0

I can't match joomlas error.php lines with fail2ban regex. I suspect it might be related with date and time format used in the log file or the amount of whitespaces in the error line. Do you have an idea how to add custom date/time format definition somewhere in fail2ban ?

Log line:

2013-05-28      06:25:39        INFO    1.2.3.4 Joomla FAILURE:         Username and password do not match or you do not have an account yet.

With fail2ban-regex i have tried everything from the most general wild cards to copypasting the exact line but nothing matches. Try for eg.

fail2ban-regex "2013-05-28      06:25:39        INFO    1.2.3.4 Joomla FAILURE:         Username and password do not match or you do not have an account yet." "^.*<HOST>.*FAILURE"

Installed Packages Name : fail2ban Arch : noarch Version : 0.9.6 Release : 1.el6.1

Vedran B
  • 33
  • 5

1 Answers1

0

Problem 1 is that you need a regex that continues to the end of the line. Your log file doesn't end in FAILURE.

Second you need to be a log more strict with your regex, Fail2ban's guide on FILTERS shows how this can lead to a DoS as your regex will expose you too.

To help you work out a stricter regex, use the fail2ban-regex -D option and interactively make this into a strict regex

danblack
  • 12,130
  • 2
  • 22
  • 41
  • Can you generate a match on your system ? I have tried with with a regex that continues to the end of line but to no avail. debuggex shows it as correct. I ahd a stricter rule but opted for the simplest just to generate a match. I suspect the problem to be the datetime format and excessive spaces in between...unless you get a match on yours ... – Vedran B Sep 19 '18 at 00:27