-
-
Notifications
You must be signed in to change notification settings - Fork 1.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Documentation of filter flags in regex patterns in filter.conf/ directory #2519
Comments
Some of this tags are used to implement new single line processing of multi-line handling in the filter (to replace old behavior with scanning using buffer containing multi-lines), see #1698, #2239, #2090 etc for more info.
Firstly, tests like So this one means that following tests (unless new section follow) will be executed two times, once without any options (default filter settings) and once with
This one means that following tests running with modes fail2ban/fail2ban/tests/files/logs/sshd Line 263 in a395361
So some rules are using only if certain mode is selected in filter/jail.
Both are true.
And if another scenario occurs: if some previous failure message was found (but for example it does not contain an IP), then also by |
Thank you very much for your reply. That information is very helpful. I think I am still doing something wrong, though. I want fail2ban to ban the IPs associated with these preauth failures:
I have set my In [DEFAULT]
bantime = 1d
findtime = 2h
maxretry = 3
[sshd]
enabled = true
mode = aggressive
In
No more messages follow after, so I do not think that the preauth connections are being marked as failures by fail2ban. Any guidance you can provide would be most appreciated: |
-^<F-NOFAIL>Connection <F-MLFFORGET>closed</F-MLFFORGET></F-NOFAIL> by <HOST>(?: \[preauth\])?\s*$
+^<F-NOFAIL>Connection <F-MLFFORGET>closed</F-MLFFORGET></F-NOFAIL> by(?: authenticating user <F-USER>\S+|.+?</F-USER>)? <HOST>(?: (?:port \d+|on \S+)){0,2}\s*$
+^Connection <F-MLFFORGET>closed</F-MLFFORGET> by(?: authenticating user <F-USER>\S+|.+?</F-USER>)? <HOST>(?: (?:port \d+|on \S+)){0,2}\s+\[preauth\]\s*$
Anyway testing on your excerpt with the current version I got this:
|
Looking at the release changelogs it looks like I need to be on 0.10.3 or later?
|
Sure. failregex = %(known/failregex)s
^Connection <F-MLFFORGET>closed</F-MLFFORGET> by(?: authenticating user <F-USER>\S+|.+?</F-USER>)? <HOST>(?: (?:port \d+|on \S+)){0,2}\s+\[preauth\]\s*$ Just don't forget to remove it later your version becomes updated. |
Thank you for your help. I removed the distribution installed fail2ban package and installed 0.10.4 from here. Everything worked perfectly on
Thank you again for your guidance. |
Fail2Ban v0.10.5 fail2ban-regex -vv /var/log/secure 'sshd[mode=aggressive]' | grep 'Connection from' /var/log/secure: Feb 17 17:40:17 sshd[19725]: Connection from 10.10.8.10 port 62004 on 10.10.8.13 port 22 and more.... I use aggressive mode, how can I block by such expressions like this? |
Hmmm... looks like it this error https://github.com/openssh/openssh-portable/blob/415192348a5737a960f6d1b292a17b64d55b542c/kex.c#L1290 - so no SSH ident implicit after connect. Fixed now in ab3a7fc. As long as not released (upgraded), following jail configuration could solve that for you: [sshd]
enabled = true
mode = aggressive
failregex = %(known/failregex)s
^kex_exchange_identification: client sent invalid protocol identifier |
Sergey, thank you very much for the back reaction and response! I no longer even hoped that anyone would pay attention to this problem and I even thought that this problem had already been solved somewhere. |
How can I set ignoreregex for a particular jail? [sshd]
enabled = true
port = 22
maxretry = 3
bantime = 600
findtime = 2d
banaction = nftables-multiport
action = %(action_mwl)s
[sshd-aggressive]
filter = sshd[mode=aggressive]
enabled = true
port = 22
maxretry = 1
bantime = 300
findtime = 2d
banaction = nftables-multiport
logpath = %(sshd_log)s
ignoreregex = ^Failed \b(?!publickey)\S+ for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>(?: (?:port \d+|on \S+)){0,2}(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$) I want to ignore these lines for aggressive mode, but so that everything else matches. |
Exactly so you have set it for Are you really understand what you're trying to ignore?
but for example this will be not ignored by this ignoreregex (but possibly in filter):
You cannot simply negate (remove) a particular regex with negative lookahead or lookbehind via ignoreregex, because it depends. And you could use short regex there, like: ignoreregex = ^Failed \b(?!publickey)\S+ for\b But better you provide an example line you want ignore. |
The idea is that the aggressive mode would not work on this expression, but at first the first mode would work (normal). [sshd] Otherwise, in my example above, the [sshd] mode normal does not make sense, it is immediately blocked by an aggressive mode. Example:
|
You are wrong, because there are several scenarios where it absolutely makes sense, for example you can have 2 jails with different [sshd]
mode = normal
findtime = 10m
maxretry = 3
bantime = 30m
enabled = true
[sshd-aggressive]
filter = sshd[mode=aggressive]
findtime = 20m
maxretry = 10
bantime = 5m
enabled = true For example here jail with normal mode makes sense too, and is not immediately blocked by an aggressive mode due to different settings (it simply expects more attempts within a bit long time). So if you really want to have both (why?), just increase
This is incorrect expectation too, because there is simply no such mode for "only aggressive attempts". You're misinterpreting the usage of mode Although something like that could work: [sshd-aggressive-without-normal]
filter = sshd[mode=ddos, mdre-aggressive="<mdre-ddos>
<mdre-extra>"] but it depends on internal (not public) parameters that may change in the next version so it could stop to work later. Or still worse it would work only partially (because ignoring something important). Regarding ignore - as already said in previous comment, sometimes you cannot simply neglect some regexp's with an ignore, because they may be "half" positive (contain negative parts that would bother in negating case) or ignoring important regexp's which would be helper for other to find an IP of the session. |
Back to the original question, is there documentation for the various ? |
What do you mean? The IP that gets banned is available in Anyway every data enclosed in filter tag starting with failregex = ^failure from <ADDR> for user <F-USER>\S+</F-USER>, agent: <F-AGENT>.*</F-AGENT>$ and available in action using same tag: actionban = logger ... "banned <ip>, user: <F-USER>, aggent: <F-AGENT>" Also see my answer to related issue - #1935 (comment) |
I want to get the DST ip (i have multiple WAN ip's), from my log file the "DST="; |
Well, as I described above change your failregex to something like this: -failregex = ... SRC=<ADDR> DST=\S+ ...
+failregex = ... SRC=<ADDR> DST=<F-DST>\S+</F-DST> ... and you can get it using |
So its not a set of F-FLAGS that I can use but rather I am creating them in the filter file, that's great. |
Hello, is the purpose of the filter flags present in the
/etc/fail2ban/filter.conf/
files documented somewhere? I am referring to these flags:In
/etc/fail2ban/jail.conf
the following section appears:So I looked at
/etc/fail2ban/filter.conf/sshd.conf
to try and understand what the difference between the different modes for thesshd
jail are. The flags inside of the regex patterns makes it very unclear what will happen for preauth failures like the following:In looking at
/usr/lib/python3/dist-packages/fail2ban/tests/files/logs/sshd
I got even more confused. It looks like the test cases seem contradict one another, but I am likely misinterpreting them.Which one is true? Should this kind of message result in a
Found
match? What mode do I need to set mysshd
jail to in order to ban these preauth attempts?Thank you.
The text was updated successfully, but these errors were encountered: