☰

用于 fail2ban 配置文件的正则表达式，用于匹配 mail.log 中的 pregreet 行

tag-icon • tag-icon security postfix regex fail2ban
用于 fail2ban 配置文件的正则表达式，用于匹配 mail.log 中的 pregreet 行

mail.log 中要匹配的行如下：

May  6 10:06:16 mikes-serverbox postfix/postscreen[15486]: PREGREET 14 after 0.1 from [173.225.99.104]:57130: EHLO ylmf-pc\r\n

May  9 11:36:36 mikes-serverbox postfix/postscreen[14463]: PREGREET 26 after 0 from [71.6.232.5]:49432: EHLO zx1.quadmetrics.com\r\n

当我使用 fail2ban-regex 检查正则表达式时，它正确匹配了很多行。

fail2ban-regex /var/log/mail.log "^.*PREGREET \d{1,3} after \d+(\.\d{1,2})? from \[<HOST>\]"

当我使用 fail2ban-regex 检查 fail2ban 配置文件中是否存在相同的正则表达式时，

fail2ban-regex /var/log/mail.log /etc/fail2ban/filter.d/postfix.conf

它与这个正则表达式匹配 3 行

^RCPT from [^[]*\[<HOST>\]%(_port)s: 55[04] 5\.7\.1\s

而我写的正则表达式却没有：

^.*PREGREET \d{1,3} after \d+(\.\d{1,2})? from \[<HOST>\]

postfix.conf 的相关部分是：

prefregex = ^%(__prefix_line)s<mdpr-<mode>> <F-CONTENT>.+</F-CONTENT>$
mdpr-normal = (?:NOQUEUE: reject:|improper command pipelining after \S+)
mdre-normal = ^RCPT from [^[]*\[<HOST>\]%(_port)s: 55[04] 5\.7\.1\s
              ^RCPT from [^[]*\[<HOST>\]%(_port)s: 45[04] 4\.7\.1 (?:Service unavailable\b|Client host rejected: cannot find your (reverse )?hostname\b)
              ^RCPT from [^[]*\[<HOST>\]%(_port)s: 450 4\.7\.1 (<[^>]*>)?: Helo command rejected: Host not found\b
              ^EHLO from [^[]*\[<HOST>\]%(_port)s: 504 5\.5\.2 (<[^>]*>)?: Helo command rejected: need fully-qualified hostname\b
              ^VRFY from [^[]*\[<HOST>\]%(_port)s: 550 5\.1\.1\s
              ^RCPT from [^[]*\[<HOST>\]%(_port)s: 450 4\.1\.8 (<[^>]*>)?: Sender address rejected: Domain not found\b
              ^from [^[]*\[<HOST>\]%(_port)s:?
              ^NOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.5\.2 .*$
              ^.*PREGREET \d{1,3} after \d+(\.\d{1,2})? from \[<HOST>\]
              ^NOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
              ^NOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.1\.1 .*$
              ^improper command pipelining after \S+ from [^[]*\[<HOST>\]:?$
              ^NOQUEUE: reject: RCPT from (.*)\[<HOST>\]: 454 4\.7\.1\.*

问题是：fail2ban 配置文件的正确正则表达式是什么，以匹配 mail.log 中上面提到的行？

答案1

正确的正则表达式是：

prefregex = ^%(__prefix_line)s<mdpr-<mode>> <F-CONTENT>.+</F-CONTENT>$
mdpr-normal = (?:PREGREET|NOQUEUE: reject:|improper command pipelining after \S+)
mdre-normal = mdre-normal = ^RCPT from [^[]*\[<HOST>\]%(_port)s: 55[04] 5\.7\.1\s
              ^RCPT from [^[]*\[<HOST>\]%(_port)s: 45[04] 4\.7\.1 (?:Service unavailable\b|Client host rejected: cannot find your (reverse )?hostname\b)
              ^RCPT from [^[]*\[<HOST>\]%(_port)s: 450 4\.7\.1 (<[^>]*>)?: Helo command rejected: Host not found\b
              ^EHLO from [^[]*\[<HOST>\]%(_port)s: 504 5\.5\.2 (<[^>]*>)?: Helo command rejected: need fully-qualified hostname\b
              ^VRFY from [^[]*\[<HOST>\]%(_port)s: 550 5\.1\.1\s
              ^RCPT from [^[]*\[<HOST>\]%(_port)s: 450 4\.1\.8 (<[^>]*>)?: Sender address rejected: Domain not found\b
              ^from [^[]*\[<HOST>\]%(_port)s:?
              ^NOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.5\.2 .*$
              ^\d{1,3} after \d+(\.\d{1,2})? from [^[]*\[<HOST>\]%(_port)s:?
              ^NOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
              ^NOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.1\.1 .*$
              ^improper command pipelining after \S+ from [^[]*\[<HOST>\]:?$
              ^NOQUEUE: reject: RCPT from (.*)\[<HOST>\]: 454 4\.7\.1\.*

相关内容