From 897b21a4c56c51ac7580dc1a3de6b07876528487 Mon Sep 17 00:00:00 2001 From: para-do-x Date: Mon, 22 Sep 2025 09:46:46 +0400 Subject: [PATCH] Update froxlor-auth.conf updated the regex to the new logging situation for froxlor. --- config/filter.d/froxlor-auth.conf | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/config/filter.d/froxlor-auth.conf b/config/filter.d/froxlor-auth.conf index d8f3785c..632b12fa 100644 --- a/config/filter.d/froxlor-auth.conf +++ b/config/filter.d/froxlor-auth.conf @@ -1,11 +1,13 @@ # Fail2Ban configuration file to block repeated failed login attempts to Frolor installation(s) # # Froxlor needs to log to Syslog User (e.g. /var/log/user.log) with one of the following messages -# Froxlor: [Login Action ] Unknown user '' tried to login. -# Froxlor: [Login Action ] User '' tried to login with wrong password. +# froxlor[1-6]: froxlor.WARNING: Unknown user tried to login. {"source":"login","action":"50","user":""} [] +# froxlor[1-6]: froxlor.WARNING: User tried to login with wrong password. {"source":"login","action":"50","user":""} [] # # Author: Joern Muehlencord # +# Modified: Para-do-x™️ - Andreas Duennwald +# [INCLUDES] @@ -16,7 +18,7 @@ before = common.conf [Definition] -_daemon = Froxlor +_daemon = froxlor # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The @@ -26,15 +28,12 @@ _daemon = Froxlor # Values: TEXT # -prefregex = ^%(__prefix_line)s\[Login Action \] .+$ - -failregex = ^Unknown user \S* tried to login.$ - ^User \S* tried to login with wrong password.$ - +prefregex = +failregex = ^%(__prefix_line)s\S* froxlor\[\S+\]: froxlor.WARNING: Unknown user tried to login. {"source":"login","action":"50","user":""\S* \[\] + ^%(__prefix_line)s\S* froxlor\[\S+\]: froxlor.WARNING: User tried to login with wrong password. \{"source":"login","action":"50","user":""\S* \[\] # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex = -