1

Fail2Ban version: 0.10.2

I have tried a lot of filter config files for MongoDB remote authentication fail, none of them have been working, I have figured that the problem is with failregex and I am not able to come up with a proper regex.

{"$date":"2021-08-10T17:27:13.498+05:30"},"s":"I",  "c":"ACCESS",   "id":20249,   "ctx":"conn187","msg":"Authentication failed","attr":{"mechanism":"SCRAM-SHA-256","speculative":true,"principalName":"Admin","authenticationDatabase":"admin","remote":"123.456.789.123:60054","extraInfo":{},"error":"AuthenticationFailed: SCRAM authentication failed, storedKey mismatch"}}

This is the mongo log I get on the failed attempt. I have tried using <HOST>, <ADDR> in the regex but the <HOST> gives 0.0.0.0 and <ADDR> gives 3:6005 (last digit of IP and 4 digits of port).

What would be the proper regex to filter this log?

Regex I have tried

^(.*Authentication failed.*)|(.*<ADDR>.*)|$
^(.*Authentication failed.*)|(.*<HOST>.*)|$
3
  • @MichaelHampton I have added the regex I have used. With the mentioned regex fail2ban was able to detect after max retries but it doesn't get the IP properly
    – Toncy John
    Aug 11, 2021 at 6:13
  • uh fail2ban for mongodb? should you expose your database to public internet?
    – mforsetti
    Aug 11, 2021 at 7:13
  • @mforsetti the database I am exposing to the public internet is only used for testing while development so this shouldn't be an issue. Also, the reason for setting up fail2ban is to act as extra security to compensate for this.
    – Toncy John
    Aug 11, 2021 at 7:32

1 Answer 1

0
  1. https://github.com/fail2ban/fail2ban/issues/2932
  2. https://github.com/fail2ban/fail2ban/issues/3046

shortly:

[Definition]

datepattern = ^\{"t":\{"\$date":"%%Y-%%m-%%dT%%H:%%M:%%S\.%%f%%z"}\s*,\s*
_groupre = (?:"(?!(?:msg|attr|client|remote)\b)\w+":(?:"[^"]+"|\w+)\s*[,\}]\s*)
failregex = ^%(_groupre)s*"msg":"Authentication failed"\s*,\s*%(_groupre)s*"attr"\s*:\s*\{%(_groupre)s*"(?:client|remote)":"<ADDR>:\d+"
2
  • This works, thanks for the solution. Regarding exposing the database to the public internet how safe it would be with a strong passphrase and fail2ban implemented?
    – Toncy John
    Aug 12, 2021 at 10:52
  • It's hard to say. Fail2ban would just reduce the risk of success by the bruteforce (e. g. drastically reduce the attempts count), but for example it would not really protect against some vulnerabilities (if any exists or will be introduced in the future). So if it's possible, better is to protect it by the firewall (e. g. net-filter white-listing some hosts/addresses allowed to communicate with mongodb, or http- or port-knocking, etc).
    – sebres
    Aug 12, 2021 at 11:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .