mirror of https://github.com/fail2ban/fail2ban
amend to #3405, eliminate catch-all
parent
36af3f2502
commit
ae5fe2e003
|
@ -15,7 +15,7 @@ _subj = (?:unconfined_u|system_u):system_r:sshd_t:s0-s0:c0\.c1023
|
|||
_exe =/usr/sbin/sshd
|
||||
_terminal = ssh
|
||||
|
||||
_anygrp = (?!acct=|exe=|addr=|terminal=|res=)\w+=(?:".*"|\S*)
|
||||
_anygrp = (?!acct=|exe=|addr=|terminal=|res=)\w+=(?:"[^"]+"|\S*)
|
||||
|
||||
_msg = (?:%(_anygrp)s )*acct=(?:"<F-USER>[^"]+</F-USER>"|<F-ALT_USER>\S+</F-ALT_USER>) exe="%(_exe)s" (?:%(_anygrp)s )*addr=<ADDR> terminal=%(_terminal)s res=failed
|
||||
|
||||
|
|
Loading…
Reference in New Issue