git: 791d1920fad7 - 2025Q1 - security/py-fail2ban: Add support for sshd-session
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 27 Mar 2025 15:55:39 UTC
The branch 2025Q1 has been updated by cy:
URL: https://cgit.FreeBSD.org/ports/commit/?id=791d1920fad7f3f0097fb87cbcc1fd5791752f3e
commit 791d1920fad7f3f0097fb87cbcc1fd5791752f3e
Author: Cy Schubert <cy@FreeBSD.org>
AuthorDate: 2025-03-27 15:44:16 +0000
Commit: Cy Schubert <cy@FreeBSD.org>
CommitDate: 2025-03-27 15:55:29 +0000
security/py-fail2ban: Add support for sshd-session
Now that sshd has been split into sshd and sshd-session, sshd-session
is now the producer of syslog messages. We cannot replace the existing
*sshd.conf files because this port must also run on older systems with
older OpenSSH. Therefore we add new filters to support both.
Reported by: sef (private email)
(cherry picked from commit c98813ccb07851890f73f442be26ce530b6744d0)
---
security/py-fail2ban/Makefile | 1 +
.../patch-config_filter.d_bsd-sshd-session.conf | 44 +++++++
.../files/patch-config_filter.d_sshd-session.conf | 142 +++++++++++++++++++++
3 files changed, 187 insertions(+)
diff --git a/security/py-fail2ban/Makefile b/security/py-fail2ban/Makefile
index dd569b7bb1d9..cbc9cd490909 100644
--- a/security/py-fail2ban/Makefile
+++ b/security/py-fail2ban/Makefile
@@ -1,5 +1,6 @@
PORTNAME= fail2ban
DISTVERSION= 1.1.0
+PORTREVISION= 1
CATEGORIES= security python
PKGNAMEPREFIX= ${PYTHON_PKGNAMEPREFIX}
diff --git a/security/py-fail2ban/files/patch-config_filter.d_bsd-sshd-session.conf b/security/py-fail2ban/files/patch-config_filter.d_bsd-sshd-session.conf
new file mode 100644
index 000000000000..ad786447e655
--- /dev/null
+++ b/security/py-fail2ban/files/patch-config_filter.d_bsd-sshd-session.conf
@@ -0,0 +1,44 @@
+--- bsd-sshd-session.conf.orig 2025-03-27 08:35:58.483811000 -0700
++++ bsd-sshd-session.conf 2025-03-27 08:41:34.639425000 -0700
+@@ -0,0 +1,41 @@
++# Fail2Ban configuration file
++#
++# Author: Cyril Jaquier
++#
++# $Revision: 663 $
++#
++
++[INCLUDES]
++
++# Read common prefixes. If any customizations available -- read them from
++# common.local
++before = common.conf
++
++
++[Definition]
++
++_daemon = sshd-session
++
++# Option: failregex
++# Notes.: regex to match the password failures messages in the logfile. The
++# host must be matched by a group named "host". The tag "<HOST>" can
++# be used for standard IP/hostname matching and is only an alias for
++# (?:::f{4,6}:)?(?P<host>\S+)
++# Values: TEXT
++#
++failregex = ^%(__prefix_line)s(?:error: PAM: )?[A|a]uthentication (?:failure|error) for .* from <HOST>\s*$
++ ^%(__prefix_line)sDid not receive identification string from <HOST>$
++ ^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
++ ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
++ ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
++ ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST> port \d*$
++ ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$
++ ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
++ ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
++ ^%(__prefix_line)sreverse mapping checking getaddrinfo for .* \[<HOST>\] .* POSSIBLE BREAK-IN ATTEMPT!$
++
++# Option: ignoreregex
++# Notes.: regex to ignore. If this regex matches, the line is ignored.
++# Values: TEXT
++#
++ignoreregex =
diff --git a/security/py-fail2ban/files/patch-config_filter.d_sshd-session.conf b/security/py-fail2ban/files/patch-config_filter.d_sshd-session.conf
new file mode 100644
index 000000000000..3f4310c54c0f
--- /dev/null
+++ b/security/py-fail2ban/files/patch-config_filter.d_sshd-session.conf
@@ -0,0 +1,142 @@
+--- sshd-session.conf.orig 2025-03-27 08:42:15.550403000 -0700
++++ sshd-session.conf 2025-03-27 08:42:34.056893000 -0700
+@@ -0,0 +1,139 @@
++# Fail2Ban filter for openssh
++#
++# If you want to protect OpenSSH from being bruteforced by password
++# authentication then get public key authentication working before disabling
++# PasswordAuthentication in sshd_config.
