severity 605661 normal tags 605661 = moreinfo unreproducible thanks Hi Ivan,
Could you elaborate on how the removal of "-" from the falregex expression addresses anything? or am I missing some other change? please provide example of log lines which are not caught by old expression but caught by your "fixed" one On Thu, 02 Dec 2010, Ivan Agliardi wrote: > To fix this problem you just need to edit /etc/fail2ban/filter.d and change > it as follows: > failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ > \[\S+\] to \S+:\S+$ > \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): Incorrect > password\.$ > \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\.$ > \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded$ > becomes: > failregex = \(\S+\[<HOST>\]\)[: ]+ USER \S+: no such user found from \S+ > \[\S+\] to \S+:\S+$ > \(\S+\[<HOST>\]\)[: ]+ USER \S+ \(Login failed\): Incorrect > password\.$ > \(\S+\[<HOST>\]\)[: ]+ SECURITY VIOLATION: \S+ login attempted\.$ > \(\S+\[<HOST>\]\)[: ]+ Maximum login attempts \(\d+\) exceeded$ -- =------------------------------------------------------------------= Keep in touch www.onerussian.com Yaroslav Halchenko www.ohloh.net/accounts/yarikoptic -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
