2015-11-29 15:56:56 +00:00
|
|
|
# Fail2Ban filter for murmur/mumble-server
|
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
[Definition]
|
|
|
|
|
|
|
|
|
|
_daemon = murmurd
|
|
|
|
|
|
2015-12-17 17:45:24 +00:00
|
|
|
# N.B. If you allow users to have usernames that include the '>' character you
|
|
|
|
|
# should change this to match the regex assigned to the 'username'
|
|
|
|
|
# variable in your server config file (murmur.ini / mumble-server.ini).
|
|
|
|
|
_usernameregex = [^>]+
|
|
|
|
|
|
2018-02-09 10:43:55 +00:00
|
|
|
# Prefix for systemd-journal (with second date-pattern as optional match):
|
|
|
|
|
#
|
|
|
|
|
__prefix_journal = (?:\S+\s+%(_daemon)s\[\d+\]:(?:\s+\<W\>[\d\-]+ [\d:]+.\d+)?)
|
|
|
|
|
|
|
|
|
|
__prefix_line = %(__prefix_journal)s?
|
|
|
|
|
|
|
|
|
|
_prefix = %(__prefix_line)s\s+\d+ => <\d+:%(_usernameregex)s\(-1\)> Rejected connection from <HOST>:\d+:
|
2015-12-17 17:45:24 +00:00
|
|
|
|
2017-02-21 14:54:59 +00:00
|
|
|
prefregex = ^%(_prefix)s <F-CONTENT>.+</F-CONTENT>$
|
|
|
|
|
|
|
|
|
|
failregex = ^Invalid server password$
|
|
|
|
|
^Wrong certificate or password for existing user$
|
2015-11-29 15:56:56 +00:00
|
|
|
|
|
|
|
|
ignoreregex =
|
|
|
|
|
|
2016-10-05 17:34:21 +00:00
|
|
|
datepattern = ^<W>{DATE}
|
2015-11-29 15:56:56 +00:00
|
|
|
|
2018-02-09 10:43:55 +00:00
|
|
|
journalmatch = _SYSTEMD_UNIT=murmurd.service + _COMM=murmurd
|
|
|
|
|
|
2015-11-29 15:56:56 +00:00
|
|
|
# DEV Notes:
|
|
|
|
|
#
|
|
|
|
|
# Author: Ross Brown
|
