You can subscribe to this list here.
2005 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
(11) |
Oct
(8) |
Nov
(10) |
Dec
(8) |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2006 |
Jan
(6) |
Feb
(1) |
Mar
(43) |
Apr
(17) |
May
(2) |
Jun
(8) |
Jul
(9) |
Aug
(14) |
Sep
(15) |
Oct
(25) |
Nov
(20) |
Dec
(12) |
2007 |
Jan
(29) |
Feb
(19) |
Mar
(8) |
Apr
(12) |
May
(10) |
Jun
(9) |
Jul
(40) |
Aug
(33) |
Sep
(74) |
Oct
(19) |
Nov
(31) |
Dec
(13) |
2008 |
Jan
(50) |
Feb
(52) |
Mar
(43) |
Apr
(21) |
May
(68) |
Jun
(28) |
Jul
(6) |
Aug
(25) |
Sep
(14) |
Oct
(32) |
Nov
(7) |
Dec
(13) |
2009 |
Jan
(25) |
Feb
(1) |
Mar
(2) |
Apr
(8) |
May
(4) |
Jun
(6) |
Jul
(24) |
Aug
(40) |
Sep
(24) |
Oct
(15) |
Nov
(31) |
Dec
(35) |
2010 |
Jan
(6) |
Feb
(1) |
Mar
(23) |
Apr
(16) |
May
(4) |
Jun
(36) |
Jul
(20) |
Aug
(13) |
Sep
(36) |
Oct
(12) |
Nov
(9) |
Dec
(2) |
2011 |
Jan
(16) |
Feb
(9) |
Mar
(21) |
Apr
(33) |
May
(27) |
Jun
(31) |
Jul
(20) |
Aug
(7) |
Sep
(20) |
Oct
(41) |
Nov
(29) |
Dec
(52) |
2012 |
Jan
(127) |
Feb
(36) |
Mar
(15) |
Apr
(40) |
May
(23) |
Jun
(43) |
Jul
(84) |
Aug
(50) |
Sep
(31) |
Oct
(45) |
Nov
(43) |
Dec
(47) |
2013 |
Jan
(39) |
Feb
(83) |
Mar
(50) |
Apr
(50) |
May
(79) |
Jun
(87) |
Jul
(71) |
Aug
(41) |
Sep
(39) |
Oct
(81) |
Nov
(61) |
Dec
(74) |
2014 |
Jan
(76) |
Feb
(50) |
Mar
(45) |
Apr
(62) |
May
(59) |
Jun
(21) |
Jul
(93) |
Aug
(64) |
Sep
(53) |
Oct
(44) |
Nov
(37) |
Dec
(43) |
2015 |
Jan
(60) |
Feb
(72) |
Mar
(35) |
Apr
(50) |
May
(52) |
Jun
(89) |
Jul
(110) |
Aug
(94) |
Sep
(77) |
Oct
(82) |
Nov
(41) |
Dec
(26) |
2016 |
Jan
(42) |
Feb
(44) |
Mar
(26) |
Apr
(55) |
May
(26) |
Jun
(17) |
Jul
(63) |
Aug
(38) |
Sep
(43) |
Oct
(50) |
Nov
(45) |
Dec
(55) |
2017 |
Jan
(26) |
Feb
(29) |
Mar
(28) |
Apr
(40) |
May
(2) |
Jun
(16) |
Jul
(22) |
Aug
(21) |
Sep
(35) |
Oct
(47) |
Nov
(10) |
Dec
(15) |
2018 |
Jan
(18) |
Feb
(35) |
Mar
(71) |
Apr
(9) |
May
(39) |
Jun
(19) |
Jul
(14) |
Aug
(108) |
Sep
(5) |
Oct
(34) |
Nov
(24) |
Dec
(13) |
2019 |
Jan
(13) |
Feb
(19) |
Mar
(33) |
Apr
(11) |
May
(21) |
Jun
(61) |
Jul
(21) |
Aug
(80) |
Sep
(26) |
Oct
(10) |
Nov
(8) |
Dec
(4) |
2020 |
Jan
(26) |
Feb
(81) |
Mar
(31) |
Apr
(37) |
May
(52) |
Jun
(10) |
Jul
(47) |
Aug
(25) |
Sep
(63) |
Oct
(36) |
Nov
(19) |
Dec
(18) |
2021 |
Jan
(49) |
Feb
(11) |
Mar
(18) |
Apr
(21) |
May
(66) |
Jun
(8) |
Jul
(35) |
Aug
(30) |
Sep
(10) |
Oct
(31) |
Nov
(4) |
Dec
(23) |
2022 |
Jan
(1) |
Feb
(16) |
Mar
(34) |
Apr
(6) |
May
(2) |
Jun
|
Jul
(1) |
Aug
(17) |
Sep
(1) |
Oct
(2) |
Nov
(4) |
Dec
(16) |
2023 |
Jan
(10) |
Feb
(39) |
Mar
(7) |
Apr
(44) |
May
(17) |
Jun
(20) |
Jul
|
Aug
(2) |
Sep
(10) |
Oct
(7) |
Nov
(3) |
Dec
(3) |
2024 |
Jan
(1) |
Feb
(10) |
Mar
(8) |
Apr
(1) |
May
(19) |
Jun
(15) |
Jul
(3) |
Aug
(5) |
Sep
|
Oct
|
Nov
|
Dec
|
From: Mauce <met...@gm...> - 2005-12-23 13:25:20
|
Hi, I'm running fail2ban 0.6.0 on Mandriva Powerpack 2006 and came across the next problem after some testing: when fail2ban is started the iptables-commands configured for 'fwstart' and 'fwend' are not executed. 1) I start fail2ban (the logfiles says it started up properly. but when I check my iptables with (iptables --list) there are no fail2ban chains 2) When I execute the commands as defined in e.g. 'fwstart' manually it works. 3) The same applies for the fwend function. Is there a workaround? I really need this (I need to block IP's in case of attacks on SSH or FTP) I've been searching a lot on the internet for alternatives but I coudn't find a tool that is reliable or has the same functionaly as fail2ban: daemonshield (doesn't work on mandriva, crashes), blockhosts (not what I'm looking for). Can anyone help please. Thanks in advance Mauce |
From: Cyril J. <cyr...@bl...> - 2005-12-18 10:20:21
|