++#
++#
++# "Connection from <HOST> port \d+" requires LogLevel VERBOSE in sshd_config
++#
++
++[INCLUDES]
++
++# Read common prefixes. If any customizations available -- read them from
++# common.local
++before = common.conf
++
++[DEFAULT]
++
++_daemon = sshd-session
++
++# optional prefix (logged from several ssh versions) like "error: ", "error: PAM: " or "fatal: "
++__pref = (?:(?:error|fatal): (?:PAM: )?)?
++# optional suffix (logged from several ssh versions) like " [preauth]"
++#__suff = (?: port \d+)?(?: \[preauth\])?\s*
++__suff = (?: (?:port \d+|on \S+|\[preauth\])){0,3}\s*
++__on_port_opt = (?: (?:port \d+|on \S+)){0,2}
++# close by authenticating user (don't use <HOST> after %(__authng_user)s because of catch-all `.*?`):
++__authng_user = (?: (?:by|from))?(?: (?:invalid|authenticating) user <F-USER>\S+|.*?</F-USER>)?(?: from)?
++
++# for all possible (also future) forms of "no matching (cipher|mac|MAC|compression method|key exchange method|host key type) found",
++# see ssherr.c for all possible SSH_ERR_..._ALG_MATCH errors.
++__alg_match = (?:(?:\w+ (?!found\b)){0,2}\w+)
++
++# PAM authentication mechanism, can be overridden, e. g. `filter = sshd[__pam_auth='pam_ldap']`:
++__pam_auth = pam_[a-z]+
++
++[Definition]
++
++prefregex = ^<F-MLFID>%(__prefix_line)s</F-MLFID>%(__pref)s<F-CONTENT>.+</F-CONTENT>$
++
++cmnfailre = ^[aA]uthentication (?:failure|error|failed) for <F-USER>.*?</F-USER> (?:from )?<HOST>( via \S+)?%(__suff)s$
++ ^User not known to the underlying authentication module for <F-USER>.*?</F-USER> (?:from )?<HOST>%(__suff)s$
++ <cmnfailre-failed-pub-<publickey>>
++ ^Failed <cmnfailed> for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
++ ^<F-USER>ROOT</F-USER> LOGIN REFUSED FROM <HOST>
++ ^[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> (?:from )?<HOST>%(__suff)s$
++ ^User <F-USER>\S+|.*?</F-USER> (?:from )?<HOST> not allowed because not listed in AllowUsers%(__suff)s$
++ ^User <F-USER>\S+|.*?</F-USER> (?:from )?<HOST> not allowed because listed in DenyUsers%(__suff)s$
++ ^User <F-USER>\S+|.*?</F-USER> (?:from )?<HOST> not allowed because not in any group%(__suff)s$
++ ^refused connect from \S+ \(<HOST>\)
++ ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:\s*3: .*: Auth fail%(__suff)s$
++ ^User <F-USER>\S+|.*?</F-USER> (?:from )?<HOST> not allowed because a group is listed in DenyGroups%(__suff)s$
++ ^User <F-USER>\S+|.*?</F-USER> (?:from )?<HOST> not allowed because none of user's groups are listed in AllowGroups%(__suff)s$
++ ^<F-NOFAIL>%(__pam_auth)s\(sshd:auth\):\s+authentication failure;</F-NOFAIL>(?:\s+(?:(?:logname|e?uid|tty)=\S*)){0,4}\s+ruser=<F-ALT_USER>\S*</F-ALT_USER>\s+rhost=<HOST>(?:\s+user=<F-USER>\S*</F-USER>)?%(__suff)s$
++ ^maximum authentication attempts exceeded for (?:invalid user )?<F-USER>.*?</F-USER> (?:from )?<HOST>%(__on_port_opt)s(?: ssh\d*)?%(__suff)s$
++ ^User <F-USER>\S+|.*?</F-USER> not allowed because account is locked%(__suff)s
++ ^<F-MLFFORGET>Disconnecting</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\S+</F-USER> <HOST>%(__on_port_opt)s:\s*Change of username or service not allowed:\s*.*\[preauth\]\s*$
++ ^Disconnecting: Too many authentication failures(?: for <F-USER>\S+|.*?</F-USER>)?%(__suff)s$
++ ^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>%(__on_port_opt)s:\s*11:
++ <mdre-<mode>-other>
++ ^<F-MLFFORGET><F-MLFGAINED>Accepted \w+</F-MLFGAINED></F-MLFFORGET> for <F-USER>\S+</F-USER> from <HOST>(?:\s|$)
++
++cmnfailed-any = \S+
++cmnfailed-ignore = \b(?!publickey)\S+
++cmnfailed-invalid = <cmnfailed-ignore>
++cmnfailed-nofail = (?:<F-NOFAIL>publickey</F-NOFAIL>|\S+)
++cmnfailed = <cmnfailed-<publickey>>
++
++mdre-normal =
++# used to differentiate "connection closed" with and without `[preauth]` (fail/nofail cases in ddos mode)
