mirror of https://github.com/fail2ban/fail2ban
68 lines
1.9 KiB
Plaintext
68 lines
1.9 KiB
Plaintext
# Generic configuration items (to be used as interpolations) in other
|
|
# filters or actions configurations
|
|
#
|
|
|
|
[INCLUDES]
|
|
|
|
# Load customizations if any available
|
|
after = common.local
|
|
|
|
|
|
[DEFAULT]
|
|
|
|
# Daemon definition is to be specialized (if needed) in .conf file
|
|
_daemon = \S*
|
|
|
|
#
|
|
# Shortcuts for easier comprehension of the failregex
|
|
#
|
|
# PID.
|
|
# EXAMPLES: [123]
|
|
__pid_re = (?:\[\d+\])
|
|
|
|
# Daemon name (with optional source_file:line or whatever)
|
|
# EXAMPLES: pam_rhosts_auth, [sshd], pop(pam_unix)
|
|
__daemon_re = [\[\(]?%(_daemon)s(?:\(\S+\))?[\]\)]?:?
|
|
|
|
# extra daemon info
|
|
# EXAMPLE: [ID 800047 auth.info]
|
|
__daemon_extra_re = \[ID \d+ \S+\]
|
|
|
|
# Combinations of daemon name and PID
|
|
# EXAMPLES: sshd[31607], pop(pam_unix)[4920]
|
|
__daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:?)
|
|
|
|
# Some messages have a kernel prefix with a timestamp
|
|
# EXAMPLES: kernel: [769570.846956]
|
|
__kernel_prefix = kernel: \[ *\d+\.\d+\]
|
|
|
|
__hostname = \S+
|
|
|
|
# A MD5 hex
|
|
# EXAMPLES: 07:06:27:55:b0:e3:0c:3c:5a:28:2d:7c:7e:4c:77:5f
|
|
__md5hex = (?:[\da-f]{2}:){15}[\da-f]{2}
|
|
|
|
# bsdverbose is where syslogd is started with -v or -vv and results in <4.3> or
|
|
# <auth.info> appearing before the host as per testcases/files/logs/bsd/*.
|
|
__bsd_syslog_verbose = <[^.]+\.[^.]+>
|
|
|
|
__vserver = @vserver_\S+
|
|
|
|
__date_ambit = (?:\[\])
|
|
|
|
# Common line prefixes (beginnings) which could be used in filters
|
|
#
|
|
# [bsdverbose]? [hostname] [vserver tag] daemon_id spaces
|
|
#
|
|
# This can be optional (for instance if we match named native log files)
|
|
__prefix_line = %(__date_ambit)s?\s*(?:%(__bsd_syslog_verbose)s\s+)?(?:%(__hostname)s\s+)?(?:%(__kernel_prefix)s\s+)?(?:%(__vserver)s\s+)?(?:%(__daemon_combs_re)s\s+)?(?:%(__daemon_extra_re)s\s+)?
|
|
|
|
# PAM authentication mechanism check for failures, e.g.: pam_unix, pam_sss,
|
|
# pam_ldap
|
|
__pam_auth = pam_unix
|
|
|
|
# standardly all formats using prefix have line-begin anchored date:
|
|
datepattern = {^LN-BEG}
|
|
|
|
# Author: Yaroslav Halchenko
|