I just forward Fernando answer to the list... Hi Cyril, i don't changed nothing im locale, the unique option in locale changed its the LC_ALL to pt_BR following the advice of one of your e-mails.... but i noted my syslog has a mixed dates, for example: I have restarted my syslog and the locale have setting to pt_BR, and in the messages show this: Dec 17 12:18:33 saturno sshd[7711]: Accepted password for suporte from xxx.xxx.xxx.xxx port 1086 ssh2 Dec 17 12:18:34 saturno sshd(pam_unix)[7713]: session opened for user suporte by (uid=3D500) Dez 17 12:18:38 saturno su(pam_unix)[7727]: session opened for user root by suporte(uid=3D500) Dec 17 12:18:51 saturno exiting on signal 15 Dec 17 12:18:52 saturno syslogd 1.4.1: restart. Dez 17 12:18:52 saturno syslog: syslogd startup succeeded Dec 17 12:18:53 saturno kernel: klogd 1.4.1, log source =3D /proc/kmsg started. Dec 17 12:18:53 saturno kernel: Inspecting /boot/System.map-2.4.21-28872c= l Dez 17 12:18:53 saturno syslog: klogd startup succeeded Dec 17 12:18:53 saturno kernel: Loaded 16687 symbols from /boot/System.map-2.4.21-28872cl. Dec 17 12:18:53 saturno kernel: Symbols match kernel version 2.4.21. Dec 17 12:18:53 saturno kernel: Loaded 711 symbols from 29 modules. Dez 17 12:18:51 saturno syslog: syslogd shutdown succeeded note the dates in pt_BR and in en_US mixed, and the syslog continues mixing dates, i have noted some service display dates in syslog in pt_BR and other services in en_US, ssh shows in en_US, i have changed my locales to en_US and fail2ban has started and ban ip again, its normal again, but have problems if my locales stay in en_US??? I leave my system running with locales in en_US. I waiting your return, regards Fernando Jos=E9 |
From: Cyril J. <cyr...@bl...> - 2005-12-17 13:25:19
|
Hi, If I refer to the first e-mail you send me, I notice that the name of the month changed. Before: data=3DDez 1 08:04:19 fmt=3D%b %d %H:%M:%S After: data=3DDec 11 04:02:00 fmt=3D%b %d %H:%M:%S You now have a "Dec" for December. Did you change something related to locale on your system? With the CVS HEAD version, the locale are set using your system default. So here, Fail2ban probably wait for "Dez" (Dezembro) which should be correct for "pt_BR". Could you try to set the environnement variable LC_ALL to "en_US", "C" and "POSIX"? # LC_ALL=3D"en_US" fail2ban -vv I cc'ed this e-mail to the mailing-list. It is an interesting issue to discuss ;) So please do not forget to reply to the list too. Thank you Cyril Fernando Jos=E9 wrote: > Hi again Cyril, i tested the CVS version of fail2ban, and now fail2ban > its running again.... but... other error has ocurried now, the software > has running ok but its not blocking not at all... in the logs has other > error with the data, the error in fail2ban logs its this: >=20 > 2005-12-17 00:15:25,817 ERROR: Please check the format and your locale > settings. > 2005-12-17 00:15:25,818 ERROR: time data did not match format: data=3D= Dec > 17 00:00:00 fmt=3D%b %d %H:%M:%S > 2005-12-17 00:15:25,819 ERROR: Please check the format and your locale > settings. > 2005-12-17 00:15:49,813 ERROR: time data did not match format: data=3D= Dec > 11 04:02:00 fmt=3D%b %d %H:%M:%S > 2005-12-17 00:15:49,813 ERROR: Please check the format and your locale > settings. > 2005-12-17 00:15:49,814 ERROR: time data did not match format: data=3D= Dec > 17 00:15:48 fmt=3D%b %d %H:%M:%S > 2005-12-17 00:15:49,815 ERROR: Please check the format and your locale > settings. > 2005-12-17 00:15:49,816 ERROR: time data did not match format: data=3D= Dec > 17 00:15:48 fmt=3D%b %d %H:%M:%S > 2005-12-17 00:15:49,816 ERROR: Please check the format and your locale > settings. >=20 > Im using new fail2ban.conf from CVS and i tested too with my original > fail2ban.conf from 0.6.0 version and the error persists, my locale > settings have this: >=20 > LANG=3Dpt_BR > LC_CTYPE=3D"pt_BR" > LC_NUMERIC=3D"pt_BR" > LC_TIME=3D"pt_BR" > LC_COLLATE=3D"pt_BR" > LC_MONETARY=3D"pt_BR" > LC_MESSAGES=3D"pt_BR" > LC_PAPER=3D"pt_BR" > LC_NAME=3D"pt_BR" > LC_ADDRESS=3D"pt_BR" > LC_TELEPHONE=3D"pt_BR" > LC_MEASUREMENT=3D"pt_BR" > LC_IDENTIFICATION=3D"pt_BR" > LC_ALL=3Dpt_BR >=20 > and in my logs have this: >=20 > Dec 16 23:59:59 saturno sshd[30882]: Failed password for myuser from > xxx.xxx.xxx.xxx port 41473 ssh2 > Dec 17 00:00:00 saturno sshd[30882]: Failed password for myuser from > xxx.xxx.xxx.xxx port 41473 ssh2 > Dec 17 00:00:00 saturno sshd(pam_unix)[30882]: 2 more authentication > failures; logname=3D uid=3D0 euid=3D0 tty=3DNODEVssh ruser=3D > rhost=3Dmyhost.mydomain user=3Dmyuser > Dec 17 00:15:48 saturno sshd(pam_unix)[31324]: authentication failure; > logname=3D uid=3D0 euid=3D0 tty=3DNODEVssh ruser=3D rhost=3Dmyhost.mydo= main=20 > user=3Dmyuser > Dec 17 00:15:48 saturno sshd[31324]: Failed password for myuser from > xxx.xxx.xxx.xxx port 43831 ssh2 >=20 > I waiting your return for this message, thanks for your time, and > sorry... i don't have a minimal time to send my logs (messages arquive) > for you, but now its here :) >=20 > PS: in the again i've retired my ips and my users >=20 > Fernando Jos=E9 - Linux User 357026 >=20 >=20 >=20 |
