.local
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
_daemon = (?:cyrus/)?(?:imap(d|s)?|pop3(d|s)?)
|
||||
|
||||
failregex = ^%(__prefix_line)sbadlogin: [^\[]*\[<HOST>\] \S+ .*?\[?SASL\(-13\): (authentication failure|user not found): .*\]?$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# Author: Jan Wagner <waja@cyconet.org>
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
# Fail2Ban configuration file for Directadmin
|
||||
#
|
||||
#
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = ^: \'<HOST>\' \d{1,3} failed login attempt(s)?. \s*
|
||||
|
||||
ignoreregex =
|
||||
|
||||
datepattern = ^%%Y:%%m:%%d-%%H:%%M:%%S
|
||||
|
||||
#
|
||||
# Requires Directadmin v1.45.3 or higher. http://www.directadmin.com/features.php?id=1590
|
||||
#
|
||||
# Author: Cyril Roos
|
||||
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
# Fail2Ban configuration file for IBM Domino SMTP Server TASK to detect failed login attempts
|
||||
#
|
||||
# Author: Christian Brandlehner
|
||||
#
|
||||
# $Revision: 003 $
|
||||
#
|
||||
# Configuration:
|
||||
# Set the following Domino Server parameters in notes.ini:
|
||||
# console_log_enabled=1
|
||||
# log_sessions=2
|
||||
# You also have to use a date and time format supported by fail2ban. Recommended notes.ini configuration is:
|
||||
# DateOrder=DMY
|
||||
# DateSeparator=-
|
||||
# ClockType=24_Hour
|
||||
# TimeSeparator=:
|
||||
#
|
||||
# Depending on your locale you might have to tweak the date and time format so fail2ban can read the log
|
||||
|
||||
#[INCLUDES]
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# common.local
|
||||
#before = common.conf
|
||||
|
||||
[Definition]
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failure messages in the logfile. The
|
||||
# host must be matched by a group named "host". The tag "<HOST>" can
|
||||
# be used for standard IP/hostname matching and is only an alias for
|
||||
# (?:::f{4,6}:)?(?P<host>\S+)
|
||||
# Values: TEXT
|
||||
#
|
||||
# Sample log entries (used different time formats and an extra sample with process info in front of date)
|
||||
# 01-23-2009 19:54:51 SMTP Server: Authentication failed for user postmaster ; connecting host 1.2.3.4
|
||||
# [28325:00010-3735542592] 22-06-2014 09:56:12 smtp: postmaster [1.2.3.4] authentication failure using internet password
|
||||
# 08-09-2014 06:14:27 smtp: postmaster [1.2.3.4] authentication failure using internet password
|
||||
# 08-09-2014 06:14:27 SMTP Server: Authentication failed for user postmaster ; connecting host 1.2.3.4
|
||||
|
||||
__prefix = (?:\[[^\]]+\])?\s*
|
||||
__opt_data = (?::|\s+\[[^\]]+\])
|
||||
failregex = ^%(__prefix)sSMTP Server%(__opt_data)s Authentication failed for user .*? \; connecting host \[?<HOST>\]?$
|
||||
^%(__prefix)ssmtp: (?:[^\[]+ )*\[?<HOST>\]? authentication failure using internet password\s*$
|
||||
^%(__prefix)sSMTP Server%(__opt_data)s Connection from \[?<HOST>\]? rejected for policy reasons\.
|
||||
|
||||
# Option: ignoreregex
|
||||
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
||||
# Values: TEXT
|
||||
#
|
||||
|
||||
ignoreregex =
|
||||
|
||||
|
|
@ -0,0 +1,47 @@
|
|||
# Fail2Ban filter Dovecot authentication and pop3/imap server
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
_auth_worker = (?:dovecot: )?auth(?:-worker)?
|
||||
_daemon = (?:dovecot(?:-auth)?|auth)
|
||||
|
||||
prefregex = ^%(__prefix_line)s(?:%(_auth_worker)s(?:\([^\)]+\))?: )?(?:%(__pam_auth)s(?:\(dovecot:auth\))?: |(?:pop3|imap)-login: )?(?:Info: )?<F-CONTENT>.+</F-CONTENT>$
|
||||
|
||||
failregex = ^authentication failure; logname=<F-ALT_USER1>\S*</F-ALT_USER1> uid=\S* euid=\S* tty=dovecot ruser=<F-USER>\S*</F-USER> rhost=<HOST>(?:\s+user=<F-ALT_USER>\S*</F-ALT_USER>)?\s*$
|
||||
^(?:Aborted login|Disconnected)(?::(?: [^ \(]+)+)? \((?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)\):(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
|
||||
^pam\(\S+,<HOST>(?:,\S*)?\): pam_authenticate\(\) failed: (?:User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\)|Permission denied)\s*$
|
||||
^[a-z\-]{3,15}\(\S*,<HOST>(?:,\S*)?\): (?:unknown user|invalid credentials|Password mismatch)\s*$
|
||||
<mdre-<mode>>
|
||||
|
||||
mdre-aggressive = ^(?:Aborted login|Disconnected)(?::(?: [^ \(]+)+)? \((?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,)(?: (?:in|waited) \d+ secs)?\):(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
