From: <los...@us...> - 2006-12-10 21:16:37
|
Revision: 484 http://svn.sourceforge.net/fail2ban/?rev=484&view=rev Author: lostcontrol Date: 2006-12-10 13:16:26 -0800 (Sun, 10 Dec 2006) Log Message: ----------- - Added named group "host" for "failregex" - Fixed vulnerability CVE-2006-6302 Modified Paths: -------------- branches/FAIL2BAN-0_6/CHANGELOG branches/FAIL2BAN-0_6/README branches/FAIL2BAN-0_6/config/fail2ban.conf.hostsdeny branches/FAIL2BAN-0_6/config/fail2ban.conf.iptables branches/FAIL2BAN-0_6/config/fail2ban.conf.shorewall branches/FAIL2BAN-0_6/logreader/logreader.py branches/FAIL2BAN-0_6/version.py Modified: branches/FAIL2BAN-0_6/CHANGELOG =================================================================== --- branches/FAIL2BAN-0_6/CHANGELOG 2006-12-10 16:46:54 UTC (rev 483) +++ branches/FAIL2BAN-0_6/CHANGELOG 2006-12-10 21:16:26 UTC (rev 484) @@ -14,6 +14,8 @@ (Yaroslav Halchenko): * Made locale configurable * Fixed warning if ignoreip is empty +- Added named group "host" for "failregex". Fixed security + vulnerability CVE-2006-6302 ver. 0.6.1 (2006/03/16) - stable ---------- Modified: branches/FAIL2BAN-0_6/README =================================================================== --- branches/FAIL2BAN-0_6/README 2006-12-10 16:46:54 UTC (rev 483) +++ branches/FAIL2BAN-0_6/README 2006-12-10 21:16:26 UTC (rev 484) @@ -4,7 +4,7 @@ |_| \__,_|_|_/___|_.__/\__,_|_||_| ============================================================= -Fail2Ban (version 0.6.1) 2006/03/16 +Fail2Ban (version 0.6.2) 2006/??/?? ============================================================= Fail2Ban scans log files like /var/log/pwdfail and bans IP @@ -58,8 +58,8 @@ To install, just do: -> tar xvfj fail2ban-0.6.1.tar.bz2 -> cd fail2ban-0.6.1 +> tar xvfj fail2ban-0.6.2.tar.bz2 +> cd fail2ban-0.6.2 > python setup.py install This will install Fail2Ban into /usr/lib/fail2ban. The @@ -130,10 +130,10 @@ Thanks: ------- -K\xE9vin Drapel, Marvin Rouge, Sireyessire, Robert Edeker, +Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker, Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko, Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark -Edgington, Patrick B\xF6rjesson, kojiro, zugeschmiert +Edgington, Patrick Börjesson, kojiro, zugeschmiert License: -------- Modified: branches/FAIL2BAN-0_6/config/fail2ban.conf.hostsdeny =================================================================== --- branches/FAIL2BAN-0_6/config/fail2ban.conf.hostsdeny 2006-12-10 16:46:54 UTC (rev 483) +++ branches/FAIL2BAN-0_6/config/fail2ban.conf.hostsdeny 2006-12-10 21:16:26 UTC (rev 484) @@ -257,7 +257,7 @@ # Notes.: regex to match the password failure messages in the logfile. # Values: TEXT Default: authentication failure|user .* not found # -failregex = authentication failure|user .* not found +failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found) [VSFTPD] @@ -297,7 +297,7 @@ # Notes.: regex to match the password failures messages in the logfile. # Values: TEXT Default: Authentication failure|Failed password|Invalid user # -failregex = FAIL LOGIN +failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+) [SSH] @@ -333,4 +333,4 @@ # Notes.: regex to match the password failures messages in the logfile. # Values: TEXT Default: Authentication failure|Failed password|Invalid user # -failregex = Authentication failure|Failed password|Invalid user +failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*) Modified: branches/FAIL2BAN-0_6/config/fail2ban.conf.iptables =================================================================== --- branches/FAIL2BAN-0_6/config/fail2ban.conf.iptables 2006-12-10 16:46:54 UTC (rev 483) +++ branches/FAIL2BAN-0_6/config/fail2ban.conf.iptables 2006-12-10 21:16:26 UTC (rev 484) @@ -285,7 +285,7 @@ # Notes.: regex to match the password failure messages in the logfile. # Values: TEXT Default: authentication failure|user .* not found # -failregex = authentication failure|user .* not found +failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found) [VSFTPD] @@ -325,7 +325,7 @@ # Notes.: regex to match the password failures messages in the logfile. # Values: TEXT Default: Authentication failure|Failed password|Invalid user # -failregex = FAIL LOGIN +failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+) [SSH] @@ -367,4 +367,4 @@ # Notes.: regex to match the password failures messages in the logfile. # Values: TEXT Default: Authentication failure|Failed password|Invalid user # -failregex = Authentication failure|Failed password|Invalid user +failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*) Modified: branches/FAIL2BAN-0_6/config/fail2ban.conf.shorewall =================================================================== --- branches/FAIL2BAN-0_6/config/fail2ban.conf.shorewall 2006-12-10 16:46:54 UTC (rev 483) +++ branches/FAIL2BAN-0_6/config/fail2ban.conf.shorewall 2006-12-10 21:16:26 UTC (rev 484) @@ -251,8 +251,9 @@ # Notes.: regex to match the password failure messages in the logfile. # Values: TEXT Default: authentication failure|user .* not found # -failregex = authentication failure|user .* not found +failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found) + [VSFTPD] # Option: enabled # Notes.: enable monitoring for this section. @@ -284,7 +285,7 @@ # Notes.: regex to match the password failures messages in the logfile. # Values: TEXT Default: Authentication failure|Failed password|Invalid user # -failregex = FAIL LOGIN +failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+) [SSH] @@ -320,4 +321,4 @@ # Notes.: regex to match the password failures messages in the logfile. # Values: TEXT Default: Authentication failure|Failed password|Invalid user # -failregex = Authentication failure|Failed password|Invalid user +failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*) Modified: branches/FAIL2BAN-0_6/logreader/logreader.py =================================================================== --- branches/FAIL2BAN-0_6/logreader/logreader.py 2006-12-10 16:46:54 UTC (rev 483) +++ branches/FAIL2BAN-0_6/logreader/logreader.py 2006-12-10 21:16:26 UTC (rev 484) @@ -177,7 +177,16 @@ timeMatch = re.search(self.timeregex, match.string) if timeMatch: date = self.getUnixTime(timeMatch.group()) - ipMatch = textToIp(match.string) + try: + # Fix for CVE-2006-6302 + matchString = match.group("host") + except IndexError: + # However does not break the current configuration + logSys.warn("No 'host' group defined. This is a security " + + "issue. Please fix your configuration file " + + "and look at CVE-2006-6302") + matchString = match.string + ipMatch = textToIp(matchString) if ipMatch: for ip in ipMatch: failList.append([ip, date]) Modified: branches/FAIL2BAN-0_6/version.py =================================================================== --- branches/FAIL2BAN-0_6/version.py 2006-12-10 16:46:54 UTC (rev 483) +++ branches/FAIL2BAN-0_6/version.py 2006-12-10 21:16:26 UTC (rev 484) @@ -24,4 +24,4 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" -version = "0.6.1-CVS" +version = "0.6.1-SVN" This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |