From 5ed0f7f90aa748e1d64879d1b81df447702cc190 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 10 Sep 2009 12:04:42 -0400
Subject: [PATCH] BF: proftpd filter -- if login failed -- count regardless of
 the reason for failure

---
 config/filter.d/proftpd.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index eb43a14d..55a15da9 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -15,7 +15,7 @@
 # Values: TEXT
 #
 failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+ *$
-            \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): Incorrect password\. *$
+            \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): .*$
             \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\. *$
             \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$