github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Dante SOCKS server: handle "1 byte/second" case 

Thanks to @Loriowar and @sebres for pointing it out
pull/2112/head
Andrey Alekseenko 2018-08-13 20:22:37 +03:00
parent 05c162ef10
commit df91b047d2
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
config/filter.d/dante.conf
View File

@ -9,7 +9,7 @@ before = common.conf
[Definition]
_daemon = danted
failregex = ^%(__prefix_line)sinfo: block\(1\): tcp/accept \]: <HOST>\.\d+ [\d.]+: error after reading \d+ bytes in \d+ seconds: (could not access user "\w+"'s records in the system password file: no system error|system password authentication failed for user "\w+")$
failregex = ^%(__prefix_line)sinfo: block\(1\): tcp/accept \]: <HOST>\.\d+ [\d.]+: error after reading \d+ bytes? in \d+ seconds?: (could not access user "\w+"'s records in the system password file: no system error|system password authentication failed for user "\w+")$
[Init]
journalmatch = _SYSTEMD_UNIT=danted.service

2
fail2ban/tests/files/logs/dante
View File

@ -2,3 +2,5 @@
Apr 14 15:35:03 vps111111 danted[17969]: info: block(1): tcp/accept ]: 1.2.3.4.50550 0.0.0.0.1080: error after reading 35 bytes in 0 seconds: could not access user "roooooooot"'s records in the system password file: no system error
# failJSON: { "time": "2005-04-14T15:44:26", "match": true , "host": "1.2.3.4" }
Apr 14 15:44:26 vps111111 danted[1846]: info: block(1): tcp/accept ]: 1.2.3.4.57178 0.0.0.0.1080: error after reading 18 bytes in 0 seconds: system password authentication failed for user "aland"
# failJSON: { "time": "2005-04-14T15:44:26", "match": true , "host": "1.2.3.4" }
Apr 14 15:44:26 vps111111 danted[1846]: info: block(1): tcp/accept ]: 1.2.3.4.57178 0.0.0.0.1080: error after reading 1 byte in 1 second: system password authentication failed for user "aland"