Hi @ll,
i now have the fail2ban-script running on all my BQ CentOS4 boxes.
The problem with the python-version was backported, so the latest 0.8.2
works great with python>= 2.3 / with CentOS4.
Sources can be found under www.fail2ban.org
Till now, i just use the sshd and proftpd-filter. To make the
proftpd-filter work, here's my fixed config for BQ:
----snipp-----
[root (at mark) serv1 filter.d]# pwd
/etc/fail2ban/filter.d
[root (at mark) serv1 filter.d]# cat proftpd.conf
# Fail2Ban configuration file
#
# Author: Yaroslav Halchenko
#
# $Revision: 665 $
# RoB: adapted to BQ
[Definition]
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile.
The
# host must be matched by a group named "host". The tag
"<HOST>" can
# be used for standard IP/hostname matching and is only an
alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from
\S* ?\[[0-9.]+\] to \S+\s*$
\(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): Incorrect
password\. $
\(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login
attempted\.$
\(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\)
exceeded$
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
----snipp-----
The sshd-filter worked without any modification.
Greets
Roman
On Mon, 2008-04-14 at 11:21 +0200, Tom M端ller-Kortkamp wrote:
> Hi,
> as the pop3 bruteforces get worse searched around and found fail2ban
> for centos4 on rpmforge...
>
> I started with a simple config for proftpd and let you know ...
> Will expand with dovecot and sshd if its working ...
>
> Am 18.01.2008 um 19:03 schrieb Doug Harvey:
> > If you find a solution, please do let me know. I am hit pretty hard
> > every night and would love something like this.
> >
> > Doug
> >
> > On Jan 18, 2008 6:09 AM, Roman Buerkle < buerkle (at mark) stimme.net> wrote:
> > Hi @ll,
> >
> > we try to get a fail2ban daemon running on a BQ.
> >
> > I can't establish the current stable fail2ban-0.8.1, because it needs
> > python>= 2.4, which is not in CentOS4.
> >
> > So, does anyone of you have a fail2ban-0.6.x (python>=2.3) with the
> > fitting reg-expressions for sshd, proftp, sendmail and httpd for our
> > beloved BQ's?
> >
> > Greets
> > RoB
> >
> > -LINUX - sooner or later we emulate u -
> >
> >
> >
> >
>
> --
> kommunity GmbH & Co.KG
> Goseriede 4, D-30159 Hannover
> ------------
> Phone +49 (0)5 11 - 80 72 58 - 0
> Fax +49 (0)5 11 - 80 72 58 - 10
> ------------
> Sitz der Gesellschaft: Hannover,
> Registergericht: Amtsgericht Hannover,
> Handelsregisternummer HRA 26721
>
>
> Pers旦nlich haftende Gesellschafterin:
> kommunity Verwaltungsgesellschaft mbH
> vertreten durch den Gesch辰ftsf端hrer
> Tom M端ller-Kortkamp
> Sitz der Gesellschaft: Hannover,
> Registergericht: Amtsgericht Hannover,
> Registernummer HRB 60200
>
>
>
>
>