github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Update froxlor-auth.conf 

updated the regex to the new logging situation for froxlor.
pull/4075/head
para-do-x 2025-09-22 09:46:46 +04:00 committed by sebres
parent 65668b8ed8
commit 897b21a4c5
1 changed files with 8 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
config/filter.d/froxlor-auth.conf
View File

@ -1,11 +1,13 @@
# Fail2Ban configuration file to block repeated failed login attempts to Frolor installation(s) # Fail2Ban configuration file to block repeated failed login attempts to Frolor installation(s)
# #
# Froxlor needs to log to Syslog User (e.g. /var/log/user.log) with one of the following messages # Froxlor needs to log to Syslog User (e.g. /var/log/user.log) with one of the following messages
# <syslog prefix> Froxlor: [Login Action <HOST>] Unknown user '<USER>' tried to login. # <syslog prefix> froxlor[1-6]: froxlor.WARNING: Unknown user tried to login. {"source":"login","action":"50","user":"<ADDR>"} []
# <syslog prefix> Froxlor: [Login Action <HOST>] User '<USER>' tried to login with wrong password. # <syslog prefix> froxlor[1-6]: froxlor.WARNING: User tried to login with wrong password. {"source":"login","action":"50","user":"<ADDR>"} []
# #
# Author: Joern Muehlencord # Author: Joern Muehlencord
# #
# Modified: Para-do-x™️ - Andreas Duennwald
#
[INCLUDES] [INCLUDES]
@ -16,7 +18,7 @@ before = common.conf
[Definition] [Definition]
_daemon = Froxlor _daemon = froxlor
# Option: failregex # Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The # Notes.: regex to match the password failures messages in the logfile. The
@ -26,15 +28,12 @@ _daemon = Froxlor
# Values: TEXT # Values: TEXT
# #
prefregex = ^%(__prefix_line)s\[Login Action <HOST>\] <F-CONTENT>.+</F-CONTENT>$ prefregex =
failregex = ^%(__prefix_line)s\S* froxlor\[\S+\]: froxlor.WARNING: Unknown user tried to login. {"source":"login","action":"50","user":"<ADDR>"\S* \[\]
failregex = ^Unknown user \S* tried to login.$ ^%(__prefix_line)s\S* froxlor\[\S+\]: froxlor.WARNING: User tried to login with wrong password. \{"source":"login","action":"50","user":"<ADDR>"\S* \[\]
^User \S* tried to login with wrong password.$
# Option: ignoreregex # Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored. # Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT # Values: TEXT
# #
ignoreregex = ignoreregex =