|
||||
|
||||
mdre-normal =
|
||||
|
||||
# Parameter `mode` - `normal` or `aggressive`.
|
||||
# Aggressive mode can be used to match log-entries like:
|
||||
# 'no auth attempts', 'disconnected before auth was ready', 'client didn't finish SASL auth'.
|
||||
# Note it may produce lots of false positives on misconfigured MTAs.
|
||||
# Ex.:
|
||||
# filter = dovecot[mode=aggressive]
|
||||
mode = normal
|
||||
|
||||
ignoreregex =
|
||||
|
||||
journalmatch = _SYSTEMD_UNIT=dovecot.service
|
||||
|
||||
datepattern = {^LN-BEG}TAI64N
|
||||
{^LN-BEG}
|
||||
|
||||
# DEV Notes:
|
||||
# * the first regex is essentially a copy of pam-generic.conf
|
||||
# * Probably doesn't do dovecot sql/ldap backends properly (resolved in edit 21/03/2016)
|
||||
#
|
||||
# Author: Martin Waschbuesch
|
||||
# Daniel Black (rewrote with begin and end anchors)
|
||||
# Martin O'Neal (added LDAP authentication failure regex)
|
||||
# Sergey G. Brester aka sebres (reviewed, optimized, IPv6-compatibility)
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
# Fail2Ban filter for dropbear
|
||||
#
|
||||
# NOTE: The regex below is ONLY intended to work with a patched
|
||||
# version of Dropbear as described here:
|
||||
# http://www.unchartedbackwaters.co.uk/pyblosxom/static/patches
|
||||
# ^%(__prefix_line)sexit before auth from <HOST>.*\s*$
|
||||
#
|
||||
# The standard Dropbear output doesn't provide enough information to
|
||||
# ban all types of attack. The Dropbear patch adds IP address
|
||||
# information to the 'exit before auth' message which is always
|
||||
# produced for any form of non-successful login. It is that message
|
||||
# which this file matches.
|
||||
#
|
||||
# More information: http://bugs.debian.org/546913
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# common.local
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
_daemon = dropbear
|
||||
|
||||
prefregex = ^%(__prefix_line)s<F-CONTENT>(?:[Ll]ogin|[Bb]ad|[Ee]xit).+</F-CONTENT>$
|
||||
|
||||
failregex = ^[Ll]ogin attempt for nonexistent user ('.*' )?from <HOST>:\d+$
|
||||
^[Bb]ad (PAM )?password attempt for .+ from <HOST>(:\d+)?$
|
||||
^[Ee]xit before auth \(user '.+', \d+ fails\): Max auth tries reached - user '.+' from <HOST>:\d+\s*$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# The first two regexs here match the unmodified dropbear messages. It isn't
|
||||
# possible to match the source of the 'exit before auth' messages from dropbear
|
||||
# as they don't include the "from <HOST>" bit.
|
||||
#
|
||||
# The second last failregex line we need to match with the modified dropbear.
|
||||
#
|
||||
# For the second regex the following apply:
|
||||
#
|
||||
# http://www.netmite.com/android/mydroid/external/dropbear/svr-authpam.c
|
||||
# http://svn.dd-wrt.com/changeset/16642#file64
|
||||
#
|
||||
# http://svn.dd-wrt.com/changeset/16642/src/router/dropbear/svr-authpasswd.c
|
||||
#
|
||||
# Author: Francis Russell
|
||||
# Zak B. Elep
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
# Fail2Ban filter to block repeated failed login attempts to Drupal site(s)
|
||||
#
|
||||
#
|
||||
# Drupal must be setup to use Syslog, which defaults to the following format:
|
||||
#
|
||||
# !base_url|!timestamp|!type|!ip|!request_uri|!referer|!uid|!link|!message
|
||||
#
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
before = common.conf
|
||||
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = ^%(__prefix_line)s(https?:\/\/)([\da-z\.-]+)\.([a-z\.]{2,6})(\/[\w\.-]+)*\|\d{10}\|user\|<HOST>\|.+\|.+\|\d\|.*\|Login attempt failed for .+\.$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# https://www.drupal.org/documentation/modules/syslog
|
||||
#
|
||||
# Author: Lee Clemens
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Steven Hiscocks
|
||||
#
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failures messages in the logfile. The
