Search code examples
linuxiptablesnamedfail2ban

Fail2ban named-refused failregex syntax


When running the fail2ban-regex

fail2ban-regex /var/log/named/security1.log /etc/fail2ban/filter.d/named-refused.conf

I get following output

Running tests
=============

Use regex file : /etc/fail2ban/filter.d/named-refused.conf
Use log file   : /var/log/named/security1.log

Matched time template Day-MONTH-Year Hour:Minute:Second[.Millisecond]
Matched time template Day-MONTH-Year Hour:Minute:Second[.Millisecond]
Matched time template Day-MONTH-Year Hour:Minute:Second[.Millisecond]
Matched time template Day-MONTH-Year Hour:Minute:Second[.Millisecond]
Matched time template Day-MONTH-Year Hour:Minute:Second[.Millisecond]


Results
=======

Failregex: 0 total

Ignoreregex: 0 total

Summary
=======

Sorry, no match

Here is some output of the security1.log file

08-Feb-2016 11:38:15.324 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.326 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.326 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.326 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.326 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied

the failregex is the following

failregex = %(__line_prefix)sclient <HOST>#\S+: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$

I think there is a difference between the output of my security1.log and the failregex syntax of the named-refused.conf file which makes it not find anything.

Thanks in advance,

Guy


Solution

  • I ran your log through my Debian 8.2 fail2ban in the same way you described and got.

    Results
    =======
    
    Failregex: 14 total
    |-  #) [# of hits] regular expression
    |   1) [14] ^(?:\s\S+ (?:(?:\[\d+\])?:\s+\(?named(?:\(\S+\))?\)?:?|\(?named(?:\(\S+\))?\)?:?(?:\[\d+\])?:)\s+)?(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
    `-
    
    Ignoreregex: 0 total
    
    Date template hits:
    |- [# of hits] date format
    |  [14] Day-MONTH-Year Hour:Minute:Second[.Millisecond]
    `-
    
    Lines: 14 lines, 0 ignored, 14 matched, 0 missed
    

    So if your interested, the /etc/fail2ban/filter.d/named-refused.conf file in my distro is:

    [Definition]                                                                                                                                                                    
    
    # Daemon name                                                                                                                                                                   
    _daemon=named                                                                                                                                                                   
    
    # Shortcuts for easier comprehension of the failregex                                                                                                                           
    
    __pid_re=(?:\[\d+\])                                                                                                                                                            
    __daemon_re=\(?%(_daemon)s(?:\(\S+\))?\)?:?                                                                                                                                     
    __daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)                                                                                            
    
    #       hostname       daemon_id         spaces                                                                                                                                 
    # this can be optional (for instance if we match named native log files)                                                                                                        
    __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?                                                                                                                               
    
    failregex = ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$                           
                ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$                                                     
                ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$                 
    
    # DEV Notes:                                                                                                                                                                    
    # Trying to generalize the                                                                                                                                                      
    #          structure which is general to capture general patterns in log                                                                                                        
    #          lines to cover different configurations/distributions                                                                                                                
    #..........                                                                                                                                                                     
    # (\.\d+)? is a really ugly catch of the microseconds not captured in the date detector                                                                                         
      #                                                                                                                                                                               
    # Author: Yaroslav Halchenko 
    

    Note the authors comment about the "really ugly catch of the microseconds not captured in the date detector" You could try it (after a sanity check against your own version of course) and see if it works. By the way, what is your distro ?