On Thu, 11 Jul 2013, Daniel Black wrote:

>  > +            ^%(_apache_error_client)s invalid nonce .* received - (length|hash) is not \S+\s*$
>  > +            ^%(_apache_error_client)s invalid nonce .* received - user attempted time travel\s*$
>  > +            ^%(_apache_error_client)s user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
>  > +            ^%(_apache_error_client)s user .*: one-time-nonce mismatch - sending new nonce\s*$

>      are there known attack vectors exercising some bugs in nonce code or
>      smth like that?

>    Not that I know of.

>      I am still not sure if banning on something occurring in
>      regular use is something we should by default do here.

>    A correctly implemented client will never trigger these errors. A poorly
>    implemented brute forcing tool probably will.

I thought you said that nonce could expire thus leading to "sending new
nonce".

>      well... what if many users come through the same proxy? ... once again
>      -- unless there is a very good reason, we should not ban on messages
>      associated with non-malicious use.

>    This is not new behaviour. The apache-auth regex, before it was broken,
>    has always caught the original fail. I've not introduced new behaviour
>    here, just a bunch of regexs that match the same behaviour for different
>    authentication types.

I am talking here about nonce's -- we haven't had those before, and they are
introduced now.  I am ok with all the authentication failregexes -- Thanks btw
-- it is nonce's which worry me.  On my side -- I see few of those indeed
not following too closely in time, but that is only me using the https server
there:

   www.XXX-ssl-error.log.8.gz:[Wed May 15 21:39:09 2013] [error] [client 1.2.3.4] Digest: invalid nonce 0WCBvsbcBAA=74599a088b6d334cfd7041012bac139971038ac4 received - hash is not c16b8de9cb68361488598820648f09859eb93f97

once again -- that is under normal non-malicious use... and me alone (so with
more users -- would be more!)...  since the filter is 'apache-auth' and this
has nothing to do with authentication per se, I would vote to move them
aside, e.g. apache-ssl-abuse or smth like that so the two (authentication and
abuse) are not mixed together.


-- 
Yaroslav O. Halchenko, Ph.D.
http://neuro.debian.net http://www.pymvpa.org http://www.fail2ban.org
Senior Research Associate,     Psychological and Brain Sciences Dept.
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
Phone: +1 (603) 646-9834                       Fax: +1 (603) 646-1419
WWW:   http://www.linkedin.com/in/yarik