fail2ban/fail2ban — pull request #733 by JoelSnyder (2014-06-03 02:22:29+00:00)
Title: 0.8

Oracle IMS (also called Oracle Communications Unified Communications Suite) is an enterprise-class messaging server; it's effectively the great-grandchild of the Netscape Mail Server and Innosoft's PMDF, with some LDAP ancestry in between.

I implemented a filter for this server and wanted to contribute it back (if you guys want it) to the pile. I'm not sure of the exact format you want changes, but fundamentally I'm contributing a file "oracleims.conf" to the filter.d directory, plus a bit of documentation.

For IMS, the difficulty is that the log files are very system-manager configurable. We are using LOG_FORMAT=4 (the XML format), and so it is fairly simple to get the information you want. So this will work with anyone who is using that format, which would be typical.

oracleims.conf:

---------------------------------------------------------
# Fail2Ban configuration file
# for Oracle IMS with XML logging
#
# Author: Joel Snyder/jms@opus1.com/2014-June-01
#
#
# Example inclusion in jail.local
#[oracleims-iptables]
#
#enabled = true
#filter = oracleims
#action = iptables-allports[name=ORACLEIMS]
# sendmail[name=ORACLEIMS, dest=support@, #sender=fail2ban@]
#logpath = /opt/sun/comms/messaging64/log/mail.log_current
#maxretry = 5

[INCLUDES]

# Read common prefixes.
# If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages
# in the logfile. The host must be matched by a
# group named "host". The tag "" can
# be used for standard IP/hostname matching and is
# only an alias for
# (?:::f{4,6}:)?(?P[\w\-.^_]+)
# Values: TEXT
#
#
# Typical line IF YOU ARE USING TAGGING ! ! ! is:
#
#
# All that would be on one line.
# Note that you MUST have LOG_FORMAT=4 for this to work!
#
# Many of these sub-fields are optional and can be turned on and off
# by the system manager. We need the "tr" field
# (transport information (present if bit 5 of LOG_CONNECTION is
# set and transport information is available))
# and we depend on the "di" field being present.
# You could say "look, mi is so much simpler"
# but mi is only present if LOG_MESSAGE_ID is set.
# We can't work without tr, but we can get the info
# out of di.

failregex = ^.*tr=".*\|.*\|\d+\|\|\d+" .+ Bad username or password.*"/>$

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

---------------------------