Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add rsyslog filter for TLS connections #3607

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add rsyslog filter for TLS connections #3607

wants to merge 1 commit into from

Conversation

opoplawski
Copy link
Contributor

Before submitting your PR, please review the following checklist:

  • CHOOSE CORRECT BRANCH: if filing a bugfix/enhancement
    against certain release version, choose 0.9, 0.10 or 0.11 branch,
    for dev-edition use master branch
  • CONSIDER adding a unit test if your PR resolves an issue
  • [NA] LIST ISSUES this PR resolves
  • MAKE SURE this PR doesn't break existing tests
  • KEEP PR small so it could be easily reviewed.
  • AVOID making unnecessary stylistic changes in unrelated code
  • ACCOMPANY each new failregex for filter X with sample log lines
    within fail2ban/tests/files/logs/X file

@sebres
Copy link
Contributor

sebres commented Oct 19, 2023 •
edited

  1. Did I understand correctly, that the filter is intended to match will be closed due to error as a failure, but only if it follows gnutls returned error on handshake or peer did not provide a certificate messages?

  2. Wouldn't it be easily outcheated? I mean simply do several parallel sessions, where one generates some messages between them and so avoid the match... It would be even enough to do the "attack" with 3 concurrent connection simultaneously to produce a log which never cause an attempt finding (if lines-window contain only 3 lines):

Oct 15 15:15:20 localhost.localdomain rsyslogd[284640]: gnutls returned error on handshake: An unexpected TLS packet was received.  [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2083 ]
Oct 15 15:15:20 localhost.localdomain rsyslogd[284640]: gnutls returned error on handshake: An unexpected TLS packet was received.  [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2083 ]
Oct 15 15:15:20 localhost.localdomain rsyslogd[284640]: gnutls returned error on handshake: An unexpected TLS packet was received.  [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2083 ]
Oct 15 15:15:30 localhost.localdomain rsyslogd[284640]: GnuTLS handshake retry returned error: The TLS connection was non-properly terminated.  [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2083 ]
Oct 15 15:15:30 localhost.localdomain rsyslogd[284640]: GnuTLS handshake retry returned error: The TLS connection was non-properly terminated.  [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2083 ]
Oct 15 15:15:30 localhost.localdomain rsyslogd[284640]: GnuTLS handshake retry returned error: The TLS connection was non-properly terminated.  [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2083 ]
Oct 15 15:15:30 localhost.localdomain rsyslogd[284640]: netstream session 0x7f97d0036b00 from 185.233.19.152 will be closed due to error [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2089 ]
Oct 15 15:15:30 localhost.localdomain rsyslogd[284640]: netstream session 0x7f97d0036b00 from 185.233.19.152 will be closed due to error [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2089 ]
Oct 15 15:15:30 localhost.localdomain rsyslogd[284640]: netstream session 0x7f97d0036b00 from 185.233.19.152 will be closed due to error [v8.2102.0-13.el8 try https://www.rsyslog.com/e/2089 ]

(the filter will find nothing here by maxlines = 3)
Let alone rsyslogd or rather another service via syslog would generate another messages to syslog_daemon file.

For the same reason (missing common session ID everywhere) it has a good potential for false positives (erroneous ban of legitimate users).

I'd like to try <F-MLFID> variant here, but still have a need for clarification or rather larger log excerpts (or more analysis).
However I am afraid it'd be impossible without common session identifier for all messages with no occasion to catch false positives mistakenly.

@Neustradamus
Copy link

@opoplawski: Have you progressed on your PR?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@opoplawski @sebres @Neustradamus