fail2ban-users — The mailing list for help on getting Fail2Ban up and running on your machine

Re: [Fail2ban-users] Should this match?

[Cyril J. <cyr...@bl...>]

Hi,

> I think that the failregex is too broad, since it will start killing
> off the <host> for any class of errors. At first I only want to trap
> "550 User unknown".

You're right.

> I am soooo happy we've got this working.

Me too :)

> I can't test with 7.x right now, since I'm using debian testing and it
> seems that the 6.x series is what's there, and I can't take the time
> to manually upgrade this system right now since it's my personal
> server.
> 
> Am I wrong about this? Is there a .deb or an apt repo with 7.x that I
> should use? If so, I'd be happy to try once again if somoene else is
> using it and can vouch for the specific package being working software
> right now.

Debian maintainer, Yaroslav, should release a 0.7.1 package soon. Please
be patient ;) I'm using 0.7.x on my home server. You can see a plot of
the attacks against my SSH server here:

http://jaquier.dyndns.org/rrdtool/dynrrd.php?rrd=fail2ban&start=1w

There are 2-6 attempts/day.

Regards,

Cyril Jaquier

Re: [Fail2ban-users] Should this match?

[Peter C. N. <spa...@le...>]

Cyril,

I think that the failregex is too broad, since it will start killing
off the <host> for any class of errors. At first I only want to trap
"550 User unknown".

Building on what you provided, using this worked and is a bit more
conservative:

failregex = error,relay=(?::f{4,6}:)?(?P<host>\S*).*550 User unknown

This works. Many, many, many bots out there are now being blocked for
1/2 hour periods.

/me sighs

I am soooo happy we've got this working. It's been a thorn in my side
forever.

I can't test with 7.x right now, since I'm using debian testing and it
seems that the 6.x series is what's there, and I can't take the time
to manually upgrade this system right now since it's my personal
server.

Am I wrong about this? Is there a .deb or an apt repo with 7.x that I
should use? If so, I'd be happy to try once again if somoene else is
using it and can vouch for the specific package being working software
right now.

Thanks again,

-Peter

On Wed, Aug 30, 2006 at 12:19:39AM +0200, Cyril Jaquier wrote:
> Hi Peter,
> 
> > I'm re-visiting my attempt at tracking ip addresses that are hassling
> > my courier server (last tried a year+ ago, haven't had time since).
> 
> I have created a "couriersmtp.conf" which matches your log message. This
> is for 0.7 however it should work with your Debian package. Just
> copy/paste the "failregex" option. But I would be really happy if you
> could test this with 0.7.1 ;)
> 
> Regards,
> 
> Cyril Jaquier



-- 
The 5 year plan:
In five years we'll make up another plan.
Or just re-use this one.

Re: [Fail2ban-users] Should this match?

[Cyril J. <cyr...@bl...>]

Hi Peter,

> I'm re-visiting my attempt at tracking ip addresses that are hassling
> my courier server (last tried a year+ ago, haven't had time since).

I have created a "couriersmtp.conf" which matches your log message. This
is for 0.7 however it should work with your Debian package. Just
copy/paste the "failregex" option. But I would be really happy if you
could test this with 0.7.1 ;)

Regards,

Cyril Jaquier

[Fail2ban-users] Should this match?

[Peter C. N. <spa...@le...>]

I'm re-visiting my attempt at tracking ip addresses that are hassling
my courier server (last tried a year+ ago, haven't had time since).

I'm using debian fail2ban 0.6.1-10.

In trying to get this, I get the following kinds of messages (on one
line from syslog):

Aug 29 12:23:04 HOSTNAME courieresmtpd:
error,relay=::ffff:203.162.223.135,from=\<fir...@ac...>,to=<BOGUSUSER@HOSTEDDOMAIN.org>:
550 User unknown.

With HOSTNAME and HOSTEDDOMAIN being what they appear to be.

