github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

* add `__prefix_line` to regex 

* fix time in log file
pull/1478/head
Andrii Melnyk 2016-07-08 05:29:51 +03:00
parent c335663395
commit dcb69b0242
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
config/filter.d/slapd.conf
View File

@ -3,9 +3,17 @@
# Detecting invalid credentials: error code 49 # Detecting invalid credentials: error code 49
# http://www.openldap.org/doc/admin24/appendix-ldap-result-codes.html#invalidCredentials (49) # http://www.openldap.org/doc/admin24/appendix-ldap-result-codes.html#invalidCredentials (49)
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf
[Definition] [Definition]
failregex = ^.* conn=(?P<pid>\d+) fd=\d+ ACCEPT from IP=<HOST>\:\d+ .+$<SKIPLINES>^.+ conn=(?P=pid) .* RESULT .* err=49 .*$ _daemon = slapd
failregex = ^(?P<__prefix>%(__prefix_line)s).* conn=(?P<pid>\d+) fd=\d+ ACCEPT from IP=<HOST>\:\d+ .+$<SKIPLINES>(?P=__prefix).+ conn=(?P=pid) .* RESULT .* err=49 .*$
ignoreregex = ignoreregex =

2
fail2ban/tests/files/logs/slapd
View File

@ -10,7 +10,7 @@ Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 op=0 STARTTLS
Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 op=0 RESULT oid= err=1 text=TLS already started Jul 8 01:47:19 ldap-server slapd[1183]: conn=1022 op=0 RESULT oid= err=1 text=TLS already started
# failJSON: { "match": false } # failJSON: { "match": false }
Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=1 BIND dn="uid=gipson,ou=people,dc=example,dc=com" method=128 Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=1 BIND dn="uid=gipson,ou=people,dc=example,dc=com" method=128
# failJSON: { "time": "2016-07-08T01:47:20", "match": true , "host": "8.8.8.8", "desc": "Multiline match for invalid credentials" } # failJSON: { "time": "2005-07-08T01:47:20", "match": true , "host": "8.8.8.8", "desc": "Multiline match for invalid credentials" }
Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=1 RESULT tag=97 err=49 text= Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=1 RESULT tag=97 err=49 text=
# failJSON: { "match": false } # failJSON: { "match": false }
Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=2 UNBIND Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=2 UNBIND