|
||||
# host must be matched by a group named "host". The tag "<HOST>" can
|
||||
# be used for standard IP/hostname matching and is only an alias for
|
||||
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
|
||||
# Multiline regexs should use tag "<SKIPLINES>" to separate lines.
|
||||
# This allows lines between the matching lines to continue to be
|
||||
# searched for other failures. This tag can be used multiple times.
|
||||
# Values: TEXT
|
||||
#
|
||||
failregex = ^=INFO REPORT==== ===\nI\(<0\.\d+\.0>:ejabberd_c2s:\d+\) : \([^)]+\) Failed authentication for \S+ from (?:IP )?<HOST>(?: \({{(?:\d+,){3}\d+},\d+}\))?$
|
||||
^(?:\.\d+)? \[info\] <0\.\d+\.\d>@ejabberd_c2s:\w+:\d+ \([^\)]+\) Failed (?:c2s \w+ )?authentication for \S+ from (?:IP )?(?:::FFFF:)?<HOST>(?:: |$)
|
||||
|
||||
# Option: ignoreregex
|
||||
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
||||
# Values: TEXT
|
||||
#
|
||||
ignoreregex =
|
||||
|
||||
# "maxlines" is number of log lines to buffer for multi-line regex searches
|
||||
maxlines = 2
|
||||
|
||||
# Option: journalmatch
|
||||
# Notes.: systemd journalctl style match filter for journal based backend
|
||||
# Values: TEXT
|
||||
#
|
||||
journalmatch =
|
||||
|
||||
#datepattern = ^(?:=[^=]+={3,} )?({DATE})
|
||||
# explicit time format using prefix =...==== and no date in second string begins with I(...)...
|
||||
datepattern = ^(?:=[^=]+={3,} )?(%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?)
|
||||
^I\(()**
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# Fail2Ban filter file for common exim expressions
|
||||
#
|
||||
# This is to be used by other exim filters
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Load customizations if any available
|
||||
after = exim-common.local
|
||||
|
||||
[Definition]
|
||||
|
||||
host_info_pre = (?:H=([\w.-]+ )?(?:\(\S+\) )?)?
|
||||
host_info_suf = (?::\d+)?(?: I=\[\S+\](:\d+)?)?(?: U=\S+)?(?: P=e?smtp)?(?: F=(?:<>|[^@]+@\S+))?\s
|
||||
host_info = %(host_info_pre)s\[<HOST>\]%(host_info_suf)s
|
||||
pid = (?: \[\d+\])?
|
||||
|
||||
# DEV Notes:
|
||||
# From exim source code: ./src/receive.c:add_host_info_for_log
|
||||
#
|
||||
# Author: Daniel Black
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
# Fail2Ban filter for exim the spam rejection messages
|
||||
#
|
||||
# Honeypot traps are very useful for fighting spam. You just activate an email
|
||||
# address on your domain that you do not intend to use at all, and that normal
|
||||
# people do not risk to try for contacting you. It may be something that
|
||||
# spammers often test. You can also hide the address on a web page to be picked
|
||||
# by spam spiders. Or simply parse your mail logs for an invalid address
|
||||
# already being frequently targeted by spammers. Enable the address and
|
||||
# redirect it to the blackhole. In Exim's alias file, you would add the
|
||||
# following line (assuming the address is honeypot@yourdomain.com):
|
||||
#
|
||||
# honeypot: :blackhole:
|
||||
#
|
||||
# For the SA: Action: silently tossed message... to be logged exim's SAdevnull option needs to be used.
|
||||
#
|
||||
# To this filter use the jail.local should contain in the right jail:
|
||||
#
|
||||
# filter = exim-spam[honeypot=honeypot@yourdomain.com]
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# exim-common.local
|
||||
before = exim-common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = ^%(pid)s \S+ F=(<>|\S+@\S+) %(host_info)srejected by local_scan\(\): .{0,256}$
|
||||
^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: .*dnsbl.*\s*$
|
||||
^%(pid)s \S+ %(host_info)sF=(<>|[^@]+@\S+) rejected after DATA: This message contains a virus \(\S+\)\.\s*$
|
||||
^%(pid)s \S+ SA: Action: flagged as Spam but accepted: score=\d+\.\d+ required=\d+\.\d+ \(scanned in \d+/\d+ secs \| Message-Id: \S+\)\. From \S+ \(host=\S+ \[<HOST>\]\) for <honeypot>$
|
||||
^%(pid)s \S+ SA: Action: silently tossed message: score=\d+\.\d+ required=\d+\.\d+ trigger=\d+\.\d+ \(scanned in \d+/\d+ secs \| Message-Id: \S+\)\. From \S+ \(host=(\S+ )?\[<HOST>\]\) for \S+$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
[Init]