In this case, here is the failregex I'm trying to use:

failregex = .*couriersmtpd: error,relay=::f{4,6}:(?P<host>\S*).*550
User unknown\.*

Can anyone tell me what I'm obviously doing wrong when this doesn't
result in anything:

$ for count in 1 2 3 4 5 6 7 8 9 10; do logger -t "courieresmtpd" -p
mail.warn
"error,relay=::ffff:72.70.78.217,from=<con...@ea...>,to=<home@HOSTEDDOMAIN.org>:
550 User unknown BOGUS $count"; sleep 10; done

This seems to create a matching entry in syslog.conf. but I'm puzzled
as to what I'm missing now.

Can anyone recommed a better solution? 

Thanks,

-Peter

-- 
The 5 year plan:
In five years we'll make up another plan.
Or just re-use this one.

[Fail2ban-users] Bug fixes in 0.7.1

[Cyril J. <cyr...@bl...>]

Hi,

A few critical bugs were found in 0.7.0. A new release is available
which should fix them.

I need feedbacks and bug reports. So please, test it ;)

Howto:

http://fail2ban.sourceforge.net/wiki/index.php/HOWTO_fail2ban_0.7.x

Homepage: http://fail2ban.sourceforge.net

Regards,

Cyril Jaquier

[Fail2ban-users] Bug in Fail2ban 0.7.0

[<cyr...@bl...>]

Hi,

I found a bug introduced during refactoring yesterday :-(

# ./fail2ban-client start
ERROR  No section: 'Definition'
ERROR  No section: 'Definition'
Traceback (most recent call last):
  File "fail2ban-server", line 120, in ?
    server.start(sys.argv)
  File "fail2ban-server", line 105, in start
    retCode = createDaemon()
NameError: global name 'createDaemon' is not defined
ERROR  Could not start server. Try -x option

I will fix it this evening and publish 0.7.1.

Regards,

Cyril Jaquier

[Fail2ban-users] Fail2ban 0.7.0 is out

[Cyril J. <cyr...@bl...>]

Hi,

Here is the first release of the new 0.7.x branch. This is almost a
complete rewrite of Fail2ban with multithreading, client/server, better
configuration files, etc. You can get more information on the website.
There is still a lot of work before 0.8.0 but it should already run
correctly.

Fail2ban 0.7.0 is considered alpha software. I need feedback and bug
reports. So please, test it ;) And do not hesitate to contribute with
documentation, patches, bug reports and feedbacks.

You can find a quick howto on the website:

http://fail2ban.sourceforge.net/wiki/index.php/HOWTO_fail2ban_0.7.x

Homepage: http://fail2ban.sourceforge.net

Regards,

Cyril Jaquier

[Fail2ban-users] Fail2ban 0.7.0 soon...

[Cyril J. <cyr...@bl...>]

Hi,

Most of the features for 0.7.0 are now implemented. I hope to release a
0.7.0 package next week. Before, I will improve the documentation of the
configuration files.

http://fail2ban.sourceforge.net/wiki/index.php/Features#0.7.2

I updated the howto to reflect the latest changes.

http://fail2ban.sourceforge.net/wiki/index.php/HOWTO_fail2ban_0.7.x

I need feedbacks about this branch. Has anyone already tested it? It
runs on my home server for more than 2 weeks ;)

http://jaquier.dyndns.org/rrdtool/dynrrd.php?rrd=fail2ban&start=3w

Thank you

Regards,

Cyril Jaquier

Re: [Fail2ban-users] Error running fail2ban on RedHat 7.2 server

[Cyril J. <cyr...@bl...>]

Strange...

Execute "python -V" and be sure it returns 2.4.3. Then start Fail2ban
from the same console.

Could you try this too:

# /usr/bin/env python -V

And if it still does not work, find the path to your Python 2.4.3 binary
and replace

#!/usr/bin/env python

on the first line of fail2ban.py with the path to your Python binary.

