Added filter and sample log file for qpsmtpd #3089
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sebres
requested changes
Aug 20, 2021
|
|
||
| [Definition] | ||
|
|
||
| failregex = ^.*535 LOGIN authentication failed for .* from <HOST>$ |
There was a problem hiding this comment.
We'll don't accept pull requests with vulnerable REs anymore - not anchored (^.* is not an anchor) and several catch-all's (especially before <HOST>).
- failregex = ^.*535 LOGIN authentication failed for .* from <HOST>$
+ failregex = ^[^\[]+\[\d+\]: 535 LOGIN authentication failed for <F-USER>\S+|.*?(?= from)</F-USER> from <ADDR>$There was a problem hiding this comment.
Thanks Sergey, I'll take a look at this and other changes, and resubmit.
| failregex = ^.*535 LOGIN authentication failed for .* from <HOST>$ | ||
| ignoreregex = | ||
|
|
||
| datepattern = ^%%a %%b %%d %%H:%%M:%%S %%Y |
There was a problem hiding this comment.
This datepattern is one of default (anchored at begin) patterns of fail2ban, but you can indeed leave it if it is surely always this timestamp format (and not something configurable by system/in syslog).
| @@ -0,0 +1,4 @@ | |||
| Thu Aug 19 23:37:09 2021 host.domain.example.com[11793]: 535 LOGIN authentication failed for marta from 2.56.59.87 | |||
There was a problem hiding this comment.
The test cases missing JSON record describing what must be matched by filter (once per failure line), for instance:
+ # failJSON: { "time": "2021-08-19T23:37:09", "match": true , "host": "192.0.2.1" }
Thu Aug 19 23:37:09 2021 host.domain.example.com[11793]: 535 LOGIN authentication failed for marta from 192.0.2.1
otherwise test suite would fail in CI.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I've just had a tiny change accepted into qpsmtpd master, to now include an IP address in the log, starting with smtpd/qpsmtpd#301.
The included filter works in 0.10.2-2.1 in Debian Buster, but of course that version of qpsmtpd is not yet in a release.
Before submitting your PR, please review the following checklist:
against certain release version, choose
0.9,0.10or0.11branch,for dev-edition use
masterbranchfailregexfor filterXwith sample log lineswithin
fail2ban/tests/files/logs/Xfile