#1  
Old 21st May 2013, 09:21
jackyie.note jackyie.note is offline
Junior Member
 
Join Date: May 2013
Posts: 1
Thanks: 0
Thanked 0 Times in 0 Posts
 
Default Fail2ban filter issue

to All:
fail2ban install centos5.9. I am looking to create a conf file for fail2ban that contains the proper regex expression that bans repeat offenders that show up in the maillogs. The maillogs show the following:
[2013/01/10 05:25:14] [36.224.203.36:27304] User sl.wang login failed.
[2013/01/10 05:45:17] [36.224.203.36:30613] User sl.wang login failed.
[2013/01/10 06:34:54] [36.224.203.36:7021] User sl.wang login failed.
[2013/01/10 07:24:59] [36.224.203.36:15711] User sl.wang login failed.
[2013/01/10 07:45:02] [36.224.203.36:19712] User sl.wang login failed.
[2013/01/10 07:55:03] [36.224.203.36:21755] User sl.wang login failed.

And I tried the following but to no avail:
failregex = ^\[\d{1,4}\/d{1,2}\/d{1,2}.\d{1,2}:\d{1,2}:\d{1,2}\] \[<HOST>:.*].User.*.login failed

Any ideas?
Reply With Quote
Sponsored Links
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
The Perfect SpamSnake 10.10 luigi HOWTO-Related Questions 21 2nd May 2011 19:45
fail2ban is doing nothing? rlischer Server Operation 16 29th June 2010 07:29
ISP Config hesitation when opening web pages frankb Installation/Configuration 7 15th December 2008 13:06
network issues now it says "401 The web site is blocked by administrator" Check General 3 26th February 2008 14:22
Apache2 Freezes celtic Server Operation 31 28th May 2007 17:18


All times are GMT +2. The time now is 20:25.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.