| 6 |
- |
1 |
# Fail2Ban configuration file
|
|
|
2 |
#
|
|
|
3 |
# Author: Steven Hiscocks
|
|
|
4 |
#
|
|
|
5 |
#
|
|
|
6 |
|
|
|
7 |
[Definition]
|
|
|
8 |
|
|
|
9 |
# Option: failregex
|
|
|
10 |
# Notes.: regex to match the password failures messages in the logfile. The
|
|
|
11 |
# host must be matched by a group named "host". The tag "<HOST>" can
|
|
|
12 |
# be used for standard IP/hostname matching and is only an alias for
|
|
|
13 |
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
|
|
|
14 |
# Multiline regexs should use tag "<SKIPLINES>" to separate lines.
|
|
|
15 |
# This allows lines between the matching lines to continue to be
|
|
|
16 |
# searched for other failures. This tag can be used multiple times.
|
|
|
17 |
# Values: TEXT
|
|
|
18 |
#
|
| 33 |
- |
19 |
failregex = ^=INFO REPORT==== ===\nI\(<0\.\d+\.0>:ejabberd_c2s:\d+\) : \([^)]+\) Failed authentication for .+ from IP <HOST> \({{(?:\d+,){3}\d+},\d+}\)$
|
|
|
20 |
^(?:\.\d+)? \[info\] <0\.\d+\.\d>@ejabberd_c2s:wait_for_feature_request:\d+ \([^\)]+\) Failed authentication for \S+ from IP <HOST>$
|
|
|
21 |
|
|
|
22 |
# Option: ignoreregex
|
|
|
23 |
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
|
|
24 |
# Values: TEXT
|
|
|
25 |
#
|
|
|
26 |
ignoreregex =
|
|
|
27 |
|
|
|
28 |
[Init]
|
|
|
29 |
|
|
|
30 |
# "maxlines" is number of log lines to buffer for multi-line regex searches
|
|
|
31 |
maxlines = 2
|
|
|
32 |
|
|
|
33 |
# Option: journalmatch
|
|
|
34 |
# Notes.: systemd journalctl style match filter for journal based backend
|
|
|
35 |
# Values: TEXT
|
|
|
36 |
#
|
|
|
37 |
journalmatch =
|