On Thu, 5 Jan 2012, Ross Halliday wrote:
Hello fellow Debian ISPs,
This isn't necessarily ISP-specific but I'm hoping someone here might have had a similar experience. Or, if there is a better venue for my question I'd love to know.
I like blocking badness. Chances are, if an IP is sending me junk and trying to break things, I don't want to have anything to do with it. So, I'm trying to get Fail2Ban to match junk as logged by Suhosin. For the most part my regexes work, but yesterday I got a bunch of garbage along these lines:
Jan 4 11:53:47 homepage suhosin[17930]: ALERT - configured request variable name length limit exceeded - dropped variable '-J3^>;c#/m08N3eiCh}mZ6#VQz*FhG82oc_#wL%AWy@A*%<cx{_opL*_gT^ >0_H0oO-_w]V#/3'ZLp>V:`857niwx5_%,G,'FtmU":9Yr_6}H' (attacker '24.156.217.14', file '/var/www/speedtest/speedtest/upload.php')
Jan 4 11:53:47 homepage suhosin[17930]: ALERT - configured request variable name length limit exceeded - dropped variable 'FilB%_e*i20mxOi"P^pOWnQn>u_}5L,2<@]<q,SgB_0Xu'OZ4`D!}c6#skXR2(@zAcQ-p4r#AvpX,">J_l`e8"(<]Bk"_}@BUg_B30)?<d4kty*[:fD/P@0pt|5@]' (attacker '24.156.217.14', file '/var/www/speedtest/speedtest/upload.php')
My existing Fail2Ban regex filter looks like this:
suhosin[[[:digit:]]+]: ALERT - configured request variable value length limit exceeded - dropped variable '.*' (attacker '<HOST>', file '/var/www/speedtest/speedtest/upload.php')$
Replacing .* with [[
rint:]]+ didn't seem to match that new garbage. I attempted [x20-x7E]+, but that returned "Invalid range end" from egrep. The only hits I found in searching related to this response are to do with character classes and locales which I don't think should really apply if you're specifying ASCII character numbers.
I apologize if this is obvious, but my searching only yielded the above.
Your log messages says "variable name length", while your regex says
"variable value length".
--
Povl Ole "stderr" Haarlev Olsen
--
To UNSUBSCRIBE, email to debian-isp-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: alpine.DEB.2.00.1201051941570.17683@noget.stderr.d k.localdomain">http://lists.debian.org/alpine.DEB.2.00.1201051941570.17683@noget.stderr.d k.localdomain
Matching Suhosin entries with Fail2Ban
Works much better now. Guess I just needed a second set of eyes.
