ghost
commented
6 years ago I just tested around and that's the response I get when trying it manually with the provided info out of my fail2ban logfiles:
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 2a00:xxxx:x:xxxx::x...
* TCP_NODELAY set
* Trying xxx.xxx.xxx.xxx...
* TCP_NODELAY set
* Connected to www.blocklist.de (xxx.xxx.xxx.xxx) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
} [5 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [107 bytes data]
* NPN, negotiated HTTP1.1
{ [5 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [2871 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [333 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [70 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Unknown (67):
} [36 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
{ [1 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: OU=Domain Control Validated; CN=*.blocklist.de
* start date: Dec xxx.xxx.xxx.xxx 2017 GMT
* expire date: Jan xxx.xxx.xxx.xxx 2019 GMT
* subjectAltName: host "www.blocklist.de" matched cert's "*.blocklist.de"
* issuer: C=BE; O=GlobalSign nv-sa; CN=AlphaSSL CA - SHA256 - G2
* SSL certificate verify ok.
} [5 bytes data]
> POST /en/httpreports.html HTTP/1.1
> Host: www.blocklist.de
> User-Agent: Fail2Ban/0.10.2
> Accept: */*
> Content-Length: 110
> Content-Type: application/x-www-form-urlencoded
>
} [110 bytes data]
* upload completely sent off: 110 out of 110 bytes
{ [5 bytes data]
< HTTP/xxx.xxx.xxx.xxx Bad Request
< Server: nginx/1.12.2
< Date: Sat, 03 Feb xxx.xxx.xxx.xxx:46 GMT
< Content-Type: text/html; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Keep-Alive: timeout=20
< X-Frame-Options: sameorigin
<
{ [93 bytes data]
100 192 0 82 100 110 178 239 --:--:-- --:--:-- --:--:-- 418
* Connection #0 to host www.blocklist.de left intact
logs: Please insert the Logfiles, and more than 20 Signs.<br />status: error<br />
sebres
Environment:
The issue:
After updating to the latest version an error occured within the resolve of variables (e.g: \<matches>) which get passed to specific filters (blocklist_de in this case). I already checked everything and didn't find the root cause which leads to that behaviour. As a result all generated reports get denied by blocklist.de since they miss correct log files and only pass a
$f2bV_matches.Another little addition to the checkbox about customizations above: I added my blocklist-API key in the [DEFAULT] section of my jail.config as described in the commented area from the corresponding jail.
Steps to reproduce
Activate the 'blocklist_de' action in the jail.config / jail.local file and wait till F2B gets 3 failed attempts in its authentification log. Check the fail2ban log after that and inspect the same error I described above.
Expected behavior
F2B should send a curl request containing sender adress, api key, bantime, service category and the corresponding logs in a url-encoded text format.
Observed behavior
F2B returns an error stating that the request got denied, if I remove the --fail parameter from the action file I get the following text back from blocklist.de: logs:
Any additional information
It seems like the variable
$f2bV_matchesgets passed at it is instead of resolving it into the log excerpt. Other webmasters are experiencing those issues too, as you can see right here: https://forum.blocklist.de/viewtopic.php?f=4&t=678 (it's in German though).Configuration, dump and another helpful excerpts
jail.config
Any customizations done to /etc/fail2ban/ configuration
Relevant parts of /var/log/fail2ban.log file:
preferably obtained while running fail2ban with
loglevel = 4fail2ban.log
Relevant lines from monitored log files in question:
auth.log