Menu
▾
▴
[Fail2ban-commit] SF.net SVN: fail2ban: [484] branches/FAIL2BAN-0_6
|
From: <los...@us...> - 2006-12-10 21:16:37
|
Revision: 484
http://svn.sourceforge.net/fail2ban/?rev=484&view=rev
Author: lostcontrol
Date: 2006-12-10 13:16:26 -0800 (Sun, 10 Dec 2006)
Log Message:
-----------
- Added named group "host" for "failregex"
- Fixed vulnerability CVE-2006-6302
Modified Paths:
--------------
branches/FAIL2BAN-0_6/CHANGELOG
branches/FAIL2BAN-0_6/README
branches/FAIL2BAN-0_6/config/fail2ban.conf.hostsdeny
branches/FAIL2BAN-0_6/config/fail2ban.conf.iptables
branches/FAIL2BAN-0_6/config/fail2ban.conf.shorewall
branches/FAIL2BAN-0_6/logreader/logreader.py
branches/FAIL2BAN-0_6/version.py
Modified: branches/FAIL2BAN-0_6/CHANGELOG
===================================================================
--- branches/FAIL2BAN-0_6/CHANGELOG 2006-12-10 16:46:54 UTC (rev 483)
+++ branches/FAIL2BAN-0_6/CHANGELOG 2006-12-10 21:16:26 UTC (rev 484)
@@ -14,6 +14,8 @@
(Yaroslav Halchenko):
* Made locale configurable
* Fixed warning if ignoreip is empty
+- Added named group "host" for "failregex". Fixed security
+ vulnerability CVE-2006-6302
ver. 0.6.1 (2006/03/16) - stable
----------
Modified: branches/FAIL2BAN-0_6/README
===================================================================
--- branches/FAIL2BAN-0_6/README 2006-12-10 16:46:54 UTC (rev 483)
+++ branches/FAIL2BAN-0_6/README 2006-12-10 21:16:26 UTC (rev 484)
@@ -4,7 +4,7 @@
|_| \__,_|_|_/___|_.__/\__,_|_||_|
=============================================================
-Fail2Ban (version 0.6.1) 2006/03/16
+Fail2Ban (version 0.6.2) 2006/??/??
=============================================================
Fail2Ban scans log files like /var/log/pwdfail and bans IP
@@ -58,8 +58,8 @@
To install, just do:
-> tar xvfj fail2ban-0.6.1.tar.bz2
-> cd fail2ban-0.6.1
+> tar xvfj fail2ban-0.6.2.tar.bz2
+> cd fail2ban-0.6.2
> python setup.py install
This will install Fail2Ban into /usr/lib/fail2ban. The
@@ -130,10 +130,10 @@
Thanks:
-------
-K\xE9vin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
+Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker,
Tom Pike, Iain Lea, Andrey G. Grozin, Yaroslav Halchenko,
Jonathan Kamens, Stephen Gildea, Markus Hoffmann, Mark
-Edgington, Patrick B\xF6rjesson, kojiro, zugeschmiert
+Edgington, Patrick Börjesson, kojiro, zugeschmiert
License:
--------
Modified: branches/FAIL2BAN-0_6/config/fail2ban.conf.hostsdeny
===================================================================
--- branches/FAIL2BAN-0_6/config/fail2ban.conf.hostsdeny 2006-12-10 16:46:54 UTC (rev 483)
+++ branches/FAIL2BAN-0_6/config/fail2ban.conf.hostsdeny 2006-12-10 21:16:26 UTC (rev 484)
@@ -257,7 +257,7 @@
# Notes.: regex to match the password failure messages in the logfile.
# Values: TEXT Default: authentication failure|user .* not found
#
-failregex = authentication failure|user .* not found
+failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
[VSFTPD]
@@ -297,7 +297,7 @@
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
#
-failregex = FAIL LOGIN
+failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+)
[SSH]
@@ -333,4 +333,4 @@
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
#
-failregex = Authentication failure|Failed password|Invalid user
+failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
Modified: branches/FAIL2BAN-0_6/config/fail2ban.conf.iptables
===================================================================
--- branches/FAIL2BAN-0_6/config/fail2ban.conf.iptables 2006-12-10 16:46:54 UTC (rev 483)
+++ branches/FAIL2BAN-0_6/config/fail2ban.conf.iptables 2006-12-10 21:16:26 UTC (rev 484)
@@ -285,7 +285,7 @@
# Notes.: regex to match the password failure messages in the logfile.
# Values: TEXT Default: authentication failure|user .* not found
#
-failregex = authentication failure|user .* not found
+failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
[VSFTPD]
@@ -325,7 +325,7 @@
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
#
-failregex = FAIL LOGIN
+failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+)
[SSH]
@@ -367,4 +367,4 @@
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
#
-failregex = Authentication failure|Failed password|Invalid user
+failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
Modified: branches/FAIL2BAN-0_6/config/fail2ban.conf.shorewall
===================================================================
--- branches/FAIL2BAN-0_6/config/fail2ban.conf.shorewall 2006-12-10 16:46:54 UTC (rev 483)
+++ branches/FAIL2BAN-0_6/config/fail2ban.conf.shorewall 2006-12-10 21:16:26 UTC (rev 484)
@@ -251,8 +251,9 @@
# Notes.: regex to match the password failure messages in the logfile.
# Values: TEXT Default: authentication failure|user .* not found
#
-failregex = authentication failure|user .* not found
+failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
+
[VSFTPD]
# Option: enabled
# Notes.: enable monitoring for this section.
@@ -284,7 +285,7 @@
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
#
-failregex = FAIL LOGIN
+failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=(?P<host>\S+)
[SSH]
@@ -320,4 +321,4 @@
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid user
#
-failregex = Authentication failure|Failed password|Invalid user
+failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
Modified: branches/FAIL2BAN-0_6/logreader/logreader.py
===================================================================
--- branches/FAIL2BAN-0_6/logreader/logreader.py 2006-12-10 16:46:54 UTC (rev 483)
+++ branches/FAIL2BAN-0_6/logreader/logreader.py 2006-12-10 21:16:26 UTC (rev 484)
@@ -177,7 +177,16 @@
timeMatch = re.search(self.timeregex, match.string)
if timeMatch:
date = self.getUnixTime(timeMatch.group())
- ipMatch = textToIp(match.string)
+ try:
+ # Fix for CVE-2006-6302
+ matchString = match.group("host")
+ except IndexError:
+ # However does not break the current configuration
+ logSys.warn("No 'host' group defined. This is a security " +
+ "issue. Please fix your configuration file " +
+ "and look at CVE-2006-6302")
+ matchString = match.string
+ ipMatch = textToIp(matchString)
if ipMatch:
for ip in ipMatch:
failList.append([ip, date])
Modified: branches/FAIL2BAN-0_6/version.py
===================================================================
--- branches/FAIL2BAN-0_6/version.py 2006-12-10 16:46:54 UTC (rev 483)
+++ branches/FAIL2BAN-0_6/version.py 2006-12-10 21:16:26 UTC (rev 484)
@@ -24,4 +24,4 @@
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
__license__ = "GPL"
-version = "0.6.1-CVS"
+version = "0.6.1-SVN"
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
|