From: Cyril J. <cyr...@bl...> - 2005-12-17 00:13:07
|
Hi, I am really sorry but I am quite busy these days :( We have not started to work on the new development branch yet (and probably not before next year). However, I fixed some bugs in 0.6.0 and added a new feature. These modifications are available in the CVS HEAD. ChangeLog: - Added permanent banning. Set banTime to a negative value to enable this feature (-1 is perfect). Thanks to Mannone - Fixed locale bug. Thanks to Fernando Jos=E9 - Fixed crash when time format does not match data Regards, Cyril Jaquier |
From: Cyril J. <cyr...@bl...> - 2005-12-16 23:59:49
|
Hi, > After deploying fail2ban on a set of servers I would like to > suggest adding the keyword <hostname> to the subject option: This will be added in the next development branch. Thank you. Regards, Cyril Jaquier |
From: Iain L. <ia...@br...> - 2005-11-30 10:07:52
|
After deploying fail2ban on a set of servers I would like to suggest adding the keyword <hostname> to the subject option: # Option: subject # Notes.: subject of the e-mail. # Tags: <section> active section (eg ssh, apache, etc) # <hostanme> hostname running fail2ban # <ip> IP address # <failures> number of failures # <failtime> unix timestamp of the last failure # Values: TEXT Default: [Fail2Ban] <section>: Banned <ip> # subject = [Fail2Ban] <hostname> <section>: Banned <ip> Would save a lot of time as I had to hardcode each hostname in the current version ie. subject = [Fail2Ban] server16.fqdn.com <section>: Banned <ip> Regards Iain -- +49-172-8196039 Skype: iain.lea |
From: Iain L. <ia...@br...> - 2005-11-30 09:12:57
|
On Tue, Nov 29, 2005 at 10:01:07PM +0100, Cyril Jaquier wrote: > > I want to know what people think about XML for configuration files. This > could be added in the next development branch. > > Personally, I do not really like XML for configuration files. I prefer > the old text based solution which I find more "human readable". > > What is your opinion? Stay with the current format. Its readable enough and does the job. Regards Iain |
From: Andrew S. <an...@sw...> - 2005-11-29 21:13:52
|
On Tue, 29 Nov 2005, Cyril Jaquier wrote: > I want to know what people think about XML for configuration files. This > could be added in the next development branch. No, thanks. There really is no need for an extensible dictionary in this case. The config files are never shared outside of fail2ban, thus no other entity needs to grok the config files. > Personally, I do not really like XML for configuration files. I prefer > the old text based solution which I find more "human readable". I prefer the "old" text files too. -- Andrew B. Sweger -- The great thing about multitasking is that several things can go wrong at once. |
From: Cyril J. <cyr...@bl...> - 2005-11-29 21:01:28
|
Hi, I want to know what people think about XML for configuration files. This could be added in the next development branch. Personally, I do not really like XML for configuration files. I prefer the old text based solution which I find more "human readable". What is your opinion? Thanks ;) Cyril |
From: Cyril J. <cyr...@bl...> - 2005-11-29 20:56:56
|
> I'm working with an old codebase (well, working doesn't really > describe my lack of progress for the past few weeks) to add obscene > amounts of logging (optionally), and to segregate logging so it can be > set differently in each section of the configuration file. Nice :) > It sounds like you may be moving the entire codebase to a more > segmented configuration in general. Is there somewhere I should look > to try to make the patches I eventually plan to submit work nicely? I will create a CVS branch named FAIL2BAN-0_7 for development. So just checkout this branch and adapt your patches. Moreover, I will post information about big changes in the code on this mailing-list. I will send an email on fail2ban-users mailing-list when FAIL2BAN-0_7 will be created. Cyril |
From: Peter C. N. <sp...@le...> - 2005-11-29 20:40:48
