Your message dated Wed, 28 Aug 2013 16:33:56 +0200
with message-id <[email protected]>
and subject line Re: Bug#573314: SASL failregex still broken for
Postfix+SASLAuthd
has caused the Debian Bug report #573314,
regarding fail2ban: sasl regex when used in combination with postfix.
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
573314: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=573314
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: fail2ban
Version: 0.8.3-2sid1
Severity: normal
The regex used for sasl is as follows:
failregex = : warning: [-._\w]+\[<HOST>\]: SASL
(?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
postfix logs as follows:
Mar 10 13:33:30 gandalf postfix/smtpd[3937]: warning: HOSTNAME[IP-ADDR]: SASL
LOGIN authentication failed: authentication failure
It can be resolved by removing the $ at the end of the regex, or by
adding : authentication failure in fromt of the $.
regards
Robert
-- System Information:
Debian Release: 5.0.4
APT prefers stable
APT policy: (500, 'stable')
Architecture: i386 (i686)
Kernel: Linux 2.6.26-2-686 (SMP w/1 CPU core)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/bash
Versions of packages fail2ban depends on:
ii lsb-base 3.2-20 Linux Standard Base 3.2 init scrip
ii python 2.5.2-3 An interactive high-level object-o
ii python-central 0.6.8 register and build utility for Pyt
Versions of packages fail2ban recommends:
ii iptables 1.4.2-6 administration tools for packet fi
ii whois 4.7.30 an intelligent whois client
Versions of packages fail2ban suggests:
ii bsd-mailx [mailx] 8.1.2-0.20071201cvs-3 A simple mail user agent
ii mailx 1:20071201-3 Transitional package for mailx ren
pn python-gamin <none> (no description available)
-- no debconf information
--- End Message ---
--- Begin Message ---
Version: 0.8.4+svn20110323-1
found 573314 0.8.4-3+squeeze2
fixed 573314 0.8.4+svn20110323-1
archive 573314
thanks
Hey Yaroslav,
Am 2013-08-28 15:36, schrieb Yaroslav Halchenko:
are you sure that bug was not fixed for that version of
postfix+saslauthd which was in archive when I did upload
0.8.4+svn20110323-1 and that this is not just a new change in the
postfix log lines? if not -- then this bug should have left RIP and
you
should have filed a new one so I could actually know which version of
fail2ban you are talking about etc...
as far as I see it -- the changes you are talking about have long being
part of released fail2ban, since it was fixed upstream in
$> git describe 02e7dfb099ca0e417f6fc1d5c5d2ad88b7eb4b55
0.8.4-14-g02e7dfb
You're correct, my fault. This bug is not fixed in the squeeze version
of fail2ban, but later versions carry the fix. Didn't check properly.
Sorry for the noise :-/
Kind regards,
jonas
commit 02e7dfb099ca0e417f6fc1d5c5d2ad88b7eb4b55
Author: Yaroslav Halchenko <[email protected]>
Date: Wed Mar 23 20:36:50 2011 +0000
BF: allow space in the trailing of failregex for sasl.conf: see
http://bugs.debian.org/573314
git-svn-id:
https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@772
a942ae1a-1317-0410-a47c-b1dcaea8d605
diff --git a/config/filter.d/sasl.conf b/config/filter.d/sasl.conf
index 5cd8a6d..e316605 100644
--- a/config/filter.d/sasl.conf
+++ b/config/filter.d/sasl.conf
@@ -14,7 +14,7 @@
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
-failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL
(?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(:
[A-Za-z0-9+/]*={0,2})?$
+failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL
(?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [
A-Za-z0-9+/]*={0,2})?$
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is
ignored.
so please make sure you don't just carry outdated "config" files for
fail2ban.
And if you find that it was a miss on your side -- please put this
report back
to RIP with correct version where it was fixed afaik.
On Wed, 28 Aug 2013, Jonas Meurer wrote:
Hello,
unfortunately the failregex for SASL filter is still broken when
used for Postfix+saslauthd.
Following is an example failure log line:
Aug 25 07:47:51 www postfix/smtpd[4525]: warning:
host.example.tld[192.168.0.2]: SASL LOGIN authentication failed:
authentication failure
With upload of fail2ban 0.8.4+svn20110323-1, you changed the
failregex at /etc/fail2ban/filter.d/sasl.conf to:
failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL
(?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(:
[A-Za-z0-9+/]*={0,2})?$
This regex doesn't match the failure log lines. The space is missing
in the last regex part. This one works:
failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL
(?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(:
[A-Za-z0-9+/ ]*={0,2})?$
This has been discused here as well:
http://www.howtoforge.com/forums/showthread.php?t=51349
Seconds, I found a small typo in /etc/fail2ban/jail.conf line 241
(section [sasl]): The mail warn log is '/var/log/mail.warn', not
'/var/log/warn.log' ;)
Kind regards,
jonas
--- End Message ---