Example:

#!/usr/bin/python2.4

The logging module is available since Python 2.3.
http://docs.python.org/lib/module-logging.html

Regards,

Cyril

Russ Hazzon wrote:
> python -V - returns version 2.4.3
>  
> Python -c "import logging" does not return an error code
> 
> Did I uninstall the old version of python - probably not.  It was an RPM.  I
> installed the latest version from source.  I now see files for both versions
> lingering on the system.  I know enough about Linux to get by (and get in
> trouble), but some of this stuff is WAY over my head.  I looked for an RPM
> to do the Python upgrade, but could not find a package more recent than
> version 1.5 so I attempted to install from source.  I think maybe it's time
> to rebuild this server with a more recent distro (Fedora Core 5?), just need
> to find the time as this is a working mail server in my home.
> 
> Russ
> 
> 
> -----Original Message-----
> From: Cyril Jaquier [mailto:cyr...@bl...] 
> Sent: Thursday, August 17, 2006 5:33 PM
> To: ru...@ha...
> Cc: fai...@li...
> Subject: Re: [Fail2ban-users] Error running fail2ban on RedHat 7.2 server
> 
> Russ Hazzon wrote:
>> Just upgraded to 2.4.3.  Still getting the same error message.
>>
>> Russ
> 
> Could you try this:
> 
> # python -V
> 
> # python -c "import logging"
> 
> Are you sure you correctly removed your previous version before?
> 
> Cyril
> 
>> -----Original Message-----
>> From: Cyril Jaquier [mailto:cyr...@bl...]
>> Sent: Thursday, August 17, 2006 3:46 PM
>> To: ru...@ha...
>> Subject: Re: [Fail2ban-users] Error running fail2ban on RedHat 7.2 
>> server
>>
>> Hi,
>>
>>> [root@penguin root]# fail2ban -h
>>> Traceback (innermost last):
>>>   File "/usr/bin/fail2ban", line 29, in ?
>>>     import sys, traceback, logging, locale
>>> ImportError: No module named logging
>> Which version of Python do you have?
>>
>> $ python -V
>> Python 2.4.3
>>
>> You need at least Python 2.3 which has the logging module.
>>
>> Regards,
>>
>> Cyril Jaquier
>>
>>
>>
> 
> 
> 

Re: [Fail2ban-users] Error running fail2ban on RedHat 7.2 server

[Cyril J. <cyr...@bl...>]

Russ Hazzon wrote:
> Just upgraded to 2.4.3.  Still getting the same error message.
> 
> Russ

Could you try this:

# python -V

# python -c "import logging"

Are you sure you correctly removed your previous version before?

Cyril

> -----Original Message-----
> From: Cyril Jaquier [mailto:cyr...@bl...] 
> Sent: Thursday, August 17, 2006 3:46 PM
> To: ru...@ha...
> Subject: Re: [Fail2ban-users] Error running fail2ban on RedHat 7.2 server
> 
> Hi,
> 
>> [root@penguin root]# fail2ban -h
>> Traceback (innermost last):
>>   File "/usr/bin/fail2ban", line 29, in ?
>>     import sys, traceback, logging, locale
>> ImportError: No module named logging
> 
> Which version of Python do you have?
> 
> $ python -V
> Python 2.4.3
> 
> You need at least Python 2.3 which has the logging module.
> 
> Regards,
> 
> Cyril Jaquier
> 
> 
> 

[Fail2ban-users] Error running fail2ban on RedHat 7.2 server

[Russ H. <ru...@ha...>]

I've tried to get fail2ban running but keep receiving the error below.  Any
ideas on how to resolve this issue?
 
 
-------------------------------------error----------------------------------
 
[root@penguin root]# fail2ban -h
Traceback (innermost last):
  File "/usr/bin/fail2ban", line 29, in ?
    import sys, traceback, logging, locale
ImportError: No module named logging

[Fail2ban-users] New version testing

[Cyril J. <cyr...@bl...>]

Hi,

As you probably know, I'm working on an almost complete rewrite of
Fail2ban. The basic features are there but there is still a lot of work.
I wrote a HOWTO about how to test this new version. Please, feel free to
try it.

http://fail2ban.sourceforge.net/wiki/index.php/HOWTO_fail2ban_0.7.x

Here is a RRDTool graph of the ban on my home server.

http://jaquier.dyndns.org/rrdtool/dynrrd.php?rrd=fail2ban&start=1w

As you can see, I have 1-2 brute force attempts per day.

Moreover, if you want to help me with Python programming, documentation
writing, etc, do not hesitate to contact me ;)

Regards,

Cyril Jaquier

Re: [Fail2ban-users] modsecurity

[Andres B. <and...@gm...>]

2006/7/6, Yaroslav Halchenko <li...@on...>:
> ok here is the section which works for me on your file
> just adjust logfile to point to actual file
> also I wasn't sure on how much from a Request line to match. I matched
> just for error codes 403 -- you might want to broaden/narrow it down.

looks like my grep regexp was not exactly fit for python...