|
Cyril, I'm working with an old codebase (well, working doesn't really describe my lack of progress for the past few weeks) to add obscene amounts of logging (optionally), and to segregate logging so it can be set differently in each section of the configuration file. It sounds like you may be moving the entire codebase to a more segmented configuration in general. Is there somewhere I should look to try to make the patches I eventually plan to submit work nicely? Thanks, -Peter On Tue, Nov 29, 2005 at 09:34:19PM +0100, Cyril Jaquier wrote: > Hi, > > A new development branch should appear soon. I'm quite busy these days > with my diploma so please be patient ;) > > We will add "split configuration file" support. We want to have a better > separation of fail2ban.conf which starts to become too big at my > opinion. Here is an example: > > /etc/fail2ban/: > fail2ban.conf > mail.conf > whitelist.conf > /etc/fail2ban/scripts.d/: > iptables-chains.conf > iptables-without-chains.conf > watchguard.conf > host-deny.conf > /etc/fail2ban/logreader.d/: > apache.conf > apache-debian.conf > sshd.conf > squid.conf > > Notice the "host-deny.conf" file which could use "/etc/host.deny" to ban > IP addresses (mmhhh... I saw this somewhere...). We could add a > "apache-attack.conf" in "logreader.d" with the corresponding regexp. > > Maybe we could add: > > /etc/fail2ban/regexp.d/: > apache-log.conf > std-log.conf > apache-auth.conf > sshd-log.conf > apache-attack.conf > > These files would contain regular expression for: > > 1/ log time and date > 2/ failure or attack pattern > > Here is a possible example for "/etc/fail2ban/logreader.d/apache.conf": > > ------ > [Apache] > timeregexp = apache-log > failregexp = apache-auth apache-attack > ban = iptables-chain host-deny > ------ > > However, it is already possible to block these attacks against Apache. > Simply set : > > failregex = ^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* - - \[.\*] "CONNECT|.* - - > .* "GET /_vti_bin/|GET /MSOffice|/sumthin HTTP > > in your Apache section. > > Regards, > > Cyril > > Iain Lea wrote: > > After using fail2ban for a while on external servers I have a > > feature suggestion that I think would make fail2ban a killer > > security tool :-) > > > > One should add a new parse type to fail2ban to be able to block webattacks. > > I get the following attacks all the time in my webserver logs: > > > > 220.137.93.28 - - [24/Nov/2005:00:18:18 +0100] "CONNECT smtp.rol.ru:25 > > 212.204.78.162 - - [27/Nov/2005:16:48:04 +0100] "GET > > /_vti_bin/owssvr.dll?UL=1&ACT=4&BUILD=6254&STRMVER=4&CAPREQ=0 HTTP/1.1" 404 > > 212.204.78.162 - - [27/Nov/2005:16:48:04 +0100] "GET > > /MSOffice/cltreq.asp?UL=1&ACT=4&BUILD=6254&STRMVER=4&CAPREQ=0 HTTP/1.1" 404 > > 218.89.167.126 - - [28/Nov/2005:11:20:12 +0100] "GET /sumthin HTTP/1.0" > > > > What I envision is a new [ATTACK] keyword/section in the config file: > > > > [ATTACK] > > # Option: enabled > > # Notes.: enable monitoring for this section. > > # Values: [true | false] Default: false > > # > > enabled = true > > > > # Option: logfile > > # Notes.: logfile to monitor. > > # Values: FILE Default: /var/log/httpd/access_log > > # > > logfile = /var/log/httpd/access_log > > > > # Option: attackfile > > # Notes.: file containing attacks to block > > # Values: FILE Default: /etc/fail2ban.dat > > # > > attackfile = /etc/fail2ban.dat > > > > (rest of config to enable blocking/unblocking etc.) > > > > > > The attack matching and blocking file would based on the above logfile > > entries could be: > > > > ^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* - - \[.\*] "CONNECT > > .* - - .* "GET /_vti_bin/ > > GET /MSOffice > > /sumthin HTTP > > > > > > With the external file read in and parse ability fail2ban would be > > a very powerful tool and could be used to block numerous types of > > bad activity. > > > > Regards > > > > Iain > > > > > ------------------------------------------------------- > This SF.net email is sponsored by: Splunk Inc. Do you grep through log files > for problems? Stop! Download the new AJAX search engine that makes > searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! > http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users -- The 5 year plan: In five years we'll make up another plan. Or just re-use this one. |