|
||||
|
||||
# Option: honeypot
|
||||
# Notes.: honeypot is an email address that isn't published anywhere that a
|
||||
# legitimate email sender would send email too.
|
||||
# Values: email address
|
||||
|
||||
honeypot = trap@example.com
|
||||
|
||||
# DEV Notes:
|
||||
# The %(host_info) defination contains a <HOST> match
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
# Daniel Black (rewrote with strong regexs)
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
# Fail2Ban filter for exim
|
||||
#
|
||||
# This includes the rejection messages of exim. For spam and filter
|
||||
# related bans use the exim-spam.conf
|
||||
#
|
||||
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# exim-common.local
|
||||
before = exim-common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
# Fre-filter via "prefregex" is currently inactive because of too different failure syntax in exim-log (testing needed):
|
||||
#prefregex = ^%(pid)s <F-CONTENT>\b(?:\w+ authenticator failed|([\w\-]+ )?SMTP (?:(?:call|connection) from|protocol(?: synchronization)? error)|no MAIL in|(?:%(host_info_pre)s\[[^\]]+\]%(host_info_suf)s(?:sender verify fail|rejected RCPT|dropped|AUTH command))).+</F-CONTENT>$
|
||||
|
||||
failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
|
||||
^%(pid)s \w+ authenticator failed for (?:[^\[\( ]* )?(?:\(\S*\) )?\[<HOST>\](?::\d+)?(?: I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
|
||||
^%(pid)s %(host_info)srejected RCPT [^@]+@\S+: (?:relay not permitted|Sender verify failed|Unknown user|Unrouteable address)\s*$
|
||||
^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (?:connection from|"\S+") %(host_info)s(?:next )?input=".*"\s*$
|
||||
^%(pid)s SMTP call from (?:[^\[\( ]* )?%(host_info)sdropped: too many (?:nonmail commands|syntax or protocol errors) \(last (?:command )?was "[^"]*"\)\s*$
|
||||
^%(pid)s SMTP protocol error in "[^"]+(?:"+[^"]*(?="))*?" %(host_info)sAUTH command used when not advertised\s*$
|
||||
^%(pid)s no MAIL in SMTP connection from (?:[^\[\( ]* )?(?:\(\S*\) )?%(host_info)sD=\d\S*s(?: C=\S*)?\s*$
|
||||
^%(pid)s (?:[\w\-]+ )?SMTP connection from (?:[^\[\( ]* )?(?:\(\S*\) )?%(host_info)sclosed by DROP in ACL\s*$
|
||||
<mdre-<mode>>
|
||||
|
||||
mdre-aggressive = ^%(pid)s no host name found for IP address <HOST>$
|
||||
^%(pid)s no IP address found for host \S+ \(during SMTP connection from \[<HOST>\]\)$
|
||||
|
||||
mdre-normal =
|
||||
|
||||
# Parameter `mode` - `normal` or `aggressive`.
|
||||
# Aggressive mode can be used to match flood and ddos-similar log-entries like:
|
||||
# 'no host found for IP', 'no IP found for host'.
|
||||
# Note this is not an authentication failures, so it may produce lots of false
|
||||
# positives on misconfigured MTAs.
|
||||
# Ex.:
|
||||
# filter = exim[mode=aggressive]
|
||||
mode = normal
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# DEV Notes:
