github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Update oracleims.conf to be 'less greedy' 

This assumes that the protocol is always a string, which it always is, and that the other four fields in the "tr" are always numeric (which they always are).  See port_access documentation at http://docs.oracle.com/cd/E19563-01/819-4428/bgaur/index.html
pull/734/head
JoelSnyder 2014-06-09 18:44:27 -07:00
parent c325e88634
commit 5165d2f6ea
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
config/filter.d/oracleims.conf
View File

@ -45,12 +45,14 @@ before = common.conf
# mi="Bad password"
# us="01ko8hqnoif09qx0np@imap.opus1.com"
# di="535 5.7.8 Bad username or password (Authentication failed)."/>
# Format is generally documented in the PORT_ACCESS mapping
# at http://docs.oracle.com/cd/E19563-01/819-4428/bgaur/index.html
#
# All that would be on one line.
# Note that you MUST have LOG_FORMAT=4 for this to work!
#
failregex = ^.*tr=".*\|.*\|\d+\|<HOST>\|\d+" .+ Bad username or password.*"/>$
failregex = ^.*tr="[A-Z]+\|[0-9.]+\|\d+\|<HOST>\|\d+" .+ Bad username or password.*"/>$
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.