github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

ENH: filter gssftpd is a syslog based service so anchor it using syslog prefix

pull/357/head
Daniel Black 2013-09-17 07:25:23 +10:00
parent bb32295b50
commit 13ec9d58c0
2 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@ -68,6 +68,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
and extra failure examples in sample logs and extra failure examples in sample logs
* filter.d/apache-auth - added expressions for mod_authz, mod_auth and * filter.d/apache-auth - added expressions for mod_authz, mod_auth and
mod_auth_digest failures. mod_auth_digest failures.
* filter.d/gssftpd - anchored regex at start
Daniel Black & Georgiy Mernov & ftoppi & Мернов Георгий Daniel Black & Georgiy Mernov & ftoppi & Мернов Георгий
* filter.d/exim.conf -- regex hardening and extra failure examples in * filter.d/exim.conf -- regex hardening and extra failure examples in
sample logs sample logs

21
config/filter.d/gssftpd.conf
View File

@ -1,19 +1,18 @@
# Fail2Ban configuration file for wuftpd # Fail2Ban configuration file for gssftp
# #
# Author: Kevin Zembower (copied from wsftpd.conf) # Author: Kevin Zembower
# Edited: Daniel Black - syslog based daemon
# #
# Note: gssftp is part of the krb5-appl-servers in Fedora
# #
[INCLUDES]
before = common.conf
[Definition] [Definition]
# Option: failregex _daemon = ftpd
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT failregex = ^%(__prefix_line)srepeated login failures from <HOST> \(\S+\)$
#
failregex = ftpd(?:\[\d+\])?:\s+repeated login failures from <HOST> \(\S+\)$
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex = ignoreregex =