|
||||
# The %(host_info) defination contains a <HOST> match
|
||||
#
|
||||
# SMTP protocol synchronization error \([^)]*\) <- This needs to be non-greedy
|
||||
# to void capture beyond ")" to avoid a DoS Injection vulnerabilty as input= is
|
||||
# user injectable data.
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
# Daniel Black (rewrote with strong regexs)
|
||||
# Martin O'Neal (added additional regexs to detect authentication failures, protocol errors, and drops)
|
||||
|
|
@ -0,0 +1,58 @@
|
|||
# Fail2Ban configuration file
|
||||
#
|
||||
# Enable "log-auth-failures" on each Sofia profile to monitor
|
||||
# <param name="log-auth-failures" value="true"/>
|
||||
# -- this requires a high enough loglevel on your logs to save these messages.
|
||||
#
|
||||
# In the fail2ban jail.local file for this filter set ignoreip to the internal
|
||||
# IP addresses on your LAN.
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# common.local
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
_daemon = freeswitch
|
||||
|
||||
# Parameter "mode": normal, ddos or extra (default, combines all)
|
||||
# Usage example (for jail.local):
|
||||
# [freeswitch]
|
||||
# mode = normal
|
||||
# # or with rewrite filter parameters of jail:
|
||||
# [freeswitch-ddos]
|
||||
# filter = freeswitch[mode=ddos]
|
||||
#
|
||||
mode = extra
|
||||
|
||||
# Prefix contains common prefix line (server, daemon, etc.) and 2 datetimes if used systemd backend
|
||||
_pref_line = ^%(__prefix_line)s(?:(?:\d+-)?\d+-\d+ \d+:\d+:\d+\.\d+)?
|
||||
|
||||
prefregex = ^%(_pref_line)s \[WARN(?:ING)?\](?: \[SOFIA\])? \[?sofia_reg\.c:\d+\]? <F-CONTENT>.+</F-CONTENT>$
|
||||
|
||||
cmnfailre = ^Can't find user \[[^@]+@[^\]]+\] from <HOST>$
|
||||
|
||||
mdre-normal = %(cmnfailre)s
|
||||
^SIP auth failure \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[[^\]]*\] from ip <HOST>$
|
||||
|
||||
mdre-ddos = ^SIP auth (?:failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[[^\]]*\] from ip <HOST>$
|
||||
|
||||
mdre-extra = %(cmnfailre)s
|
||||
<mdre-ddos>
|
||||
|
||||
failregex = <mdre-<mode>>
|
||||
|
||||
ignoreregex =
|
||||
|
||||
datepattern = ^(?:%%Y-)?%%m-%%d[ T]%%H:%%M:%%S(?:\.%%f)?
|
||||
{^LN-BEG}
|
||||
|
||||
# Author: Rupa SChomaker, soapee01, Daniel Black, Sergey Brester aka sebres
|
||||
# https://freeswitch.org/confluence/display/FREESWITCH/Fail2Ban
|
||||
# Thanks to Jim on mailing list of samples and guidance
|
||||
#
|
||||
# No need to match the following. Its a duplicate of the SIP auth regex.
|
||||
# ^\.\d+ \[DEBUG\] sofia\.c:\d+ IP <HOST> Rejected by acl "\S+"\. Falling back to Digest auth\.$
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
# Fail2Ban configuration file to block repeated failed login attempts to Frolor installation(s)
|
||||
#
|
||||
# Froxlor needs to log to Syslog User (e.g. /var/log/user.log) with one of the following messages
|
||||
# <syslog prefix> Froxlor: [Login Action <HOST>] Unknown user '<USER>' tried to login.
|
||||
# <syslog prefix> Froxlor: [Login Action <HOST>] User '<USER>' tried to login with wrong password.
|
||||
#
|
||||
# Author: Joern Muehlencord
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# common.local
|
||||
before = common.conf
|
||||
|
||||
|
||||
[Definition]
|
||||
|
||||
_daemon = Froxlor
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failures messages in the logfile. The
|
||||
# host must be matched by a group named "host". The tag "<HOST>" can
|
||||
# be used for standard IP/hostname matching and is only an alias for
|
||||
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
|
||||
# Values: TEXT
|
||||
#
|
||||
|
||||
prefregex = ^%(__prefix_line)s\[Login Action <HOST>\] <F-CONTENT>.+</F-CONTENT>$
|
||||
|
||||
failregex = ^Unknown user \S* tried to login.$
|
||||
^User \S* tried to login with wrong password.$
|
||||
|
||||
|
||||
# Option: ignoreregex
|
||||
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
||||
# Values: TEXT
|
||||
#
|
||||
ignoreregex =
|
||||
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
# Fail2Ban filter for Group-Office
|
||||
#
|
||||
# Enable logging with:
|
||||
# $config['info_log']='/home/groupoffice/log/info.log';
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = ^\[\]LOGIN FAILED for user: "\S+" from IP: <HOST>$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# Author: Daniel Black
|
||||
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
# Fail2Ban filter file for gssftp
|
||||
#
|
||||
# Note: gssftp is part of the krb5-appl-servers in Fedora
|
||||
#
|
||||
[INCLUDES]
|
||||
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
_daemon = ftpd
|
||||
|
||||
failregex = ^%(__prefix_line)srepeated login failures from <HOST> \(\S+\)$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# Author: Kevin Zembower
|
||||
# Edited: Daniel Black - syslog based daemon
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
# Fail2Ban configuration file for guacamole
|
||||
#
|
||||
# Author: Steven Hiscocks
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failures messages in the logfile.
