mirror of https://github.com/fail2ban/fail2ban
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
40 lines
1.5 KiB
40 lines
1.5 KiB
# Fail2Ban configuration file |
|
# |
|
# Author: Steven Hiscocks |
|
# |
|
# |
|
|
|
[Definition] |
|
|
|
# Option: failregex |
|
# Notes.: regex to match the password failures messages in the logfile. The |
|
# host must be matched by a group named "host". The tag "<HOST>" can |
|
# be used for standard IP/hostname matching and is only an alias for |
|
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) |
|
# Multiline regexs should use tag "<SKIPLINES>" to separate lines. |
|
# This allows lines between the matching lines to continue to be |
|
# searched for other failures. This tag can be used multiple times. |
|
# Values: TEXT |
|
# |
|
failregex = ^=INFO REPORT==== ===\nI\(<0\.\d+\.0>:ejabberd_c2s:\d+\) : \([^)]+\) Failed authentication for \S+ from (?:IP )?<HOST>(?: \({{(?:\d+,){3}\d+},\d+}\))?$ |
|
^(?:\.\d+)? \[info\] <0\.\d+\.\d>@ejabberd_c2s:\w+:\d+ \([^\)]+\) Failed (?:c2s \w+ )?authentication for \S+ from (?:IP )?(?:::FFFF:)?<HOST>(?:: |$) |
|
|
|
# Option: ignoreregex |
|
# Notes.: regex to ignore. If this regex matches, the line is ignored. |
|
# Values: TEXT |
|
# |
|
ignoreregex = |
|
|
|
# "maxlines" is number of log lines to buffer for multi-line regex searches |
|
maxlines = 2 |
|
|
|
# Option: journalmatch |
|
# Notes.: systemd journalctl style match filter for journal based backend |
|
# Values: TEXT |
|
# |
|
journalmatch = |
|
|
|
#datepattern = ^(?:=[^=]+={3,} )?({DATE}) |
|
# explicit time format using prefix =...==== and no date in second string begins with I(...)... |
|
datepattern = ^(?:=[^=]+={3,} )?(%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?) |
|
^I\(()**
|
|
|