HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials

HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials (http://www.howtoforge.com/forums/index.php)
-   Server Operation (http://www.howtoforge.com/forums/forumdisplay.php?f=5)
-   -   fail2ban(-regex) not recognizing proftpd logs (http://www.howtoforge.com/forums/showthread.php?t=35089)

lartis 18th May 2009 03:54

fail2ban(-regex) not recognizing proftpd logs
 
hi all,

i have a redhat el5 vserver and got fail2ban working for ssh without any problems. i wanted to add support for proftpd today.

the fail2ban-regex test tool doesnt find any matches for the following proftpd.conf:

Quote:

# Fail2Ban configuration file
#
# Author: Yaroslav Halchenko
#
# $Revision: 677 $
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+$
\(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): Incorrect password\.$
\(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\.$
\(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded$

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

log from /var/log/secure with failed logins looks like this:
Quote:

May 18 01:17:38 mymachinehostname proftpd[24440]: my.hostname.com (12.345.67.89[12.345.67.89]) - USER testingfail2ban: no such user found from 12.345.67.89[12.345.67.89] to 11.222.333.44:21
"fail2ban-regex /var/log/secure /etc/fail2ban/filter.d/proftpd.conf" gives me:
Quote:

Running tests
=============

Use regex file : /etc/fail2ban/filter.d/proftpd.conf
Use log file : /var/log/secure


Results
=======

Failregex
|- Regular expressions:
| [1] \w+<HOST>[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+$
| [2] \w+<HOST>[: -]+ USER \S+ \(Login failed\): Incorrect password\.$
| [3] \w+<HOST>[: -]+ SECURITY VIOLATION: \S+ login attempted\.$
| [4] \w+<HOST>[: -]+ Maximum login attempts \(\d+\) exceeded$
|
`- Number of matches:
[1] 0 match(es)
[2] 0 match(es)
[3] 0 match(es)
[4] 0 match(es)

Ignoreregex
|- Regular expressions:
|
`- Number of matches:

Summary
=======

Sorry, no match
any hints would be greatly appreciated,
thx guys

falko 18th May 2009 12:16

What's in /etc/fail2ban/jail.local?

lartis 18th May 2009 12:21

hey thanks for your answer,
i dont have a jail.local, for now i edited all the confs themselves

lartis 19th May 2009 06:01

quick update maybe i can help someone:

i just wrote my own proftpd.conf with my poor regex skills but now theyre recognized properly, maybe too dirty for bigger / more complicated systems


Quote:

failregex = ^(.)+proftpd(.)+\[<HOST>\](.)*no such user found from (.)* to (.)*$
^(.)+proftpd(.)+\[<HOST>\](.)*USER(.)*Login failed(.)*Incorrect password(.)*$
^(.)+proftpd(.)+\[<HOST>\](.)*SECURITY VIOLATION:(.)*login attempted(.)*$
^(.)+proftpd(.)+\[<HOST>\](.)*Maximum login attempts(.)*exceeded(.)*$

marpada 28th May 2009 20:42

Thank you very much lartis,

Also wasted a few hours trying to make the default regex too work but just got a headache :confused:
________
Zx14 Vs Hayabusa
________
MARIJUANA BUBBLER


All times are GMT +2. The time now is 05:18.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.