|
||||
# Values: TEXT
|
||||
#
|
||||
failregex = ^.*\nWARNING: Authentication attempt from <HOST> for user "[^"]*" failed\.$
|
||||
|
||||
# Option: ignoreregex
|
||||
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
||||
# Values: TEXT
|
||||
#
|
||||
ignoreregex =
|
||||
|
||||
# "maxlines" is number of log lines to buffer for multi-line regex searches
|
||||
maxlines = 2
|
||||
|
||||
datepattern = ^%%b %%d, %%ExY %%I:%%M:%%S %%p
|
||||
^WARNING:()**
|
||||
{^LN-BEG}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
# Fail2Ban filter configuration file to match failed login attempts to
|
||||
# HAProxy HTTP Authentication protected servers.
|
||||
#
|
||||
# PLEASE NOTE - When a user first hits the HTTP Auth a 401 is returned by the server
|
||||
# which prompts their browser to ask for login details.
|
||||
# This initial 401 is logged by HAProxy.
|
||||
# In other words, even successful logins will have at least 1 fail regex match.
|
||||
# Please keep this in mind when setting findtime and maxretry for jails.
|
||||
#
|
||||
# Author: Jordan Moeser
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# common.local
|
||||
before = common.conf
|
||||
|
||||
|
||||
[Definition]
|
||||
|
||||
_daemon = haproxy
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failures messages in the logfile. The
|
||||
# host must be matched by a group named "host". The tag "<HOST>" can
|
||||
# be used for standard IP/hostname matching and is only an alias for
|
||||
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
|
||||
# Values: TEXT
|
||||
#
|
||||
failregex = ^%(__prefix_line)s<HOST>(?::\d+)?\s+.*<NOSRV> -1/-1/-1/-1/\+*\d* 401
|
||||
|
||||
# Option: ignoreregex
|
||||
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
||||
# Values: TEXT
|
||||
#
|
||||
ignoreregex =
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
# fail2ban filter configuration for horde
|
||||
|
||||
|
||||
[Definition]
|
||||
|
||||
|
||||
failregex = ^ HORDE \[error\] \[(horde|imp)\] FAILED LOGIN for \S+ \[<HOST>\](\(forwarded for \[\S+\]\))? to (Horde|{[^}]+}) \[(pid \d+ )?on line \d+ of \S+\]$
|
||||
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# DEV NOTES:
|
||||
# https://github.com/horde/horde/blob/master/imp/lib/Auth.php#L132
|
||||
# https://github.com/horde/horde/blob/master/horde/login.php
|
||||
#
|
||||
# Author: Daniel Black
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
#!/usr/bin/env fail2ban-python
|
||||
# Inspired by https://isc.sans.edu/forums/diary/When+Google+isnt+Google/15968/
|
||||
#
|
||||
# Written in Python to reuse built-in Python batteries and not depend on
|
||||
# presence of host and cut commands
|
||||
#
|
||||
import sys
|
||||
from fail2ban.server.ipdns import DNSUtils, IPAddr
|
||||
|
||||
def process_args(argv):
|
||||
if len(argv) != 2:
|
||||
raise ValueError("Please provide a single IP as an argument. Got: %s\n"
|
||||
% (argv[1:]))
|
||||
ip = argv[1]
|
||||
|
||||
if not IPAddr(ip).isValid:
|
||||
raise ValueError("Argument must be a single valid IP. Got: %s\n"
|
||||
% ip)
|
||||
return ip
|
||||
|
||||
google_ips = None
|
||||
|
||||
def is_googlebot(ip):
|
||||
import re
|
||||
|
||||
host = DNSUtils.ipToName(ip)
|
||||
if not host or not re.match(r'.*\.google(bot)?\.com$', host):
|
||||
return False
|
||||
host_ips = DNSUtils.dnsToIp(host)
|
||||
return (ip in host_ips)
|
||||
|
||||
if __name__ == '__main__': # pragma: no cover
|
||||
try:
|
||||
ret = is_googlebot(process_args(sys.argv))
|
||||
except ValueError as e:
|
||||
sys.stderr.write(str(e))
|
||||
sys.exit(2)
|
||||
sys.exit(0 if ret else 1)
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
# Fail2ban filter for kerio
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = ^ SMTP Spam attack detected from <HOST>,
|
||||
^ IP address <HOST> found in DNS blacklist
|
||||
^ Relay attempt from IP address <HOST>
|
||||
^ Attempt to deliver to unknown recipient \S+, from \S+, IP address <HOST>$
|
||||
^ Failed SMTP login from <HOST>
|
||||
^ SMTP: User \S+ doesn't exist. Attempt from IP address <HOST>
|
||||
^ Client with IP address <HOST> has no reverse DNS entry, connection rejected before SMTP greeting$
|
||||
