mirror of https://github.com/fail2ban/fail2ban
made failregex universal for both PAM and native vsftpd logging
parent
2e992c2353
commit
ae96eaa40c
|
@ -1,4 +1,4 @@
|
||||||
fail2ban (0.7.5-3~pre1) unstable; urgency=low
|
fail2ban (0.7.5-3~pre2) unstable; urgency=low
|
||||||
|
|
||||||
* Fail2ban now bans vsftpd logins (corrected logfile path and failregex)
|
* Fail2ban now bans vsftpd logins (corrected logfile path and failregex)
|
||||||
(Closes: #404060)
|
(Closes: #404060)
|
||||||
|
|
|
@ -98,6 +98,10 @@ enabled = false
|
||||||
port = ftp
|
port = ftp
|
||||||
filter = vsftpd
|
filter = vsftpd
|
||||||
logpath = /var/log/vsftpd.log
|
logpath = /var/log/vsftpd.log
|
||||||
|
# or overwrite it in jails.local to be
|
||||||
|
# logpath = /var/log/auth.log
|
||||||
|
# if you want to rely on PAM failed login attempts
|
||||||
|
# vsftpd's failregex should match both of those formats
|
||||||
maxretry = 6
|
maxretry = 6
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -7,13 +7,13 @@
|
||||||
@DPATCH@
|
@DPATCH@
|
||||||
diff -urNad fail2ban-0.7.5~/config/filter.d/vsftpd.conf fail2ban-0.7.5/config/filter.d/vsftpd.conf
|
diff -urNad fail2ban-0.7.5~/config/filter.d/vsftpd.conf fail2ban-0.7.5/config/filter.d/vsftpd.conf
|
||||||
--- fail2ban-0.7.5~/config/filter.d/vsftpd.conf 2006-11-19 16:34:49.000000000 -0500
|
--- fail2ban-0.7.5~/config/filter.d/vsftpd.conf 2006-11-19 16:34:49.000000000 -0500
|
||||||
+++ fail2ban-0.7.5/config/filter.d/vsftpd.conf 2006-12-21 11:46:30.000000000 -0500
|
+++ fail2ban-0.7.5/config/filter.d/vsftpd.conf 2006-12-21 23:50:14.000000000 -0500
|
||||||
@@ -13,7 +13,7 @@
|
@@ -13,7 +13,7 @@
|
||||||
# be used for standard IP/hostname matching.
|
# be used for standard IP/hostname matching.
|
||||||
# Values: TEXT
|
# Values: TEXT
|
||||||
#
|
#
|
||||||
-failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=<HOST>
|
-failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=<HOST>
|
||||||
+failregex = \[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$
|
+failregex = (?:vsftpd: \(pam_unix\) authentication failure; .* rhost=<HOST>|\[.+\] FAIL LOGIN: Client "<HOST>")$
|
||||||
|
|
||||||
# Option: ignoreregex
|
# Option: ignoreregex
|
||||||
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
||||||
|
|
Loading…
Reference in New Issue