I am trying to log failed attempts from an .htpasswd file. i want the failed attempts to be emailed to me. It is working for failed ssh logins. It seems like fail2ban is reading my log file entries???? I'm lost on why it won't email me
jail.conf
Code:
[apache]
enabled = true
filter = apache-auth
action = sendmail-whois[name=ApacheDeny, dest=george@abc.com]
logpath = /var/log/phpmyadmin.log
maxretry = 2
apache-auth.conf
Code:
[Definition]
# Option: failregex
# Notes.: regex to match the password failure messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
#failregex = [[]client <HOST>[]] user .* authentication failure
# [[]client <HOST>[]] user .* not found /
# [[]client <HOST>[]] user .* password mismatch
failregex = [[]client <HOST>[]] user .* not found
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
log file
[Sat Mar 03 18:27:01 2012] [error] [client 74.4.4.4] user asfadsfasf not found: /
[Sat Mar 03 18:27:03 2012] [error] [client 74.4.4.4] user asfsadfdsfad not found: /
[Sat Mar 03 18:27:08 2012] [error] [client 74.4.4.4] user ffffffff not found: /
[Sat Mar 03 18:27:10 2012] [error] [client 74.4.4.4] user ffffffff not found: /
result of test - fail2ban-regex /var/log/phpmyadmin.log "[[]client <HOST>[]] user .* not found"
Results
=======
Failregex
|- Regular expressions:
| [1] [[]client <HOST>[]] user .* not found
|
`- Number of matches:
[1] 4 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
=======
Recent comments
1 day 17 hours ago
1 day 20 hours ago
2 days 8 hours ago
2 days 10 hours ago
2 days 14 hours ago
2 days 21 hours ago
3 days 6 hours ago
3 days 8 hours ago
3 days 16 hours ago
3 days 17 hours ago