I have just shortened it a little, to make it more generic
(modsecurity can return other errors and applies to POST too.

This is the line, derived on yours that I am now using:
failregex = ^Request: (?:\S* |)(?P<host>\S*)\s*

and works perfectly.

I got the first spammer banned a few seconds after installing it...

Thanks for the script - suits perfectly my needs. I'll test it for
some time and I will give my further feedback as soon as I have
something interesting to report.

   Andres

Re: [Fail2ban-users] modsecurity

[Yaroslav H. <li...@on...>]

ok here is the section which works for me on your file
just adjust logfile to point to actual file
also I wasn't sure on how much from a Request line to match. I matched
just for error codes 403 -- you might want to broaden/narrow it down.

Please let us know if that works for you ok - and we would include it in
our releases ;-)

[ApacheModSecurity]
# Option:  enabled
# Notes.:  enable monitoring for this section.
# Values:  [true | false]  Default:  false
#
enabled = true

# Option:  logfile
# Notes.:  logfile to monitor.
# Values:  FILE  Default:  /var/log/apache/access.log
#
logfile = /var/tmp/modsec_audit_sample.log

# Option:  port
# Notes.:  specifies port to monitor
# Values:  [ NUM | STRING ]  Default:
#
port = http

# Option:  maxfailures
# Notes.:  number of failures before IP gets banned.
# Values:  NUM  Default:  5
#
maxfailures = 2

# Option:  timeregex
# Notes.:  regex to match timestamp in Apache access logfile.
# Values:  [19/Feb/2006:08:38:18]
# Default: \d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}
#
timeregex = \d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}

# Option:  timepattern
# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
# Values:  TEXT  Default: %%d/%%b/%%Y:%%H:%%M:%%S
#
timepattern = %%d/%%b/%%Y:%%H:%%M:%%S

# Option:  failregex
# Notes.:  regex to match the password failure messages in the logfile.
# Values:  TEXT  Default:
#
failregex = ^Request: (?:\S* |)(?P<host>\S*)\s*- - \[.*\] "GET .*" 403.*


On Thu, 06 Jul 2006, Andres Baravalle wrote:

> 2006/7/5, Yaroslav Halchenko <li...@on...>:
> > why grep? why don't you try them directly from python (or ipython) --
> > they must be python REs, thus different from what grep eats (besides the
> > most simple ones)
> 
> my python skills are not good enought... I've done some python a long
> time ago...
> 
> that's why I was trying to test the expressions with grep
> 
> > if you want -- send me a few lines attached in a file (thus not wrapped
> > around my the mailer) and I will devise you a failregex
> 
> thanks, that would be great! not sure if the list allows attachments,
> so I have copied the last lines of my log here:
> http://baravalle.it/modsec_audit_sample.log
> 
> Thanks for your email - now everything is more clear on how fail2ban works.
> 
> On the other hand, I've been running fail2ban for all the day
> yesterday and it did't ban any of the addresses that where in my
> /var/log/secure log as failed logins.
> 
> My changes in the default configuration are just:
> maxfailures = 2
> bantime = 180000
> findtime = 1200
> ignoreip = 127.0.0.1 someiphere anotheriphere
> 
> and nothing else... (I wanted some extra protection. Many ips are
> attacking my server for several hours). Up to now I have been using
> sshblack, but it parses only /var/log/secure, while fail2ban seems
> more configurable.
> 
> Is there any suggested approach to check why fail2ban is not banning
> the offending ips? I have seen that the chains in iptables have been
> created correctly.
> 
> Thanks again,
>    Andres
> 
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
> 

-- 
                                  .-.
=------------------------------   /v\  ----------------------------=
Keep in touch                    // \\     (yoh@|www.)onerussian.com
Yaroslav Halchenko              /(   )\               ICQ#: 60653192
                   Linux User    ^^-^^    [175555]

Re: [Fail2ban-users] modsecurity

[Andres B. <and...@gm...>]

2006/7/6, Andres Baravalle <and...@gm...>:
> Is there any suggested approach to check why fail2ban is not banning
> the offending ips? I have seen that the chains in iptables have been
> created correctly.
>
> Thanks again,
>    Andres

actually the SSH part looks as it's now working - I managed to ban
myself (and unban). still not working the modsecurity one.

