Github messages for voidlinux
 help / color / mirror / Atom feed
* [PR PATCH] fail2ban: add filter for sshd with socklog
@ 2023-07-11  0:54 dexgs
  2023-07-11 17:16 ` MeganerdNL
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: dexgs @ 2023-07-11  0:54 UTC (permalink / raw)
  To: ml

[-- Attachment #1: Type: text/plain, Size: 1826 bytes --]

There is a new pull request by dexgs against master on the void-packages repository

https://github.com/dexgs/void-packages fail2ban
https://github.com/void-linux/void-packages/pull/44977

fail2ban: add filter for sshd with socklog
The sshd filter distributed with fail2ban does not work properly with socklog out of the box.

Ideally, socklog would have comprehensive support upstream, but the configuration to make it work with *just* sshd is very straighforward and the fail2ban package should be able to protect sshd out of the box with void's preferred syslog implementation.

This change doesn't override any of fail2ban's default configuration. It adds a new filter defined in `sshd-socklock.conf` which inherits from the default `sshd.conf` and overrides only what is needed to make it work.

<!-- Uncomment relevant sections and delete options which are not applicable -->

#### Testing the changes
- I tested the changes in this PR: **YES**

<!--
#### New package
- This new package conforms to the [package requirements](https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#package-requirements): **YES**|**NO**
-->

<!-- Note: If the build is likely to take more than 2 hours, please add ci skip tag as described in
https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#continuous-integration
and test at least one native build and, if supported, at least one cross build.
Ignore this section if this PR is not skipping CI.
-->
<!--
#### Local build testing
- I built this PR locally for my native architecture, (ARCH-LIBC)
- I built this PR locally for these architectures (if supported. mark crossbuilds):
  - aarch64-musl
  - armv7l
  - armv6l-musl
-->


A patch file from https://github.com/void-linux/void-packages/pull/44977.patch is attached

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-fail2ban-44977.patch --]
[-- Type: text/x-diff, Size: 2185 bytes --]

From fb077616b6dd62e8c617574897da88143c73d0a2 Mon Sep 17 00:00:00 2001
From: Dexter Gaon-Shatford <dexter.gaonshatford@gmail.com>
Date: Mon, 10 Jul 2023 20:48:08 -0400
Subject: [PATCH] fail2ban: add filter for sshd with socklog

The sshd filter distributed with fail2ban does not work properly with
socklog out of the box.

Ideally, socklog would have comprehensive support upstream, but the
configuration to make it work with *just* sshd is very straighforward and
the fail2ban package should be able to protect sshd out of the box with
void's preferred syslog implementation.

This change doesn't override any of fail2ban's default configuration. It
adds a new filter defined in `sshd-socklock.conf` which inherits from
the default `sshd.conf` and overrides only what is needed to make it work.
---
 srcpkgs/fail2ban/files/filter.d/sshd-socklog.conf | 12 ++++++++++++
 srcpkgs/fail2ban/template                         |  3 ++-
 2 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 srcpkgs/fail2ban/files/filter.d/sshd-socklog.conf

diff --git a/srcpkgs/fail2ban/files/filter.d/sshd-socklog.conf b/srcpkgs/fail2ban/files/filter.d/sshd-socklog.conf
new file mode 100644
index 000000000000..dc6cc6e05444
--- /dev/null
+++ b/srcpkgs/fail2ban/files/filter.d/sshd-socklog.conf
@@ -0,0 +1,12 @@
+# Fail2Ban filter for openssh, modified to work with socklog on Void Linux.
+#
+# The default logpath for sshd's output under socklog is
+# /var/log/socklog/secure/current
+
+[INCLUDES]
+before = sshd.conf
+
+[Definition]
+prefregex = ^ auth[a-z]*\.[a-z]+: \w{3} \d{2} \d{2}:\d{2}:\d{2} <F-MLFID><_daemon><__pid_re></F-MLFID>: <F-CONTENT>.+</F-CONTENT>$
+
+# Author: Dexter Gaon-Shatford
diff --git a/srcpkgs/fail2ban/template b/srcpkgs/fail2ban/template
index 6538155a42a4..1b9b021cfe57 100644
--- a/srcpkgs/fail2ban/template
+++ b/srcpkgs/fail2ban/template
@@ -1,7 +1,7 @@
 # Template file for 'fail2ban'
 pkgname=fail2ban
 version=1.0.2
-revision=1
+revision=2
 build_style=python3-module
 hostmakedepends="pkg-config python3"
 depends="python3"
@@ -25,4 +25,5 @@ pre_build() {
 
 post_install() {
 	vsv fail2ban
+	vcopy ${FILESDIR}/filter.d/*.conf etc/fail2ban/filter.d
 }

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-10-25  1:45 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-11  0:54 [PR PATCH] fail2ban: add filter for sshd with socklog dexgs
2023-07-11 17:16 ` MeganerdNL
2023-07-11 17:16 ` MeganerdNL
2023-07-11 17:25 ` MeganerdNL
2023-10-10  1:45 ` github-actions
2023-10-25  1:45 ` [PR PATCH] [Closed]: " github-actions

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).