github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity
fail2ban/testcases/files/logs/proftpd

17 lines
2.2 KiB
Plaintext
Raw Normal View History

TST: Test sample logs' entries are matched by filter regexs
2013-07-13 22:03:01 +00:00
# failJSON: { "time": "2005-01-10T00:00:00", "match": true , "host": "123.123.123.123" }
Adding log samples accumulated in Debian branch
2011-11-18 16:55:46 +00:00
Jan 10 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username (Login failed): User in /etc/ftpusers
TST: Test sample logs' entries are matched by filter regexs
2013-07-13 22:03:01 +00:00
# failJSON: { "time": "2005-02-01T00:00:00", "match": true , "host": "123.123.123.123" }
Adding log samples accumulated in Debian branch
2011-11-18 16:55:46 +00:00
Feb 1 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username: no such user found from 123.123.123.123 [123.123.123.123] to 234.234.234.234:21
TST: Test sample logs' entries are matched by filter regexs
2013-07-13 22:03:01 +00:00
# failJSON: { "time": "2005-06-09T07:30:58", "match": true , "host": "67.227.224.66" }
ENH: proftp regex hardening and log messages
2013-06-13 12:11:05 +00:00
Jun 09 07:30:58 platypus.ace-hosting.com.au proftpd[11864] platypus.ace-hosting.com.au (mail.bloodymonster.net[::ffff:67.227.224.66]): USER username (Login failed): Incorrect password.
TST: Test sample logs' entries are matched by filter regexs
2013-07-13 22:03:01 +00:00
# failJSON: { "time": "2005-06-09T11:15:43", "match": true , "host": "101.71.143.238" }
ENH: proftp regex hardening and log messages
2013-06-13 12:11:05 +00:00
Jun 09 11:15:43 platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.com.au (::ffff:101.71.143.238[::ffff:101.71.143.238]): USER god: no such user found from ::ffff:101.71.143.238 [::ffff:101.71.143.238] to ::ffff:123.212.99.194:21
TST: Test sample logs' entries are matched by filter regexs
2013-07-13 22:03:01 +00:00
# failJSON: { "time": "2005-06-13T22:07:23", "match": true , "host": "59.167.242.100" }
ENH: proftp regex hardening and log messages
2013-06-13 12:11:05 +00:00
Jun 13 22:07:23 platypus.ace-hosting.com.au proftpd[15719] platypus.ace-hosting.com.au (::ffff:59.167.242.100[::ffff:59.167.242.100]): SECURITY VIOLATION: root login attempted.
TST: Test sample logs' entries are matched by filter regexs
2013-07-13 22:03:01 +00:00
# failJSON: { "time": "2005-06-14T00:09:59", "match": true , "host": "59.167.242.100" }
ENH: injection of fail data into USER field
2013-06-13 14:17:41 +00:00
Jun 14 00:09:59 platypus.ace-hosting.com.au proftpd[17839] platypus.ace-hosting.com.au (::ffff:59.167.242.100[::ffff:59.167.242.100]): USER platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.com.au (hihoinjection[1.2.3.44]): no such user found from ::ffff:59.167.242.100 [::ffff:59.167.242.100] to ::ffff:113.212.99.194:21
ENH: Tweak proftpd regex and add sample logs Needed to add optional ":" post __pid_re, and for consistency, decided to make use of __prefix_line instead which includes this.
2013-07-21 21:03:49 +00:00
# failJSON: { "time": "2005-05-31T10:53:25", "match": true , "host": "1.2.3.4" }
May 31 10:53:25 mail proftpd[15302]: xxxxxxxxxx (::ffff:1.2.3.4[::ffff:1.2.3.4]) - Maximum login attempts (3) exceeded
# failJSON: { "time": "2004-12-05T15:44:32", "match": true , "host": "1.2.3.4" }
Dec 5 15:44:32 serv1 proftpd[70944]: serv1.domain.com (example.com[1.2.3.4]) - USER jtittle@domain.org: no such user found from example.com [1.2.3.4] to 1.2.3.4:21