^ Administration login into Web Administration from <HOST> failed: IP address not allowed$
|
||||
^ Message from IP address <HOST>, sender \S+ rejected: sender domain does not exist$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
datepattern = ^\[%%d/%%b/%%Y %%H:%%M:%%S\]
|
||||
|
||||
# DEV NOTES:
|
||||
#
|
||||
# Author: A.P. Lawrence
|
||||
# Updated by: M. Bischoff <https://github.com/herrbischoff>
|
||||
#
|
||||
# Based off: http://aplawrence.com/Kerio/fail2ban.html
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
# Fail2Ban filter to match wrong passwords as notified by lighttpd's auth Module
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = ^: \((?:http|mod)_auth\.c\.\d+\) (?:password doesn\'t match .* username: .*|digest: auth failed for .*: wrong password|get_password failed), IP: <HOST>\s*$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# Author: Francois Boulogne <fboulogne@april.org>
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
# Fail2Ban filter for unsuccesfull MongoDB authentication attempts
|
||||
#
|
||||
# Logfile /var/log/mongodb/mongodb.log
|
||||
#
|
||||
# add setting in /etc/mongodb.conf
|
||||
# logpath=/var/log/mongodb/mongodb.log
|
||||
#
|
||||
# and use of the authentication
|
||||
# auth = true
|
||||
#
|
||||
|
||||
[Definition]
|
||||
#failregex = ^\s+\[initandlisten\] connection accepted from <HOST>:\d+ \#(?P<__connid>\d+) \(1 connection now open\)<SKIPLINES>\s+\[conn(?P=__connid)\] Failed to authenticate\s+
|
||||
failregex = ^\s+\[conn(?P<__connid>\d+)\] Failed to authenticate [^\n]+<SKIPLINES>\s+\[conn(?P=__connid)\] end connection <HOST>
|
||||
|
||||
ignoreregex =
|
||||
|
||||
|
||||
[Init]
|
||||
maxlines = 10
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# Regarding the multiline regex:
|
||||
#
|
||||
# There can be a nunber of non-related lines between the first and second part
|
||||
# of this regex maxlines of 10 is quite generious.
|
||||
#
|
||||
# Note the capture __connid, includes the connection ID, used in second part of regex.
|
||||
#
|
||||
# The first regex is commented out (but will match also), because it is better to use
|
||||
# the host from "end connection" line (uncommented above):
|
||||
# - it has the same prefix, searching begins directly with failure message
|
||||
# (so faster, because ignores success connections at all)
|
||||
# - it is not so vulnerable in case of possible race condition
|
||||
#
|
||||
# Log example:
|
||||
# 2016-10-20T09:54:27.108+0200 [initandlisten] connection accepted from 127.0.0.1:53276 #1 (1 connection now open)
|
||||
# 2016-10-20T09:54:27.109+0200 [conn1] authenticate db: test { authenticate: 1, nonce: "xxx", user: "root", key: "xxx" }
|
||||
# 2016-10-20T09:54:27.110+0200 [conn1] Failed to authenticate root@test with mechanism MONGODB-CR: AuthenticationFailed UserNotFound Could not find user root@test
|
||||
# 2016-11-09T09:54:27.894+0100 [conn1] end connection 127.0.0.1:53276 (0 connections now open)
|
||||
# 2016-11-09T11:55:58.890+0100 [initandlisten] connection accepted from 127.0.0.1:54266 #1510 (1 connection now open)
|
||||
# 2016-11-09T11:55:58.892+0100 [conn1510] authenticate db: admin { authenticate: 1, nonce: "xxx", user: "root", key: "xxx" }
|
||||
# 2016-11-09T11:55:58.892+0100 [conn1510] Failed to authenticate root@admin with mechanism MONGODB-CR: AuthenticationFailed key mismatch
|
||||
# 2016-11-09T11:55:58.894+0100 [conn1510] end connection 127.0.0.1:54266 (0 connections now open)
|
||||
#
|
||||
# Authors: Alexander Finkhäuser
|
||||
# Sergey G. Brester (sebres)
|
||||
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
# Fail2Ban filter for monit.conf, looks for failed access attempts
|
||||
#
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# common.local
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
_daemon = monit
|
||||
|
||||
# Regexp for previous (accessing monit httpd) and new (access denied) versions
|
||||
failregex = ^\[\s*\]\s*error\s*:\s*Warning:\s+Client '<HOST>' supplied (?:unknown user '[^']+'|wrong password for user '[^']*') accessing monit httpd$
|
||||
^%(__prefix_line)s\w+: access denied -- client <HOST>: (?:unknown user '[^']+'|wrong password for user '[^']*'|empty password)$
