Subject: address remote denial of service CVE-2013-6890 From: Helmut Grohne ssh -l 'Invalid user root from 123.123.123.123' 21.21.21.21 results in a log lines sshd[123]: Invalid user Invalid user root from 123.123.123.123 from 21.21.21.21 sshd[123]: input_userauth_request: invalid user Invalid user root from 123.123.123.123 [preauth] sshd[123]: Connection closed by 21.21.21.21 [preauth] and causes denyhosts to block both ips 21.21.21.21 and 123.123.123.123. This patch tightens the regular expressions used to avoid these and similar injections. Index: denyhosts-2.6/DenyHosts/regex.py =================================================================== --- denyhosts-2.6.orig/DenyHosts/regex.py 2013-12-22 11:54:42.000000000 +0100 +++ denyhosts-2.6/DenyHosts/regex.py 2013-12-22 11:55:05.000000000 +0100 @@ -6,22 +6,22 @@ #DATE_FORMAT_REGEX = re.compile(r"""(?P[A-z]{3,3})\s*(?P\d+)""") -SSHD_FORMAT_REGEX = re.compile(r""".* (sshd.*:|\[sshd\]) (?P.*)""") +SSHD_FORMAT_REGEX = re.compile(r""".*? (sshd.*?:|\[sshd\]) (?P.*)""") #SSHD_FORMAT_REGEX = re.compile(r""".* sshd.*: (?P.*)""") -FAILED_ENTRY_REGEX = re.compile(r"""Failed (?P.*) for (?Pinvalid user |illegal user )?(?P.*?) .*from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""") +FAILED_ENTRY_REGEX = re.compile(r"""Failed (?P\S*) for (?Pinvalid user |illegal user )?(?P.*) from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$""") -FAILED_ENTRY_REGEX2 = re.compile(r"""(?P(Illegal|Invalid)) user (?P.*?) .*from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""") +FAILED_ENTRY_REGEX2 = re.compile(r"""(?P(Illegal|Invalid)) user (?P.*) from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$""") -FAILED_ENTRY_REGEX3 = re.compile(r"""Authentication failure for (?P.*) .*from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""") +FAILED_ENTRY_REGEX3 = None -FAILED_ENTRY_REGEX4 = re.compile(r"""Authentication failure for (?P.*) .*from (?P.*)""") +FAILED_ENTRY_REGEX4 = re.compile(r"""Authentication failure for (?P.*) from (::ffff:)?(?P\S+)$""") -FAILED_ENTRY_REGEX5 = re.compile(r"""User (?P.*) .*from (?P.*) not allowed because none of user's groups are listed in AllowGroups$""") +FAILED_ENTRY_REGEX5 = re.compile(r"""User (?P.*) from (::ffff:)?(?P\S+) not allowed because none of user's groups are listed in AllowGroups$""") -FAILED_ENTRY_REGEX6 = re.compile(r"""Did not receive identification string .*from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""") +FAILED_ENTRY_REGEX6 = re.compile(r"""Did not receive identification string .*from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$""") -FAILED_ENTRY_REGEX7 = re.compile(r"""User (?P.*) from (?P.*) not allowed because not listed in AllowUsers""") +FAILED_ENTRY_REGEX7 = re.compile(r"""User (?P.*) from (::ffff:)?(?P\S+) not allowed because not listed in AllowUsers$""") # these are reserved for future versions @@ -42,7 +42,7 @@ FAILED_ENTRY_REGEX_MAP[i] = rx -SUCCESSFUL_ENTRY_REGEX = re.compile(r"""Accepted (?P.*) for (?P.*?) from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""") +SUCCESSFUL_ENTRY_REGEX = re.compile(r"""Accepted (?P\S+) for (?P.*?) from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$""") TIME_SPEC_REGEX = re.compile(r"""(?P\d*)\s*(?P[smhdwy])?""")