Hi to all, I just encountered an attack. I was wondering why fail2ban didn't catch it. The attacker used alphabetic user name. The regex detects numeric digits only. As a quick fix I modified the filter portion: ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from <HOST>$ TO: ... Can't find user \[.+@\d+\.\d+\.\d+\.\d+\] from <HOST>$ to catch all characters. Just sharing this.
Good catch... I guess another thing to keep in mind is that this will only work with IPV4, not a huge issue currently... but it might pay to keep that in mind also. in reality we could probably just use [\d+@\d+] or similar ... On 17 March 2014 17:00, Nandy Dagondon <nandy1925@gmail.com> wrote:
Hi to all,
I just encountered an attack. I was wondering why fail2ban didn't catch it. The attacker used alphabetic user name. The regex detects numeric digits only. As a quick fix I modified the filter portion: ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from <HOST>$
TO: ... Can't find user \[.+@\d+\.\d+\.\d+\.\d+\] from <HOST>$
to catch all characters.
Just sharing this.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely Jay
participants (2)
-
jay binks
-
Nandy Dagondon