++mdre-normal-other = ^<F-NOFAIL><F-MLFFORGET>(?:Connection (?:closed|reset)|Disconnect(?:ed|ing))</F-MLFFORGET></F-NOFAIL>%(__authng_user)s <ADDR>%(__on_port_opt)s(?:: (?!Too many authentication failures)[^\[]+)?(?: \[preauth\])?\s*$
++
++mdre-ddos = ^(?:Did not receive identification string from|Timeout before authentication for) <HOST>
++ ^kex_exchange_identification: (?:read: )?(?:[Cc]lient sent invalid protocol identifier|[Cc]onnection (?:closed by remote host|reset by peer))
++ ^Bad protocol version identification '(?:[^']|.*?)' (?:from )?<HOST>%(__suff)s$
++ ^<F-NOFAIL>SSH: Server;Ltype:</F-NOFAIL> (?:Authname|Version|Kex);Remote: <HOST>-\d+;[A-Z]\w+:
++ ^Read from socket failed: Connection <F-MLFFORGET>reset</F-MLFFORGET> by peer
++ ^(?:banner exchange|ssh_dispatch_run_fatal): Connection from <HOST><__on_port_opt>: (?:invalid format|(?:message authentication code incorrect|[Cc]onnection corrupted) \[preauth\])
++
++# same as mdre-normal-other, but as failure (without <F-NOFAIL> with [preauth] and with <F-NOFAIL> on no preauth phase as helper to identify address):
++mdre-ddos-other = ^<F-MLFFORGET>(?:Connection (?:closed|reset)|Disconnect(?:ed|ing))</F-MLFFORGET>%(__authng_user)s <ADDR>%(__on_port_opt)s(?:: (?!Too many authentication failures)[^\[]+)?\s+\[preauth\]\s*$
++ ^<F-NOFAIL><F-MLFFORGET>(?:Connection (?:closed|reset)|Disconnect(?:ed|ing))</F-MLFFORGET></F-NOFAIL>%(__authng_user)s <ADDR>(?:%(__on_port_opt)s(?:: (?!Too many authentication failures)[^\[]+)?|\s*)$
++
++mdre-extra = ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:\s*14: No(?: supported)? authentication methods available
++ ^Unable to negotiate with <HOST>%(__on_port_opt)s: no matching <__alg_match> found.
++ ^Unable to negotiate a <__alg_match>
++ ^no matching <__alg_match> found:
++# part of mdre-ddos-other, but user name is supplied (invalid/authenticating) on [preauth] phase only:
++mdre-extra-other = ^<F-MLFFORGET>Disconnected</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\S+|.*?</F-USER> (?:from )?<HOST>%(__on_port_opt)s \[preauth\]\s*$
++
++mdre-aggressive = %(mdre-ddos)s
++ %(mdre-extra)s
++# mdre-extra-other is fully included within mdre-ddos-other:
++mdre-aggressive-other = %(mdre-ddos-other)s
++
++# Parameter "publickey": nofail (default), invalid, any, ignore
++publickey = nofail
++# consider failed publickey for invalid users only:
++cmnfailre-failed-pub-invalid = ^Failed publickey for invalid user <F-USER>(?P<cond_user>\S+)|(?:(?! from ).)*?</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
++# consider failed publickey for valid users too (don't need RE, see cmnfailed):
++cmnfailre-failed-pub-any =
++# same as invalid, but consider failed publickey for valid users too, just as no failure (helper to get IP and user-name only, see cmnfailed):
++cmnfailre-failed-pub-nofail = <cmnfailre-failed-pub-invalid>
++# don't consider failed publickey as failures (don't need RE, see cmnfailed):
++cmnfailre-failed-pub-ignore =
++
++cfooterre = ^<F-NOFAIL>Connection from</F-NOFAIL> <HOST>
++
++failregex = %(cmnfailre)s
++ <mdre-<mode>>
++ %(cfooterre)s
++
++# Parameter "mode": normal (default), ddos, extra or aggressive (combines all)
++# Usage example (for jail.local):
++# [sshd]
++# mode = extra
++# # or another jail (rewrite filter parameters of jail):
++# [sshd-aggressive]
++# filter = sshd[mode=aggressive]
++#
++mode = normal
++
++#filter = sshd[mode=aggressive]
++
++ignoreregex =
++
++maxlines = 1
++
++journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd
++
++# DEV Notes:
++#
++# "Failed \S+ for .*? from <HOST>..." failregex uses non-greedy catch-all because
++# it is coming before use of <HOST> which is not hard-anchored at the end as well,
++# and later catch-all's could contain user-provided input, which need to be greedily
++# matched away first.
++#
++# Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black and Sergey Brester aka sebres
++# Rewritten using prefregex (and introduced "mode" parameter) by Serg G. Brester.