   Andres

Re: [Fail2ban-users] modsecurity

[Andres B. <and...@gm...>]

2006/7/5, Yaroslav Halchenko <li...@on...>:
> why grep? why don't you try them directly from python (or ipython) --
> they must be python REs, thus different from what grep eats (besides the
> most simple ones)

my python skills are not good enought... I've done some python a long
time ago...

that's why I was trying to test the expressions with grep

> if you want -- send me a few lines attached in a file (thus not wrapped
> around my the mailer) and I will devise you a failregex

thanks, that would be great! not sure if the list allows attachments,
so I have copied the last lines of my log here:
http://baravalle.it/modsec_audit_sample.log

Thanks for your email - now everything is more clear on how fail2ban works.

On the other hand, I've been running fail2ban for all the day
yesterday and it did't ban any of the addresses that where in my
/var/log/secure log as failed logins.

My changes in the default configuration are just:
maxfailures = 2
bantime = 180000
findtime = 1200
ignoreip = 127.0.0.1 someiphere anotheriphere

and nothing else... (I wanted some extra protection. Many ips are
attacking my server for several hours). Up to now I have been using
sshblack, but it parses only /var/log/secure, while fail2ban seems
more configurable.

Is there any suggested approach to check why fail2ban is not banning
the offending ips? I have seen that the chains in iptables have been
created correctly.

Thanks again,
   Andres

Re: [Fail2ban-users] python version?

[Cyril J. <cyr...@bl...>]

Hi,

> I'm using (well, trying to use) version 0.6.1, and I have python 2.3.
> Is that sufficient? I cannot see any startup error messages.

I put 2.4 in README because it is the version I'm using. However, it
should work with 2.3. If you don't get errors about missing packages, it
should work as expected ;)

Regards,

Cyril

Re: [Fail2ban-users] modsecurity

[Yaroslav H. <li...@on...>]

Hi Andres,

> If I try the expression failregex with grep, it correctly identifies
why grep? why don't you try them directly from python (or ipython) --
they must be python REs, thus different from what grep eats (besides the
most simple ones)

as for yours... Here is the failregex which I use to match lines in
apache.log against attempts to hack awstats...

failregex =3D ^(?P<host>\S*) -.*"GET .*(?:awstats\.pl\?configdir=3D|index2\=
=2Ephp\?_REQUEST\[option\].*)\|echo.*

if you want -- send me a few lines attached in a file (thus not wrapped
around my the mailer) and I will devise you a failregex

> -about the port - how is it used? why do I need it?
port is used in interpolations of iptables fwstart:

fwstart =3D iptables -N fail2ban-%(__name__)s
          iptables -A fail2ban-%(__name__)s -j RETURN
          iptables -I %(fwchain)s -p %(protocol)s --dport %(port)s -j fail2=
ban-%(__name__)s

So if you want to match/ban all traffic, remove '--dport %(port)s' part
=66rom fwstart/fwend (can be redefined per section).

> -should failregex include both the offending IP and the time? should I
> use parenthesis or something to identify the ip?
time is searched and matched and there is a separate timeregex and
timepattern for that... it doens't have to be included in failregex

to identify IP in Debian revision of fail2ban -- you should use named
group "host" (like  (?P<host>\S*) in the example above). In mainstream
fail2ban I believe that patch is not propagated yet - so IP is just
searched in the whole log line, which can lead to DoS attack if IP is
seeded in username or URL...

> -are timeregex and timepattern correct?
> timeregex =3D \d{1,2}\/\s{3}\/\d{2,4}:\d{2}:\d{2}:\d{2}
> timepattern =3D %%d/%%b/%%Y:%%H:%%M:%%S
almost ;-) \s vs \S! Just to make sure here is what I have to match against
apache.log:
timeregex =3D \d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}
timepattern =3D %%d/%%b/%%Y:%%H:%%M:%%S

On Wed, 05 Jul 2006, Andres Baravalle wrote:

> Hi,
> I'm trying to setup fail2ban with modsecurity. I have thousands of
> accesses from spammers and script kids, that I can identify with
> modsecurity (at least in part) and that I would like to ban
> automatically.

