Bug#722970: fail2ban: adapt to OpenSSH 6.3

2013-11-09 Thread Colin Watson
On Sat, Nov 09, 2013 at 09:24:40AM -0800, Yaroslav Halchenko wrote: > Just upload new release... I will upload updated fail 2 ban later today OK, on its way into the archive now. Thanks. -- Colin Watson [cjwat...@debian.org] -- To UNSUBSCRIBE, email to d

Bug#722970: fail2ban: adapt to OpenSSH 6.3

2013-11-09 Thread Yaroslav Halchenko
Just upload new release... I will upload updated fail 2 ban later today Colin Watson wrote: >On Fri, Nov 08, 2013 at 11:12:26AM -0500, Yaroslav Halchenko wrote: >> indeed BUT it might help to avoid unforseen injection "vectors" by >> simply specifying the logline format in its entirety (thus >>

Bug#722970: fail2ban: adapt to OpenSSH 6.3

2013-11-09 Thread Colin Watson
On Fri, Nov 08, 2013 at 11:12:26AM -0500, Yaroslav Halchenko wrote: > indeed BUT it might help to avoid unforseen injection "vectors" by > simply specifying the logline format in its entirety (thus > trailing anchor). Opening up the trailer to be anything would not be of > any benefit here OK - w

Bug#722970: fail2ban: adapt to OpenSSH 6.3

2013-11-08 Thread Yaroslav Halchenko
On Fri, 08 Nov 2013, Colin Watson wrote: > > we have adjusted sshd filter upstream already to be > > ^%(__prefix_line)sFailed \S+ for .* from (?: port \d*)?(?: > > ssh\d*)?(: (ruser .{0,100}|(\S+ ID \S+ \(serial \d+\) CA )?\S+ > > %(__md5hex)s(, client user ".{0,100}", client host ".{0,100}")?

Bug#722970: fail2ban: adapt to OpenSSH 6.3

2013-11-08 Thread Colin Watson
On Fri, Nov 08, 2013 at 10:14:23AM -0500, Yaroslav Halchenko wrote: > we have adjusted sshd filter upstream already to be > > ^%(__prefix_line)sFailed \S+ for .* from (?: port \d*)?(?: ssh\d*)?(: > (ruser .{0,100}|(\S+ ID \S+ \(serial \d+\) CA )?\S+ %(__md5hex)s(, client > user ".{0,100}", clie

Bug#722970: fail2ban: adapt to OpenSSH 6.3

2013-11-08 Thread Yaroslav Halchenko
On Fri, 08 Nov 2013, Colin Watson wrote: > On Sat, Sep 14, 2013 at 07:48:49PM -0400, Yaroslav Halchenko wrote: > > cool -- thanks Colin for the heads up. > > I guess that is the code: > > authlog("%s %s%s%s for %s%.100s from %.200s port %d %s%s%s", > > authmsg, > > method, > >

Bug#722970: fail2ban: adapt to OpenSSH 6.3

2013-11-08 Thread Colin Watson
On Sat, Sep 14, 2013 at 07:48:49PM -0400, Yaroslav Halchenko wrote: > cool -- thanks Colin for the heads up. > I guess that is the code: > authlog("%s %s%s%s for %s%.100s from %.200s port %d %s%s%s", > authmsg, > method, > submethod != NULL ? "/" : "", submethod == NULL

Bug#722970: fail2ban: adapt to OpenSSH 6.3

2013-09-14 Thread Yaroslav Halchenko
cool -- thanks Colin for the heads up. I guess that is the code: authlog("%s %s%s%s for %s%.100s from %.200s port %d %s%s%s", authmsg, method, submethod != NULL ? "/" : "", submethod == NULL ? "" : submethod, authctxt->valid ? "" : "invalid user ", authct

Bug#722970: fail2ban: adapt to OpenSSH 6.3

2013-09-14 Thread Colin Watson
Package: fail2ban Version: 0.8.10-3 Severity: important config/filter.d/sshd.conf has: ^%(__prefix_line)sFailed \S+ for .* from (?: port \d*)?(?: ssh\d*)?\s*$ This is likely to break with OpenSSH 6.3: * sshd(8): standardise logging of information during user authentication. Th