|
||||
|
||||
# Ignore login with empty user (first connect, no user specified)
|
||||
# ignoreregex = %(__prefix_line)s\w+: access denied -- client <HOST>: (?:unknown user '')
|
||||
ignoreregex =
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
# Fail2Ban filter for murmur/mumble-server
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
_daemon = murmurd
|
||||
|
||||
# N.B. If you allow users to have usernames that include the '>' character you
|
||||
# should change this to match the regex assigned to the 'username'
|
||||
# variable in your server config file (murmur.ini / mumble-server.ini).
|
||||
_usernameregex = [^>]+
|
||||
|
||||
# Prefix for systemd-journal (with second date-pattern as optional match):
|
||||
#
|
||||
__prefix_journal = (?:\S+\s+%(_daemon)s\[\d+\]:(?:\s+\<W\>[\d\-]+ [\d:]+.\d+)?)
|
||||
|
||||
__prefix_line = %(__prefix_journal)s?
|
||||
|
||||
_prefix = %(__prefix_line)s\s+\d+ => <\d+:%(_usernameregex)s\(-1\)> Rejected connection from <HOST>:\d+:
|
||||
|
||||
prefregex = ^%(_prefix)s <F-CONTENT>.+</F-CONTENT>$
|
||||
|
||||
failregex = ^Invalid server password$
|
||||
^Wrong certificate or password for existing user$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
datepattern = ^<W>{DATE}
|
||||
|
||||
journalmatch = _SYSTEMD_UNIT=murmurd.service + _COMM=murmurd
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# Author: Ross Brown
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
# Fail2Ban filter for unsuccesful MySQL authentication attempts
|
||||
#
|
||||
#
|
||||
# To log wrong MySQL access attempts add to /etc/my.cnf in [mysqld]:
|
||||
# log-error=/var/log/mysqld.log
|
||||
# log-warnings = 2
|
||||
#
|
||||
# If using mysql syslog [mysql_safe] has syslog in /etc/my.cnf
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# common.local
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
_daemon = mysqld
|
||||
|
||||
failregex = ^%(__prefix_line)s(?:(?:\d{6}|\d{4}-\d{2}-\d{2})[ T]\s?\d{1,2}:\d{2}:\d{2} )?(?:\d+ )?\[\w+\] (?:\[[^\]]+\] )*Access denied for user '[^']+'@'<HOST>' (to database '[^']*'|\(using password: (YES|NO)\))*\s*$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# Technically __prefix_line can equate to an empty string hence it can support
|
||||
# syslog and non-syslog at once.
|
||||
# Example:
|
||||
# 130322 11:26:54 [Warning] Access denied for user 'root'@'127.0.0.1' (using password: YES)
|
||||
#
|
||||
# Authors: Artur Penttinen
|
||||
# Yaroslav O. Halchenko
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
# Fail2Ban filter for Nagios Remote Plugin Executor (nrpe2)
|
||||
# Detecting unauthorized access to the nrpe2 daemon
|
||||
# typically logged in /var/log/messages syslog
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
# Read syslog common prefixes
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
_daemon = nrpe
|
||||
failregex = ^%(__prefix_line)sHost <HOST> is not allowed to talk to us!\s*$
|
||||
ignoreregex =
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# Author: Ivo Truxa - 2014/02/03
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
# Fail2Ban filter file for named (bind9).
|
||||
#
|
||||
|
||||
# This filter blocks attacks against named (bind9) however it requires special
|
||||
# configuration on bind.
|
||||
#
|
||||
# By default, logging is off with bind9 installation.
|
||||
#
|
||||
# You will need something like this in your named.conf to provide proper logging.
|
||||
#
|
||||
# logging {
|
||||
# channel security_file {
|
||||
# file "/var/log/named/security.log" versions 3 size 30m;
|
||||
# severity dynamic;
|
||||
# print-time yes;
|
||||
# };
|
||||
# category security {
|
||||
# security_file;
|
||||
# };
|
||||
# };
|
||||