> This is an example line of a modsecurity log:
> Request: www.baravalle.it 66.230.190.15 - - [29/Jun/2006:12:47:07
> +0200] "GET /plesk-stat/webstat/usage_200605.html HTTP/1.1" 403 238
> "http://ringtone-maker.20best.info/" "libwww-perl/5.805" - "-"

> And this is my (non working) configuration:

> [MODSECURITY]
> enabled =3D true
> port =3D http
> logfile =3D /var/log/httpd/modsec_audit.log
> timeregex =3D \d{1,2}\/\s{3}\/\d{2,4}:\d{2}:\d{2}:\d{2}
> timepattern =3D %%d/%%b/%%Y:%%H:%%M:%%S
> #failregex =3D Request:\ [^\ ]+\
> ([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3})
> failregex =3D Request:\ [^\ ]+\
> ([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3})\
> \-\ \-\ \[.+\]

> If I try the expression failregex with grep, it correctly identifies
> the bad requests lines - eg:
> Request: www.baravalle.it 66.230.190.15 - - [29/Jun/2006:12:47:07 +0200]
> Not sure of how to test timeregex and timepattern - looks like grep
> doesn't like the sysntax.

> I'm not sure:
> -about the port - how is it used? why do I need it?
> -should failregex include both the offending IP and the time? should I
> use parenthesis or something to identify the ip?
> -are timeregex and timepattern correct?

> Can you spot any specific errors?

> Thanks in advance,
>    Andres

> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job ea=
sier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=
=3D121642
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users


--=20
                                  .-.
=3D------------------------------   /v\  ----------------------------=3D
Keep in touch                    // \\     (yoh@|www.)onerussian.com
Yaroslav Halchenko              /(   )\               ICQ#: 60653192
                   Linux User    ^^-^^    [175555]

Re: [Fail2ban-users] python version?

[Yaroslav H. <li...@on...>]

2.3 is good enough

On Wed, 05 Jul 2006, Andres Baravalle wrote:

> Hi,
> I'm going throught the documentation and I have found conflicting
> information on the minimal python version required.

> I'm using (well, trying to use) version 0.6.1, and I have python 2.3.
> Is that sufficient? I cannot see any startup error messages.

>   Andres

> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users


-- 
                                  .-.
=------------------------------   /v\  ----------------------------=
Keep in touch                    // \\     (yoh@|www.)onerussian.com
Yaroslav Halchenko              /(   )\               ICQ#: 60653192
                   Linux User    ^^-^^    [175555]

[Fail2ban-users] python version?

[Andres B. <and...@gm...>]

Hi,
I'm going throught the documentation and I have found conflicting
information on the minimal python version required.

I'm using (well, trying to use) version 0.6.1, and I have python 2.3.
Is that sufficient? I cannot see any startup error messages.

  Andres

[Fail2ban-users] modsecurity

[Andres B. <and...@gm...>]

Hi,
I'm trying to setup fail2ban with modsecurity. I have thousands of
accesses from spammers and script kids, that I can identify with
modsecurity (at least in part) and that I would like to ban
automatically.

This is an example line of a modsecurity log:
Request: www.baravalle.it 66.230.190.15 - - [29/Jun/2006:12:47:07
+0200] "GET /plesk-stat/webstat/usage_200605.html HTTP/1.1" 403 238
"http://ringtone-maker.20best.info/" "libwww-perl/5.805" - "-"

And this is my (non working) configuration:

[MODSECURITY]
enabled = true
port = http
logfile = /var/log/httpd/modsec_audit.log
timeregex = \d{1,2}\/\s{3}\/\d{2,4}:\d{2}:\d{2}:\d{2}
timepattern = %%d/%%b/%%Y:%%H:%%M:%%S
#failregex = Request:\ [^\ ]+\
([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3})
failregex = Request:\ [^\ ]+\
([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3})\
\-\ \-\ \[.+\]

If I try the expression failregex with grep, it correctly identifies
the bad requests lines - eg:
Request: www.baravalle.it 66.230.190.15 - - [29/Jun/2006:12:47:07 +0200]
Not sure of how to test timeregex and timepattern - looks like grep
doesn't like the sysntax.

