Date: Sat, 18 Jun 2011 06:05:31 GMT From: Christoph Theis <theis@gmx.at> To: freebsd-gnats-submit@FreeBSD.org Subject: ports/157979: fail2ban fails 2 ban since update of June, 11 Message-ID: <201106180605.p5I65V2L080381@red.freebsd.org> Resent-Message-ID: <201106180610.p5I6AADF037557@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 157979 >Category: ports >Synopsis: fail2ban fails 2 ban since update of June, 11 >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sat Jun 18 06:10:10 UTC 2011 >Closed-Date: >Last-Modified: >Originator: Christoph Theis >Release: 8.2-RELEASE >Organization: >Environment: FreeBSD galadriel 8.2-RELEASE FreeBSD 8.2-RELEASE #0: Fri Feb 18 02:24:46 UTC 2011 root@almeida.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 >Description: Since the last update of June, 11 2011 fail2ban fails to recognize "SSH intruders" with the filter filter.d/bsd-sshd.conf. I guess the bug was introduced with the introduction of supporting verbose output of syslog, the patch from June 11. In filter.d/common.conf the __prefix_line is now defined as __prefix_line = \s*%(__bsd_verbose_mode)s(?:\S+ )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s* But isn't the __bsd_verbose_mode this way not now mandatory? I think __prefix_line shall be defined as __prefix_line = \s*%(__bsd_verbose_mode)s?(?:\S+ )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s* ( add a "?" after "%(__bsd_verbose_mode)s" ) I tested with fail2ban-regex: With the original line from the ports I get 0 hits on the log file, with my modified line I get > 1000 hits. And the comment above that line still reads # [hostname] [vserver tag] daemon_id spaces But shouldn't it read # [verbose] [hostname] [vserver tag] daemon_id spaces >How-To-Repeat: In /usr/local/etc/fail2ban run fail2ban-regex /var/log/auth.log filter.d/bsd-sshd.conf filter.d/bsd-sshd.conf and check for the number of hits >Fix: See above: __bsd_verbose_mode shall be optional (add an "?" added after it) >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201106180605.p5I65V2L080381>