From: Cyril J. <cyr...@bl...> - 2005-11-29 20:34:45
|
Hi, A new development branch should appear soon. I'm quite busy these days with my diploma so please be patient ;) We will add "split configuration file" support. We want to have a better separation of fail2ban.conf which starts to become too big at my opinion. Here is an example: /etc/fail2ban/: fail2ban.conf mail.conf whitelist.conf /etc/fail2ban/scripts.d/: iptables-chains.conf iptables-without-chains.conf watchguard.conf host-deny.conf /etc/fail2ban/logreader.d/: apache.conf apache-debian.conf sshd.conf squid.conf Notice the "host-deny.conf" file which could use "/etc/host.deny" to ban IP addresses (mmhhh... I saw this somewhere...). We could add a "apache-attack.conf" in "logreader.d" with the corresponding regexp. Maybe we could add: /etc/fail2ban/regexp.d/: apache-log.conf std-log.conf apache-auth.conf sshd-log.conf apache-attack.conf These files would contain regular expression for: 1/ log time and date 2/ failure or attack pattern Here is a possible example for "/etc/fail2ban/logreader.d/apache.conf": ------ [Apache] timeregexp = apache-log failregexp = apache-auth apache-attack ban = iptables-chain host-deny ------ However, it is already possible to block these attacks against Apache. Simply set : failregex = ^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* - - \[.\*] "CONNECT|.* - - .* "GET /_vti_bin/|GET /MSOffice|/sumthin HTTP in your Apache section. Regards, Cyril Iain Lea wrote: > After using fail2ban for a while on external servers I have a > feature suggestion that I think would make fail2ban a killer > security tool :-) > > One should add a new parse type to fail2ban to be able to block webattacks. > I get the following attacks all the time in my webserver logs: > > 220.137.93.28 - - [24/Nov/2005:00:18:18 +0100] "CONNECT smtp.rol.ru:25 > 212.204.78.162 - - [27/Nov/2005:16:48:04 +0100] "GET > /_vti_bin/owssvr.dll?UL=1&ACT=4&BUILD=6254&STRMVER=4&CAPREQ=0 HTTP/1.1" 404 > 212.204.78.162 - - [27/Nov/2005:16:48:04 +0100] "GET > /MSOffice/cltreq.asp?UL=1&ACT=4&BUILD=6254&STRMVER=4&CAPREQ=0 HTTP/1.1" 404 > 218.89.167.126 - - [28/Nov/2005:11:20:12 +0100] "GET /sumthin HTTP/1.0" > > What I envision is a new [ATTACK] keyword/section in the config file: > > [ATTACK] > # Option: enabled > # Notes.: enable monitoring for this section. > # Values: [true | false] Default: false > # > enabled = true > > # Option: logfile > # Notes.: logfile to monitor. > # Values: FILE Default: /var/log/httpd/access_log > # > logfile = /var/log/httpd/access_log > > # Option: attackfile > # Notes.: file containing attacks to block > # Values: FILE Default: /etc/fail2ban.dat > # > attackfile = /etc/fail2ban.dat > > (rest of config to enable blocking/unblocking etc.) > > > The attack matching and blocking file would based on the above logfile > entries could be: > > ^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* - - \[.\*] "CONNECT > .* - - .* "GET /_vti_bin/ > GET /MSOffice > /sumthin HTTP > > > With the external file read in and parse ability fail2ban would be > a very powerful tool and could be used to block numerous types of > bad activity. > > Regards > > Iain > |