倉金家ホームページ

[Fail2Ban] ProFTPD: banned xxx.xxx.xxx.xxx
日付: 2010-10-30 21:13
 差出人: Fail2Ban 
 宛先: root@mail.iroribata.net
 
Hi,

The IP xxx.xxx.xxx.xxx has just been banned by Fail2Ban after
2 attempts against ProFTPD.

(このあとIPアドレスの所有者、国などの情報)

[Fail2Ban] SSH: banned xxx.xxx.xxx.xxx
 日付: 2010-10-30 21:39
 差出人: Fail2Ban 
 宛先: root@mail.iroribata.net
 
Hi,

The IP xxx.xxx.xxx.xxx has just been banned by Fail2Ban after
3 attempts against SSH.

......

[dovecot-iptables]

enabled  = true
filter   = dovecot
action   = iptables-multiport[name=Dovecot, port="pop3,imap,smtp", protocol=tcp]
           sendmail-whois[name=Dovecot, dest=root, sender=fail2ban]
logpath  = /var/log/maillog
maxretry = 10

[Definition]

failregex = \S+ dovecot: \S+-login: Aborted login:.* rip=<HOST>, \S+$
            \S+ dovecot: \S+-login: Disconnected:.* rip=<HOST>, \S+$
            \S+ dovecot: auth-worker\(default\): sql\(\S+,<HOST>\): unknown user$
            \S+ dovecot: auth-worker\(default\): sql\(\S+,<HOST>\): Password mismatch$

ignoreregex = 

[http-iptables]

enabled  = true
filter   = http-scan
action   = iptables-multiport[name=Http-Scan, port="http,https"]
           sendmail-buffered[name=Http-Scan, lines=5, dest=root, sender=fail2ban]
logpath  = /var/log/httpd/error_log
maxretry = 3
bantime  = 3600

[Definition]

failregex = [[]client <HOST>[]] File does not exist: /home/https?/\S*[Aa][Dd][Mm][Ii][Nn]
            [[]client <HOST>[]] File does not exist: /home/https?/[Dd][Bb]
            [[]client <HOST>[]] File does not exist: /home/https?/[Pp][Mm][Aa]
            [[]client <HOST>[]] File does not exist: /home/https?/[Mm][Yy][Ss][Qq][Ll]
            [[]client <HOST>[]] client denied by server configuration:.*

ignoreregex =

........


[ssh-iptables]

enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]
           sendmail-whois[name=SSH, dest=root, sender=fail2ban]
logpath  = /var/log/secure
bantime  = 21600
findtime = 3600
maxretry = 2


[dovecot-iptables]

enabled  = true
filter   = dovecot
action   = iptables-multiport[name=Dovecot, port="pop3,imap,smtp", protocol=tcp]
           sendmail-whois[name=Dovecot, dest=root, sender=fail2ban]
logpath  = /var/log/maillog
bantime  = 21600
findtime = 600
maxretry = 10


[httpd-iptables]

enabled  = true
filter   = httpd
action   = iptables-multiport[name=Httpd, port="http,https", protocol=tcp]
           sendmail-whois[name=Httpd, dest=root, sender=fail2ban]
logpath  = /var/log/httpd/error_log
bantime  = 21600
findtime = 600
maxretry = 3


[postfix-iptables]

enabled  = true
filter   = postfix
action   = iptables-multiport[name=Postfix, port="pop3,imap,smtp", protocol=tcp]
           sendmail-whois[name=Postfix, dest=root, sender=fail2ban]
logpath  = /var/log/maillog
bantime  = 21600
findtime = 3600
maxretry = 4


[proftpd-iptables]

enabled  = true
filter   = proftpd
action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
           sendmail-whois[name=ProFTPD, dest=root, sender=fail2ban]
logpath  = /var/log/proftpd/proftpd.log
bantime  = 21600
findtime = 600
maxretry = 7


........

failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
            ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
            ^%(__prefix_line)sFailed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
            ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
            ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$
            ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
            ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
            ^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT!*\s*$
            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$
            ^%(__prefix_line)sInvalid user\s*\S* from <HOST>
            ^%(__prefix_line)spam_unix(sshd:auth): authentication failure;\s*\S* rhost=<HOST>
            ^%(__prefix_line)sFailed password for invalid user\s*\S* from <HOST>.*
            ^%(__prefix_line)sConnection closed by <HOST>.*$

failregex = \S+ dovecot: \S+-login: Aborted login:.* rip=<HOST>, \S+
            \S+ dovecot: \S+-login: Disconnected:.* rip=<HOST>, \S+
            \S+ dovecot: auth-worker\(default\): sql\(\S+,<HOST>): unknown user
            \S+ dovecot: auth-worker\(default\): sql\(\S+,<HOST>\): Password mismatch
            \S+ dovecot: auth\(default\): passdb\(\S+,<HOST>\): Attempted login with password having illegal chars

failregex = [[]client <HOST>[]] script '.*' not found or unable to stat$
            [[]client <HOST>[]] client denied by server configuration:
            [[]client <HOST>[]] File does not exist: .*([Aa]dmin|[Mm]anager|[Ee]ditor|[Uu]ser|login)
            [[]client <HOST>[]] File does not exist: .*/([Pp][Mm][Aa]|[Mm][Yy][Ss][Qq][Ll])
            [[]client <HOST>[]] File does not exist: .*/(db|scripts|forum|board|[vV][bB])
            [[]client <HOST>[]] File does not exist: .*/(blog|wordpress|wp)
            [[]client <HOST>[]] File does not exist: .*/(catalog|shop|oscommerce|ipb)

failregex = reject: RCPT from (.*)\[<HOST>\]: 550 5.1.1
            reject: RCPT from (.*)\[<HOST>\]: 554 5.7.1
            warning: \S+\[<HOST>\]: SASL (LOGIN|PLAIN) authentication failed:

failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+ *$
            \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): .*$
            \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\. *$
            \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$

lockingopt = -w

lockingopt =