I'm not sure:
-about the port - how is it used? why do I need it?
-should failregex include both the offending IP and the time? should I
use parenthesis or something to identify the ip?
-are timeregex and timepattern correct?

Can you spot any specific errors?

Thanks in advance,
   Andres

[Fail2ban-users] News...

[Cyril J. <cyr...@bl...>]

Hi,

I'm pleased to give you some news about Fail2ban. First of all, no,
Fail2ban is not dead ;)

* I have moved to Z=FCrich and got my first job there. I only have an
Internet connection since last week.

* The website is now powered by Mediawiki. Do not hesitate to improve it
and thanks to the people who already added some contributions.

* Fail2ban moved from CVS to Subversion. CVS has been disabled. You can
browse the repository online here:

http://svn.sourceforge.net/viewcvs.cgi/fail2ban/

* The new development code has been commited. Lots of things are still
missing but basic features should work. I will publish further
instructions on the website latter. You can get the source with the
following command:

svn co https://svn.sourceforge.net/svnroot/fail2ban/trunk fail2ban

A+

Cyril Jaquier

[Fail2ban-users] (no subject)

[Nils B. (L. Internet) <ni...@le...>]

Hello,

I want to use fail2ban on a FC3 machine running Plesk (http:// 
www.plesk.com/) that already uses the psa-firewall package, which  
sets a bunch of iptables rules that accepts of rejects traffic on  
certain ports. However, when I start and restart the fail2ban service  
(I use the rpm, fail2ban-0.6.1-2jik) I see these messages in /var/log/ 
fail2ban.log:

When I restart the fail2ban service on

2006-06-16 14:49:14,999 WARNING:  is not a valid IP address
2006-06-16 15:51:29,446 WARNING: Restoring firewall rules...
2006-06-16 15:51:29,762 ERROR: Fail2Ban already running with PID 15539

2006-06-16 15:51:29,845 ERROR: 'iptables -D INPUT -p tcp --dport ssh - 
j fail2ban-SSH
iptables -F fail2ban-SSH
iptables -X fail2ban-SSH' returned 256
2006-06-16 15:56:56,986 WARNING:  is not a valid IP address

What's wrong? Does fail2ban interfere with the psa-firewall rules or  
is something wrong with my fail2ban setup? I only changed the mail  
settings in /etc/fail2ban.conf.

Nils Breunese.

Re: [Fail2ban-users] Debian Installation

[Chris W. <ch...@si...>]

Yaroslav Halchenko wrote:
> yeah -- there is something funky happening... didn't get it yet -- it
> seems something with firewall configs although firewall (ipmasq + custom
> iptables rules) restart helped. Also our local IT department constantly
> mangling network at the moment... the problem partially is that web server
> itself runs inside vserver and doesn't have a separate IP address so I
> need to do all DNAT/SNAT forwards - some issues get tricky to
> troubleshoot... I will keep an eye on it

No worries, just wanted to make sure it wasn't me doing something :-)

Chris

-- 
Simplistix - Content Management, Zope & Python Consulting
            - http://www.simplistix.co.uk

Re: [Fail2ban-users] Interaction with Shorewall?

[Chris W. <ch...@si...>]

Yaroslav Halchenko wrote:
> you can use config shipped within fail2ban.conf.shorewall which will use
> shorewall to ban/unban, so everything will be very clean (though it
> seems now that config doesn't instruct for specific ports to be dropped
> :-/) now rules are

So it'll just drop the whole ip? honestly, that's how I'd prefer it to 
work anyway ;-)

> but even if you use iptables directly (default behaviour), I think
> that if you restart shorewall it might wipe out all fail2ban rules.
> fail2ban will reinit its rules as soon as any fwcheck fails, so no
> biggie as fail2ban concern

Yep.

thanks for the info!

cheers,

Chris

-- 
Simplistix - Content Management, Zope & Python Consulting
            - http://www.simplistix.co.uk