#1 Unexpected error, exiting:exceptions.AttributeError

[Athanasius]

I'm getting the Summary-line error fairly regularly in
syslog, and of course Daemonshield dies. This is 0.4.0
which appears to still be the latest.

What can I most usefully do to help track down the cause ?

Linux 2.6.12.3
Debian 3.1
Python 2.3.5 (as supplied by Debian)

I have slightly modified things from the default
config, mostly to catch a few extra instances of
attack. Config attached.

[Athanasius]

Logged In: YES
user_id=19402

I turned on debugging and after a few days it finally
crashed, but the log isn't really helpful, I've attached it
anyway.

[Athanasius]

Debug log from crash

[Mauce]

Logged In: YES
user_id=1374258

Because Mandriva's (Mandriva Powerpack 2006) logfiles are
slightly different I had to make the following changes in
daemonshield.conf:
# Regexp of log entry of attack
failstring=dropbear.*: bad password
# logfile searched
logfile=/var/log/auth.log

However after these changes the daemonshieldprocess crashes
and passes the following error to /var/log/messages:
Nov 6 21:01:33 mauce daemonshield[10677]: Started.
Nov 6 21:01:38 mauce daemonshield[10677]: Unexpected error,
exiting:exceptions.AttributeError

[Athanasius]

Logged In: YES
user_id=19402

(I get a feeling the maintainer/owner is long since gone,
but maybe we can help each other)

I finally got around to running daemonshield manually so I
could get a full backtracke on this crash. So does this
give anyone who knows Python a clue ?

Getting counts of ips from /var/log/auth.log
Deleting ip chain.
/sbin/iptables -D daemonshield17672 -j LOG --log-level info
--log-prefix 'Dropp
ed IP: ' -m limit --limit 1/m
/sbin/iptables -D daemonshield17672 -j DROP
/sbin/iptables -X daemonshield17672
Unexpected error, exiting:exceptions.AttributeError
Traceback (most recent call last):
File "/usr/local/sbin/daemonshield", line 436, in ?
if __name__ == "__main__": main()
File "/usr/local/sbin/daemonshield", line 422, in main
daemonshield.watchLogs()
File "/usr/local/sbin/daemonshield", line 154, in watchLogs
self.processLog(h)
File "/usr/local/sbin/daemonshield", line 257, in processLog
ips = handler.getAttackerIps(lines)
File "/usr/local/lib/daemonshield/handler.py", line 53, in
getAttackerIps
ip = self.IPRE.search(line[0]).group()
AttributeError: 'NoneType' object has no attribute 'group'

[Athanasius]

Logged In: YES
user_id=19402

Ok, I think I've tracked down why I've been seeing this bug.

Basically in the code where it fails it's running a regex to
try and pick an IPv4 address out of the line.

I had:

failstring=sshd.*: (Failed password|User .* not allowed because)

where the latter part of that would match a line like:

Nov 11 15:48:05 jimblewix sshd[22267]: User mail not allowed
because listed in DenyUsers

which contains no IP, and thus the regex fails to match
anything, so self.IPRE.search(line[0]) is
empty/null/whatever Python calls it, and thus it of course
has no .group() attribute.

So, make sure you only point daemonshield at lines that will
definitely have an IPv4 address on them. I'll see if I can
come up with a small patch to get daemonshield to at least
skip lines that don't match the regex.

[Athanasius]

Logged In: YES
user_id=19402

Find your handler.py (/usr/local/lib/daemonshield/) and go
to the function getAttackerIps. Change it to be like the
following code. This will catch any attempt to match on a
line without a recognisable IPv4 address and log the bad
line so you can fix your config.

def getAttackerIps(self, lines):
self.logger.debug("Getting counts of ips
from " + self.logfile)
ips = [{},{},{}]
for line in lines:
# If we find a failed line, extract
the ip and add it to ips[]
## Careful, the user may have
erroneously set us up
## to parse a line without an IP
foundip = self.IPRE.search(line[0]);
if foundip:
ip = foundip.group();
else:
self.logger.error(" found
line without an IP, check your daemonshield.conf: " + line[0]);
continue;
if ip in ips[0]:
ips[0][ip] += 1
if line[1] < ips[1][ip]:
ips[1][ip] = line[1]
elif line[1] > ips[2][ip]:
ips[2][ip] = line[1]
else:
ips[0][ip] = 1
ips[1][ip] = line[1]
ips[2][ip] = line[1]
return ips

[negora]

Although this ticket is old, it has been very helpful to me to configure the SSH rule in /usr/local/etc/daemonshield.conf. I've checked the file /var/log/secure and actually there have been a few lines that have matched the default regular expression in the configuration file but that has contained the text "UNKNOWN" instead of an IP. So I've changed my rule from:

sshd.*: Failed password

to:

sshd.: Failed password.from(?! UNKNOWN)

And it seems to have worked... At least by now :) .

Thank you.