github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

combine both REs to single RE, no prefregex needed here

pull/4075/head
sebres 2025-09-24 16:23:05 +02:00
parent a9401233dd
commit 13563fd09b
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
config/filter.d/froxlor-auth.conf
View File

@ -20,15 +20,15 @@ before = common.conf
[DEFAULT]
_daemon = [Ff]roxlor
_re = (?:Unknown )?[uU]ser(?: '<F-USER>(?:\S*|[^']*)</F-USER>')? tried to login(?: with wrong password)?\.
[type1]
prefregex = ^%(__prefix_line)s\[Login Action <HOST>\] <F-CONTENT>.+</F-CONTENT>$
failregex = ^%(__prefix_line)s\[Login Action <ADDR>\] %(_re)s$
[type2]
prefregex = ^%(__prefix_line)sfroxlor\.WARNING: <F-CONTENT>.+</F-CONTENT> \{(?:"[^"]+":"[^"]*",\s*){,5}"user":"<ADDR>"\} \[\]$
failregex = ^%(__prefix_line)sfroxlor\.WARNING: %(_re)s \{(?:"[^"]+":"[^"]*",\s*){,5}"user":"<ADDR>"\} \[\]$
[Definition]
type = 2
prefregex = <type<type>/prefregex>
failregex = ^Unknown user(?: <F-USER>\S*</F-USER>)? tried to login\.$
^User(?: <F-USER>\S*</F-USER>)? tried to login with wrong password\.$
failregex = <type<type>/failregex>
ignoreregex =