From: Cyril J. <cyr...@bl...> - 2005-11-29 20:34:45
|
Hi, A new development branch should appear soon. I'm quite busy these days with my diploma so please be patient ;) We will add "split configuration file" support. We want to have a better separation of fail2ban.conf which starts to become too big at my opinion. Here is an example: /etc/fail2ban/: fail2ban.conf mail.conf whitelist.conf /etc/fail2ban/scripts.d/: iptables-chains.conf iptables-without-chains.conf watchguard.conf host-deny.conf /etc/fail2ban/logreader.d/: apache.conf apache-debian.conf sshd.conf squid.conf Notice the "host-deny.conf" file which could use "/etc/host.deny" to ban IP addresses (mmhhh... I saw this somewhere...). We could add a "apache-attack.conf" in "logreader.d" with the corresponding regexp. Maybe we could add: /etc/fail2ban/regexp.d/: apache-log.conf std-log.conf apache-auth.conf sshd-log.conf apache-attack.conf These files would contain regular expression for: 1/ log time and date 2/ failure or attack pattern Here is a possible example for "/etc/fail2ban/logreader.d/apache.conf": ------ [Apache] timeregexp = apache-log failregexp = apache-auth apache-attack ban = iptables-chain host-deny ------ However, it is already possible to block these attacks against Apache. Simply set : failregex = ^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* - - \[.\*] "CONNECT|.* - - .* "GET /_vti_bin/|GET /MSOffice|/sumthin HTTP in your Apache section. Regards, Cyril Iain Lea wrote: > After using fail2ban for a while on external servers I have a > feature suggestion that I think would make fail2ban a killer > security tool :-) > > One should add a new parse type to fail2ban to be able to block webattacks. > I get the following attacks all the time in my webserver logs: > > 220.137.93.28 - - [24/Nov/2005:00:18:18 +0100] "CONNECT smtp.rol.ru:25 > 212.204.78.162 - - [27/Nov/2005:16:48:04 +0100] "GET > /_vti_bin/owssvr.dll?UL=1&ACT=4&BUILD=6254&STRMVER=4&CAPREQ=0 HTTP/1.1" 404 > 212.204.78.162 - - [27/Nov/2005:16:48:04 +0100] "GET > /MSOffice/cltreq.asp?UL=1&ACT=4&BUILD=6254&STRMVER=4&CAPREQ=0 HTTP/1.1" 404 > 218.89.167.126 - - [28/Nov/2005:11:20:12 +0100] "GET /sumthin HTTP/1.0" > > What I envision is a new [ATTACK] keyword/section in the config file: > > [ATTACK] > # Option: enabled > # Notes.: enable monitoring for this section. > # Values: [true | false] Default: false > # > enabled = true > > # Option: logfile > # Notes.: logfile to monitor. > # Values: FILE Default: /var/log/httpd/access_log > # > logfile = /var/log/httpd/access_log > > # Option: attackfile > # Notes.: file containing attacks to block > # Values: FILE Default: /etc/fail2ban.dat > # > attackfile = /etc/fail2ban.dat > > (rest of config to enable blocking/unblocking etc.) > > > The attack matching and blocking file would based on the above logfile > entries could be: > > ^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* - - \[.\*] "CONNECT > .* - - .* "GET /_vti_bin/ > GET /MSOffice > /sumthin HTTP > > > With the external file read in and parse ability fail2ban would be > a very powerful tool and could be used to block numerous types of > bad activity. > > Regards > > Iain > |
From: Iain L. <ia...@br...> - 2005-11-29 09:56:12
|
After using fail2ban for a while on external servers I have a feature suggestion that I think would make fail2ban a killer security tool :-) One should add a new parse type to fail2ban to be able to block webattacks. I get the following attacks all the time in my webserver logs: 220.137.93.28 - - [24/Nov/2005:00:18:18 +0100] "CONNECT smtp.rol.ru:25 212.204.78.162 - - [27/Nov/2005:16:48:04 +0100] "GET /_vti_bin/owssvr.dll?UL=1&ACT=4&BUILD=6254&STRMVER=4&CAPREQ=0 HTTP/1.1" 404 212.204.78.162 - - [27/Nov/2005:16:48:04 +0100] "GET /MSOffice/cltreq.asp?UL=1&ACT=4&BUILD=6254&STRMVER=4&CAPREQ=0 HTTP/1.1" 404 218.89.167.126 - - [28/Nov/2005:11:20:12 +0100] "GET /sumthin HTTP/1.0" What I envision is a new [ATTACK] keyword/section in the config file: [ATTACK] # Option: enabled # Notes.: enable monitoring for this section. # Values: [true | false] Default: false # enabled = true # Option: logfile # Notes.: logfile to monitor. # Values: FILE Default: /var/log/httpd/access_log # logfile = /var/log/httpd/access_log # Option: attackfile # Notes.: file containing attacks to block # Values: FILE Default: /etc/fail2ban.dat # attackfile = /etc/fail2ban.dat (rest of config to enable blocking/unblocking etc.) The attack matching and blocking file would based on the above logfile entries could be: ^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* - - \[.\*] "CONNECT .* - - .* "GET /_vti_bin/ GET /MSOffice /sumthin HTTP With the external file read in and parse ability fail2ban would be a very powerful tool and could be used to block numerous types of bad activity. Regards Iain -- +49-172-8196039 Skype: iain.lea |
