github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Update froxlor-auth.conf 

updated the regex to the new logging situation for froxlor.
pull/4075/head
para-do-x 2025-09-22 09:46:46 +04:00 committed by sebres
parent 65668b8ed8
commit 897b21a4c5
1 changed files with 8 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
config/filter.d/froxlor-auth.conf
View File

@ -1,11 +1,13 @@
# Fail2Ban configuration file to block repeated failed login attempts to Frolor installation(s)
#
# Froxlor needs to log to Syslog User (e.g. /var/log/user.log) with one of the following messages
# <syslog prefix> Froxlor: [Login Action <HOST>] Unknown user '<USER>' tried to login.
# <syslog prefix> Froxlor: [Login Action <HOST>] User '<USER>' tried to login with wrong password.
# <syslog prefix> froxlor[1-6]: froxlor.WARNING: Unknown user tried to login. {"source":"login","action":"50","user":"<ADDR>"} []
# <syslog prefix> froxlor[1-6]: froxlor.WARNING: User tried to login with wrong password. {"source":"login","action":"50","user":"<ADDR>"} []
#
# Author: Joern Muehlencord
#
# Modified: Para-do-x™️ - Andreas Duennwald
#
[INCLUDES]
@ -16,7 +18,7 @@ before = common.conf
[Definition]
_daemon = Froxlor
_daemon = froxlor
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
@ -26,15 +28,12 @@ _daemon = Froxlor
# Values: TEXT
#
prefregex = ^%(__prefix_line)s\[Login Action <HOST>\] <F-CONTENT>.+</F-CONTENT>$
failregex = ^Unknown user \S* tried to login.$
^User \S* tried to login with wrong password.$
prefregex =
failregex = ^%(__prefix_line)s\S* froxlor\[\S+\]: froxlor.WARNING: Unknown user tried to login. {"source":"login","action":"50","user":"<ADDR>"\S* \[\]
^%(__prefix_line)s\S* froxlor\[\S+\]: froxlor.WARNING: User tried to login with wrong password. \{"source":"login","action":"50","user":"<ADDR>"\S* \[\]
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =