From 46386412a4eaabb659f0226dfafa6f6cb1d6fb81 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 5 Oct 2013 20:01:43 +1000
Subject: [PATCH] ENH: filter.d/vsftpd - pam regex as syslog and anchored at
 start

---
 ChangeLog                   | 1 +
 config/filter.d/vsftpd.conf | 9 ++++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 46b125287..cfbe9fd6c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -76,6 +76,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
    * filter.d/apache-auth - added expressions for mod_authz, mod_auth and
      mod_auth_digest failures.
    * filter.d/recidive -- support f2b syslog target and anchor regex at start
+   * filter.d/vsftpd - anchored regex at start. disable old pam format regex
    * filter.d/pam-generic - added syslog prefix. Disabled support for
      linux-pam before version 0.99.2.0 (2005)
    * filter.d/gssftpd - anchored regex at start
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index 3aaf168de..661fbb610 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -4,8 +4,15 @@
 #
 #
 
+[INCLUDES]
+
+before = common.conf
+
 [Definition]
 
+__pam_re=\(?pam_unix(?:\(\S+\))?\)?:?
+_daemon =  vsftpd
+
 # Option: failregex
 # Notes.: regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
@@ -13,7 +20,7 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values: TEXT
 #
-failregex = vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authentication failure; .* rhost=<HOST>(?:\s+user=\S*)?\s*$
+failregex = ^%(__prefix_line)s%(__pam_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty= ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
             ^ \[pid \d+\] \[.+\] FAIL LOGIN: Client "<HOST>"\s*$
 
 # Option:  ignoreregex