fail2ban(-regex) not recognizing proftpd logs

[lartis]

hi all,

i have a redhat el5 vserver and got fail2ban working for ssh without any problems. i wanted to add support for proftpd today.

the fail2ban-regex test tool doesnt find any matches for the following proftpd.conf:

# Fail2Ban configuration file
#
# Author: Yaroslav Halchenko
#
# $Revision: 677 $
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+$
\(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): Incorrect password\.$
\(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\.$
\(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded$

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =



log from /var/log/secure with failed logins looks like this:
May 18 01:17:38 mymachinehostname proftpd[24440]: my.hostname.com (12.345.67.89[12.345.67.89]) - USER testingfail2ban: no such user found from 12.345.67.89[12.345.67.89] to 11.222.333.44:21


"fail2ban-regex /var/log/secure /etc/fail2ban/filter.d/proftpd.conf" gives me:
Running tests
=============

Use regex file : /etc/fail2ban/filter.d/proftpd.conf
Use log file : /var/log/secure


Results
=======

Failregex
|- Regular expressions:
| [1] \w+<HOST>[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+$
| [2] \w+<HOST>[: -]+ USER \S+ \(Login failed\): Incorrect password\.$
| [3] \w+<HOST>[: -]+ SECURITY VIOLATION: \S+ login attempted\.$
| [4] \w+<HOST>[: -]+ Maximum login attempts \(\d+\) exceeded$
|
`- Number of matches:
[1] 0 match(es)
[2] 0 match(es)
[3] 0 match(es)
[4] 0 match(es)

Ignoreregex
|- Regular expressions:
|
`- Number of matches:

Summary
=======

Sorry, no match

any hints would be greatly appreciated,
thx guys

[falko]

What's in /etc/fail2ban/jail.local?

[lartis]

hey thanks for your answer,
i dont have a jail.local, for now i edited all the confs themselves

[lartis]

quick update maybe i can help someone:

i just wrote my own proftpd.conf with my poor regex skills but now theyre recognized properly, maybe too dirty for bigger / more complicated systems



failregex = ^(.)+proftpd(.)+\[<HOST>\](.)*no such user found from (.)* to (.)*$
^(.)+proftpd(.)+\[<HOST>\](.)*USER(.)*Login failed(.)*Incorrect password(.)*$
^(.)+proftpd(.)+\[<HOST>\](.)*SECURITY VIOLATION:(.)*login attempted(.)*$
^(.)+proftpd(.)+\[<HOST>\](.)*Maximum login attempts(.)*exceeded(.)*$

[marpada]

Thank you very much lartis,

Also wasted a few hours trying to make the default regex too work but just got a headache :confused:
________
Zx14 Vs Hayabusa (http://wiki.answers.com/Q/Which_bike_is_quicker_kawasaki_zx_-14_or_suzuki_hayabusa)
________
MARIJUANA BUBBLER (http://bubblers.net/)