Package: fail2ban Version: 0.7.5-2etch1 Severity: normal The '/etc/fail2ban/filter.d/wuftpd.conf' file shipped in the package contains a regex which matches the error message generated by PAM:
failregex = wu-ftpd(?:\[\d+\])?:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>$ The problem is that the value of 'rhost' is the resolved reverse DNS entry for the remote host. Also, fail2ban's checking of the <HOST> entry stops after it finds a valid IP address. I noticed this thanks to the following log entries: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=26.232.125.75.gs.dynamic.163data.com.cn That reverse DNS entry actually comes from 125.75.232.26, but fail2ban took the beginning of that string and banned the IP address 26.232.125.75. The attached patch changes the regexp to one that matches the log message generated by wu-ftpd itself, which contains the unresolved IP address of the remote host. Note that this message is by default written to syslog and not auth.log. -- System Information: Debian Release: 4.0 APT prefers stable APT policy: (900, 'stable'), (200, 'testing'), (100, 'experimental') Architecture: amd64 (x86_64) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.18-6-amd64 Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_GB.UTF-8) Versions of packages fail2ban depends on: ii iptables 1.3.6.0debian1-5 administration tools for packet fi ii lsb-base 3.1-23.2etch1 Linux Standard Base 3.1 init scrip ii python 2.4.4-2 An interactive high-level object-o ii python-central 0.5.12 register and build utility for Pyt ii python2.4 2.4.4-3+etch2 An interactive high-level object-o fail2ban recommends no packages. -- no debconf information -- Chris Butler <[email protected]> GnuPG Key ID: 1024D/D097A261
>From 3f915b680d67690273dd5754d6bfdde87642906b Mon Sep 17 00:00:00 2001 From: Chris Butler <[email protected]> Date: Wed, 4 Feb 2009 14:09:17 +0000 Subject: [PATCH] Changed regex for matching wu-ftpd login failures, as the pam messages contained resolved reverse DNS, which may be unresolvable or spoofed. --- config/filter.d/wuftpd.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/config/filter.d/wuftpd.conf b/config/filter.d/wuftpd.conf index 2d08022..11baef3 100644 --- a/config/filter.d/wuftpd.conf +++ b/config/filter.d/wuftpd.conf @@ -11,4 +11,4 @@ # Notes.: regex to match the password failures messages in the logfile. # Values: TEXT # -failregex = wu-ftpd(?:\[\d+\])?:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>$ +failregex = wu-ftpd\[\d+\]:\s+failed login from .* \[<HOST>\]$ -- 1.4.4.4
