Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for a way to use fail2ban to control/block samba logins on Ubuntu 12.04.3 LTS.
I already set up an jail.local. The samba part currently looks like this:

[samba]
enabled = true
port = 135,139,445,137,138
protocol = tcp,udp

I'm missing these two options:

filter =
logpath =

I know that samba log are located in /var/log/samba, but every hostname has its own file, so what do I have to set as logpath and as filter? Or is this even possible?

Thank you very much

share|improve this question
    
Did you even bother to read the documentation ? –  Iain Jan 10 at 19:15
    
I wouldn't ask if I haven't already done some research. For example the official fail2ban Wiki: fail2ban.org/wiki/… . –  Copy Devil Jan 10 at 19:19
    
@CopyDevil What, specifically have you attempted to get this working in your environment? What specific error messages or unexpected behavior are you experiencing? Server Fault is not here to do your work for you. You must ask a good, specific, answerable question in order for us to help you. –  voretaq7 Jan 10 at 19:48
    
I think I wrote it: I know that samba log are located in /var/log/samba, but every hostname has its own file, this is what I tried, and why I failed. I also posted the code I wrote so far. Do the work? I'm asking for 2 little options, where I'm stucked! What are you trying to do? What have you tried in order to make it happen? What results did you expect? What actually happened? Everything is in my Question. I'm really sorry. –  Copy Devil Jan 10 at 20:25
    
@CopyDevil You are not asking for "two little options", you are asking for the solution handed to you on a silver platter. We can certainly help you with the syntax for logpath (See Iain's answer), but as pointed out in the same answer filter is a regex you're going to need to define yourself based on your needs. –  voretaq7 Jan 10 at 23:24

1 Answer 1

up vote 4 down vote accepted

The logpath option takes a wildcard as the official wiki you reference says

wildcard support in logpath option

so for example

logpath  = /var/log/apache*/*error.log 

Again from the document you say you read

filter : a filter defines a regular expression which must match a pattern corresponding to a log-in failure or any other expression

These are normally put into a .conf file in the filter.d directory.

share|improve this answer
    
I thank you very much for the answer, but I don't understand your point. I think that every answer on every IT-Related stackexchange Site could be answered by reading the Documentation. But if someone asks a short question like this one, this would simply be overkill. Now the question is answered, and if anybody has the same question, he will find a quick answer. I believe this is easier than everyone reading the manual... –  Copy Devil Jan 10 at 19:32
    
Try to read: oreilly.com/openbook/samba/book/ch09_01.html (9.1.1 Samba Logs) –  Pol Hallen May 28 at 16:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.