Create Fail2ban Rule for Named

Question

As I am trying to create a rule for Fail2ban which seems to me missing for a long while as I being really nerved by in the past I'm also willing to submit it to the world :-)

What's been done?

1. Already created a file under fail2ban/filter/named-antispam.conf

2. Created it with content

    #cat filter.d/named-antispam.conf
    [Definition]
    prefregex = ([a-zA-Z][a-zA-Z][a-zA-Z])\s([0-9]|[0-9][0-9])\s([0-9][0-9]):([0-9][0-9]:[0-9][0-9])
    failregex = ^rate limit drop all response to <HOST>$

and jail.conf

#Disabled for Writing this Articel
[named-antispam]
enabled = false
filter = named-antispam
logpath  = /var/log/named/rate.log
bantime      = 2628000
maxretry     = 30
findtime     = 60

3. checked what happen to fail2ban if I enable it and set to it debug?

2021-01-26 11:25:19,461 fail2ban.filterpyinotify[14180]: DEBUG   Event queue size: 16
2021-01-26 11:25:19,462 fail2ban.filterpyinotify[14180]: DEBUG   <_RawEvent cookie=0 mask=0x2 name='' wd=2 >

If I disable the rule I can set debug without that error - so it seems to me that I have some kind of error which I can't figure out and that's why I ask here. and at the Ending - yes i have a lot of entrys in my log but fail2ban does not care off

Answer 1

You did not provide what is the issue basically, moreover neither a log excerpt with messages you want to catch in filter, nor the atempt what fail2ban-regex -v find with filter.

I guess the message looks like:

Jan 26 14:00:10 srv named[26403]: client 192.0.2.100#21324 (example.com): rate limit drop all response to 192.0.2.0/24

Then here are 2 things to note - firstly the IP is after client (here 192.0.2.100), and at end it has a subnet (IP/CIDR notation, here 192.0.2.0/24).

If you want to ban a subnet (if your fail2ban and choosen banaction are able to ban subnets at all), you can use depending on your version:

either this (if your fail2ban supports <SUBNET>):

failregex = ^\s*\S+\s+named(?:\[\d+\])?: [^:]+: rate limit drop all response to <SUBNET>

or this:

failregex = ^\s*\S+\s+named(?:\[\d+\])?: [^:]+: rate limit drop all response to (?:<F-IP4>\d+\.\S+</F-IP4>|<F-IP6>\w+\:\S+</F-IP6>)

You can also ban IP instead of subnet, then use either this one:

failregex = ^\s*\S+\s+named(?:\[\d+\])?: client <ADDR>[^:]*: rate limit drop all response

You can also check it with fail2ban-regex, for example:

msg='Jan 26 14:00:10 srv named[26403]: client 192.0.2.100#21324 (example.com): rate limit drop all response to 192.0.2.0/24'
fail2ban-regex "$msg" '^\s*\S+\s+named(?:\[\d+\])?: [^:]+: rate limit drop all response to <SUBNET>'
...
Lines: 1 lines, 0 ignored, 1 matched, 0 missed

or to test the filter with a log-file use this:

fail2ban-regex /var/log/named/rate.log named-antispam

---

As for your prefregex and failregex - they are just not correct. Neither prefregex nor failregex must contain a part with timestamp matching datepattern (read a how-to's in our wiki or manual, it contains: NOTE: the failregex will be applied to the remaining part of message after prefregex processing (if specified), which in turn takes place after datepattern processing (whereby the string of timestamp matching the best pattern, cut out from the message).

Also prefregex makes sense, if you need some prefiltering, for instance you have more than one failregex (and such a regex's will be applied either on whole part of line, or on part matched RE enclosed between <F-CONTENT> and </F-CONTENT>, if it is specified. If no prefiltering expected, prefregex makes few sense.

Anyway if you need it for some reason, it would look like this:

prefregex = ^\s*\S+\s+named(?:\[\d+\])?: <F-CONTENT>.+</F-CONTENT>$ 

failregex = ^[^:]+: rate limit drop all response to <SUBNET>
#failregex = ^[^:]+: rate limit drop all response to (?:<F-IP4>\d+\.\S+</F-IP4>|<F-IP6>\w+\:\S+</F-IP6>)
#failregex = ^client <ADDR>[^:]*: rate limit drop all response