Merge pull request #593 from grooverdan/tine

ENH: Tine20 filter

ChangeLog

@@ -61,6 +61,7 @@ configuration before relying on it.
    * Filter for Counter Strike 1.6. Thanks to onorua for logs.
      Close gh-347
    * Filter for squirrelmail. Close gh-261
+   * Filter for tine20. Close gh-583
 
 - Enhancements
    * Jail names increased to 26 characters and iptables prefix reduced

THANKS

@@ -54,6 +54,7 @@ Justin Shore
 Kévin Drapel
 kjohnsonecl
 kojiro
+Lars Kneschke
 Lee Clemens
 Manuel Arostegui Ramirez
 Marcel Dopita
@@ -67,6 +68,7 @@ mEDI
 Merijn Schering
 Michael C. Haller
 Michael Hanselmann
+Mika (mkl)
 Nick Munger
 onorua
 Patrick Börjesson

config/filter.d/tine20.conf

@@ -0,0 +1,21 @@
+# Fail2Ban filter for Tine 2.0 authentication
+#
+# Enable logging with:
+# $config['info_log']='/var/log/tine20/tine20.log';
+#
+
+[Definition]
+
+failregex =  ^[\da-f]{5,} [\da-f]{5,} (-- none --|.*?)( \d+(\.\d+)?(h|m|s|ms)){0,2} -  WARN \(\d+\): Tinebase_Controller::login::\d+ Login with username .*? from <HOST> failed \(-[13]\)!$
+
+ignoreregex = 
+
+# Author: Mika (mkl) from Tine20.org forum: https://www.tine20.org/forum/viewtopic.php?f=2&t=15688&p=54766
+# Editor: Daniel Black
+# Advisor: Lars Kneschke
+#
+# Usernames can contain spaces.
+#
+# Authentication: http://git.tine20.org/git?p=tine20;a=blob;f=tine20/Tinebase/Controller.php#l105
+# Logger: http://git.tine20.org/git?p=tine20;a=blob;f=tine20/Tinebase/Log/Formatter.php
+# formatMicrotimeDiff: http://git.tine20.org/git?p=tine20;a=blob;f=tine20/Tinebase/Helper.php#l276

config/jail.conf

@@ -435,6 +435,12 @@ port     = http,https
 logpath  = /var/log/sogo/sogo.log
 
 
+[tine20]
+
+logpath  = /var/log/tine20/tine20.log
+port     = http,https
+maxretry = 5
+
 
 #
 # Web Applications

fail2ban/tests/files/logs/tine20

@@ -0,0 +1,7 @@
+# Wrong username (-1) error
+# failJSON: { "time": "2014-01-13T06:02:22", "match": true, "host": "127.0.0.1" }
+78017 00cff -- none -- - 2014-01-13T05:02:22+00:00 WARN (4): Tinebase_Controller::login::106 Login with username sdfsadf from 127.0.0.1 failed (-1)!
+
+# Wrong password (-3) error
+# failJSON: { "time": "2014-01-21T05:38:14", "match": true, "host": "127.0.0.1" }
+8e035 ffff3 -- none -- - 2014-01-21T04:38:14+00:00 WARN (4): Tinebase_Controller::login::106 Login with username testuser from 127.0.0.1 failed (-3)!