View Single Post
  #20  
Old 5th January 2012, 15:31
cbj4074 cbj4074 is offline
Senior Member
 
Join Date: Nov 2010
Posts: 395
Thanks: 30
Thanked 58 Times in 50 Posts
Default Sorry to ressurrect an old thread...

Hello, everyone,

I'm running ISPConfig 3.0.4.1, on Ubuntu 10.04, with pure-ftpd-mysql.

My goal is to render fail2ban effective for FTP, sFTP (over SSH), and FTPs (over SSL or TLS).

It seems that the "ssh" fail2ban jail will handle sFTP, but that pure-ftpd-mysql must handle FTP and FTPs (both over port 21).

fail2ban comes with a pure-ftpd jail, but I haven't been using it because up until recently, I thought that pure-ftpd-mysql was logging failed authentication attempts to /var/log/auth.log (which it wasn't -- at least not directly), so I created my own jail and filter that were -mysql-specific. (More on this in a moment.)

It bears mention that pure-ftpd-mysql is a bit different from the standard pure-ftpd implementation because it uses virtual user mapping via MySQL. Most individuals who have followed the "Perfect Server" tutorials for Ubuntu and Debian (and possibly other OSs) will have this variation of pureFTPd.

In particular, the primary difference I've noticed with pure-ftpd-mysql vs. a "stock" pureFTPd configuration is that pure-ftpd-mysql does not log failed authentication attempts (or anything else, it would seem) to /var/log/messages. I don't know whether I failed to enable a given setting or if this behavior is by design.

pure-ftpd-mysql does, however, log authentication failures to /var/log/syslog.

The secondary difference I've noticed is that this version of pureFTPd stores its configuration options in individual files within the /etc/pure-ftpd/conf directory. Virtually all of the documentation on pureFTPd states that configuration options must be passed as command-line arguments, or an equivalent wrapper must be used with configuration files. So, I assume that there is a wrapper for these configuration files.

I've read through this thread (any many others like it) in an effort to configure fail2ban to respond to a certain type of attack in which the hostname does not resolve to a valid IP address. I have described the details of such attacks in the fail2ban mailing list archives: http://sourceforge.net/mailarchive/f...fail2ban-users

After seeing my logs flooded with

Code:
fail2ban.filter : WARNING Unable to find a corresponding IP address for
example.com
I thought, "Well, that's easy. I'll just force pure-ftpd-mysql to log IP addresses only and not hostnames." Of course, I was looking in /var/log/auth.log because I had seen pure-ftpd-mysql messages there before. As it turns-out, the messages in this log seem to be generated by PAM, during the pure-ftpd-mysql's authentication process, and so the presence of /etc/pure-ftpd/conf/DontResolve was having no effect on these log entries. (However, this directive was affecting the log entries in /var/log/syslog, but I didn't realize that at the time.)

To bring this full-circle, it seems that the ideal solution is to use the pure-ftpd jail that comes with fail2ban, and point it to /var/log/syslog. The problem here is that the provided regex (which has been corrected since the comments just before mine in this thread were made) does not seem to match the entries in /var/log/syslog.

To demonstrate, we can use fail2ban's regex facility. The log entries look like this:

Code:
Jan  4 17:34:29 localhost pure-ftpd: (?@1.2.3.4) [INFO] New connection from 1.2.3.4
Jan  4 17:34:29 localhost pure-ftpd: (?@1.2.3.4) [INFO] PAM_RHOST enabled. Getting the peer address
Jan  4 17:34:36 localhost pure-ftpd: (?@1.2.3.4) [WARNING] Authentication failed for user [test]
Jan  4 17:34:36 localhost pure-ftpd: (?@1.2.3.4) [INFO] Logout.
and the regex that is included with fail2ban looks like this:

Code:
pure-ftpd(?:\[\d+\])?: \(.+?@<HOST>\) \[WARNING\] %(__errmsg)s \[.+\]\s*$
It seems that we'd need to replace the __errmsg variable with the string that's assigned to it in /etc/fail2ban/filter.d/pure-ftpd.conf, and reduce the 4-line log entry to a single line, before running the arguments through fail2ban-regex, e.g.:

Code:
root@localhost:~# fail2ban-regex "Jan  4 17:34:29 localhost pure-ftpd: (?@1.2.4.3) [INFO] New connection from 1.2.4.3 Jan  4 17:34:29 localhost pure-ftpd: (?@1.2.4.3) [INFO] PAM_RHOST enabled. Getting the peer address Jan  4 17:34:36 localhost pure-ftpd: (?@1.2.4.3) [WARNING] Authentication failed for user [test] Jan  4 17:34:36 localhost pure-ftpd: (?@1.2.4.3) [INFO] Logout." "pure-ftpd(?:\[\d+\])?: \(.+?@<HOST>\) \[WARNING\] %(Authentication failed for user)s \[.+\]\s*$"
Unfortunately, this yields no matches:

Code:
Running tests
=============

Use regex line : pure-ftpd(?:\[\d+\])?: \(.+?@<HOST>\) \[WARNING\] ...
Use single line: Jan  4 17:34:29 localhost pure-ftpd: (?@1.2.4.3) [...


Results
=======

Failregex
|- Regular expressions:
|  [1] pure-ftpd(?:\[\d+\])?: \(.+?@<HOST>\) \[WARNING\] %(Authentication failed for user)s \[.+\]\s*$
|
`- Number of matches:
   [1] 0 match(es)

Ignoreregex
|- Regular expressions:
|
`- Number of matches:

Summary
=======

Sorry, no match

Look at the above section 'Running tests' which could contain important
information.
I'm no expert in PCRE, so if anyone knows what I might be missing here, please chime-in!

I think that covers everything. My mention of this problem on the fail2ban mailing list has generated a longer discussion as to whether or not fail2ban should perform any hostname lookups; the argument goes that doing so provides a potential attack vector. So, this seems to be a problem worthy of everyone's attention who uses pure-ftpd-mysql and fail2ban.

Thanks in advance!

Last edited by cbj4074; 5th January 2012 at 15:33.
Reply With Quote