github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Update murmur.conf 

Support for multiline logging.
This will catch cases where the exception is thrown on the next line.
Ie, these:

<W>2024-11-13 07:29:21.851 1 => <0:(-1)> New connection: 91.238.000.00:65070
<W>2024-11-13 07:29:21.859 1 => <0:(-1)> Connection closed: Error during SSL handshake: error:0A00010B:SSL routines::wrong version number [13]
pull/3883/head
dankmaster 2024-11-15 13:32:24 +01:00 committed by GitHub
parent 12ff98027f
commit 2997843278
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
config/filter.d/murmur.conf
View File

@ -16,16 +16,13 @@ __prefix_journal = (?:\S+\s+%(_daemon)s\[\d+\]:(?:\s+\<W\>[\d\-]+ [\d:]+.\d+)?)
__prefix_line = %(__prefix_journal)s? __prefix_line = %(__prefix_journal)s?
_prefix = %(__prefix_line)s\s+\d+ => <\d+:%(_usernameregex)s\(-1\)> Rejected connection from <HOST>:\d+: maxlines = 2
prefregex = ^%(_prefix)s <F-CONTENT>.+</F-CONTENT>$ failregex = ^\s*\d+ => <.*> Rejected connection from <HOST>:\d+: Invalid server password$
^\s*\d+ => <.*> Rejected connection from <HOST>:\d+: Wrong certificate or password for existing user$
^\s*\d+ => <.*> New connection: <HOST>:\d+\s+^\s*\d+ => <.*> Connection closed: Error during SSL handshake: error:.*:wrong version number \[\d+\]$ignoreregex =
failregex = ^Invalid server password$ datepattern = ^<\w>%%Y-%%m-%%d %%H:%%M:%%S\.%%f
^Wrong certificate or password for existing user$
ignoreregex =
datepattern = ^<W>{DATE}
journalmatch = _SYSTEMD_UNIT=murmurd.service + _COMM=murmurd journalmatch = _SYSTEMD_UNIT=murmurd.service + _COMM=murmurd