# Fail2ban, adapté cette regex: - POSSIBLE BREAK-IN ATTEMPT! **URL:** \ **Category:** Trucs et Astuces\ **Created:** [Février 21, 2016, 1:29 UTC](https://www.debian-fr.org/t/fail2ban-adapte-cette-regex-possible-break-in-attempt/55076 "2016-02-21T13:29:40Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![loreleil](https://www.debian-fr.org/letter_avatar_proxy/v4/letter/l/77aa72/32.png) [@loreleil](https://www.debian-fr.org/u/loreleil)\ **Post date:** [Février 21, 2016, 1:29 UTC](https://www.debian-fr.org/t/fail2ban-adapte-cette-regex-possible-break-in-attempt/55076/1 "2016-02-21T13:29:40Z")
Salut, Des log conséquents et répétitifs ![:mrgreen:](https://www.debian-fr.org/uploads/default/original/1X/cc83e9b583138e48ff45f96609046b06d06c7f9d.gif "Mr. Green") m’ont amené à établir une nouvelle regex pour le filtre sshd.conf Fail2ban nativement, restait de marbre! ![:033](https://www.debian-fr.org/uploads/default/original/1X/42cd8bd0447ecac24cdff1e26fa990a5c8442791.gif "petard") [quote]Oct 3 21:37:04 yunohost sshd[20004]: warning: /etc/hosts.allow, line 14: can’t verify hostname: getaddrinfo([adsl186-29130105.din.etb.net.co](http://adsl186-29130105.din.etb.net.co), AF\_INET) failed Oct 3 21:37:05 yunohost sshd[20004]: reverse mapping checking getaddrinfo for [adsl186-29130105.din.etb.net.co](http://adsl186-29130105.din.etb.net.co) [186.29.130.105] failed - POSSIBLE BREAK-IN ATTEMPT! … … … Oct 5 00:27:03 yunohost sshd[13256]: reverse mapping checking getaddrinfo for [adsl186-28235088.sta.etb.net.co](http://adsl186-28235088.sta.etb.net.co) [186.28.235.88] failed - POSSIBLE BREAK-IN ATTEMPT! Oct 5 00:27:03 yunohost sshd[13257]: Received disconnect from 186.28.235.88: 11: Goodbye Oct 5 00:27:08 yunohost sshd[13302]: warning: /etc/hosts.allow, line 14: can’t verify hostname: getaddrinfo([adsl186-28235088.sta.etb.net.co](http://adsl186-28235088.sta.etb.net.co), AF\_INET) failed Oct 5 00:27:12 yunohost sshd[13302]: reverse mapping checking getaddrinfo for [adsl186-28235088.sta.etb.net.co](http://adsl186-28235088.sta.etb.net.co) [186.28.235.88] failed - POSSIBLE BREAK-IN ATTEMPT! Oct 5 00:27:12 yunohost sshd[13303]: Received disconnect from 186.28.235.88: 11: Goodbye [/quote] \* edit \* Notes: `fail2ban Installé : 0.8.6-3 0 ` Nécessite: python-gamin [quote="/etc/fail2ban/jail.conf"]# “backend” specifies the backend used to get files modification. Available # options are “gamin”, “polling” and “auto”. # yoh: For some reason Debian shipped python-gamin didn’t work as expected # This issue left ToDo, so polling is default backend for now backend = auto [/quote] Pour ce faire il suffit d’ajouter cette nouvelle regex. [quote] ~ # cat /etc/fail2ban/filter.d/sshd.conf # Fail2Ban configuration file # # Author: Cyril Jaquier # # $Revision$ # [INCLUDES] # Read common prefixes. If any customizations available – read them from # common.local before = common.conf [Definition] \_daemon = sshd # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named “host”. The tag “” can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P[\w-.^\_]+) # Values: TEXT # failregex = ^%(\_\_prefix\_line)s(?:error: PAM: )?Authentication failure for .\* from \s\*$ ^%(\_\_prefix\_line)s(?:error: PAM: )?User not known to the underlying authentication module for .\* from \s\*$ ^%(\_\_prefix\_line)sFailed (?:password|publickey) for .\* from (?: port \d\*)?(?: ssh\d\*)?$ ^%(\_\_prefix\_line)sROOT LOGIN REFUSED.\* FROM \s\*$ ^%(\_\_prefix\_line)siI user .\* from \s\*$ ^%(\_\_prefix\_line)sUser .+ from not allowed because not listed in AllowUsers$ ^%(\_\_prefix\_line)sauthentication failure; logname=\S\* uid=\S\* euid=\S\* tty=\S\* ruser=\S\* rhost=(?:\s+user=._)?\s_$ ^%(\_\_prefix\_line)srefused connect from \S+ ()\s\*$ ^%(\_\_prefix\_line)sAddress .\* POSSIBLE BREAK-IN ATTEMPT!_\s_$ ^%(\_\_prefix\_line)sreverse mapping checking getaddrinfo for .