From: Yaroslav H. <li...@on...> - 2005-11-22 02:30:12
|
Hi Andrew, Indeed description could be more descriptive... Bad me (I believe I was the source of all this reinit business). I will add clarification into README.Debian and Cyril is welcome to adjust the description in config file and/or README. The purpose of "reinit" is to deal with external (not introduced by fail2ban) modifications of the firewall rules. Possible test case: while running fail2ban you reinitialize your iptables rules (/etc/init.d/firehol restart or smth like that), In that case all modifications in firewall tables introduced by fail2ban might get lost and that is why commands like fwban, fwunban or fwcheck might fail. To fix the situation reinitialization of fail2ban part of firewall rules (eg fwstart, etc) is necessary. If reinitializations follow to closely in time (more often that once reinittime) or there have been more than maxreinits of them, fail2ban will quit since the situation has gone out of its control -- some other external means (self-defensive firewall, drunk sysadmin, stuck "up-enter" key, bad weather) forbids fail2ban from executing normally. This "reinit" business serves as a fix for a few filed bugs against fail2ban. So if you think that the causes I have just described are not common to the users, you are wrong ;-) I hope this email clarifies your confusion and gives a novel meaning to the description in the config file. You are more than welcome to provide your version of the description and it might be accepted at least to the Debian fail2ban package ;-) Cheers -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Andrew S. <an...@co...> - 2005-11-22 01:49:25
|
I'm confused by the descriptions of reinnittime and maxreinits: # Option: reinittime # Notes.: minimal number of seconds between the re-initialization of # firewalls due to external changes in their rules (see fwcheck) # Values: NUM Default: 100 # reinittime = 10 # Option: maxreinits # Notes.: maximal number of re-initialization of firewalls due to external # changes. -1 stays for infinite, so only reinittime is of importance # Values: NUM Default: -1 # maxreinits = -1 What does "re-initialization" refer to? Is this something that fail2ban does? Different from just adding a firewall rule? When does fail2ban do it? What does "due to external changes" mean? Does this refer to password-related entries appearing in a log file? Or something else? About the only way I can make sense of these two options is: reinittime = minimum time between times when fail2ban will add a firewall rule. maxreinits = maximum number of times that fail2ban will add a firewall rule. If these aren't right, then I really don't know what these options do. Can somone clarify? Thanks, Andrew. |
From: Yaroslav H. <li...@on...> - 2005-10-17 14:49:28
|
cool.... We worked out a solution for this problem. Cyril will release it in 0.6 I believe and in debian it is already available in 0.5.4-5.14 release (was uploaded this morning). So just wait or If you install it from sources, then you can just grab them (with a patch) from: http://itanix.rutgers.edu/rumba/dists/unstable/perspect/source/net/ there is .orig which is upstream (Cyril) latest release and .diff is my debian "patch", which I believe should work on most linuxes as well although no guarantee :-) On Mon, Oct 17, 2005 at 09:20:00AM +0200, Constantin Bronowski wrote: > It was exactly that! I was messing around with shorewall (script to > configure iptables) and restartet netfilter a few times, but couldn't > figure out that the fail2ban chain was deleted by that action. > Just started fail2ban again after the firewall restarts and it works > perfectly. > Thanks! -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Constantin B. <con...@fr...> - 2005-10-17 07:20:07
