github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #3469 from vitkabele/routeros-auth 

New filter: routeros-auth.conf
pull/3573/head
Sergey G. Brester 2023-09-02 18:56:04 +02:00 committed by GitHub
parent 35af8b6d5d a2c77429b9
commit f8f8c046a2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
config/filter.d/routeros-auth.conf Normal file
View File

@ -0,0 +1,10 @@
# Fail2Ban filter for failure attempts in MikroTik RouterOS
#
#
[Definition]
failregex = ^\s*\S+ system,error,critical login failure for user <F-USER>.*?</F-USER> from <ADDR> via \S+$
# Author: Vit Kabele <vit@kabele.me>

3
config/jail.conf
View File

@ -962,6 +962,9 @@ port = http,https
logpath = %(syslog_authpriv)s
backend = %(syslog_backend)s
[routeros-auth]
port = ssh,http,https
logpath = /var/log/MikroTik/router.log
[zoneminder]
# Zoneminder HTTP/HTTPS web interface auth

15
fail2ban/tests/files/logs/routeros-auth Normal file
View File

@ -0,0 +1,15 @@
# RouterOS v7.5
# failJSON: { "time": "2005-02-15T11:25:46", "match": true , "host": "192.168.88.6", "user": "admin" }
Feb 15 11:25:46 gw.local system,error,critical login failure for user admin from 192.168.88.6 via web
# RouterOS v7.5
# failJSON: { "match": false }
Feb 15 11:26:15 gw.local system,info log rule changed by admin
# RouterOS v7.5
# failJSON: { "time": "2005-02-15T11:57:42", "match": true , "host": "2001:470:1:c84::24", "user": "" }
Feb 15 11:57:42 1234.hostname.cz system,error,critical login failure for user from 2001:470:1:c84::24 via ssh
# RouterOS v7.5
# failJSON: { "time": "2005-03-02T09:09:46", "match": true , "host": "1.2.3.4", "user": "user with space" }
Mar 2 09:09:46 gw.local system,error,critical login failure for user user with space from 1.2.3.4 via ssh