\* [] failed - POSSIBLE BREAK-IN ATTEMPT!_\s_$ ``` ^%(__prefix_line)sUser .+ from not allowed because none of user's groups are listed in AllowGroups\s*$ ``` # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex = [/quote] Testez cette dernière pour vous en convaincre. ![:083](https://www.debian-fr.org/uploads/default/original/1X/d14bbab5e0eb9167fe7ed1d009c5a9b723425957.gif "yeux-ciel") # [quote]~ # fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf Running tests # Use regex file : /etc/fail2ban/filter.d/sshd.conf Use log file : /var/log/auth.log Results Failregex |- Regular expressions: … | [10] ^\s\*(?:\S+ )?(?:kernel: [\d+.\d+] )?(?:@vserver\_\S+ )?(?:(?:[\d+])?:\s+[[(]?sshd(?:(\S+))?[])]?:?|[[(]?sshd(?:(\S+))?[])]?:?(?:[\d+])?:)?\s_reverse mapping checking getaddrinfo for ._ [] failed - POSSIBLE BREAK-IN ATTEMPT!\s\*$ `- Number of matches: [1] 0 match(es) [2] 0 match(es) [3] 0 match(es) [4] 0 match(es) [5] 2 match(es) [6] 0 match(es) [7] 0 match(es) [8] 0 match(es) [9] 0 match(es) [10] 417 match(es) [11] 0 match(es) # Ignoreregex |- Regular expressions: | `- Number of matches: Summary Addresses found: [1] [2] [3] [4] [5] 114.141.180.109 (Thu Oct 04 20:17:50 2012) 199.115.230.96 (Fri Oct 05 00:10:38 2012) [6] [7] [8] [9] [10] 186.29.130.105 (Wed Oct 03 21:35:16 2012) 186.29.130.105 (Wed Oct 03 21:37:05 2012) 184.22.105.30 (Thu Oct 04 17:11:51 2012) 184.22.105.30 (Thu Oct 04 17:11:52 2012) 184.22.105.30 (Thu Oct 04 17:11:53 2012) 184.22.105.30 (Thu Oct 04 17:11:54 2012) 184.22.105.30 (Thu Oct 04 17:11:55 2012) 184.22.105.30 (Thu Oct 04 17:11:56 2012) … 190.221.26.51 (Thu Oct 04 21:36:40 2012) 190.221.26.51 (Thu Oct 04 21:36:57 2012) 190.221.26.51 (Thu Oct 04 21:37:31 2012) 190.221.26.51 (Thu Oct 04 21:37:54 2012) 190.221.26.51 (Thu Oct 04 21:38:08 2012) 190.221.26.51 (Thu Oct 04 21:38:22 2012) 190.221.26.51 (Thu Oct 04 21:38:33 2012) 190.221.26.51 (Thu Oct 04 21:38:45 2012) 190.221.26.51 (Thu Oct 04 21:38:58 2012) 190.221.26.51 (Thu Oct 04 21:39:10 2012) 190.221.26.51 (Thu Oct 04 21:39:22 2012) 190.221.26.51 (Thu Oct 04 21:39:33 2012) 190.221.26.51 (Thu Oct 04 21:39:45 2012) 190.221.26.51 (Thu Oct 04 21:39:59 2012) 190.221.26.51 (Thu Oct 04 21:40:13 2012) 190.221.26.51 (Thu Oct 04 21:40:26 2012) 190.221.26.51 (Thu Oct 04 21:40:41 2012) 190.221.26.51 (Thu Oct 04 21:40:55 2012) 190.221.26.51 (Thu Oct 04 21:41:11 2012) 190.221.26.51 (Thu Oct 04 21:41:26 2012) 190.221.26.51 (Thu Oct 04 21:41:40 2012) 190.221.26.51 (Thu Oct 04 21:41:56 2012) 190.221.26.51 (Thu Oct 04 21:42:08 2012) 190.221.26.51 (Thu Oct 04 21:42:17 2012) … 190.221.26.51 (Thu Oct 04 21:47:43 2012) 190.221.26.51 (Thu Oct 04 21:47:55 2012) 186.28.235.88 (Fri Oct 05 00:27:03 2012) 186.28.235.88 (Fri Oct 05 00:27:12 2012) 186.28.235.88 (Fri Oct 05 00:29:45 2012) 186.28.235.88 (Fri Oct 05 00:30:09 2012) 186.28.235.88 (Fri Oct 05 00:30:46 2012) 186.28.235.88 (Fri Oct 05 00:31:30 2012) [11] Date template hits: 94964 hit(s): MONTH Day Hour:Minute:Second 0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year 0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second 0 hit(s): Year/Month/Day Hour:Minute:Second 0 hit(s): Day/Month/Year Hour:Minute:Second 0 hit(s): Day/Month/Year Hour:Minute:Second 0 hit(s): Day/MONTH/Year:Hour:Minute:Second 0 hit(s): Month/Day/Year:Hour:Minute:Second 0 hit(s): Year-Month-Day Hour:Minute:Second 0 hit(s): Year.Month.Day Hour:Minute:Second 0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond] 0 hit(s): Day-Month-Year Hour:Minute:Second 0 hit(s): TAI64N 0 hit(s): Epoch 0 hit(s): ISO 8601 0 hit(s): Hour:Minute:Second 0 hit(s): \ Success, the total number of match is 419 However, look at the above section ‘Running tests’ which could contain important information. ~ # [/quote] ` .-. /v\ // \\ /( )\ ^^-^^ . ^¿^ .` ![:006](https://www.debian-fr.org/uploads/default/original/1X/924eb3db8bedad6a0d333b02031d3c6a9af9d9c5.gif "salut")