|
It was exactly that! I was messing around with shorewall (script to configure iptables) and restartet netfilter a few times, but couldn't figure out that the fail2ban chain was deleted by that action. Just started fail2ban again after the firewall restarts and it works perfectly. Thanks! |
From: Yaroslav H. <li...@on...> - 2005-10-11 15:47:56
|
Check if your chain fail2ban-ssh exists whenever this error occur (iptables -L). May be you've restarted firewall or just cleared out iptables, then chain will not exist thus commands will fail. -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Constantin B. <con...@fr...> - 2005-10-11 13:48:21
|
Hi, fail2ban in Version 0.5.4 gives me sometimes an iptables error message when trying to ban a host. After that fail2ban doesn't catch the error and assumes the IP is already blocked. <snip> 2005-10-10 14:32:07,352 INFO: Fail2Ban v0.5.4 is running 2005-10-10 14:32:07,353 INFO: Enabled sections: ['SSH'] 2005-10-10 14:32:37,553 INFO: SSH: 195.4.xx.xxx has 3 login failure(s). Banned. 2005-10-10 14:32:37,553 WARNING: Ban 195.4.xx.xxx 2005-10-10 14:57:38,449 WARNING: Unban 195.4.xx.xxx 2005-10-11 15:29:56,043 INFO: SSH: 62.104.xxx.xx has 3 login failure(s). Banned. 2005-10-11 15:29:56,043 WARNING: Ban 62.104.xxx.xx 2005-10-11 15:29:56,052 ERROR: 'iptables -I fail2ban-ssh 1 -s '62.104.xxx.xx' -j DROP' returned 256 2005-10-11 15:29:58,054 INFO: SSH: 62.104.xxx.xx has 3 login failure(s). Banned. 2005-10-11 15:29:58,054 ERROR: 62.104.xxx.xx already in ban list </snip> I've seen this error on two different machines, is it due to my iptables version/config? iptables v1.2.11 is being used. My config file can be seen here: http://pastebin.com/390069 Any help is very much appreciated :) Thanks in advance, Constantin |
From: Yaroslav H. <li...@on...> - 2005-10-06 21:05:44
|
On Thu, Oct 06, 2005 at 01:20:24PM -0700, Andrew Sweger wrote: > Thanks for the info. Ugh. What I wouldn't give to have all this on a > Debian system (I'm forced to use RHES2.1). Dependency hell. Well... in that case, if something went wrong you would bother me anyway -- I'm packaging fail2ban for Debian :-) > AttributeError: __impl instance has no attribute 'path' Was that a full content in which that occurred? I mean could you provide full output and also run fail2ban with debug option? if you upgrade to 0.5.4 (install from source?) then you would have an exception handler around so it might not crash that badly. Could you try? > Not sure if I have a screwed up python install now or not. I don't think so -- that seems to be just fail2ban problem: path is not initialized if conf is not yet read. Thus python crashes... we will fix it together. but I want to know why it fell before that -- I need more of information :-) > Really, really wish this was a Debian box. Sweet Debian. *ahhhkglg* You are 101% right - Debian rulez! :) -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Andrew S. <an...@sw...> - 2005-10-06 20:20:43
|
Thanks for the info. Ugh. What I wouldn't give to have all this on a Debian system (I'm forced to use RHES2.1). Dependency hell. I can't build python-2.3 because autoconf is too old (and there's too many dependency problems with 2.3 RPMs). I found a python-2.2 package on rpmfind.net that would let me build the red_dove logging kit. Now when I try to start fail2ban, I get the following error: Starting fail2ban: Traceback (most recent call last): File "/usr/bin/fail2ban", line 59, in ? pidLock.remove() File "/usr/lib/fail2ban/utils/pidlock.py", line 63, in remove os.remove(self.path) AttributeError: __impl instance has no attribute 'path' Not sure if I have a screwed up python install now or not. Really, really wish this was a Debian box. Sweet Debian. *ahhhkglg* On Thu, 6 Oct 2005, Yaroslav Halchenko wrote: > logging module was introduced to standard python distribution since > python2.3 > I'm not familiar with RH systems, but do you have python2.3 by any > chance in the distribution? > or may be there is rpm such as python-logging? > > Otherwise you might try to get it from > http://www.red-dove.com/python_logging.html#download > and install manually -- Andrew B. Sweger -- The great thing about multitasking is that several things can go wrong at once. |
