View Single Post
  #1  
Old 18th May 2009, 02:54
lartis lartis is offline
Junior Member
 
Join Date: May 2009
Posts: 3
Thanks: 1
Thanked 1 Time in 1 Post
Default fail2ban(-regex) not recognizing proftpd logs

hi all,

i have a redhat el5 vserver and got fail2ban working for ssh without any problems. i wanted to add support for proftpd today.

the fail2ban-regex test tool doesnt find any matches for the following proftpd.conf:

Quote:
# Fail2Ban configuration file
#
# Author: Yaroslav Halchenko
#
# $Revision: 677 $
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+$
\(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): Incorrect password\.$
\(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\.$
\(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded$

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

log from /var/log/secure with failed logins looks like this:
Quote:
May 18 01:17:38 mymachinehostname proftpd[24440]: my.hostname.com (12.345.67.89[12.345.67.89]) - USER testingfail2ban: no such user found from 12.345.67.89[12.345.67.89] to 11.222.333.44:21
"fail2ban-regex /var/log/secure /etc/fail2ban/filter.d/proftpd.conf" gives me:
Quote:
Running tests
=============

Use regex file : /etc/fail2ban/filter.d/proftpd.conf
Use log file : /var/log/secure


Results
=======

Failregex
|- Regular expressions:
| [1] \w+<HOST>[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+$
| [2] \w+<HOST>[: -]+ USER \S+ \(Login failed\): Incorrect password\.$
| [3] \w+<HOST>[: -]+ SECURITY VIOLATION: \S+ login attempted\.$
| [4] \w+<HOST>[: -]+ Maximum login attempts \(\d+\) exceeded$
|
`- Number of matches:
[1] 0 match(es)
[2] 0 match(es)
[3] 0 match(es)
[4] 0 match(es)

Ignoreregex
|- Regular expressions:
|
`- Number of matches:

Summary
=======

Sorry, no match
any hints would be greatly appreciated,
thx guys

Last edited by lartis; 18th May 2009 at 02:57.
Reply With Quote
Sponsored Links