fail2ban/config/filter.d/guacamole.conf

# Fail2Ban configuration file for guacamole
#
# Author: Steven Hiscocks
#

[Definition]

logging = catalina
failregex = <L_<logging>/failregex>
maxlines = <L_<logging>/maxlines>
datepattern = <L_<logging>/datepattern>

[L_catalina]

failregex = ^.*\nWARNING: Authentication attempt from <HOST> for user "[^"]*" failed\.$

maxlines = 2

datepattern = ^%%b %%d, %%ExY %%I:%%M:%%S %%p
              ^WARNING:()**
              {^LN-BEG}

[L_webapp]

failregex = ^ \[\S+\] WARN  \S+ - Authentication attempt from <HOST> for user "<F-USER>[^"]+</F-USER>" failed.

maxlines = 1

datepattern = ^%%H:%%M:%%S.%%f

# DEV Notes:
#
# failregex is based on the default pattern given in Guacamole documentation :
# https://guacamole.apache.org/doc/gug/configuring-guacamole.html#webapp-logging
#
# The following logback.xml Guacamole configuration file can then be used accordingly :
# <configuration>
#   <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
#     <file>/var/log/guacamole.log</file>
#     <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
#       <fileNamePattern>/var/log/guacamole.%d.log.gz</fileNamePattern>
#       <maxHistory>32</maxHistory>
#     </rollingPolicy>
#     <encoder>
#       <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
#     </encoder>
#   </appender>
#   <root level="info">
#     <appender-ref ref="FILE" />
#   </root>
# </configuration>
ENH+DOC: Add Guacamole filter, example log and jail 2013-04-16 20:13:31 +00:00			`# Fail2Ban configuration file for guacamole`
			`#`
			`# Author: Steven Hiscocks`
			`#`

			`[Definition]`

Enhance Guacamole jail 2020-02-26 09:41:55 +00:00			`logging = catalina`
			`failregex = <L_<logging>/failregex>`
			`maxlines = <L_<logging>/maxlines>`
			`datepattern = <L_<logging>/datepattern>`
ENH+DOC: Add Guacamole filter, example log and jail 2013-04-16 20:13:31 +00:00
Enhance Guacamole jail 2020-02-26 09:41:55 +00:00			`[L_catalina]`

			`failregex = ^.\nWARNING: Authentication attempt from <HOST> for user "[^"]" failed\.$`
ENH: Move jail `maxlines` to filter config 2013-04-18 21:11:41 +00:00
			`maxlines = 2`
more precise date template handling (WARNING: this commit creates possible incompatibilities): - datedetector rewritten more strict as earlier; - default templates can be specified exacter using prefix/suffix syntax (via `datepattern`); - more as one date pattern can be specified using option `datepattern` now (new-line separated); - some default options like `datepattern` can be specified directly in section `[Definition]`, that avoids contrary usage of unnecessarily `[Init]` section, because of performance (each extra section costs time); - option `datepattern` can be specified in jail also (jails without filters); - if first group specified, only this will be cut out from search log-line (e. g.: `^date:[({DATE})]` will cut out only datetime match pattern, and leaves `date:[] failure ip...` for searching in filter); - faster match and fewer searching of appropriate templates (DateDetector.matchTime calls rarer DateTemplate.matchDate now); - standard filters extended with exact prefixed or anchored date templates; template cache introduced (in opposition to default template cache, holds custom templates cached by pattern for possible common usage of same template/regex); 2016-10-07 12:57:45 +00:00
			`datepattern = ^%%b %%d, %%ExY %%I:%%M:%%S %%p`
			`^WARNING:()**`
Enhance Guacamole jail 2020-02-26 09:41:55 +00:00			`{^LN-BEG}`

			`[L_webapp]`

			`failregex = ^ \[\S+\] WARN \S+ - Authentication attempt from <HOST> for user "<F-USER>[^"]+</F-USER>" failed.`

			`maxlines = 1`

			`datepattern = ^%%H:%%M:%%S.%%f`

			`# DEV Notes:`
			`#`
			`# failregex is based on the default pattern given in Guacamole documentation :`
			`# https://guacamole.apache.org/doc/gug/configuring-guacamole.html#webapp-logging`
			`#`
			`# The following logback.xml Guacamole configuration file can then be used accordingly :`
			`# <configuration>`
			`# <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">`
			`# <file>/var/log/guacamole.log</file>`
			`# <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">`
			`# <fileNamePattern>/var/log/guacamole.%d.log.gz</fileNamePattern>`
			`# <maxHistory>32</maxHistory>`
			`# </rollingPolicy>`
			`# <encoder>`
			`# <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>`
			`# </encoder>`
			`# </appender>`
			`# <root level="info">`
			`# <appender-ref ref="FILE" />`
			`# </root>`
			`# </configuration>`