Thread: [Fail2ban-commit] SF.net SVN: fail2ban: [484] branches/FAIL2BAN-0_6

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 454-5900

Revision: 484
          http://svn.sourceforge.net/fail2ban/?rev=484&view=rev
Author:   lostcontrol
Date:     2006-12-10 13:16:26 -0800 (Sun, 10 Dec 2006)

Log Message:
-----------
- Added named group "host" for "failregex"
- Fixed vulnerability CVE-2006-6302

Modified Paths:
--------------
    branches/FAIL2BAN-0_6/CHANGELOG
    branches/FAIL2BAN-0_6/README
    branches/FAIL2BAN-0_6/config/fail2ban.conf.hostsdeny
    branches/FAIL2BAN-0_6/config/fail2ban.conf.iptables
    branches/FAIL2BAN-0_6/config/fail2ban.conf.shorewall
    branches/FAIL2BAN-0_6/logreader/logreader.py
    branches/FAIL2BAN-0_6/version.py

Modified: branches/FAIL2BAN-0_6/CHANGELOG
===================================================================

--- branches/FAIL2BAN-0_6/CHANGELOG	2006-12-10 16:46:54 UTC (rev 483)
+++ branches/FAIL2BAN-0_6/CHANGELOG	2006-12-10 21:16:26 UTC (rev 484)
@@ -14,6 +14,8 @@
   (Yaroslav Halchenko):
   * Made locale configurable
   * Fixed warning if ignoreip is empty
+- Added named group "host" for "failregex". Fixed security
+  vulnerability CVE-2006-6302
 
 ver. 0.6.1 (2006/03/16) - stable
 ----------

Modified: branches/FAIL2BAN-0_6/README
===================================================================
--- branches/FAIL2BAN-0_6/README	2006-12-10 16:46:54 UTC (rev 483)
+++ branches/FAIL2BAN-0_6/README	2006-12-10 21:16:26 UTC (rev 484)
@@ -4,7 +4,7 @@
              |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 =============================================================
-Fail2Ban (version 0.6.1)                           2006/03/16
+Fail2Ban (version 0.6.2)                           2006/??/??
 =============================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -58,8 +58,8 @@
 
 To install, just do:
 
-> tar xvfj fail2ban-0.6.1.tar.bz2
-> cd fail2ban-0.6.1
+> tar xvfj fail2ban-0.6.2.tar.bz2
+> cd fail2ban-0.6.2
 > python setup.py install
 
 This will install Fail2Ban into /usr/lib/fail2ban. The
@@ -130,10 +130,10 @@
 Thanks:
 -------
 
-K\xE9vin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
+Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
 Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
 Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
-Edgington, Patrick B\xF6rjesson, kojiro, zugeschmiert
+Edgington, Patrick Börjesson, kojiro, zugeschmiert
 
 License:
 --------

Modified: branches/FAIL2BAN-0_6/config/fail2ban.conf.hostsdeny
===================================================================
--- branches/FAIL2BAN-0_6/config/fail2ban.conf.hostsdeny	2006-12-10 16:46:54 UTC (rev 483)
+++ branches/FAIL2BAN-0_6/config/fail2ban.conf.hostsdeny	2006-12-10 21:16:26 UTC (rev 484)
@@ -257,7 +257,7 @@
 # Notes.:  regex to match the password failure messages in the logfile.
 # Values:  TEXT  Default:  authentication failure|user .* not found
 #
-failregex = authentication failure|user .* not found
+failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
 
 
 [VSFTPD]
@@ -297,7 +297,7 @@
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT Default: Authentication failure|Failed password|Invalid user
 #
-failregex = FAIL LOGIN
+failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+)
 
 
 [SSH]
@@ -333,4 +333,4 @@
 # Notes.:  regex to match the password failures messages in the logfile.
 # Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
 #
-failregex = Authentication failure|Failed password|Invalid user
+failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)

Modified: branches/FAIL2BAN-0_6/config/fail2ban.conf.iptables
===================================================================
--- branches/FAIL2BAN-0_6/config/fail2ban.conf.iptables	2006-12-10 16:46:54 UTC (rev 483)
+++ branches/FAIL2BAN-0_6/config/fail2ban.conf.iptables	2006-12-10 21:16:26 UTC (rev 484)
@@ -285,7 +285,7 @@
 # Notes.:  regex to match the password failure messages in the logfile.
 # Values:  TEXT  Default:  authentication failure|user .* not found
 #
-failregex = authentication failure|user .* not found
+failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
 
 
 [VSFTPD]
@@ -325,7 +325,7 @@
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT Default: Authentication failure|Failed password|Invalid user
 #
-failregex = FAIL LOGIN
+failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+)
 
 
 [SSH]
@@ -367,4 +367,4 @@
 # Notes.:  regex to match the password failures messages in the logfile.
 # Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
 #
-failregex = Authentication failure|Failed password|Invalid user
+failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)

Modified: branches/FAIL2BAN-0_6/config/fail2ban.conf.shorewall
===================================================================
--- branches/FAIL2BAN-0_6/config/fail2ban.conf.shorewall	2006-12-10 16:46:54 UTC (rev 483)
+++ branches/FAIL2BAN-0_6/config/fail2ban.conf.shorewall	2006-12-10 21:16:26 UTC (rev 484)
@@ -251,8 +251,9 @@
 # Notes.:  regex to match the password failure messages in the logfile.
 # Values:  TEXT  Default:  authentication failure|user .* not found
 #
-failregex = authentication failure|user .* not found
+failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
 
+
 [VSFTPD]
 # Option: enabled
 # Notes.: enable monitoring for this section.
@@ -284,7 +285,7 @@
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT Default: Authentication failure|Failed password|Invalid user
 #
-failregex = FAIL LOGIN
+failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+)
 
 
 [SSH]
@@ -320,4 +321,4 @@
 # Notes.:  regex to match the password failures messages in the logfile.
 # Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
 #
-failregex = Authentication failure|Failed password|Invalid user
+failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)

Modified: branches/FAIL2BAN-0_6/logreader/logreader.py
===================================================================
--- branches/FAIL2BAN-0_6/logreader/logreader.py	2006-12-10 16:46:54 UTC (rev 483)
+++ branches/FAIL2BAN-0_6/logreader/logreader.py	2006-12-10 21:16:26 UTC (rev 484)
@@ -177,7 +177,16 @@
 			timeMatch = re.search(self.timeregex, match.string)
 			if timeMatch:
 				date = self.getUnixTime(timeMatch.group())
-				ipMatch = textToIp(match.string)
+				try:
+					# Fix for CVE-2006-6302
+					matchString = match.group("host")
+				except IndexError:
+					# However does not break the current configuration
+					logSys.warn("No 'host' group defined. This is a security " +
+								"issue. Please fix your configuration file " +
+								"and look at CVE-2006-6302")
+					matchString = match.string
+				ipMatch = textToIp(matchString)
 				if ipMatch:
 					for ip in ipMatch:
 						failList.append([ip, date])

Modified: branches/FAIL2BAN-0_6/version.py
===================================================================
--- branches/FAIL2BAN-0_6/version.py	2006-12-10 16:46:54 UTC (rev 483)
+++ branches/FAIL2BAN-0_6/version.py	2006-12-10 21:16:26 UTC (rev 484)
@@ -24,4 +24,4 @@
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-version = "0.6.1-CVS"
+version = "0.6.1-SVN"


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.




Thread: [Fail2ban-commit] SF.net SVN: fail2ban: [484] branches/FAIL2BAN-0_6

fail2ban-commit