From: Yaroslav H. <li...@on...> - 2005-10-06 18:49:37
|
Hi Andrew, logging module was introduced to standard python distribution since python2.3 I'm not familiar with RH systems, but do you have python2.3 by any chance in the distribution? or may be there is rpm such as python-logging? Otherwise you might try to get it from http://www.red-dove.com/python_logging.html#download and install manually Hope that helps -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Andrew S. <an...@sw...> - 2005-10-06 18:00:13
|
I have successfully installed fail2ban from the latest RPM available (0.5.2) onto Red Hat Enterprise Linux ES release 2.1 (Panama). I get the following error when attempting to start it with: # /etc/init.d/fail2ban start Starting fail2ban: Traceback (innermost last): File "/usr/bin/fail2ban", line 29, in ? import sys, traceback, logging ImportError: No module named logging I'm not much of a python person. Could there be some critical python package I'm missing? The installation did not complain about any missing dependencies. I have the following python-ish packages installed: # rpm -qa | grep -i python python-xmlrpc-1.5.1-7.x.3 python-devel-2.2.1-17 python-popt-0.8.8-7.x.2 rpm-python-4.0.4-7x.20 mod_python-2.7.8-3.1 python-1.5.2-43.72 python-devel-1.5.2-43.72 I also tried building the package from the SRPMS, but that was just a world of hurt (must be missing even more python build things). -- Andrew B. Sweger -- The great thing about multitasking is that several things can go wrong at once. |
From: Yaroslav H. <li...@on...> - 2005-09-28 16:50:15
|
OK Peter, Could you provide more details? version, relevant config file and a test log file? Lets make it work now :-) Yarik On Wed, Sep 28, 2005 at 09:40:32AM -0700, Peter C. Norton wrote: > I've gotten fail2ban to recognize it, but I think there are some > issues with the debian package actually banning correctly. It doesn't > seem as though the correct commands get run at startup to enable the > rules, and if i manually add the chains I need, I see that the chains > are created. However, using the fail2ban startup script and setting > fwstart for each set of rules results in no chains being created. > I think in general that the scanning part is working, but startup and > shutdown seem to be hurting. > Thanks, > -Peter -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Peter C. N. <spa...@le...> - 2005-09-28 16:40:47
|
I've gotten fail2ban to recognize it, but I think there are some issues with the debian package actually banning correctly. It doesn't seem as though the correct commands get run at startup to enable the rules, and if i manually add the chains I need, I see that the chains are created. However, using the fail2ban startup script and setting fwstart for each set of rules results in no chains being created. I think in general that the scanning part is working, but startup and shutdown seem to be hurting. Thanks, -Peter On Wed, Sep 28, 2005 at 12:58:09AM -0400, Yaroslav Halchenko wrote: > Hi Peter, > > I just subscribed to this list and because you didn't report the "bug" to > the Debian BTS, I didn't see your report before. > > And it is not a bug really, but more of a wish because it just doesn't > work for your introduced section. > > As the answer: did you try > failregex = 550 User unknown > instead of your > failregex = 550 User Unknown > ? > :-))) > > In the other words: check all your regexps manually in python on a > target string. This way you make sure that whatever "bug" is really a > bug :-) > > P.S. If it works -- could you please wrap your config for courier > consistently with the rest of the config (not that I like duplicating > comment lines, but just to be consistent) and submit it to the list or > to debian BTS. Then me (or Cyril) will include it in some upcoming > release :-) Thank you in advance > > cheers > > -- > .-. > =------------------------------ /v\ ----------------------------= > Keep in touch // \\ (yoh@|www.)onerussian.com > Yaroslav Halchenko /( )\ ICQ#: 60653192 > Linux User ^^-^^ [175555] > > -- The 5 year plan: In five years we'll make up another plan. Or just re-use this one. |