0

I'm trying to add an extra filter rule to the fail2ban exim filter. I want to catch bad bot attempts that try to send auth too soon.

My exim.conf filter's failregex looks like this (with the last line being the one I added in):

failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[<HOST>\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$
^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
^%(pid)s SMTP protocol error in "AUTH LOGIN" %(host_info)sAUTH command used when not advertised\s*$

The doesn't work. When I run fail2ban-regex to test it I get the following error:

Running tests
=============

Use   failregex filter file : exim, basedir: .
Traceback (most recent call last):
  File "/usr/bin/fail2ban-regex", line 549, in <module>
    fail2banRegex.readRegex(cmd_regex, 'fail') or sys.exit(-1)
  File "/usr/bin/fail2ban-regex", line 279, in readRegex
    if not reader.read():
  File "/usr/lib/python3/dist-packages/fail2ban/client/configreader.py", line 274, in read
    return ConfigReader.read(self, self._file)
  File "/usr/lib/python3/dist-packages/fail2ban/client/configreader.py", line 89, in read
    ret = self._cfg.read(name)
  File "/usr/lib/python3/dist-packages/fail2ban/client/configreader.py", line 185, in read
    config_files_read = SafeConfigParserWithIncludes.read(self, config_files)
  File "/usr/lib/python3/dist-packages/fail2ban/client/configparserinc.py", line 206, in read
    fileNamesFull += self._getIncludes(filenames)
  File "/usr/lib/python3/dist-packages/fail2ban/client/configparserinc.py", line 151, in _getIncludes
    fileNamesFull += self.__getIncludesUncached(filename, seen)
  File "/usr/lib/python3/dist-packages/fail2ban/client/configparserinc.py", line 168, in __getIncludesUncached
    parser, i = self._getSharedSCPWI(resource)
  File "/usr/lib/python3/dist-packages/fail2ban/client/configparserinc.py", line 130, in _getSharedSCPWI
    i = cfg.read(filename, get_includes=False)
  File "/usr/lib/python3/dist-packages/fail2ban/client/configparserinc.py", line 251, in read
    return SafeConfigParser.read(self, fileNamesFull, encoding='utf-8')
  File "/usr/lib/python3.5/configparser.py", line 696, in read
    self._read(fp, filename)
  File "/usr/lib/python3.5/configparser.py", line 1107, in _read
    raise e
configparser.ParsingError: Source contains parsing errors: './filter.d/exim.conf'
    [line 21]: '^%(pid)s SMTP protocol error in "AUTH LOGIN" %(host_info)sAUTH command used when not advertised\\s*$\n'

I don't know regex well enough to know what its complaining about.

This is on Ubuntu 16.04 with fail2ban-regex version 0.9.3

0

It turns out that the multi line regexes require a tab in front of each new line, so the above filter should be:

failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
    ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[<HOST>\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
    ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$
    ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
    ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
    ^%(pid)s SMTP protocol error in "AUTH LOGIN" %(host_info)sAUTH command used when not advertised\s*$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.