github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

BF: vsftp anchoring 

it needed also optional user=, as well as optional (pam_unix) and removed 1 space

also added .examples file for testing
debian-releases/squeeze
Yaroslav Halchenko 2008-01-04 12:02:03 -05:00
parent bce05a1285
commit 33a6a98fea
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
config/filter.d/vsftpd.conf
View File

@ -14,7 +14,7 @@
# (?:::f{4,6}:)?(?P<host>\S+) # (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT # Values: TEXT
# #
failregex = vsftpd(?:\[\d+\])?: .* authentication failure; .* rhost=<HOST>\s*$ failregex = vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authentication failure; .* rhost=<HOST>(?:\s+user=\S*)?\s*$
\[.+\] FAIL LOGIN: Client "<HOST>"\s*$ \[.+\] FAIL LOGIN: Client "<HOST>"\s*$
# Option: ignoreregex # Option: ignoreregex

7
config/filter.d/vsftpd.examples Normal file
View File

@ -0,0 +1,7 @@
#1 PAM based
Oct 11 01:06:47 ServerJV vsftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=209.67.1.67
Feb 6 12:02:29 server vsftpd(pam_unix)[15522]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=64.168.103.1 user=user1
#2 Internal
Fri Jan 19 12:20:33 2007 [pid 27202] [anonymous] FAIL LOGIN: Client "64.106.46.98"